joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
movdqa xmmword [rsp + 0x70], xmm6
mov r14, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ecx, edx
call fcn.14007e5d0
mov ebx, eax
mov rcx, qword [0x14017f8b0]
test rcx, rcx
je 0x14007e44c
mov rax, qword [rcx]
mov rdx, r14
mov r8d, ebx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14007e5a8
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], 0
call fcn.14007e640
add ebx, dword [0x14017f8d8]
mov r15, qword [0x140180d28]
mov eax, ebx
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14007e575
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007e575
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14007e575
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
and ebx, 0xf
je 0x14007e50e
test eax, eax
je 0x14007e50e
mov ecx, eax
mov rax, rdi
add rax, rcx
mov edx, 1
sub edx, ebx
movzx ecx, word [rdi]
lea rdi, [rdi + rcx*2]
add rdi, 2
cmp rdi, rax
setb cl
test edx, edx
je 0x14007e50e
inc edx
cmp rdi, rax
jb 0x14007e4f2
test cl, cl
je 0x14007e575
movzx r8d, word [rdi]
test r8, r8
je 0x14007e575
mov eax, 7
movq xmm6, rax
pslldq xmm6, 8
lea rsi, [rsp + 0x20]
movdqu xmmword [rsi + 0x10], xmm6
add rdi, 2
xor ebx, ebx
mov word [rsi], bx
mov rcx, rsi
mov rdx, rdi
call fcn.140005d40
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400066b0
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
movdqu xmmword [rsi + 0x10], xmm6
mov word [rsi], bx
mov rcx, rsi
call fcn.1400066b0
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rcx]
movaps xmm1, xmmword [rcx + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqa xmmword [rcx + 0x10], xmm0
mov word [rcx], 0
call fcn.1400066b0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14011a370
mov rax, r14
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140080180
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor edi, edi
test eax, eax
je 0x1400801f4
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x1400801f4
mov rcx, rsi
call fcn.140009b30
mov edx, 1
mov r8w, 0x2e
mov rcx, rsi
call fcn.1400162b0
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140009d60
mov dil, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14011a370
mov eax, edi
add rsp, 0x238
pop rdi
pop rsi
ret
Function at 0x140094ab0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea rsi, [rcx + 0x48]
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x140094ade
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rbx, [rdi + 0x40]
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x140094af8
mov qword [rbx], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x20], rbx
lea rcx, [0x14015fcd0]
lea r9, [0x1401584a0]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbx]
test eax, eax
js 0x140094b61
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x90]
test eax, eax
js 0x140094b6f
cmp rdi, r15
je 0x140094b4e
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x140094b43
mov r15, qword [r15]
mov rcx, rdi
mov rdx, r15
call fcn.140005d40
add rdi, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.140028a30
mov al, 1
jmp 0x140094b86
test rcx, rcx
je 0x140094b84
mov qword [rbx], 0
jmp 0x140094b7e
mov rcx, qword [rsi]
test rcx, rcx
je 0x140094b84
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400950e0
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r13, [rsp + 0x58]
mov qword [r13], 0
mov qword [rsp + 0x20], r13
lea rcx, [0x14015fcc0]
lea r9, [0x1401584c0]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400952f9
mov rdi, qword [rsp + 0x58]
mov ebp, 7
cmp qword [rsi + 0x18], rbp
jbe 0x14009515a
mov rsi, qword [rsi]
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov rdx, rsi
call fcn.1400f4750
mov rdx, qword [rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
mov rcx, rbx
call fcn.1400f4770
mov rsi, qword [rsp + 0x58]
cmp qword [r12 + 0x18], rbp
jbe 0x14009518e
mov r12, qword [r12]
movzx ebp, word [rsp + 0xf0]
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov rdx, r12
call fcn.1400f4750
mov rdx, qword [rdi]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
mov rcx, rdi
call fcn.1400f4770
mov rsi, qword [rsp + 0x58]
lea rdx, [r15 + 0x20]
cmp qword [r15 + 0x38], 8
jb 0x1400951cd
mov rdx, qword [rdx]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400f4750
mov rdx, qword [rdi]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x60]
mov rcx, rdi
call fcn.1400f4770
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 0x11
call qword [rax + 0x80]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0xe0]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov dx, 0xffff
call qword [rax + 0x110]
mov rbx, qword [rsp + 0x58]
movzx r8d, bp
lea rdx, [0x1401584d0]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140040de0
cmp qword [rsi + 0x18], 7
mov rdx, rsi
jbe 0x140095252
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400f4750
mov rdx, qword [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x90]
mov rcx, rdi
call fcn.1400f4770
mov rcx, rsi
call fcn.1400066b0
mov rsi, qword [rsp + 0x58]
cmp qword [r15 + 0x18], 8
jb 0x14009528d
mov r15, qword [r15]
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, r15
call fcn.1400f4750
mov rdx, qword [rdi]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + pe_nt_image_headers64]
mov rcx, rdi
call fcn.1400f4770
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 0x7fffffff
call qword [rax + 0x130]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x150]
mov qword [r14], 0
cmp r13, r14
je 0x140095300
mov rax, qword [rsp + 0x58]
mov qword [r14], rax
mov qword [rsp + 0x58], 0
jmp 0x140095319
mov qword [r14], 0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140095319
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14011a370
mov rax, r14
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140096000
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, rdx
mov r15d, ecx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x14015fcf0]
lea r9, [0x140158678]
xor edi, edi
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140096124
xor ebx, ebx
lea rbp, [rsp + 0x50]
mov qword [rbp], rbx
mov rdi, qword [rsp + 0x58]
lea rdx, [0x140158688]
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1400f4750
mov rdx, qword [rsi]
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbp
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor r8d, r8d
xor r9d, r9d
mov rcx, rdi
call qword [rax + 0x18]
mov edi, eax
mov rcx, rsi
call fcn.1400f4770
test edi, edi
js 0x140096109
test r15b, r15b
je 0x1400960f3
mov rcx, qword [rsp + 0x50]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140096109
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov qword [r14], rax
mov dil, 1
jmp 0x140096124
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140096122
mov qword [rsp + 0x50], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edi, edi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14009613d
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011a370
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140099f30
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
mfence
mov rax, qword [0x14017f9a8]
test rax, rax
jne 0x140099f7a
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mfence
mov rax, qword [0x14017f9a8]
test rax, rax
je 0x140099f64
cmp eax, 2
jne 0x140099fc2
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009a054
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x82
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x14009a047
mov eax, 1
lock xadd qword [0x14017f9e0], rax
test rax, rax
jle 0x140099fe2
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14017f960], eax
mov qword [0x14017f958], rsi
mov rcx, qword [0x14017b780]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009a054
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0xae
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
call fcn.140002bb0
mov rcx, rsi
call fcn.14002c830
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14011a370
xor eax, eax
add rsp, 0x138
pop rdi
pop rsi
ret
Function at 0x14009a700
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x14009a729
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14009a817
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14009a76b
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a370
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp fcn.14009a840
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009a815
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x239
mov r9d, 2
mov rcx, rdi
call fcn.14002d860
lea rcx, [rsp + 0x48]
lea rdx, str.CreateDirectory
call fcn.140002bb0
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14009a7c7
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140040560
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14009a7fd
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009960
mov rcx, rsi
call fcn.1400064a0
mov rcx, rdi
call fcn.14002d9a0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a370
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x14009a840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14009a869
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009a938
mov dil, 1
test al, 0x10
jne 0x14009a9e4
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009a9e2
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x48]
mov r8d, 0x227
mov r9d, 2
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x50]
lea rdx, str.GetFileAttributes
call fcn.140002bb0
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14009a8d6
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140040560
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14009a90c
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009960
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140002bb0
mov rcx, rsi
call fcn.1400064a0
mov rcx, rdi
call fcn.14002c830
jmp 0x14009a9e2
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009a9e2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x48]
mov r8d, 0x223
mov r9d, 2
mov rcx, rdi
call fcn.14002d860
lea rcx, [rsp + 0x58]
lea rdx, str.GetFileAttributes
call fcn.140002bb0
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14009a994
mov rax, qword [rsi]
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140040560
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14009a9ca
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009960
mov rcx, rsi
call fcn.1400064a0
mov rcx, rdi
call fcn.14002d9a0
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14011a370
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x14009ce70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x70]
cmp eax, edx
jne 0x14009ce88
cmp qword [rcx + 0x28], 7
jbe 0x14009ce98
mov rcx, qword [rcx + 0x10]
jmp 0x14009ce9c
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
add eax, 1
jmp 0x14009ceb5
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x14009e900
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x60], rax
test dl, dl
je 0x14009e95b
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x14009e95b
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov dword [rax], 0x18
lea rcx, [0x140158fd8]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
jmp 0x14009e95d
xor eax, eax
movzx edx, bl
shl edx, 0x13
or edx, 3
cmp qword [rsi + 0x18], 7
jbe 0x14009e970
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rax
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov r8d, 6
mov r9d, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011a370
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14009e9c0
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x140
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x138], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14009ea93
and eax, 0xfeff
cmp eax, 6
je 0x14009ea93
mov eax, dword [0x14017f9f8]
mov ecx, dword [0x1401800d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x14009eaba
xor edx, edx
mov r8d, 0x10000000
mov rcx, rsi
call qword [0x14017f9f0]
mov sil, 1
test eax, eax
jne 0x14009ea9f
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009ea8f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x21
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x38]
lea rdx, str.InitializeCriticalSectionEx
call fcn.140002bb0
mov rcx, rsi
call fcn.14002d9a0
xor esi, esi
jmp 0x14009ea9f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14011a370
mov eax, esi
add rsp, 0x140
pop rsi
ret
lea rcx, [0x14017f9f8]
call fcn.14011a5a0
mov eax, dword [0x14017f9f8]
cmp eax, 0xffffffff
jne 0x14009ea27
lea rcx, [0x14014ae76]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.14009f040
mov qword [0x14017f9f0], rax
lea rcx, [0x14017f9f8]
call fcn.14011a540
jmp 0x14009ea27
Function at 0x14009f850
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x14017fa08]
mov ecx, dword [0x1401800d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x14009fa8a
mov rax, qword [0x14017fa00]
test rax, rax
je 0x14009f91e
lea rdx, [rsp + 0x34]
mov rcx, rdi
call rax
test eax, eax
je 0x14009f8ce
cmp dword [rsp + 0x34], 0
setne byte [rsi + 0x89]
je 0x14009f925
mov byte [rsi + 0x88], 0
mov dl, 1
jmp 0x14009f94a
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009f91e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rbx, [rsp + 0x38]
mov r8d, 0x4b
mov r9d, 2
mov rcx, rbx
call fcn.14002d860
lea rcx, [rsp + 0x48]
lea rdx, [0x14014fd3c]
call fcn.140002bb0
mov rcx, rbx
call fcn.14002d9a0
mov byte [rsi + 0x89], 0
lea rbx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rbx]
cmp eax, 9
sete byte [rsi + 0x88]
cmp byte [rsi + 0x89], 0
setne dl
lea rax, [rsi + 0x38]
lea r9, [rsi + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.14009fae0
test al, al
je 0x14009f980
cmp byte [rsi + 0x88], 0
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
mov r8, rsi
je 0x14009f9c3
call fcn.14009fcd0
jmp 0x14009f9c8
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009fa6b
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x218
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
jmp 0x14009fa5e
call fcn.1400a0250
test al, al
je 0x14009fa24
mov dl, byte [rsi + 0x88]
mov rcx, rdi
mov r8, rsi
call fcn.14009f0b0
mov sil, 1
test al, al
jne 0x14009fa6d
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009fa6b
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x226
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
jmp 0x14009fa5e
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14009fa6b
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x221
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
call fcn.140002bb0
mov rcx, rsi
call fcn.14002c830
xor esi, esi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14011a370
mov eax, esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14017fa08]
call fcn.14011a5a0
mov eax, dword [0x14017fa08]
cmp eax, 0xffffffff
jne 0x14009f89b
lea rcx, [0x14014ae76]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14009f040
mov qword [0x14017fa00], rax
lea rcx, [0x14017fa08]
call fcn.14011a540
jmp 0x14009f89b
Function at 0x1400a2610
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14017b818]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0xc]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a26a2
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rbp - 0xc]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0xc]
test eax, eax
jne 0x1400a26b6
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400a26db
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400a2674
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400a26bd
cmp eax, 0xffffffff
je 0x1400a26e0
mov esi, eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
call fcn.14011a370
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp - 0xc]
jmp 0x1400a26bb
int3

Function at 0x1400a2d00
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rdi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400a2c40
test rax, rax
jne 0x1400a2d91
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400a2d91
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x1400a2d8f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov r8d, 0xf3
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0x40]
lea rdx, [0x140159c59]
call fcn.140002bb0
mov rcx, rsi
call fcn.14002d9a0
xor esi, esi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14011a370
mov eax, esi
add rsp, 0x148
pop rdi
pop rsi
ret