joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009ae84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test r8, r8
je 0x14009af9d
mov rdi, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x14009af9d
cmp word [rax + rcx + 0x14], 0x78
jb 0x14009af9d
mov r14, r8
mov r12, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test rax, rax
je 0x14009af9d
cmp r12, 0xffff
ja 0x14009aef3
mov word [r14], r12w
jmp 0x14009afd6
mov rsi, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov edx, dword [rsi + 0x18]
lea rcx, [rdx*4]
test rcx, rcx
je 0x14009af9d
mov qword [rsp + 0x30], rsi
lea rbx, [rax + rdx*4]
lea r13, [r12 + 1]
mov qword [rsp + 0x28], rax
mov rbp, rax
mov rax, rbx
sub rax, rbp
mov rcx, rax
sar rcx, 2
shr rax, 0x3f
add rax, rcx
and rax, 0xfffffffffffffffe
lea r15, [rax*2]
add r15, rbp
mov edx, dword [r15]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov cl, byte [r12]
test cl, cl
je 0x14009af76
mov rdx, r13
cmp cl, byte [rax]
jne 0x14009af78
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14009af66
xor ecx, ecx
movzx ecx, cl
movzx eax, byte [rax]
mov edx, ecx
sub edx, eax
lea rsi, [r15 + 4]
test edx, edx
cmovg rbp, rsi
cmp ecx, eax
cmovs rbx, r15
je 0x14009afb0
xor eax, eax
cmp rbp, rbx
jne 0x14009af2c
jmp 0x14009af9f
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x30]
mov edx, dword [rsi + 0x24]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
sub r15, qword [rsp + 0x28]
sar r15, 1
movzx eax, word [rax + r15]
add ax, word [rsi + 0x10]
mov word [r14], ax
mov al, 1
jmp 0x14009af9f

Function at 0x14009b402
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14009b439
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14009b439
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x14009b439
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x14009e0a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rdi, rcx
mov rcx, r8
call fcn.1400d5d00
test al, al
je 0x14009e223
movsd xmm0, qword [rdi + 0x50]
mov r9b, 1
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x14009e243
movsd xmm0, qword [rdi + 0xad0]
subsd xmm0, qword [rdi + 0xac8]
mov rcx, qword [rdi + 0xac0]
lea rax, [rcx + 1]
shr rax, 3
movabs r10, 0xd20d20d20d20d21
mul r10
shr rdx, 1
imul rax, rdx, 0x138
neg rax
lea r8, [rcx + rax]
add r8, 1
mov rax, 0xffffffff80000000
and rax, qword [rdi + rcx*8 + 0x100]
mov rbx, qword [rdi + r8*8 + 0x100]
mov esi, ebx
and esi, 0x7ffffffe
or rsi, rax
lea rax, [rcx + 0x9c]
shr rax, 3
mul r10
shr rdx, 1
imul rax, rdx, 0x138
neg rax
add rax, rcx
add rax, 0x9c
and ebx, 1
movabs rdx, 0xb5026f5aa96619e9
imul rdx, rbx
xor rdx, qword [rdi + rax*8 + 0x100]
shr rsi, 1
xor rdx, rsi
mov qword [rdi + rcx*8 + 0x100], rdx
mov rax, qword [rdi + 0xac0]
mov rax, qword [rdi + rax*8 + 0x100]
mov rcx, rax
shr rcx, 0x1d
movabs rdx, 0x555555555
and rdx, rcx
xor rdx, rax
mov qword [rdi + 0xac0], r8
mov rax, rdx
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rcx, rax
xor rcx, rdx
mov eax, ecx
and eax, 0x7ffbf77
shl rax, 0x25
xor rax, rcx
mov rcx, rax
shr rcx, 0x2b
xor rcx, rax
movq xmm1, rcx
punpckldq xmm1, xmmword [0x14015f5b0]
subpd xmm1, xmmword [0x14015f5c0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
mulsd xmm2, qword [0x14016d360]
mulsd xmm2, xmm0
addsd xmm2, qword [rdi + 0xac8]
movsd xmm0, qword [rdi + 0x50]
ucomisd xmm0, xmm2
seta r8b
jmp 0x14009e246
cmp dword [rdi + 0x80], 0
jne 0x14009e240
mov rax, qword [rdi + 0xd30]
cmp rax, qword [rdi + 0xd38]
jne 0x14009e0bf
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov edx, r9d
call fcn.1400d8850
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400a3280
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rdi, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
cmp rdi, rax
jne 0x1400a3425
mov r15, qword [r13]
mov rbx, qword [r13 + 8]
mov rcx, rbx
sub rcx, r15
jbe 0x1400a3307
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
add rax, 1
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rbx
sub r15, rax
sub rdi, rbx
je 0x1400a32f3
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.14012f890
mov rbx, qword [r13 + 8]
add rdi, r15
mov qword [r13 + 0x10], rdi
lea rax, [rbx + r12*8]
mov qword [r13 + 8], rax
jmp 0x1400a3425
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov esi, 1
cmovne rsi, rcx
mov rax, rsi
shr rax, 0x3d
jne 0x1400a3440
mov r12, rsi
shr r12, 2
lea rcx, [rsi*8]
call fcn.14012c988
lea r11, [rax + r12*8]
mov r9, r11
lea r8, [rax + rsi*8]
sub rdi, rbx
je 0x1400a33ff
lea r10, [rdi - 8]
mov ecx, r10d
shr ecx, 3
add ecx, 1
and rcx, 7
je 0x1400a3385
neg rcx
mov rdx, r9
nop dword [rax + rax]
mov rsi, qword [rbx]
mov qword [rdx], rsi
add rdx, 8
add rbx, 8
inc rcx
jne 0x1400a3370
jmp 0x1400a3388
mov rdx, r9
add r11, rdi
cmp r10, 0x38
jb 0x1400a33fb
sar rdi, 3
shl r12, 3
lea rdi, [r12 + rdi*8]
mov rcx, rax
add rcx, rdi
nop word cs:[rax + rax]
nop dword [rax]
mov rdi, qword [rbx]
mov qword [rdx], rdi
mov rdi, qword [rbx + 8]
mov qword [rdx + 8], rdi
mov rdi, qword [rbx + 0x10]
mov qword [rdx + 0x10], rdi
mov rdi, qword [rbx + 0x18]
mov qword [rdx + 0x18], rdi
mov rdi, qword [rbx + 0x20]
mov qword [rdx + 0x20], rdi
mov rdi, qword [rbx + 0x28]
mov qword [rdx + 0x28], rdi
mov rdi, qword [rbx + 0x30]
mov qword [rdx + 0x30], rdi
mov rdi, qword [rbx + 0x38]
mov qword [rdx + 0x38], rdi
add rdx, 0x40
add rbx, 0x40
cmp rcx, rdx
jne 0x1400a33b0
mov r15, qword [r13]
mov qword [r13], rax
mov qword [r13 + 8], r9
mov qword [r13 + 0x10], r11
mov qword [r13 + 0x18], r8
test r15, r15
je 0x1400a3422
mov rcx, r15
call fcn.14012c9c4
mov rdi, qword [r13 + 0x10]
jmp 0x1400a3425
mov rdi, r11
mov rax, qword [r14]
mov qword [rdi], rax
add qword [r13 + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14013f8b4
int3
Function at 0x1400a3450
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
cmp rbx, rcx
je 0x1400a3479
mov r12, rbx
jmp 0x1400a35ee
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x1400a34cf
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea rdi, [rax + rcx]
add rdi, 1
sar rdi, 1
lea r12, [r15 + rdi*8]
mov r8, r15
sub r8, rbx
je 0x1400a34be
sub r12, r8
mov rcx, r12
mov rdx, rbx
call fcn.14012f890
mov r15, qword [rsi + 0x10]
mov qword [rsi + 8], r12
lea rax, [r15 + rdi*8]
mov qword [rsi + 0x10], rax
jmp 0x1400a35ee
sub rax, rcx
mov rcx, rax
sar rcx, 2
test rax, rax
mov edi, 1
cmovne rdi, rcx
mov rax, rdi
shr rax, 0x3d
jne 0x1400a360b
lea r13, [rdi + 3]
shr r13, 2
lea rcx, [rdi*8]
call fcn.14012c988
lea r10, [rax + r13*8]
mov r12, r10
lea r8, [rax + rdi*8]
sub r15, rbx
je 0x1400a35ce
lea r9, [r15 - 8]
mov edx, r9d
shr edx, 3
add edx, 1
and rdx, 7
je 0x1400a3555
neg rdx
mov rdi, r12
nop word cs:[rax + rax]
nop
mov rcx, qword [rbx]
mov qword [rdi], rcx
add rdi, 8
add rbx, 8
inc rdx
jne 0x1400a3540
jmp 0x1400a3558
mov rdi, r12
add r10, r15
cmp r9, 0x38
jb 0x1400a35cb
sar r15, 3
shl r13, 3
lea rcx, [r15*8]
add rcx, r13
mov rdx, rax
add rdx, rcx
nop word [rax + rax]
mov rcx, qword [rbx]
mov qword [rdi], rcx
mov rcx, qword [rbx + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rdi + 0x10], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rdi + 0x18], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rdi + 0x20], rcx
mov rcx, qword [rbx + 0x28]
mov qword [rdi + 0x28], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rdi + 0x30], rcx
mov rcx, qword [rbx + 0x38]
mov qword [rdi + 0x38], rcx
add rdi, 0x40
add rbx, 0x40
cmp rdx, rdi
jne 0x1400a3580
mov rbx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
test rbx, rbx
je 0x1400a35ee
mov rcx, rbx
call fcn.14012c9c4
mov r12, qword [rsi + 8]
mov rax, qword [r14]
mov qword [r12 - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14013f8b4
int3
Function at 0x1400c56d6
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [rcx + 0x6c], 0
je 0x1400c585f
mov rsi, rdx
mov rbx, rcx
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
lea rdx, [rcx + 0x60]
mov rcx, rdi
mov r8d, 2
call fcn.1400c5899
mov r13, qword [rdi]
test r13, r13
je 0x1400c5866
mov qword [rsp + 0x28], rbx
cmp dword [r13], 0
je 0x1400c584a
lea r14, [r13 + 8]
mov rax, qword [rsp + 0x28]
add rax, 0x30
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov rbx, qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rbp, r12
shl rbp, 4
test dword [r14 + rbp + 8], 0xc0000020
jne 0x1400c583a
add rbp, r14
test rsi, rsi
je 0x1400c57ec
mov rax, qword [rsi]
cmp qword [rsi + 8], rax
je 0x1400c57ec
mov r15d, 1
xor ecx, ecx
mov rdi, qword [rbp]
mov rdx, rcx
shl rdx, 6
lea rcx, [rdx + rcx*4]
add rcx, rax
call fcn.140007b30
mov rcx, rax
mov rdx, rdi
call rbx
test eax, eax
jne 0x1400c583a
mov ecx, r15d
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, rax
sar rdx, 2
movabs rdi, 0xf0f0f0f0f0f0f0f1
imul rdx, rdi
inc r15d
cmp rdx, rcx
ja 0x1400c57a2
mov r15, rbx
mov rdx, qword [rbp]
lea rbx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400c62d0
mov rbp, qword [rsp + 0x28]
mov rdi, qword [rbp + 0x38]
cmp rdi, qword [rbp + 0x40]
jae 0x1400c582a
mov r8d, 0x44
mov rcx, rdi
mov rdx, rbx
call fcn.14012f890
add rdi, 0x44
mov qword [rbp + 0x38], rdi
jmp 0x1400c5837
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call fcn.140094afe
mov rbx, r15
inc r12
mov eax, dword [r13]
cmp r12, rax
jb 0x1400c5773
mov qword [rsp + 0x38], 0
mov rcx, r13
call fcn.14012ca04
xor esi, esi
jmp 0x1400c5873
mov esi, 0x3f0
jmp 0x1400c5873
mov esi, dword [rsp + 0x44]
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14012cde0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400d1690
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 8]
jmp 0x1400d16a7
mov rsi, qword [rsi + 0x218]
test rsi, rsi
je 0x1400d16db
xor edi, edi
xchg qword [rsi], rdi
test rdi, rdi
je 0x1400d16a0
nop word cs:[rax + rax]
bsf rcx, rdi
mov ebx, 1
shl rbx, cl
mov rcx, qword [rsi + rcx*8 + 0x10]
call qword [rcx + 8]
xor rdi, rbx
jne 0x1400d16c0
jmp 0x1400d16a0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140106304
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret
Function at 0x14010bd5a
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [section..rdata]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.14010c808
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.1401172da
test al, al
je 0x14010be28
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14010be71
mov rcx, rdi
call fcn.14010c808
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.1401172da
test al, al
je 0x14010beba
cmp dword [r15], 0x4550
jne 0x14010befd
mov sil, 1
test r14, r14
je 0x14010bf71
mov qword [r14], rdi
jmp 0x14010bf71
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010bf6f
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x14010bf3d
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010bf6f
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14010bf3d
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010bf6f
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14010be66
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010bf6f
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
call fcn.140001e21
movzx r8d, byte [rsi]
test r8b, 1
je 0x14010bf56
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x14010bf5c
shr r8, 1
inc rsi
mov rcx, rax
mov rdx, rsi
call fcn.140001e21
mov rcx, rdi
call fcn.14002cae0
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14012cde0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14010bf92
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x1401ac698]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [section..rdata]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.14010c808
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.1401172da
test al, al
je 0x14010c060
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14010c0a9
mov rcx, rdi
call fcn.14010c808
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.1401172da
test al, al
je 0x14010c0f2
cmp dword [r15], 0x4550
jne 0x14010c135
mov sil, 1
test r14, r14
je 0x14010c1a9
mov qword [r14], rdi
jmp 0x14010c1a9
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010c1a7
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x14010c175
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010c1a7
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14010c175
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010c1a7
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14010c09e
mov ecx, 1
call fcn.14002c580
test al, al
je 0x14010c1a7
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14002c620
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
call fcn.140001e21
movzx r8d, byte [rsi]
test r8b, 1
je 0x14010c18e
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x14010c194
shr r8, 1
inc rsi
mov rcx, rax
mov rdx, rsi
call fcn.140001e21
mov rcx, rdi
call fcn.14002cae0
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14012cde0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14010edb0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx + 0x48], 0x1003f
mov eax, dword [rdx + 0x234]
mov dword [rcx + 0x4c], eax
mov eax, dword [rdx + 0x238]
mov dword [rcx + 0x50], eax
mov eax, dword [rdx + 0x23c]
mov dword [rcx + 0x54], eax
mov eax, dword [rdx + 0x240]
mov dword [rcx + 0x58], eax
mov eax, dword [rdx + 0x24c]
mov dword [rcx + 0x5c], eax
mov eax, dword [rdx + 0x250]
mov dword [rcx + 0x60], eax
lea rdx, [rcx + 0x64]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.1400e96d0
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0xd4], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0xd8], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0xdc], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0xe0], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0xe4], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0xe8], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0xec], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0xf0], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0xf4], eax
mov eax, dword [rdi]
mov dword [rsi + 0xf8], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0xfc], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x100], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x104], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x108], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x110], eax
add rsi, 0x114
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14012f890

Function at 0x14013a638
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14013a768
Function at 0x1400060b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400060e4
mov eax, esi
lea ecx, [rax - 0x24]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400060d0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140005920
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140006109
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001a880
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140006183
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000617e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000617e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071568
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140006190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400061c4
mov eax, esi
lea ecx, [rax - 0x24]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400061b0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140005920
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400061e9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001a880
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140006263
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000625e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000625e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071568
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006270
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400062a4
mov eax, esi
lea ecx, [rax - 0x24]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140006290
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140005920
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400062c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001a880
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140006343
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000633e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000633e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071568
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140006350
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140006384
mov eax, esi
lea ecx, [rax - 0x24]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140006370
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140005920
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400063a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001a880
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140006423
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000641e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000641e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071568
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000f540
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14000f563
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14000f550
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140005920
mov rax, rbx
add rsp, 0x30
pop rbx
ret