joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401226a0
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x498], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x450]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x14026dc70]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x14027c3cb]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x240]
mov rcx, r15
mov r9d, 0x1d6
call fcn.1400ee990
xor r12d, r12d
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140123200
lea rcx, [rsp + 0x240]
mov r8d, 0x208
mov dl, 0xaa
call fcn.140189b30
cmp byte [rbx + 0x17], 0
mov rax, rbx
jns 0x14012276c
mov rax, qword [rbx]
jmp 0x14012276c
mov word [rsp + 0x446], 0
jmp 0x14012277f
inc r12
cmp r12, 0x104
je 0x140122754
movzx ecx, word [rax + r12*2]
mov word [rsp + r12*2 + 0x240], cx
test cx, cx
jne 0x140122760
lea rcx, [rsp + 0x240]
call fcn.1400ddc50
lea rcx, [rsp + 0x30]
mov r8d, 0x208
mov dl, 0xaa
call fcn.140189b30
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x1401227aa
mov rax, qword [rdi]
xor ecx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + rcx*2 + 0x30], dx
test dx, dx
je 0x1401227d0
inc rcx
cmp rcx, 0x104
jne 0x1401227ac
mov word [rsp + 0x236], 0
lea rcx, [rsp + 0x30]
call fcn.1400ddc50
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1401227e6
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x1401227f2
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x140122873
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x14012281e
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x140122827
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x140122842
test eax, eax
je 0x140122878
lea rcx, [rsp + 0x450]
call fcn.1400dee50
mov rcx, qword [rsp + 0x498]
xor rcx, rsp
call fcn.1401879f0
mov eax, edi
add rsp, 0x4a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dil, 1
jmp 0x140122842
mov ecx, ebp
call fcn.14000f1c0
cmp eax, 0xfffffffc
jne 0x140122889
call fcn.1401f7f80
mov dword [rsi], eax
xor edi, edi
jmp 0x140122842
Function at 0x1401230d0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x50]
mov qword [r12 + 0x40], rax
movaps xmm0, xmmword [0x14026dc70]
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, str.Read
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x42
call fcn.1400ee990
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call fcn.140123200
mov ebp, 0xffffffff
test r14, r14
js 0x1401231ac
test esi, esi
js 0x1401231ac
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401231da
mov ebp, dword [rsp + 0x2c]
test ebp, ebp
js 0x1401231ed
lea rcx, [rsp + 0x50]
call fcn.1400dee50
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401879f0
mov eax, ebp
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
cmp eax, 0x26
setne bpl
neg ebp
jmp 0x1401231ac
int3
Function at 0x140123900
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x1402b7410]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x140123958
jnp 0x1401239be
ucomisd xmm0, xmm6
jne 0x140123960
jnp 0x1401239ba
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x140275d70]
subpd xmm1, xmmword [0x140275d80]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x14027a8d8]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401879f0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140123992
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1402b7420]
mov ecx, dword [0x1402ac5e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140123ad3
mov eax, dword [0x1402b7430]
mov ecx, dword [0x1402ac5e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140123b0d
rdtsc
mov rbx, rax
mov r14, rdx
xor r12d, r12d
lea r15, [rsp + 0x30]
mov qword [r15], r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r15], r12
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r13, qword [0x1402b7428]
cvtsi2sd xmm1, r13
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x14027a8d0]
ucomisd xmm2, xmm1
ja 0x140123958
shl r14, 0x20
or rbx, r14
sub rbx, qword [0x1402b7418]
movq xmm0, rbx
punpckldq xmm0, xmmword [0x140275d70]
subpd xmm0, xmmword [0x140275d80]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x1402b7410], xmm0
jmp 0x140123958
lea rcx, [0x1402b7420]
call fcn.140184f58
cmp dword [0x1402b7420], 0xffffffff
jne 0x140123a07
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1402b7418], rdx
lea rcx, [0x1402b7420]
call fcn.140184fc0
jmp 0x140123a07
lea rcx, [0x1402b7430]
call fcn.140184f58
cmp dword [0x1402b7430], 0xffffffff
jne 0x140123a2c
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x1402b7428], rax
lea rcx, [0x1402b7430]
call fcn.140184fc0
jmp 0x140123a2c
Function at 0x140123b60
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140123c62
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140123bf0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140123bc7
mov qword [rsi], rdi
call fcn.1400eba00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 0
inc rax
cmp rax, 1
jbe 0x140123c66
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400eba00
mov r14, qword [rsi]
cmp qword [0x1402b7720], 0
je 0x140123c21
mov rcx, qword [0x1402b7720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402ca008]
mov qword [rsi], 0
jmp 0x140123bb5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140123c69
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140123c5c
call qword [0x1402ca008]
mov rcx, rax
xor edx, edx
call fcn.14003b860
jmp 0x140123c02
xor ecx, ecx
mov dl, 1
jmp 0x140123c55
mov byte [rsi + 8], 0
int3
xor ecx, ecx
jmp 0x140123c53
Function at 0x14012f0c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov rsi, rcx
mov r13, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x38], rax
mov rdi, qword [rcx + 0x10]
lea rax, [rdi + r13]
test rdi, rdi
jle 0x14012f125
movdqa xmm0, xmmword [0x140275a10]
movdqa xmm1, xmmword [0x140275a20]
mov rcx, r13
movdqu xmm2, xmmword [rcx]
pxor xmm3, xmm3
pcmpgtb xmm3, xmm2
pand xmm3, xmm0
pxor xmm3, xmm1
movdqu xmmword [rcx], xmm3
add rcx, 0x10
cmp rcx, rax
jb 0x14012f104
mov rcx, qword [r13]
mov r8, qword [r13 + 7]
mov qword [rax + 8], r8
mov qword [rax + 1], rcx
mov byte [r13 + rdi], 0xff
test rdi, rdi
je 0x14012f254
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x28], rax
xor ebp, ebp
movabs r12, 0x9ddfea08eb382d69
mov r15, qword [rsp + 0x38]
jmp 0x14012f1da
mov r9d, 0x10
mov r10, r8
add r10, r9
and r10, rcx
movdqu xmm0, xmmword [rax + r10]
pcmpeqd xmm1, xmm1
pcmpgtb xmm1, xmm0
pmovmskb r11d, xmm1
add r9, 0x10
test r11d, r11d
je 0x14012f170
tzcnt r9d, r11d
add r9, r10
and r9, rcx
mov r10, r9
sub r10, r8
mov r11, rbp
sub r11, r8
xor r11, r10
and r11, rdi
cmp r11, 0xf
ja 0x14012f27e
and dl, 0x7f
mov byte [rax + rbp], dl
lea r8, [rbp - 0xf]
and r8, rcx
and ecx, 0xf
add rcx, r8
mov byte [rax + rcx], dl
inc rbp
add r15, r14
cmp rbp, rdi
je 0x14012f254
cmp byte [r13 + rbp], 0xfe
jne 0x14012f1cf
lea rax, [0x1401830c0]
cmp rbx, rax
jne 0x14012f240
mov rax, qword [r15]
lea rcx, [0x1402759a8]
add rax, rcx
mul r12
xor rdx, rax
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov r9, rdx
shr r9, 7
mov r8, rax
shr r8, 0xc
xor r8, r9
and r8, rcx
movdqu xmm0, xmmword [rax + r8]
pcmpeqd xmm1, xmm1
pcmpgtb xmm1, xmm0
pmovmskb r11d, xmm1
mov r10, r8
test r11d, r11d
jne 0x14012f192
jmp 0x14012f167
mov rcx, rsi
mov rdx, r15
mov rax, rbx
call qword [0x1402ca008]
mov rdx, rax
jmp 0x14012f201
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, rcx
shr rdx, 3
add rdx, qword [rsi + 0x18]
sub rcx, rdx
mov qword [rax - 8], rcx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r10, r9
imul r10, r14
add r10, qword [rsp + 0x38]
and dl, 0x7f
lea r8, [r9 - 0xf]
and r8, rcx
and ecx, 0xf
add rcx, r8
cmp byte [r13 + r9], 0x80
mov byte [rax + r9], dl
mov byte [rax + rcx], dl
mov rcx, rsi
jne 0x14012f2e1
mov rdx, r10
mov r8, r15
mov rax, qword [rsp + 0x28]
call qword [0x1402ca008]
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov r8b, 0x80
mov byte [rax + rbp], r8b
lea rdx, [rbp - 0xf]
and rdx, rcx
and ecx, 0xf
add rcx, rdx
mov byte [rax + rcx], r8b
jmp 0x14012f1cf
mov rdx, qword [rsp + 0x30]
mov r8, r10
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], r10
call qword [0x1402ca008]
mov rcx, rsi
mov rdx, qword [rsp + 0x40]
mov r8, r15
mov rax, qword [rsp + 0x28]
call qword [0x1402ca008]
mov rcx, rsi
mov rdx, r15
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call qword [0x1402ca008]
dec rbp
sub r15, r14
jmp 0x14012f1cf
Function at 0x1401335b0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov dword [rdx], 0
mov r14, qword [rdx + 8]
mov qword [rdx + 8], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1401335e3
call fcn.1400eba00
cmp qword [rsi + 8], r14
je 0x140133615
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140133624
cmp r15, 2
jb 0x14013360d
mov qword [rsi + 8], r14
call fcn.1400eba00
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400eba00
mov rbx, qword [rsi + 8]
cmp qword [0x1402b7720], 0
je 0x140133657
mov rcx, qword [0x1402b7720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402ca008]
mov qword [rsi + 8], 0
jmp 0x1401335fe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140133698
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140133692
call qword [0x1402ca008]
mov rcx, rax
xor edx, edx
call fcn.14003b860
jmp 0x140133637
xor ecx, ecx
mov dl, 1
jmp 0x14013368b
xor ecx, ecx
jmp 0x140133689

Function at 0x1401336a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov dword [rcx], 1
xor eax, eax
mov qword [rcx + 8], rax
mov r15, qword [rdx]
mov qword [rdx], rax
lea r12, [r15 + 1]
cmp r12, 2
jb 0x1401336d4
call fcn.1400eba00
cmp qword [rsi + 8], r15
je 0x140133706
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140133727
cmp r12, 2
jb 0x1401336fe
mov qword [rsi + 8], r15
call fcn.1400eba00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14013379b
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400eba00
mov r14, qword [rsi + 8]
cmp qword [0x1402b7720], 0
je 0x14013375a
mov rcx, qword [0x1402b7720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402ca008]
mov qword [rsi + 8], 0
jmp 0x1401336ef
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401337b4
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140133795
call qword [0x1402ca008]
mov rcx, rax
xor edx, edx
call fcn.14003b860
jmp 0x14013373a
xor ecx, ecx
mov dl, 1
jmp 0x14013378e
call fcn.1400eba00
mov rcx, qword [rdi]
call fcn.1401692a0
mov qword [rdi], 0
jmp 0x140133716
xor ecx, ecx
jmp 0x14013378c
Function at 0x1401337c0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x1401337ec
call fcn.1400eba00
cmp qword [rsi], r15
je 0x14013381b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14013383c
cmp r12, 2
jb 0x140133813
mov qword [rsi], r15
call fcn.1400eba00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400eba00
mov r14, qword [rsi]
cmp qword [0x1402b7720], 0
je 0x14013386d
mov rcx, qword [0x1402b7720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402ca008]
mov qword [rsi], 0
jmp 0x140133805
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401338ae
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1401338a8
call qword [0x1402ca008]
mov rcx, rax
xor edx, edx
call fcn.14003b860
jmp 0x14013384e
xor ecx, ecx
mov dl, 1
jmp 0x1401338a1
xor ecx, ecx
jmp 0x14013389f

Function at 0x140133a20
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1402b73a8]
mov ecx, dword [0x1402ac5e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140133a84
mov rax, qword [0x1402b73a0]
mov rsi, qword [rax + 0x58]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401879f0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1402b73a8]
call fcn.140184f58
cmp dword [0x1402b73a8], 0xffffffff
jne 0x140133a5c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140189b30
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140184dc4
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1402b73f0]
mov ecx, dword [0x1402ac5e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140133b44
lea r8, [0x1402b73c0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14002c120
mov qword [0x1402b73a0], rsi
lea rcx, [0x1402b73a8]
call fcn.140184fc0
jmp 0x140133a5c
lea rcx, [0x1402b73f0]
call fcn.140184f58
cmp dword [0x1402b73f0], 0xffffffff
jne 0x140133b15
xorps xmm0, xmm0
movups xmmword [0x1402b73e0], xmm0
movups xmmword [0x1402b73d0], xmm0
movups xmmword [0x1402b73c0], xmm0
lea rcx, [0x1402b73c0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1402b73f0]
call fcn.140184fc0
jmp 0x140133b15
Function at 0x14015bcd0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x14015bcfc
call fcn.1400eba00
mov qword [rsi], 0
test r15, r15
je 0x14015bd36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14015bdf3
cmp r12, 2
jb 0x14015bd2e
mov qword [rsi], r15
call fcn.1400eba00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
cmp byte [rdi + 0x1f], 0
jns 0x14015bd92
mov r14, qword [rdi + 8]
mov rbx, qword [rdi + 0x10]
cmp rbx, 0xa
jbe 0x14015bda6
movabs r15, 0x7fffffffffffffef
cmp rbx, r15
ja 0x14015be6d
mov r12, rbx
or r12, 7
inc r12
js 0x14015be68
lea rcx, [r12 + r12]
call fcn.140184dc4
mov rcx, rax
mov qword [rsi + 8], rax
add r15, 0x11
or r15, r12
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x10], rbx
jmp 0x14015bda9
lea rax, [rdi + 8]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
jmp 0x14015bdd0
mov byte [rsi + 0x1f], bl
cmp rcx, r14
ja 0x14015bdbf
lea rax, [rcx + rbx*2]
add rax, 2
cmp rax, r14
ja 0x14015be72
inc rbx
add rbx, rbx
mov rdx, r14
mov r8, rbx
call fcn.140189480
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400eba00
mov r14, qword [rsi]
cmp qword [0x1402b7720], 0
je 0x14015be27
mov rcx, qword [0x1402b7720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402ca008]
mov qword [rsi], 0
jmp 0x14015bd20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14015be75
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14015be62
call qword [0x1402ca008]
mov rcx, rax
xor edx, edx
call fcn.14003b860
jmp 0x14015be05
xor ecx, ecx
mov dl, 1
jmp 0x14015be5b
call fcn.1401c2f20
call fcn.1401c2f20
int3
xor ecx, ecx
jmp 0x14015be59
Function at 0x14015c450
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 1
xor eax, eax
lock cmpxchg qword [rsi], rcx
sete bl
jne 0x14015c4a3
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401879f0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi]
cmp rax, 1
jne 0x14015c483
movabs r15, 0x8637bd05af7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x20], rax
mov rax, qword [fcn.14014f070]
lea r12, [0x140183600]
cmp rax, r12
jne 0x14015c5ab
lea rdi, [rsp + 0x28]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
cmp rax, r15
jge 0x14015c5ee
imul rax, rax, 0xf4240
cqo
idiv qword [0x1402b7458]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movabs rbp, 0x7fffffffffffffff
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [fcn.14014f070]
cmp rax, r12
jne 0x14015c596
mov qword [rsp + 0x28], 0
mov rcx, rdi
call r13
mov rax, qword [rsp + 0x28]
cmp rax, r15
jge 0x14015c5c7
imul rax, rax, 0xf4240
cqo
idiv qword [0x1402b7458]
mov rcx, qword [rsp + 0x20]
xor edx, edx
cmp rax, rcx
setns dl
add rdx, rbp
sub rax, rcx
cmovo rax, rdx
cmp rax, 0x3e7
jg 0x14015c5bb
xor ecx, ecx
call r14
mov rax, qword [rsi]
cmp rax, 1
je 0x14015c52f
jmp 0x14015c483
lea rcx, [rsp + 0x28]
call qword [0x1402ca008]
lea rax, [rsp + 0x28]
mov rax, qword [rax]
jmp 0x14015c564
lea rcx, [rsp + 0x20]
call qword [0x1402ca008]
jmp 0x14015c512
mov ecx, 0x3e8
call fcn.1401f7470
jmp 0x14015c588
mov rcx, qword [0x1402b7458]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x14015c564
mov rcx, qword [0x1402b7458]
cqo
idiv rcx
imul r8, rax, 0xf4240
imul rax, rdx, 0xf4240
cqo
idiv rcx
add rax, r8
jmp 0x14015c50d