joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400efe30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
call qword [0x1403db008]
mov byte [rsi + 0x431], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [0x1403db008]
test rax, rax
je 0x1400efede
mov eax, dword [0x1403bee90]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400efea2
lea rcx, [0x1403bee88]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14019c190
lea rcx, [0x1403bee90]
call fcn.1401cfee0
cmp dword [0x1403bee90], 0xffffffff
jne 0x1400efe8e
mov qword [0x1403bee88], 0
lea rcx, [0x1403bee88]
xor edx, edx
call fcn.1400ed1f0
lea rcx, [0x1403bee90]
call fcn.1401cff78
jmp 0x1400efe8e
add rsp, 0x20
pop rsi
ret
Function at 0x1400f1850
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1403beea0]
cmp rdi, 1
jbe 0x1400f1879
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14019c190
lea rcx, [0x1403beea0]
call fcn.14007cbc0
test al, al
je 0x1400f18bf
mov qword [0x1403beea8], 0
lea rbx, [0x1403beea0]
lea rdi, [0x1403beea8]
mov rcx, rdi
xor edx, edx
call fcn.1400ed1f0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14007cc60
jmp 0x1400f1867
mov rdi, qword [0x1403beea0]
jmp 0x1400f1867

Function at 0x1400f2300
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
test r8b, r8b
jne 0x1400f23c9
lea r8, [rsp + 0x30]
mov rcx, rdx
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400f2437
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400f23c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x1400f23c5
call fcn.14017e5d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi], 1
mov qword [rsi + 8], 0
cmp rbx, 0xffffffffffffffff
je 0x1400f2386
test rbx, rbx
je 0x1400f23a9
call fcn.14017e5d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400f23a1
mov qword [rsi + 8], rbx
call fcn.14017e5d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x1400f236b
xor ebx, ebx
jmp 0x1400f2363
lea r8, [rsp + 0x30]
mov rcx, rdx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400f2437
lea rdi, [rsp + 0x30]
mov rdx, qword [rdi]
lea rbx, [rsp + 0x28]
mov qword [rbx], 0
mov rcx, rbx
call fcn.14016c280
mov rcx, qword [rbx]
mov edx, 1
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x1400f243f
mov rax, qword [rsp + 0x28]
inc rax
cmp rax, 2
jb 0x1400f2346
call fcn.14017e5d0
mov rcx, qword [rsp + 0x28]
call fcn.140189420
jmp 0x1400f2346
mov byte [rsi], 0
jmp 0x1400f23a9
mov byte [rsi], 0
mov rax, qword [rsp + 0x28]
inc rax
cmp rax, 2
jb 0x1400f23a9
call fcn.14017e5d0
mov rcx, qword [rsp + 0x28]
call fcn.140189420
jmp 0x1400f23a9
Function at 0x1400f60d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x1400f6104
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400f61fc
mov eax, ebx
not eax
test eax, 0x300
je 0x1400f61fc
cmp edi, 2
lea rax, [0x1403bf2c0]
lea rcx, [0x1403bf4c0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400f61fc
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400f61fc
cmp byte [0x1403bf2b0], 0
setne al
bt ebx, 8
jb 0x1400f61fc
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400f61fc
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.DM8_
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x1400f6255
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x1400f61e9
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
call fcn.1401edb44
test eax, eax
je 0x1400f621b
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x1400f61cb
cmp dword [rsp + 0x2c], 0
jne 0x1400f625d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401d1390
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [rbx + rdi*2]
cmp ecx, 0x5c
je 0x1400f6228
test ecx, ecx
jne 0x1400f61e9
lea rax, [rbx + rdi*2]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x1400f6285
cmp dword [rsp + 0x2c], 2
jne 0x1400f6296
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400f6296
mov rbx, r12
jmp 0x1400f61ac
cmp byte [r12 + 0x17], 0
js 0x1400f62c5
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.140063fd0
jmp 0x1400f61fc
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
cmp cx, 0x5c
jne 0x1400f62af
lea rbx, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x1400f629c
jmp 0x1400f62b2
mov rbx, rax
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
xor r15d, r15d
mov r13, rbp
jmp 0x1400f61f0
mov rax, qword [r12]
jmp 0x1400f6268
Function at 0x1400f6af0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
mov rcx, qword [r8]
cmovns rcx, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
cmovs rax, qword [r8 + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1401859c0
cmp byte [rsi + 0x17], 0
jns 0x1400f6b4b
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1401859c0
cmp byte [rdi + 0x17], 0
jns 0x1400f6b70
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x1400f6b8f
mov rcx, qword [rsp + 0x48]
call fcn.1401cfdbc
cmp byte [rsp + 0x87], 0
jns 0x1400f6ba3
mov rcx, qword [rsp + 0x70]
call fcn.1401cfdbc
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401d1390
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400f6c50
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1401859c0
cmp byte [rdi + 0x17], 0
jns 0x1400f6c91
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x1400f6cb2
mov rcx, qword [rsp + 0x58]
call fcn.1401cfdbc
test r14, r14
je 0x1400f6d59
test edi, edi
je 0x1400f6d59
mov ecx, edi
add rcx, rcx
call fcn.1401cfdfc
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.1401859c0
cmp byte [rsi + 0x17], 0
jns 0x1400f6cf3
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x1400f6d13
mov rcx, qword [rsp + 0x58]
call fcn.1401cfdbc
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x1400f6d77
mov rcx, rbx
call fcn.1401f8b34
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.140185d10
cmp byte [r14 + 0x17], 0
js 0x1400f6d7a
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
mov rcx, rbx
call fcn.1401cfe04
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401d1390
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
mov rcx, qword [r14]
call fcn.1401cfdbc
jmp 0x1400f6d3f
Function at 0x1400fbc30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov ebx, ecx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x1400fbc00]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x1403bf9e0]
lea rdx, [0x1400fba70]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400fbd29
cmp dword [0x1403bf9e8], 0
jne 0x1400fbd36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x1403bf9ec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
jne 0x1400fbcdf
mov ecx, 0x20
call fcn.1401a45c0
test rax, rax
je 0x1400fbd36
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov ecx, dword [0x1403bf9ec]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400fbd2e
lea rbp, [0x1403bf9f0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x1403bfa00]
mov qword [rax + rbx*8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsi + rbx*8], r14
mov esi, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1401e9f10
mov rcx, rsi
call fcn.1401a4600
mov rcx, r14
mov rax, rdi
call qword [0x1403db008]
xor esi, esi
jmp 0x1400fbd0f

Function at 0x1400fbed0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400fbf0c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400fbf16
add rdi, rbx
sub rsi, rbx
jne 0x1400fbeea
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401e9f10
int3
Function at 0x1400fc670
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov r12, rdx
mov rdi, rcx
lea r15, [rcx + 0x38]
mov rcx, qword [rcx + 0x38]
test rcx, rcx
jne 0x1400fc772
lea rbx, [rdi + 0x30]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
jne 0x1400fc78b
mov qword [rsp + 0x20], rbx
lea rcx, [0x14030a1e0]
lea r9, [0x140387780]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rsi, qword [rbx]
test eax, eax
js 0x1400fc7a4
mov rcx, qword [r15]
test rcx, rcx
jne 0x1400fc7bc
mov rax, qword [rsi]
mov rax, qword [rax + 0x90]
mov rcx, rsi
mov rdx, r15
call qword [0x1403db008]
test eax, eax
js 0x1400fc7d5
cmp rdi, r12
je 0x1400fc725
cmp byte [rdi + 0x17], 0
movzx r8d, byte [r12 + 0x17]
js 0x1400fc757
test r8b, r8b
jns 0x1400fc744
mov rdx, qword [r12]
mov r8, qword [r12 + 8]
mov rcx, rdi
call fcn.140064130
add rdi, 0x18
mov rcx, rdi
mov rdx, r14
call fcn.14017ca20
mov al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [r12 + 0x10]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [r12]
movups xmmword [rdi], xmm0
jmp 0x1400fc725
test r8b, r8b
jns 0x1400fc765
mov r8, qword [r12 + 8]
mov r12, qword [r12]
mov rcx, rdi
mov rdx, r12
call fcn.140064000
jmp 0x1400fc725
mov qword [r15], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1403db008]
jmp 0x1400fc697
mov qword [rbx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1403db008]
jmp 0x1400fc6a8
test rsi, rsi
je 0x1400fc7f1
mov qword [rbx], 0
mov rax, qword [rsi]
mov rax, qword [rax + 0x10]
mov rcx, rsi
jmp 0x1400fc7eb
mov qword [r15], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1403db008]
jmp 0x1400fc6e0
mov rcx, qword [r15]
test rcx, rcx
je 0x1400fc7f1
mov qword [r15], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1403db008]
xor eax, eax
jmp 0x1400fc736
Function at 0x1400ffbf0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, rdx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x14033b990]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov r8d, 6
call fcn.1401a4d30
xor ebp, ebp
test eax, eax
je 0x1400ffc7b
lea rcx, [rsp + 0x20]
call fcn.1401a4cf0
movzx edi, byte [reloc.OLEAUT32.dll_VariantCopy]
cmp rax, rdi
jne 0x1400ffc95
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1401a4ce0
lea rsi, [0x14038e6d8]
test dil, dil
je 0x1400ffc71
lea rdx, [0x14038e6dc]
mov rcx, rax
mov r8, rbx
call fcn.1401d2d10
test eax, eax
jne 0x1400ffc95
mov eax, dword [rsi]
mov dword [r14], eax
mov ebp, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401d1390
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x20]
call fcn.1401a4cf0
movzx edi, byte [reloc.OLEAUT32.dll_VariantInit]
cmp rax, rdi
jne 0x1400ffcda
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1401a4ce0
lea rsi, [0x14038e7a0]
test dil, dil
je 0x1400ffc71
lea rdx, [0x14038e7a4]
mov rcx, rax
mov r8, rbx
call fcn.1401d2d10
test eax, eax
je 0x1400ffc71
lea rcx, [rsp + 0x20]
call fcn.1401a4cf0
movzx edi, byte [reloc.OLEAUT32.dll_VariantInit]
cmp rax, rdi
jne 0x1400ffd27
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1401a4ce0
lea rsi, [0x14038e868]
test dil, dil
je 0x1400ffc71
lea rdx, [0x14038e86c]
mov rcx, rax
mov r8, rbx
call fcn.1401d2d10
test eax, eax
je 0x1400ffc71
lea rcx, [rsp + 0x20]
call fcn.1401a4cf0
movzx edi, byte [0x14038e93d]
cmp rax, rdi
jne 0x1400ffd74
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1401a4ce0
lea rsi, [0x14038e930]
test dil, dil
je 0x1400ffc71
lea rdx, [0x14038e934]
mov rcx, rax
mov r8, rbx
call fcn.1401d2d10
test eax, eax
je 0x1400ffc71
lea rcx, [rsp + 0x20]
call fcn.1401a4cf0
movzx edi, byte [0x14038ea0d]
cmp rax, rdi
jne 0x1400ffc7b
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1401a4ce0
lea rsi, [0x14038ea00]
test dil, dil
je 0x1400ffc71
lea rdx, [0x14038ea04]
mov rcx, rax
mov r8, rbx
call fcn.1401d2d10
test eax, eax
je 0x1400ffc71
jmp 0x1400ffc7b
Function at 0x140101230
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x14033b990]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14010131b
lea r14, [rsp + 0x6c]
xor ebx, ebx
mov r8d, 0x110
mov rcx, r14
xor edx, edx
call fcn.1401d34c0
mov dword [r14 - 0xc], 0x11c
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov qword [r14 - 8], 6
mov word [r14 + 0x108], 0
lea rcx, [rsp + 0x60]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x140101322
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.140101380
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140101322
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x14010132b
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14010a7b0
Capabilities:
Read http header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea r15, [rsp + 0x4c]
mov dword [r15], 0
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], 0
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebp, 0x80004005
cmovne ebp, ecx
cmp ebp, 0x8007007a
je 0x14010a839
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d1390
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [0x14033b990]
movaps xmmword [rbp], xmm0
mov edx, dword [rsp + 0x4c]
shr rdx, 1
mov rcx, rbp
call fcn.14021e7e0
mov r9, qword [rbp]
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], 0
mov rcx, rsi
mov edx, ebx
mov r8, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x14010a8c5
mov eax, dword [rsp + 0x4c]
shr rax, 1
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rcx, r8
sub rcx, rdx
sar rcx, 1
cmp rcx, rax
jae 0x14010a8e3
sub rax, rcx
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov rdx, rax
call fcn.140058c50
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
jmp 0x14010a8ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebp, 0x80004005
cmovne ebp, ecx
jmp 0x14010a8f8
jbe 0x14010a8ee
lea r8, [rdx + rax*2]
mov qword [rsp + 0x38], r8
mov rcx, r14
call fcn.14010a920
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14010a81d
mov qword [rsp + 0x38], rcx
call fcn.1401cfdbc
jmp 0x14010a81d

Function at 0x14010ab00
Capabilities:
Read http header

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x38], rax
or edx, 0x20000000
lea rax, [rsp + 0x34]
mov dword [rax], 4
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor esi, esi
test eax, eax
jne 0x14010ab5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14010b4b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14010b510
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14010b519
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14010b4f9
int3
mov rcx, qword [rcx + 8]
jmp 0x14010b4b0
Function at 0x14010b520
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r15
test eax, eax
je 0x14010b5c3
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14010b5b2
cmp eax, 0xffffffff
je 0x14010b5d7
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r12
cmp eax, 3
je 0x14010b561
mov eax, dword [rsp + 0x2c]
jmp 0x14010b592
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14010b594
int3

Function at 0x14010ba60
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14010b980
test rax, rax
jne 0x14010ba9f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14010babb
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14017e5e0
test al, al
jne 0x14010bacd
xor esi, esi
jmp 0x14010ba9f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.14023e670
lea rcx, [rsp + 0x40]
lea rdx, [0x14038a107]
mov r8d, ntohl
call fcn.14020f8f0
mov rcx, rsi
call fcn.14023e6f0
jmp 0x14010bac9

Function at 0x14010bfb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14010b510
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x14010b519
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x14010b4f9
int3
mov rcx, qword [rcx + 8]
jmp 0x14010b4b0

Function at 0x140110820
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140110835
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x140111340
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.1400eed10
mov byte [rsi + 8], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
lea rax, [0x14033b2d0]
mov qword [rsi], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x1401113b5
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x1401113c0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1401113ad
mov qword [rsi + 0x18], rdi
call fcn.14017e5d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14017e5d0
mov rcx, qword [rsi + 0x18]
call fcn.140189420
mov qword [rsi + 0x18], 0
jmp 0x14011139a

Function at 0x140118850
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1403bfed8]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140118885
lea rcx, [0x1403bfed0]
add rsp, 0x28
jmp fcn.14019c150
lea rcx, [0x1403bfed8]
call fcn.1401cfee0
cmp dword [0x1403bfed8], 0xffffffff
jne 0x140118875
mov qword [0x1403bfed0], 0
lea rcx, [0x1403bfed0]
xor edx, edx
call fcn.1400ed1f0
lea rcx, [0x1403bfed8]
call fcn.1401cff78
jmp 0x140118875

Function at 0x140119f50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1403bff08]
cmp rdi, 1
jbe 0x140119f79
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14019c190
lea rcx, [0x1403bff08]
call fcn.14007cbc0
test al, al
je 0x140119fbf
mov qword [0x1403bff10], 0
lea rbx, [0x1403bff08]
lea rdi, [0x1403bff10]
mov rcx, rdi
xor edx, edx
call fcn.1400ed1f0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14007cc60
jmp 0x140119f67
mov rdi, qword [0x1403bff08]
jmp 0x140119f67