joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e459d
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
cmp dword [rcx + 0x10108], 0
mov r9d, dword [rcx + 0xd4]
je 0x1401e4654
test r9, r9
je 0x1401e4654
xor eax, eax
mov r8d, 0xff
mov esi, dword [rdi + 0x10128]
mov ecx, dword [rdi + 0x10130]
mov edx, ecx
and edx, 0xfffd
lea r10d, [rdx + 2]
xor edx, 3
imul edx, r10d
shr edx, 8
movzx r10d, byte [rdi + rax + 0x100]
mov r11, qword [rdi + 0x10138]
mov ebx, esi
and ebx, r8d
xor ebx, r10d
shr esi, 8
xor esi, dword [r11 + rbx*4]
mov dword [rdi + 0x10128], esi
and esi, r8d
add esi, dword [rdi + 0x1012c]
imul ebx, esi, 0x8088405
inc ebx
mov dword [rdi + 0x1012c], ebx
shr ebx, 0x18
mov esi, ecx
and esi, r8d
xor esi, ebx
shr ecx, 8
xor ecx, dword [r11 + rsi*4]
mov dword [rdi + 0x10130], ecx
xor byte [rdi + rax + 0x100], dl
inc rax
cmp r9, rax
jne 0x1401e45cc
lea r8, [rdi + 0x100]
mov rcx, qword [rdi + 0x38]
mov rdx, qword [rdi + 0x58]
call qword [rdi + 0x10]
mov edx, dword [rdi + 0x84]
mov ebx, dword [rdi + 0xd4]
xor ecx, ecx
cmp eax, ebx
setne cl
add qword [rdi + 0x10118], rbx
add qword [rdi + 0x10120], rdx
neg ecx
xor eax, eax
mov dword [rdi + 0x84], eax
mov dword [rdi + 0xd4], eax
mov eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401eb40e
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.1401ed6f0
test al, al
je 0x1401eb43c
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x1401eb45d
mov rcx, rdi
call fcn.1401ed710
mov rcx, rdi
call fcn.1400c9cac
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x1401eb46f
mov qword [rsi + 0x60], rcx
call fcn.1400c9cac
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x1401eb485
call fcn.14008fb00
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x1401eb493
call fcn.140142bfe
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x1401eb4b4
mov rcx, rdi
call fcn.1401ed710
mov rcx, rdi
call fcn.1400c9cac
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jae 0x1401eb4e9
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x1401eb510
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x1401eb537
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14013a520
call fcn.140071760
mov rdi, qword [rsi + 0x28]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1401eb561
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rsi + 0x28], 0
jmp 0x1401eb4c1
call fcn.140071760
mov rdi, qword [rsi + 0x20]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1401eb56f
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rsi + 0x20], 0
jmp 0x1401eb4ce
call fcn.140071760
mov rdi, qword [rsi + 0x18]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x1401eb57d
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rsi + 0x18], 0
jmp 0x1401eb4db
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1401eb4fe
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1401eb525
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x1401eb54c
Function at 0x1401edf4a
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1401ed6f0
test al, al
je 0x1401edf6c
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x1401ef500
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x38
call 0x1401ef500
add rsi, 8
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1401ef500
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401ef522
mov rdi, qword [rcx]
call fcn.14001c830
mov rcx, rdi
test rdi, rdi
jne 0x1401ef512
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x1401ef547
mov r8, qword [rsi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14001ab30
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401f08e2
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
cmp byte [rcx + 0x17], 0
jns 0x1401f090d
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
je 0x1401f0939
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x1401f094e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1401f0a1c
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f0a15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x61
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x50]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400a7acb
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.14008ddb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401f09e9
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a7acb
cmp byte [rsp + 0x1a7], 0
jns 0x1401f0a0b
mov rcx, qword [rsp + 0x190]
call fcn.1400c9cac
lea rcx, [rsp + 0x40]
call fcn.1401412f0
xor edi, edi
jmp 0x1401f091c
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.1401b0399
test al, al
jne 0x1401f091c
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f0a15
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x5c
mov r9d, 2
call fcn.140122230
lea rdi, [rsp + 0x50]
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x180]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.14008ddb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401f0aac
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a7acb
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1400a7acb
cmp byte [rsp + 0x1a7], 0
jns 0x1401f0ae3
mov rcx, qword [rsp + 0x190]
call fcn.1400c9cac
lea rcx, [rsp + 0x40]
call fcn.140001c60
jmp 0x1401f0a15
Function at 0x1401f0af2
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1401f0b1a
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x1401f0b48
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f0b26
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400a7acb
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14008ddb0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x1401f0bd6
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1400a7acb
cmp byte [rsp + 0x57], 0
jns 0x1401f0bf2
mov rcx, qword [rsp + 0x40]
call fcn.1400c9cac
lea rcx, [rsp + 0x58]
call fcn.1401412f0
jmp 0x1401f0b26
Function at 0x1401f46e6
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x14029beb8]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401f4973
mov rax, qword [0x14029beb0]
test rax, rax
jne 0x1401f4809
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x140257270]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1401f49ba
test al, al
jne 0x1401f48a2
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f47ea
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1400a7acb
mov rcx, rsi
call fcn.140001c60
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call rax
test eax, eax
jne 0x1401f487f
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f4741
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x40]
lea rdx, [0x14025f60b]
mov r8d, 0xe
call fcn.1400a7acb
mov rcx, rbx
call fcn.1401412f0
jmp 0x1401f4741
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x1401f4748
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1401f477d
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
jne 0x1401f48bc
call fcn.1401f520c
jmp 0x1401f48c1
call fcn.1401f4be3
test al, al
jne 0x1401f490e
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f47ea
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x1401f47dd
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1401f3e47
mov sil, 1
test al, al
jne 0x1401f47ec
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x1401f47ea
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.140122230
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x1401f47dd
lea rcx, [0x14029beb8]
call fcn.1400c9d58
cmp dword [0x14029beb8], 0xffffffff
jne 0x1401f4731
lea rcx, [0x14025755e]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1401420ab
mov qword [0x14029beb0], rax
lea rcx, [0x14029beb8]
call fcn.1400c9cf8
jmp 0x1401f4731
Function at 0x140208290
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.1400cf750
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x1402082d2
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1402082c6

Function at 0x140218128
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x34]
mov dword [r12], 0xaaaaaaaa
mov qword [rsp + 0x20], r12
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1402181d6
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x28]
mov qword [rbp], rax
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, eax
mov r15, qword [rbp]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1402181d6
test r14d, r14d
setne al
cmp r15, rsi
sete sil
and sil, al
jmp 0x1402181d8
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14021bf4e
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x140257270]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.140206980
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.14021bcda
test al, al
je 0x14021c015
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14021c0a1
mov rcx, rdi
call fcn.140206980
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.14021bcda
test al, al
je 0x14021c0e6
cmp dword [r15], 0x4550
jne 0x14021c125
mov sil, 1
test r14, r14
je 0x14021c080
mov qword [r14], rdi
jmp 0x14021c080
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c07e
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1400a7acb
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14021c06b
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400a7acb
mov rcx, rdi
call fcn.140001c60
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c07e
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14021c055
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c07e
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14021c04f
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c07e
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14021c055
Function at 0x14021c768
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x140257270]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.140206980
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.14021bcda
test al, al
je 0x14021c82f
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14021c8bb
mov rcx, rdi
call fcn.140206980
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.14021bcda
test al, al
je 0x14021c900
cmp dword [r15], 0x4550
jne 0x14021c93f
mov sil, 1
test r14, r14
je 0x14021c89a
mov qword [r14], rdi
jmp 0x14021c89a
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c898
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1400a7acb
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14021c885
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400a7acb
mov rcx, rdi
call fcn.140001c60
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c898
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14021c86f
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c898
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14021c869
mov ecx, 1
call fcn.1400ac390
test al, al
je 0x14021c898
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140122230
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14021c86f
Function at 0x140002c44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r14
mov rax, qword [0x14000d3b8]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov rcx, qword [rbp + 0x50]
xor r14d, r14d
mov rdi, r8
mov word [r8], r14w
lea r8, str.not_loaded
lea edx, [r14 + 0x32]
call fcn.140001350
mov rsi, qword [rbp + 0x60]
lea rcx, str.comsvcs.dll
mov word [rsi], r14w
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140002e35
xor r9d, r9d
lea edx, [r14 + 0x10]
lea r8d, [r14 + 1]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
nop dword [rax + rax]
test rax, rax
je 0x140002e35
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x140002e35
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
nop dword [rax + rax]
mov r9, rax
test rax, rax
je 0x140002e35
movzx r8d, word [rax]
mov ecx, r8d
shr ecx, 1
add ecx, r8d
mov edx, ecx
lea rax, [rcx + 0xf]
cmp rax, rdx
ja 0x140002d2c
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400073b0
sub rsp, rax
mov rdx, r9
lea rbx, [rsp + 0x40]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
lea r9, [rbp]
mov rcx, rbx
lea r8, [rbp + 0x10]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140002da8
mov rax, qword [rbp + 0x10]
lea r9, [0x140008080]
mov ecx, r14d
movzx edx, word [rax]
mov rax, r9
cmp dx, word [rax]
je 0x140002d90
inc ecx
add rax, 0x10
cmp ecx, 0x27
jb 0x140002d7e
jmp 0x140002da8
mov r8d, ecx
mov edx, 5
add r8, r8
mov rcx, rdi
mov r8, qword [r9 + r8*8 + 8]
call fcn.140001350
lea r9, [rbp]
mov rcx, rbx
lea r8, [rbp + 8]
lea rdx, [0x140008c3c]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140002e35
mov r10, qword [rbp + 8]
mov r9d, dword [r10 + 8]
cmp r9d, 0xffffffff
je 0x140002e11
movzx r8d, word [r10 + 0xe]
mov edx, 0x32
movzx eax, word [r10 + 0xc]
mov rcx, qword [rbp + 0x50]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r8d
lea r8, str._u._u._u._u
movzx r10d, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], r10d
call fcn.140001a2c
mov r10, qword [rbp + 8]
test byte [r10 + 0x1c], 1
lea rax, [0x140009970]
lea r8, [0x140009978]
mov edx, 5
cmovne r8, rax
mov rcx, rsi
call fcn.140001350
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140006960
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140005fc4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x14000d3b8]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
xor ebx, ebx
mov edi, 0x105
mov qword [rsp + 0x38], rbx
mov rsi, rdx
mov dword [rsp + 0x30], edi
mov r14, rcx
test rdx, rdx
jne 0x140006017
mov eax, 0x80070057
jmp 0x1400061ec
mov qword [rcx], rbx
mov qword [rdx], rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
lea r9, [rsp + 0x30]
xor edx, edx
mov rcx, rax
lea r8, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_QueryFullProcessImageNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140006069
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400061ea
lea r9, [rsp + 0x38]
mov edx, edi
lea r8, [rbp + 0x2e0]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
test eax, eax
je 0x14000604a
mov rdx, qword [rsp + 0x38]
lea rcx, str.dllhost.exe
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400061db
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineA]
nop dword [rax + rax]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.msvcrt.dll_strchr]
nop dword [rax + rax]
test rax, rax
je 0x1400061db
add rax, 1
je 0x1400061db
movzx ecx, word [0x14000ad98]
lea rdx, [rsp + 0x40]
movsd xmm0, qword [str._ProcessID]
mov word [rsp + 0x50], cx
mov cl, byte [0x14000ad9a]
mov byte [rsp + 0x52], cl
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rcx
mov rcx, rax
movsd qword [rsp + 0x48], xmm0
call fcn.140005ed4
cmp eax, 1
jl 0x1400061db
mov al, byte [rbp - 0x40]
lea rdi, [rbp - 0x40]
jmp 0x14000613a
lea rcx, [rdi + 1]
cmp al, 0x3a
je 0x140006140
mov al, byte [rcx]
mov rdi, rcx
test al, al
jne 0x14000612d
jmp 0x140006145
mov byte [rdi], bl
mov rdi, rcx
cmp byte [rdi], bl
je 0x140006162
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x40]
call qword [sym.imp.msvcrt.dll__stricmp]
nop dword [rax + rax]
test eax, eax
je 0x140006166
lea rdi, [rbp - 0x40]
mov rcx, rbx
test rdi, rdi
je 0x140006194
mov ecx, 0x28
mov r8, rdi
mov edx, ecx
mov eax, ebx
cmp byte [r8], bl
je 0x140006188
inc r8
sub rdx, 1
jne 0x14000617a
test rdx, rdx
jne 0x140006214
mov rcx, rbx
mov eax, 0x80070057
test eax, eax
js 0x1400061db
lea r9d, [rcx + 1]
mov dword [rsp + 0x28], 0x29
lea rax, [rsp + 0x60]
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
nop dword [rax + rax]
test eax, eax
je 0x1400061db
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140002408
test eax, eax
js 0x1400061ea
mov rcx, qword [rsp + 0x38]
mov rdx, r14
call fcn.140002408
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.140006960
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
sub rcx, rdx
jmp 0x140006199