joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400390a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15d, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x50], rax
movaps xmm0, xmmword [0x1400f2f80]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rdx, str.DoInitialize
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x15a
call fcn.140068280
mov rcx, rbp
mov rdx, rdi
xor r8d, r8d
call fcn.1400682b0
mov eax, r15d
and eax, 1
neg eax
and eax, 3
test r15b, 2
mov edx, 1
cmove edx, eax
test r15b, 4
mov ecx, 4
cmovne edx, ecx
test r15b, 8
mov ebp, 2
cmove ebp, edx
test r15b, 0x10
mov eax, 5
cmove eax, ebp
test eax, eax
je 0x140039302
mov edx, r15d
and edx, 0x40
shl edx, 0x18
test r15b, r15b
cmovns ecx, edx
mov edx, r15d
rol edx, 0x1a
mov edi, r15d
shl edi, 0xb
and edi, 0x20000000
mov esi, r15d
shr esi, 4
and esi, 0x10000
and edx, 0x80000100
or edx, edi
or edx, esi
or edx, ecx
mov ecx, r15d
shr ecx, 8
and ecx, 3
mov r8d, r15d
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov edi, r15d
and edi, 0x400
mov ecx, edi
shl ecx, 0x14
mov ebp, r15d
shr ebp, 3
and ebp, 0x100
or ebp, ecx
mov ecx, r15d
shr ecx, 0xb
and ecx, 2
or ecx, ebp
mov ebp, r15d
shl ebp, 0xd
and ebp, 0x4000000
or ebp, ecx
mov ecx, r15d
shl ecx, 8
mov esi, ecx
and esi, 0x2000000
or esi, ebp
and ecx, 0x8000000
or ecx, esi
cmp byte [rbx + 0x17], 0
jns 0x140039214
mov rbx, qword [rbx]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov rcx, rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp qword [r14], rax
je 0x140039270
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r14]
inc rax
cmp rax, 2
jae 0x1400392e9
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140039265
mov qword [r14], rbx
call fcn.1400682a0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [r14]
inc rbx
cmp rbx, 2
jb 0x14003929b
shr edi, 0xa
mov dword [r14 + 0x24], 0
mov byte [r14 + 0x29], dil
test r15b, 4
jne 0x1400392d7
test r15b, 0xa
je 0x1400392ac
mov byte [r14 + 0x28], 1
jmp 0x1400392ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140038f70
mov dword [r14 + 0x24], eax
lea rcx, [rsp + 0x60]
call fcn.140068310
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14007c600
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [r14 + 0x28]
jmp 0x1400392ac
call fcn.1400682a0
mov rcx, qword [r14]
call fcn.140068910
mov qword [r14], 0
jmp 0x140039251
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [r14 + 0x24], 0xffffffff
jmp 0x1400392ac
Function at 0x140039510
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400684d0
mov qword [rsi], 0
test rax, rax
je 0x140039563
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140039597
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14003955b
mov qword [rsi], rbx
call fcn.1400682a0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14005bfd0
lea rcx, [rsi + 0x20]
call fcn.14006ee90
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400682a0
mov rcx, qword [rsi]
call fcn.140068910
mov qword [rsi], 0
jmp 0x140039549
Function at 0x14003af80
Capabilities:
Create thread

Disassembly:
jmp 0x14003af80
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.14007b74c
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x14003b2e0]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14003b021
test rbp, rbp
je 0x14003b051
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007c600
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14003b03a
mov ebp, eax
cmp eax, 0x5af
je 0x14003b03a
cmp ebp, 0xe
jne 0x14003b05c
mov rcx, r15
call fcn.1400c65c0
test r14, r14
je 0x14003afff
mov rcx, r14
call fcn.14007b788
jmp 0x14003afff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003afff
mov eax, dword [0x140114e40]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003b0cb
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.1400396a0
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x140114e38]
call fcn.14006f470
cmp byte [rsi + 0x17], 0
jns 0x14003b042
mov rcx, qword [rsp + 0x38]
call fcn.14007b788
jmp 0x14003b042
lea rcx, [0x140114e40]
call fcn.14007b8a0
cmp dword [0x140114e40], 0xffffffff
jne 0x14003b07d
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400498a0
mov qword [0x140114e38], rax
lea rcx, [0x140114e40]
call fcn.14007b938
jmp 0x14003b07d
Function at 0x14003b700
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
lea rax, [0x1400f2500]
mov qword [rcx], rax
add rcx, 8
call fcn.140061420
lea rcx, [rsi + 0x10]
call fcn.140061420
xor edi, edi
mov byte [rsi + 0x18], dil
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], edi
call fcn.140061420
mov byte [rsi + 0x48], dil
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rdi
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebx, 0x3f800000
mov dword [rsi + 0xd0], ebx
mov dword [rsi + 0xd8], edi
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebx
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebx
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebx
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebx
mov qword [rsi + 0x198], rdi
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], edi
mov eax, dword [0x1400fc7e8]
mov dword [rsi + 0x1a0], eax
lea rcx, [rsi + 0x1a8]
call fcn.14004a270
lea rcx, [rsi + 0x2f0]
movups xmmword [rsi + 0x2d8], xmm6
mov qword [rsi + 0x2e8], rdi
xor edx, edx
call fcn.1400464d0
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.1400464d0
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.1400464d0
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
mov dword [rsi + 0x328], ebx
movups xmmword [rsi + 0x330], xmm6
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x359], xmm6
movups xmmword [rsi + 0x370], xmm6
movups xmmword [rsi + 0x380], xmm6
call fcn.140019a90
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov rcx, rsi
call fcn.14003b910
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14003b900
call fcn.1400499d0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140049a80
mov qword [0x1401151e0], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14003b8cf
Function at 0x14003f950
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x14003f984
mov rax, qword [r12 + 8]
test rax, rax
je 0x14003fa7c
mov eax, ebx
not eax
test eax, 0x300
je 0x14003fa7c
cmp edi, 2
lea rax, [0x140116990]
lea rcx, [0x140116b90]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14003fa7c
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14003fa7c
cmp byte [0x140116980], 0
setne al
bt ebx, 8
jb 0x14003fa7c
shr ebx, 9
and ebx, 1
or bl, al
je 0x14003fa7c
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x14003fad7
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x14003fa69
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
call fcn.140090d48
test eax, eax
je 0x14003fa9b
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x14003fa4b
cmp dword [rsp + 0x2c], 0
jne 0x14003fadf
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007c600
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [rbx + rdi*2]
cmp cx, 0x5c
je 0x14003faaa
test cx, cx
jne 0x14003fa69
lea rax, [rbx + rdi*2]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x14003fb07
cmp dword [rsp + 0x2c], 2
jne 0x14003fb18
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x14003fb18
mov rbx, r12
jmp 0x14003fa2c
cmp byte [r12 + 0x17], 0
js 0x14003fb47
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.140026a00
jmp 0x14003fa7c
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
cmp cx, 0x5c
jne 0x14003fb31
lea rbx, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x14003fb1e
jmp 0x14003fb34
mov rbx, rax
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
xor r15d, r15d
mov r13, rbp
jmp 0x14003fa70
mov rax, qword [r12]
jmp 0x14003faea
Function at 0x140041a20
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140041a47
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140041a81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140041aa0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14007c600
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140041b60
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14007c600
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x140041b57
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x25d
mov r9d, 2
call fcn.1400c2020
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400556b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14005fad0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140041b31
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400556b0
cmp byte [rsp + 0x4f], 0
jns 0x140041b4d
mov rcx, qword [rsp + 0x38]
call fcn.14007b788
lea rcx, [rsp + 0x50]
call fcn.1400c20a0
xor esi, esi
jmp 0x140041a84
Function at 0x140041b60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140041b87
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140041bb9
mov dil, 1
test al, 0x10
je 0x140041c75
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14007c600
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x140041d38
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x248
mov r9d, 2
call fcn.1400c2020
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400556b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14005fad0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140041c4a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1400556b0
cmp byte [rsp + 0x5f], 0
jns 0x140041c66
mov rcx, qword [rsp + 0x48]
call fcn.14007b788
lea rcx, [rsp + 0x60]
call fcn.1400c20a0
jmp 0x140041d38
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x140041d38
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x24c
mov r9d, 2
call fcn.140035120
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400556b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14005fad0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140041cfd
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1400556b0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400556b0
cmp byte [rsp + 0x5f], 0
jns 0x140041d2e
mov rcx, qword [rsp + 0x48]
call fcn.14007b788
lea rcx, [rsp + 0x60]
call fcn.1400355b0
xor edi, edi
jmp 0x140041b9d
Function at 0x140043d80
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
mov rcx, qword [r8]
cmovns rcx, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
cmovs rax, qword [r8 + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.14005f840
cmp byte [rsi + 0x17], 0
jns 0x140043ddb
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.14005f840
cmp byte [rdi + 0x17], 0
jns 0x140043e00
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x140043e1f
mov rcx, qword [rsp + 0x48]
call fcn.14007b788
cmp byte [rsp + 0x87], 0
jns 0x140043e33
mov rcx, qword [rsp + 0x70]
call fcn.14007b788
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14007c600
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x140043ee0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.14005f840
cmp byte [rdi + 0x17], 0
jns 0x140043f21
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x140043f42
mov rcx, qword [rsp + 0x58]
call fcn.14007b788
test edi, edi
je 0x140043fe9
test r14, r14
je 0x140043fe9
mov ecx, edi
add rcx, rcx
call fcn.14007b7bc
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.14005f840
cmp byte [rsi + 0x17], 0
jns 0x140043f83
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x140043fa3
mov rcx, qword [rsp + 0x58]
call fcn.14007b788
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140044007
mov rcx, rbx
call fcn.1400952c0
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.14005fad0
cmp byte [r14 + 0x17], 0
js 0x140044013
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
mov rcx, rbx
call fcn.14007b7c4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007c600
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x28], 0
int3
mov rcx, qword [r14]
call fcn.14007b788
jmp 0x140043fcf
Function at 0x1400446e0
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x58], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1400f2f80]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14004475a
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
mov edi, 0x80003
cmp eax, 6
jb 0x14004475f
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.1400447c0
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140044761
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x14004476a
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14007c600
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140044d50
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14010e038]
xor rax, rsp
mov qword [rsp + 0x168], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x140044e2c
and eax, 0xfeff
cmp eax, 6
je 0x140044e2c
mov eax, dword [0x140116fc8]
mov ecx, dword [0x1401116a4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140044df3
lea rcx, [0x140116fc8]
call fcn.14007b8a0
cmp dword [0x140116fc8], 0xffffffff
jne 0x140044df3
lea rcx, str.kernel32.dll
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.140045100
mov qword [0x140116fc0], rax
lea rcx, [0x140116fc8]
call fcn.14007b938
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x140116fc0]
mov esi, eax
test eax, eax
je 0x140044e39
test esi, esi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14007c600
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
jmp 0x140044e0f
mov ecx, 2
call fcn.1400621e0
test al, al
je 0x140044e0a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x21
mov r9d, 2
call fcn.1400c2020
lea rcx, [rsp + 0x38]
lea rdx, str.InitializeCriticalSectionEx
mov r8d, 0x1b
call fcn.1400556b0
mov rcx, rdi
call fcn.1400c20a0
jmp 0x140044e0a
Function at 0x140045420
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x14004545a
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r15
jbe 0x1400454b6
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400454a5
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.14007eab0
mov r14, qword [rsi + 8]
add rbx, r15
mov qword [rsi + 0x10], rbx
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x14004543f
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14004554c
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.14007b74c
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, r14
je 0x140045520
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea r11, [rax + r12*8]
xor edx, edx
mov rcx, qword [r14 + rdx]
mov qword [r11 + rdx], rcx
add rdx, 8
cmp rbx, rdx
jne 0x14004550f
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbx, r10
test r15, r15
je 0x14004543f
mov rcx, r15
call fcn.14007b788
mov rbx, qword [rsi + 0x10]
jmp 0x14004543f
call fcn.14008eb60
int3