joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140165864
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
lea rcx, [rsp + 0x28]
mov edx, eax
call fcn.140166178
lea rdi, [rsi + 0xb8]
cmp byte [rsi + 0xcf], 0
jns 0x1401658ab
mov rcx, qword [rdi]
call fcn.1400c9cac
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ccfe0
nop
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14017d000
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.14009ccc0
cmp byte [rdi + 0x17], 0
jns 0x14017d041
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x14017d062
mov rcx, qword [rsp + 0x58]
call fcn.1400c9cac
test edi, edi
je 0x14017d10e
test r14, r14
je 0x14017d10e
mov ecx, edi
add rcx, rcx
call fcn.1400ca15c
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.14009ccc0
cmp byte [rsi + 0x17], 0
jns 0x14017d0a3
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x14017d0c3
mov rcx, qword [rsp + 0x58]
call fcn.1400c9cac
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x14017d12c
mov rcx, rbx
call fcn.1400ca328
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.14008ddb0
cmp byte [r14 + 0x17], 0
js 0x14017d130
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
test rbx, rbx
je 0x14017d10e
mov rcx, rbx
call fcn.1400c9cb4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x14017d0d5
mov rcx, qword [r14]
call fcn.1400c9cac
jmp 0x14017d0ef
Function at 0x140181e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xor eax, eax
test rcx, rcx
je 0x140181e8c
cmp edx, 0xffff
ja 0x140181e8c
mov rsi, r9
mov rdi, rcx
mov edx, edx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140181e95
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rbx, rax
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140181e8a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140181ed2
mov rcx, qword [rsp + 0x70]
mov qword [rsi], rax
mov edx, ebp
mov qword [rcx], rdx
test rax, rax
setne al
jmp 0x140181e8c
Function at 0x1401820c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xd0], rax
call fcn.14007e780
cmp eax, 8
jg 0x140182100
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x140182228
mov r14d, eax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x70]
mov qword [rdi + 0x50], r15
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.DeleteFileEvenIfInUse
lea r8, str..._.._base_files_file_util_win.cc
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov r9d, 0x205
call fcn.14007e2d0
xor esi, esi
mov rcx, rdi
mov rdx, rbp
xor r8d, r8d
call fcn.14008e970
cmp byte [rbx + 0x17], 0
mov rcx, rbx
jns 0x14018216d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14018221e
test al, 0x10
jne 0x140182211
mov qword [rsp + 0x48], r15
cmp byte [rbx + 0x17], 0
jns 0x140182192
mov rbx, qword [rbx]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x10100
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rdi, [rsp + 0x48]
mov qword [rdi], rsi
mov rcx, rdi
mov rdx, rax
call fcn.1400bdb78
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14018224a
mov rax, qword [rsp + 0x48]
inc rax
cmp rax, 2
jb 0x14018221e
call fcn.140071760
mov rdi, qword [rsp + 0x48]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1401822f8
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
jmp 0x14018221e
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rcx, [rsp + 0x70]
call fcn.14007d0f0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x14025cbbe]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtSetInformationFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401822f1
mov rbx, rax
movups xmm0, xmmword [0x14025cbd8]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
xor eax, eax
cmp r14d, 0xc
setg al
shl eax, 4
or eax, 3
lea r8, [rsp + 0x40]
mov dword [r8], eax
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x20], 0x40
mov r9d, 4
call rbx
test eax, eax
sete sil
je 0x1401821df
mov edi, eax
lea rcx, [0x14025cbbe]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401822e4
mov ecx, edi
call rax
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1401821df
xor esi, esi
jmp 0x1401821df
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x140182207
Function at 0x140182bf0
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.DeleteValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x20]
mov r9d, 0x145
call fcn.14007e2d0
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140182c50
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 4
lea r15, [rsp + 0x3c]
mov dword [r15], eax
lea r12, [rsp + 0x38]
mov dword [r12], eax
lea rsi, [rsp + 0x34]
mov dword [rsi], 0
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.14007e2d0
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140182d12
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140182cf5
cmp dword [rsp + 0x38], 4
jne 0x140182cf5
mov eax, dword [rsp + 0x34]
mov dword [r14], eax
xor edi, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x140182cf5
Function at 0x14018d1a0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x14018d1dc
mov rax, qword [r14]
mov qword [rbx], rax
add qword [rbp + 0x10], 8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rbp]
mov rdi, qword [rbp + 8]
mov rax, rdi
sub rax, r15
jbe 0x14018d239
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rdi
sub r15, rax
sub rbx, rdi
je 0x14018d228
mov rcx, r15
mov rdx, rdi
mov r8, rbx
call fcn.1400cf0a0
mov rdi, qword [rbp + 8]
add rbx, r15
mov qword [rbp + 0x10], rbx
lea rax, [rdi + r12*8]
mov qword [rbp + 8], rax
jmp 0x14018d1c0
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14018d2d0
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.1400c9cbc
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, rdi
je 0x14018d2a3
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea rcx, [rax + r12*8]
xor edx, edx
mov rsi, qword [rdi + rdx]
mov qword [rcx + rdx], rsi
add rdx, 8
cmp rbx, rdx
jne 0x14018d292
mov qword [rbp], rax
mov qword [rbp + 8], r9
mov qword [rbp + 0x10], r10
mov qword [rbp + 0x18], r8
mov rbx, r10
test r15, r15
je 0x14018d1c0
mov rcx, r15
call fcn.1400c9cac
mov rbx, qword [rbp + 0x10]
jmp 0x14018d1c0
call fcn.1400c9fe0
int3

Function at 0x14018d2e0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14018d31f
mov r15, rbx
mov rax, qword [r14]
mov qword [r15 - 8], rax
add qword [rbp + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
cmp rdi, rax
jae 0x14018d371
sub rax, rdi
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r15, [rdi + r12*8]
mov r8, rdi
sub r8, rbx
je 0x14018d363
sub r15, r8
mov rcx, r15
mov rdx, rbx
call fcn.1400cf0a0
mov rdi, qword [rbp + 0x10]
mov qword [rbp + 8], r15
lea rax, [rdi + r12*8]
mov qword [rbp + 0x10], rax
jmp 0x14018d302
sub rax, rbx
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14018d403
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.1400c9cbc
lea r15, [rax + r12*8]
lea r8, [rax + r13*8]
mov r9, r15
sub rdi, rbx
je 0x14018d3d9
lea r9, [r15 + rdi]
sar rdi, 3
shl rdi, 3
lea rcx, [rax + r12*8]
xor edx, edx
mov rsi, qword [rbx + rdx]
mov qword [rcx + rdx], rsi
add rdx, 8
cmp rdi, rdx
jne 0x14018d3c8
mov qword [rbp], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r9
mov qword [rbp + 0x18], r8
test rbx, rbx
je 0x14018d302
mov rcx, rbx
call fcn.1400c9cac
mov r15, qword [rbp + 8]
jmp 0x14018d302
call fcn.1400c9fe0
int3
Function at 0x14019c7a6
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14019c7c1
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14011c80f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14019c86f
mov rbx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x14019c86f
mov qword [rsp + 0x20], 0
mov rcx, r14
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x14019c89a
mov qword [rdi + 0x28], r14
mov al, 1
jmp 0x14019c7b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14019c7b5
mov dword [rsi], 7
jmp 0x14019c7b5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14019c7b5
Function at 0x1401a8f90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1401a900e
mov rax, 0xffffffffffffffff
xor edx, edx
div rsi
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x20]
cmp rax, rcx
ja 0x1401a8fb8
xor edx, edx
div rsi
mov rsi, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ccfe0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x1401a9fc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x90
call fcn.1401ad8a0
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1401a9fe6
mov qword [rsi + 0x70], rcx
call fcn.1400089f0
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x1401a9ff8
mov qword [rsi + 0x50], rcx
call fcn.1400089f0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x1401aa00a
mov qword [rsi + 0x30], rcx
call fcn.1400089f0
mov rdx, qword [rsi + 0x18]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1401ad8d0
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
jne 0x1401ad8e2
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rdx]
call 0x1401ad8d0
mov rdx, qword [rsi + 8]
mov rcx, rdi
call 0x1401ad8d0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400089f0

Function at 0x1401acad0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov rcx, qword [rcx]
mov rbx, qword [r15 + 8]
sub rbx, rcx
sar rbx, 4
lea rax, [rbx + 1]
mov rdx, rax
shr rdx, 0x3c
jne 0x1401acbe4
movabs rdx, 0xfffffffffffffff
mov rdi, qword [r15 + 0x10]
sub rdi, rcx
mov rcx, rdi
sar rcx, 4
sar rdi, 3
cmp rdi, rax
cmovb rdi, rax
movabs rax, 0x7ffffffffffffff
cmp rcx, rax
cmovae rdi, rdx
test rdi, rdi
jne 0x1401acbd7
xor eax, eax
shl rbx, 4
lea rdx, [rax + rbx]
shl rdi, 4
add rdi, rax
mov rcx, qword [r14]
lea r8, [rax + rbx]
add r8, 0x10
mov qword [r8 - 0x10], rcx
mov cl, byte [r14 + 8]
and cl, 1
mov byte [r8 - 8], cl
mov cl, byte [r14 + 9]
and cl, 1
mov byte [r8 - 7], cl
mov rbx, qword [r15]
mov rcx, qword [r15 + 8]
cmp rcx, rbx
je 0x1401acbaa
mov rax, qword [rcx - 0x10]
mov qword [rdx - 0x10], rax
mov al, byte [rcx - 8]
and al, 1
mov byte [rdx - 8], al
mov al, byte [rcx - 7]
lea rsi, [rcx - 0x10]
and al, 1
mov byte [rdx - 7], al
add rdx, 0xfffffffffffffff0
mov rcx, rsi
cmp rbx, rsi
jne 0x1401acb7f
mov rcx, qword [r15]
mov qword [r15], rdx
mov qword [r15 + 8], r8
mov qword [r15 + 0x10], rdi
test rcx, rcx
je 0x1401acbca
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400089f0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rdi
call fcn.1401acdb0
jmp 0x1401acb3f
mov rcx, r15
call fcn.14014e7e0
int3

Function at 0x1401ad8a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x38
call 0x1401ef500
add rsi, 8
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1401ef500
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401ef522
mov rdi, qword [rcx]
call fcn.14001c830
mov rcx, rdi
test rdi, rdi
jne 0x1401ef512
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x1401ef547
mov r8, qword [rsi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001ab30
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401b0399
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1401b03c3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401b0404
mov edi, eax
test bl, bl
jne 0x1401b04bd
mov eax, edi
and eax, 0x400
je 0x1401b04bd
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401b03e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x81
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400a7acb
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14008ddb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401b0492
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a7acb
cmp byte [rsp + 0x57], 0
jns 0x1401b04ae
mov rcx, qword [rsp + 0x40]
call fcn.1400c9cac
lea rcx, [rsp + 0x58]
call fcn.1401412f0
jmp 0x1401b03e5
and edi, 0x10
shr edi, 4
jmp 0x1401b03e7
Function at 0x1401b1f5e
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1401b1f85
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401b1fa0
and eax, 0x410
cmp eax, 0x410
je 0x1401b2094
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1401b1fac
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x1401b1fd5
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401b208d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400a7acb
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14008ddb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401b2067
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a7acb
cmp byte [rsp + 0x4f], 0
jns 0x1401b2083
mov rcx, qword [rsp + 0x38]
call fcn.1400c9cac
lea rcx, [rsp + 0x50]
call fcn.1401412f0
xor edi, edi
jmp 0x1401b1fb9
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400ccfe0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1401f0af2

Function at 0x1401b6e10
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x14029b170]
test rax, rax
je 0x1401b6f11
cmp eax, 2
jne 0x1401b6e96
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401b6ef5
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch
mov r8d, 0x1d
call fcn.1400a7acb
mov rcx, rsi
call fcn.140001c60
jmp 0x1401b6ef5
mov eax, 1
lock xadd qword [0x14029b1a8], rax
test rax, rax
jle 0x1401b6eb6
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14029b128], eax
mov qword [0x14029b120], rsi
mov rcx, qword [0x140292810]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ccfe0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x14029b170]
test rax, rax
je 0x1401b6f18
jmp 0x1401b6e3e
Function at 0x1401d829e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401e0d01
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xor r12d, r12d
test rcx, rcx
je 0x1401e0eb2
mov r14, r8
test r8, r8
je 0x1401e0eb2
mov r15, r9
mov r13, rdx
test rdx, rdx
mov rax, rdx
cmove rax, r14
movzx edx, byte [rax]
mov ebp, edx
shl ebp, 5
sub ebp, edx
sub ebp, edx
test r13, r13
je 0x1401e0d83
mov bl, byte [r13]
test bl, bl
je 0x1401e0d72
lea rdx, [r13 + 1]
movsx ebx, bl
mov esi, ebp
shl esi, 5
mov eax, ebp
shr eax, 3
add eax, ebx
add eax, esi
xor ebp, eax
mov bl, byte [rdx]
inc rdx
test bl, bl
jne 0x1401e0d56
mov eax, ebp
shl eax, 5
mov edx, ebp
shr edx, 3
add eax, edx
add eax, 0x3a
xor ebp, eax
mov bl, byte [r14]
test bl, bl
je 0x1401e0daa
lea rdx, [r14 + 1]
movsx eax, bl
mov esi, ebp
shl esi, 5
mov edi, ebp
shr edi, 3
add edi, eax
add edi, esi
xor ebp, edi
mov bl, byte [rdx]
inc rdx
test bl, bl
jne 0x1401e0d8e
mov rbx, qword [rsp + 0x90]
mov eax, ebp
shl eax, 5
mov r8d, ebp
shr r8d, 3
add r8d, eax
xor r8d, ebp
test r15, r15
je 0x1401e0e07
mov dl, byte [r15]
test dl, dl
je 0x1401e0df3
lea rax, [r15 + 1]
movsx ebp, dl
mov edx, r8d
shl edx, 5
mov esi, r8d
shr esi, 3
add esi, ebp
add esi, edx
xor r8d, esi
mov dl, byte [rax]
inc rax
test dl, dl
jne 0x1401e0dd4
mov eax, r8d
shl eax, 5
mov edx, r8d
shr edx, 3
add eax, edx
add eax, 0x3a
xor r8d, eax
test rbx, rbx
je 0x1401e0e3a
mov dl, byte [rbx]
test dl, dl
je 0x1401e0e3a
mov rbp, rbx
lea rax, [rbx + 1]
movsx edx, dl
mov edi, r8d
shl edi, 5
mov ebx, r8d
shr ebx, 3
add ebx, edx
add ebx, edi
xor r8d, ebx
mov dl, byte [rax]
inc rax
test dl, dl
jne 0x1401e0e19
jmp 0x1401e0e3d
mov rbp, rbx
mov edx, r8d
shl edx, 5
mov eax, r8d
shr eax, 3
add eax, edx
xor eax, r8d
xor r12d, r12d
xor edx, edx
div dword [rcx + 8]
mov rsi, qword [rcx]
lea rax, [rdx + rdx*2]
shl rax, 4
cmp dword [rsi + rax + 0x28], 0
je 0x1401e0eb2
add rsi, rax
je 0x1401e0eb2
xor r12d, r12d
mov rdi, rbp
mov r8, qword [rsi + 8]
mov rcx, r13
mov rdx, r14
call fcn.1401dc438
test eax, eax
je 0x1401e0eaa
mov r8, qword [rsi + 0x10]
mov rcx, r15
mov rdx, rdi
call fcn.1401dc438
test eax, eax
je 0x1401e0eaa
mov r8, qword [rsi + 0x18]
xor ecx, ecx
xor edx, edx
call fcn.1401dc438
test eax, eax
jne 0x1401e0ec6
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1401e0e73
mov rax, r12
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi + 0x20]
jmp 0x1401e0eb2
Function at 0x1401e09a5
Capabilities:
Encode data using xor

Disassembly:
push rsi
test rdx, rdx
je 0x1401e09e9
movzx r10d, byte [rdx]
mov r11d, r10d
shl r11d, 5
sub r11d, r10d
sub r11d, r10d
test r10d, r10d
je 0x1401e09ec
inc rdx
movsx r10d, r10b
mov eax, r11d
shl eax, 5
mov esi, r11d
shr esi, 3
add esi, eax
add esi, r10d
xor r11d, esi
mov r10b, byte [rdx]
inc rdx
test r10b, r10b
jne 0x1401e09c4
jmp 0x1401e09ec
xor r11d, r11d
mov eax, r11d
shl eax, 5
mov r10d, r11d
shr r10d, 3
add r10d, eax
xor r10d, r11d
test r8, r8
je 0x1401e0a2e
mov al, byte [r8]
test al, al
je 0x1401e0a2e
inc r8
movsx eax, al
mov edx, r10d
shl edx, 5
mov esi, r10d
shr esi, 3
add esi, eax
add esi, edx
xor r10d, esi
mov al, byte [r8]
inc r8
test al, al
jne 0x1401e0a0e
mov edx, r10d
shl edx, 5
mov eax, r10d
shr eax, 3
add eax, edx
xor eax, r10d
test r9, r9
je 0x1401e0a6d
mov dl, byte [r9]
test dl, dl
je 0x1401e0a6d
inc r9
movsx r8d, dl
mov esi, eax
shl esi, 5
mov edx, eax
shr edx, 3
add edx, r8d
add edx, esi
xor eax, edx
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x1401e0a4e
xor edx, edx
div dword [rcx + 8]
mov eax, edx
pop rsi
ret