joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024500
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push rbx
push r12
push r13
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x68], rax
xor r13d, r13d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x28], rdx
mov ebx, r13d
mov dword [rsp + 0x20], ebx
mov r12, r8
mov qword [rsp + 0x20], 0xffffffffffffffff
cmp rdx, 0xffffffffffffffff
jne 0x1400245f6
lea r8d, [rdx + 2]
mov r9b, 1
lea rdx, [rsp + 0x30]
call fcn.140023c80
lea rcx, [rsp + 0x20]
mov r15, qword [rax]
mov qword [rsp + 0x28], r15
mov qword [rax], 0xffffffffffffffff
call fcn.140024760
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], r15
call fcn.140024760
mov r9b, 1
mov r8, r12
mov rdx, r15
call fcn.1400240b0
test al, al
je 0x14002459f
mov bl, 1
jmp 0x140024731
cmp r15, 0xffffffffffffffff
jne 0x1400245f6
lea rcx, [rsp + 0x40]
call fcn.140006da0
lea rax, str..._.._client_settings.cc
mov qword [rbp + 0x30], r13
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x38], 0x18a
mov dword [rbp + 0x3c], 2
call fcn.140013280
lea rdx, str.Invalid_file_handle
lea rcx, [rsp + 0x40]
call fcn.140006680
lea rcx, [rsp + 0x40]
call fcn.140012fd0
jmp 0x140024731
mov qword [rsp + 0x1c8], rsi
lea r15, str..._.._third_party_mini_chromium_mini_chromium_base_rand_util.cc
mov qword [rsp + 0x178], rdi
xorps xmm0, xmm0
mov qword [rsp + 0x170], r14
mov edi, 0x10
lea r14, [rbp + 0x58]
mov dword [rbp + 0x40], 0x43506473
mov qword [rbp + 0x44], 1
mov r12d, 0xffffffff
mov dword [rbp + 0x4c], r13d
mov qword [rbp + 0x50], r13
movups xmmword [rbp + 0x58], xmm0
cmp rdi, r12
mov esi, edi
mov rcx, r14
cmova esi, r12d
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x1400246a7
lea rcx, [rsp + 0x40]
or ebx, 2
call fcn.140006da0
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r13
mov dword [rbp + 0x38], 0x7d
mov dword [rbp + 0x3c], 4
call fcn.140013280
lea rdx, str.Check_failed:_success
lea rcx, [rsp + 0x40]
call fcn.140006680
mov rcx, rax
lea rdx, [0x1400c20f0]
call fcn.140006680
test bl, 2
je 0x1400246b9
and ebx, 0xfffffffd
lea rcx, [rsp + 0x40]
call fcn.140012fd0
mov eax, esi
add r14, rax
sub rdi, rax
jne 0x140024642
movzx eax, word [rbp + 0x5e]
lea r8, [rbp + 0x40]
mov r15, qword [rsp + 0x28]
mov ecx, 0xfff
mov r14, qword [rsp + 0x170]
and ax, cx
mov rdi, qword [rsp + 0x178]
mov ecx, 0x4000
mov rsi, qword [rsp + 0x1c8]
or ax, cx
mov word [rbp + 0x5e], ax
mov rdx, r15
movzx eax, byte [rbp + 0x60]
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x60], al
call fcn.140024360
mov r12, qword [rsp + 0x38]
test al, al
jne 0x140024720
xor bl, bl
jmp 0x140024731
mov r9b, 1
mov r8, r12
mov rdx, r15
call fcn.1400240b0
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.140024760
movzx eax, bl
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.1400809d0
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret
Function at 0x1400310d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x4c]
mov dword [rbp - 0x4c], 0xa
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rax, [rbp - 0x20]
mov r15, r8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CurrentBuildNumber
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400312b7
cmp dword [rbp - 0x50], 1
jne 0x1400312b7
mov eax, dword [rbp - 0x4c]
cmp rax, 0xb
jae 0x1400312dc
xorps xmm0, xmm0
mov byte [rbp + rax - 0x20], 0
xor r14d, r14d
lea rax, [rbp - 0x20]
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], r14b
jne 0x140031161
movabs rsi, 0x7fffffffffffffff
cmp rdi, rsi
ja 0x1400312e2
mov qword [rbp - 0x28], 0xf
cmp rdi, 0x10
jae 0x1400311a6
mov r8, rdi
mov qword [rbp - 0x30], rdi
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.140082e70
mov byte [rbp + rdi - 0x40], r14b
jmp 0x1400311f0
mov rax, rdi
or rax, 0xf
cmp rax, rsi
ja 0x1400311c1
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x40]
call fcn.140006270
mov r8, rdi
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x30], rdi
mov rcx, rax
mov qword [rbp - 0x28], rsi
mov rbx, rax
call fcn.140082e70
mov byte [rbx + rdi], r14b
cmp qword [rbp - 0x30], r14
je 0x14003126c
cmp qword [rbp - 0x28], 0x10
lea rax, [rbp - 0x40]
cmovae rax, qword [rbp - 0x40]
movsx ecx, byte [rax]
call fcn.140097390
test eax, eax
jne 0x14003126c
call fcn.140090c80
lea rcx, [rbp - 0x40]
mov dword [rax], r14d
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
cmp byte [rcx], 0x2d
jne 0x140031231
mov qword [rbp - 0x48], rcx
jmp 0x140031240
xor r8d, r8d
lea rdx, [rbp - 0x48]
call fcn.140097008
mov r14d, eax
call fcn.140090c80
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x40]
cmp dword [rax], 0x22
je 0x140031274
cmp rdx, 0x10
lea rcx, [rbp - 0x40]
cmovae rcx, r8
add rcx, qword [rbp - 0x30]
cmp qword [rbp - 0x48], rcx
jne 0x140031274
mov bl, 1
jmp 0x14003127a
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x40]
mov r14d, dword [rbp - 0x50]
xor bl, bl
cmp rdx, 0x10
jb 0x1400312ac
inc rdx
mov rax, r8
cmp rdx, 0x1000
jb 0x1400312a4
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400312e8
mov rcx, r8
call fcn.1400809f0
test bl, bl
je 0x1400312b7
mov dword [r15], r14d
mov al, 1
jmp 0x1400312b9
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400809d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14008129c
int3
call fcn.140001c80
int3
call fcn.140087b78
int3
Function at 0x140031d40
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x150
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov ebx, 0xff
cmp eax, ebx
jbe 0x140031dc7
lea rcx, [rsp + 0x50]
call fcn.140006da0
lea rax, str..._.._snapshot_win_system_snapshot_win.cc
mov qword [rsp + 0x140], 0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x148], 0x10a
mov dword [rsp + 0x14c], 1
call fcn.140013280
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
lea rcx, [rsp + 0x50]
call fcn.140006680
lea rcx, [rsp + 0x50]
call fcn.140012fd0
mov eax, dword [rsp + 0x40]
cmp eax, ebx
movzx ecx, al
cmovbe ebx, ecx
movzx eax, bl
add rsp, 0x150
pop rbx
ret
Function at 0x140031e30
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
lea rcx, [rsp + 0x30]
mov r13, r8
mov r15, rdx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov ebx, 0xff
cmp eax, ebx
jbe 0x140031eca
lea rcx, [rsp + 0x60]
call fcn.140006da0
lea rax, str..._.._snapshot_win_system_snapshot_win.cc
mov qword [rsp + 0x150], rsi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x158], 0x10a
mov dword [rsp + 0x15c], 1
call fcn.140013280
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
lea rcx, [rsp + 0x60]
call fcn.140006680
lea rcx, [rsp + 0x60]
call fcn.140012fd0
mov eax, dword [rsp + 0x50]
cmp eax, ebx
mov qword [rsp + 0x190], rbp
mov rdi, rsi
mov r14, rsi
cmovbe ebx, eax
movzx r12d, bl
mov rbx, rsi
test r12, r12
je 0x140031f5e
lea rax, [r12 + r12*2]
lea rbp, [rax*8]
cmp rbp, 0x1000
jb 0x140031f31
lea rcx, [rbp + 0x27]
cmp rcx, rbp
jbe 0x140032081
call fcn.1400809f8
mov rcx, rax
test rax, rax
je 0x140032087
add rax, 0x27
and rax, 0xffffffffffffffe0
mov rbx, rax
mov qword [rax - 8], rcx
lea rdi, [rax + rbp]
jmp 0x140031f4e
test rbp, rbp
je 0x140031f47
mov rcx, rbp
call fcn.1400809f8
mov rbx, rax
lea rdi, [rax + rbp]
jmp 0x140031f4e
mov rax, rsi
lea rdi, [rsi + rbp]
mov r8, rbp
xor edx, edx
mov rcx, rax
mov r14, rdi
call fcn.140083680
xor edx, edx
lea eax, [r12 + r12*2]
shl eax, 3
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea ecx, [rdx + 0xb]
call qword [sym.imp.POWRPROF.dll_CallNtPowerInformation]
test eax, eax
je 0x140031f86
mov qword [r15], rsi
jmp 0x14003200d
mov rcx, rbx
cmp rbx, rdi
je 0x140031fc9
lea rdx, [rbx + 0x18]
cmp rdx, rdi
je 0x140031fc9
nop word [rax + rax]
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
cmovb rcx, rdx
add rdx, 0x18
cmp rdx, rdi
jne 0x140031fa0
mov eax, dword [rcx + 8]
mov rdx, rbx
imul rcx, rax, 0xf4240
mov qword [r15], rcx
lea rcx, [rbx + 0x18]
jmp 0x140031ff0
mov eax, dword [rbx + 8]
mov rdx, rbx
imul rcx, rax, 0xf4240
mov qword [r15], rcx
cmp rbx, rdi
je 0x140032003
lea rcx, [rbx + 0x18]
cmp rcx, rdi
je 0x140032003
nop word [rax + rax]
mov eax, dword [rcx + 4]
cmp dword [rdx + 4], eax
cmovb rdx, rcx
add rcx, 0x18
cmp rcx, rdi
jne 0x140031ff0
mov eax, dword [rdx + 4]
imul rsi, rax, 0xf4240
mov qword [r13], rsi
test rbx, rbx
je 0x14003205c
sub r14, rbx
movabs rax, 0xaaaaaaaaaaaaaaab
sar r14, 3
imul r14, rax
lea rdx, [r14 + r14*2]
shl rdx, 3
cmp rdx, 0x1000
jb 0x140032054
mov rcx, qword [rbx - 8]
add rdx, 0x27
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140032087
mov rbx, rcx
mov rcx, rbx
call fcn.1400809f0
mov rbp, qword [rsp + 0x190]
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001370
int3
call fcn.140087b78
int3
Function at 0x14003a470
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r15d, r15d
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x38], r15b
je 0x14003a4aa
mov rdx, qword [rcx + 0x28]
jmp 0x14003a4ad
mov edx, dword [rcx + 0x20]
lea r9, [rbp + 0x30]
mov r8d, 0x40
call fcn.14003f6d0
test al, al
jne 0x14003a52c
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x154
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.could_not_read_dos_header_from
lea rcx, [rsp + 0x28]
call fcn.140006680
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14003a510
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140009230
lea rcx, [rsp + 0x28]
call fcn.140012fd0
xor al, al
jmp 0x14003a665
mov eax, 0x5a4d
cmp word [rbp + 0x30], ax
je 0x14003a571
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x15a
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x14003a4f8
mov qword [rsp + 0x1c8], rdi
cmp byte [rbx + 0x38], r15b
je 0x14003a585
mov rax, qword [rbx + 0x28]
jmp 0x14003a588
mov eax, dword [rbx + 0x20]
movsxd rdi, dword [rbp + 0x6c]
mov r9, r14
add rdi, rax
mov r8d, 0x108
mov rdx, rdi
mov rcx, rbx
call fcn.14003f6d0
test al, al
jne 0x14003a5e1
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x162
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14003a622
cmp dword [r14], 0x4550
je 0x14003a653
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x168
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.invalid_signature_in_nt_headers_of
lea rcx, [rsp + 0x28]
call fcn.140006680
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14003a63a
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140009230
lea rcx, [rsp + 0x28]
call fcn.140012fd0
xor al, al
jmp 0x14003a65d
test rsi, rsi
je 0x14003a65b
mov qword [rsi], rdi
mov al, 1
mov rdi, qword [rsp + 0x1c8]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400809d0
add rsp, 0x180
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003a680
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r15d, r15d
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x38], r15b
je 0x14003a6ba
mov rdx, qword [rcx + 0x28]
jmp 0x14003a6bd
mov edx, dword [rcx + 0x20]
lea r9, [rbp + 0x30]
mov r8d, 0x40
call fcn.14003f6d0
test al, al
jne 0x14003a73c
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x154
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.could_not_read_dos_header_from
lea rcx, [rsp + 0x28]
call fcn.140006680
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14003a720
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140009230
lea rcx, [rsp + 0x28]
call fcn.140012fd0
xor al, al
jmp 0x14003a875
mov eax, 0x5a4d
cmp word [rbp + 0x30], ax
je 0x14003a781
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x15a
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x14003a708
mov qword [rsp + 0x1c8], rdi
cmp byte [rbx + 0x38], r15b
je 0x14003a795
mov rax, qword [rbx + 0x28]
jmp 0x14003a798
mov eax, dword [rbx + 0x20]
movsxd rdi, dword [rbp + 0x6c]
mov r9, r14
add rdi, rax
mov r8d, 0xf8
mov rdx, rdi
mov rcx, rbx
call fcn.14003f6d0
test al, al
jne 0x14003a7f1
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x162
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14003a832
cmp dword [r14], 0x4550
je 0x14003a863
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._snapshot_win_pe_image_reader.cc
mov qword [rbp + 0x18], r15
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x168
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.invalid_signature_in_nt_headers_of
lea rcx, [rsp + 0x28]
call fcn.140006680
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14003a84a
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140009230
lea rcx, [rsp + 0x28]
call fcn.140012fd0
xor al, al
jmp 0x14003a86d
test rsi, rsi
je 0x14003a86b
mov qword [rsi], rdi
mov al, 1
mov rdi, qword [rsp + 0x1c8]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400809d0
add rsp, 0x180
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400498a0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x120
cmp dword [0x1400e4d84], 0
mov rdi, rcx
jne 0x140049a40
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140049a40
mov rax, qword [0x1400e4d60]
mov qword [rsp + 0x130], rbx
mov ebx, 1
mov dword [0x1400e4d84], ebx
test rax, rax
je 0x1400498f6
mov rdx, qword [0x1400e4d68]
mov rcx, qword [0x1400e4d58]
call rax
mov rax, qword [0x1400e4df8]
nop
test rax, rax
jne 0x140049918
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400e4df8]
nop
test rax, rax
je 0x140049903
cmp eax, 2
jne 0x14004996e
lea rcx, [rsp + 0x20]
call fcn.140006da0
lea rax, str..._.._client_crashpad_client_win.cc
mov qword [rsp + 0x110], 0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x118], 0xc7
mov dword [rsp + 0x11c], 2
call fcn.140013280
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x140049a05
lock xadd qword [0x1400e4f18], rbx
lea rax, [rbx + 1]
cmp rax, 1
jle 0x14004998e
xor edx, edx
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [0x1400e0c80]
mov dword [0x1400e4e08], eax
mov qword [0x1400e4e00], rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140006da0
lea rax, str..._.._client_crashpad_client_win.cc
mov qword [rsp + 0x110], 0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x118], 0xf3
mov dword [rsp + 0x11c], 2
call fcn.140013280
lea rdx, str.crash_server_did_not_respond__self_terminating
lea rcx, [rsp + 0x20]
call fcn.140006680
lea rcx, [rsp + 0x20]
call fcn.140012fd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x130]
xor eax, eax
add rsp, 0x120
pop rdi
ret
xor eax, eax
add rsp, 0x120
pop rdi
ret
Function at 0x140060760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400607d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400607d8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400607c5
nop
cmp rbx, rcx
jae 0x1400607d8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400607b0
cmp rbx, rcx
jae 0x1400607d8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x1400607da
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14006eb20
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor ebp, ebp
call fcn.140002550
mov rcx, rax
test rax, rax
je 0x14006ebf3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov edx, edi
mov qword [rbx], rax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
test rax, rax
je 0x14006ebdb
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x14006ebfe
mov rax, qword [rbx]
mov edx, 1
mov ecx, dword [rax - 0xc]
sub edx, dword [rax - 8]
sub ecx, edi
or edx, ecx
jge 0x14006eb9f
mov edx, edi
mov rcx, rbx
call fcn.140064340
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14006ebba
mov eax, ebp
jmp 0x14006ebc7
movsxd rdx, dword [rcx - 0xc]
call fcn.1400978c4
test eax, eax
js 0x14006ebfe
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14006ebfe
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002430
int3
mov ecx, 0x80070057
call fcn.140002430
int3
Function at 0x14006eee0
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rcx + 0x50], 0
mov r14, rdx
mov r15, rcx
jne 0x14006f103
xor ebp, ebp
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14006ef63
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rbp
mov qword [r14 + 0x18], 0xf
mov byte [r14], bpl
jmp 0x14006f10f
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x28], 8
mov r9d, 0xc
mov edx, 0x2d1400
mov qword [rsp + 0x20], rax
mov rcx, r12
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x4c], 8
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14006f0fa
mov eax, dword [rsp + 0x4c]
mov rbx, rbp
mov edi, eax
mov rsi, rbp
test eax, eax
je 0x14006f01c
cmp rax, 0x1000
jb 0x14006effc
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x14006f138
call fcn.1400809f8
test rax, rax
je 0x14006f13e
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14006f007
mov rcx, rdi
call fcn.1400809f8
mov rbx, rax
mov r8, rdi
lea rsi, [rbx + rdi]
xor edx, edx
mov rcx, rbx
call fcn.140083680
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rcx, r12
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
mov edx, 0x2d1400
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14006f087
test rbx, rbx
je 0x14006f0fa
sub rsi, rbx
cmp rsi, 0x1000
jb 0x14006f082
mov rcx, qword [rbx - 8]
add rsi, 0x27
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14006f13e
mov rbx, rcx
mov rdx, rsi
jmp 0x14006f0f2
mov eax, dword [rbx + 0x18]
mov rdi, rsi
sub rdi, rbx
cmp rax, rdi
jae 0x14006f0c9
lea rbp, [rbx + rax]
xor r8d, r8d
mov rcx, rbp
mov rdx, rsi
call fcn.14007e880
cmp rax, rsi
je 0x14006f0c9
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r8 + rbp], 0
jne 0x14006f0b3
lea rcx, [r15 + 0x40]
mov rdx, rbp
call fcn.1400062d0
test rbx, rbx
je 0x14006f0fa
cmp rdi, 0x1000
jb 0x14006f0ef
mov rcx, qword [rbx - 8]
add rdi, 0x27
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14006f13e
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.1400809f0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [r15 + 0x40]
mov rcx, r14
call fcn.140005d90
mov rax, r14
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400809d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140001370
int3
call fcn.140087b78
int3
Function at 0x14006f6c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [rcx + 0x1d0], 0
mov rbx, rdx
mov rdi, rcx
je 0x14006f703
lea rdx, [rcx + 0x1c0]
mov rcx, rbx
call fcn.140005d90
jmp 0x14006f89a
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xc0], rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x20]
cmp ecx, 9
ja 0x14006f76a
je 0x14006f75b
test ecx, ecx
je 0x14006f74c
sub ecx, 5
je 0x14006f73d
cmp ecx, 1
jne 0x14006f76f
lea rdx, str.Intel_Itanium_based
lea r8d, [rcx + 0x12]
jmp 0x14006f78b
lea rdx, [0x1400cc018]
mov r8d, 3
jmp 0x14006f78b
lea rdx, [0x1400cc01c]
mov r8d, 3
jmp 0x14006f78b
lea rdx, [0x1400c9628]
mov r8d, 3
jmp 0x14006f78b
cmp ecx, 0xc
je 0x14006f77e
lea rdx, str.unknown
mov r8d, 7
jmp 0x14006f78b
lea rdx, str.arm64
mov r8d, 5
lea rcx, [rdi + 0x1c0]
call fcn.1400062d0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14006f8d0
mov r9d, 1
lea r8, [0x1400c9320]
mov rcx, rax
call fcn.14004c7b0
lea rdx, [rsp + 0x50]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
movq rcx, xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rsp + 0x50], xmm0
mov byte [rax], 0
movdqa xmm0, xmm1
movq r8, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
movups xmmword [rsp + 0x60], xmm1
cmovae rdx, rcx
lea rcx, [rdi + 0x1c0]
call fcn.1400061f0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14006f847
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f842
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f8be
call fcn.1400809f0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x14006f883
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f87e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f8be
call fcn.1400809f0
lea rdx, [rdi + 0x1c0]
mov rcx, rbx
call fcn.140005d90
mov rsi, qword [rsp + 0xc0]
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400809d0
mov rbx, qword [rsp + 0xc8]
add rsp, 0xa0
pop rdi
ret
call fcn.140087b78
int3