joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082f80
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
call fcn.14008ca10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14008cb90
mov rax, qword [rsp + 0x20]
bswap rax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140111850
add rsp, 0xa8
ret

Function at 0x140083d80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
sub rcx, r9
sar rcx, 2
test rcx, rcx
je 0x140083e07
mov r10, rcx
lea r11, [0x1401513a0]
nop dword [rax]
mov eax, dword [r9]
lea r9, [r9 + 4]
movzx r8d, cl
shr ecx, 8
movzx edx, al
xor r8, rdx
mov dword [rsp + 8], eax
movzx eax, byte [rsp + 9]
mov edx, dword [r11 + r8*4]
xor edx, ecx
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xa]
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
mov edx, dword [r11 + rcx*4]
xor edx, r8d
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r11 + rcx*4]
xor eax, edx
mov ecx, eax
sub r10, 1
jne 0x140083da0
ret
mov eax, ecx
ret
Function at 0x1400a4ecc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, edx
mov rdi, rcx
cmp edx, 0x675
je 0x1400a4f31
cmp edx, 0x749
je 0x1400a4f28
cmp edx, 0x81d
je 0x1400a4f1f
cmp edx, 0xb38
jne 0x1400a4f4f
lea r8, [0x140154b88]
jmp 0x1400a4f38
lea r8, [0x140154b68]
jmp 0x1400a4f38
lea r8, [0x140154b58]
jmp 0x1400a4f38
lea r8, [0x140154b78]
mov rax, qword [0x14017c010]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
movsxd rcx, dword [rdx + 8]
mov ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14017c280]
xor r12d, r12d
test rcx, rcx
je 0x1400a4f70
mov r9, qword [rcx]
mov r8d, ebx
mov rdx, rdi
call qword [r9 + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400a5081
mov r13d, 7
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r13
mov word [rbp - 0x50], r12w
call fcn.1400a4e6c
mov r14, qword [0x140177888]
lea r8d, [r13 - 1]
mov rcx, r14
mov esi, dword [rax + 0x20]
add esi, ebx
mov eax, esi
shr eax, 4
inc ax
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x1400a505b
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a505b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400a505b
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and esi, 0xf
jbe 0x1400a5009
cmp rbx, rcx
jae 0x1400a505b
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add esi, 0xffffffff
jne 0x1400a4ff4
cmp rbx, rcx
jae 0x1400a505b
cmp word [rbx], r12w
je 0x1400a505b
movzx r8d, word [rbx]
lea rdx, [rbx + 2]
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
call fcn.140029c40
xor r8d, r8d
lea rcx, [rbp - 0x50]
mov dl, 1
call fcn.140029bc0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140029ff0
xor r8d, r8d
lea rcx, [rbp - 0x30]
mov dl, 1
call fcn.140029bc0
mov qword [rdi + 0x18], r13
lea rdx, [rbp - 0x50]
mov qword [rdi + 0x10], r12
mov rcx, rdi
mov word [rdi], r12w
call fcn.140029ff0
xor r8d, r8d
lea rcx, [rbp - 0x50]
mov dl, 1
call fcn.140029bc0
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a7928
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r13d, r13d
mov rsi, rcx
mov r12, r8
mov dword [rsp + 0x30], r13d
mov rbx, rdx
lea ecx, [r13 + 0x58]
call fcn.140111b94
mov r15, rax
lea rdx, [rsp + 0x38]
lea rax, [0x140162c60]
mov rcx, rbx
mov qword [r15], rax
lea rdi, [r15 + 8]
mov qword [rdi + 0x10], r13
lea eax, [r13 + 7]
mov qword [rdi + 0x18], rax
mov word [rdi], r13w
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x30], r13
mov word [rdi + 0x20], r13w
mov qword [rdi + 0x40], r13
mov qword [rdi + 0x48], r13
mov rax, qword [rbx]
call qword [rax + 0x10]
lea r14, [rdi + 0x48]
mov rbp, rax
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a79c1
mov qword [r14], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rbx, [rdi + 0x40]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400a79d6
mov qword [rbx], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r9, [0x140156558]
lea rcx, [0x14013be40]
lea r8d, [rdx + 0x17]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbx]
test eax, eax
jns 0x1400a7a0f
test rcx, rcx
je 0x1400a7a0a
mov qword [rbx], r13
mov rax, qword [rcx]
call qword [rax + 0x10]
mov bl, r13b
jmp 0x1400a7a5f
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 0x90]
test eax, eax
jns 0x1400a7a2c
mov rcx, qword [r14]
test rcx, rcx
je 0x1400a7a0a
mov qword [r14], r13
jmp 0x1400a7a04
or rbx, 0xffffffffffffffff
cmp rdi, rbp
je 0x1400a7a46
mov r9, rbx
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call fcn.140029d5c
lea rcx, [rdi + 0x20]
cmp rcx, r12
je 0x1400a7a5d
mov r9, rbx
xor r8d, r8d
mov rdx, r12
call fcn.140029d5c
mov bl, 1
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov dl, 1
call fcn.140029bc0
test bl, bl
je 0x1400a7a77
mov qword [rsi], r15
jmp 0x1400a7a87
mov qword [rsi], r13
mov edx, 1
mov rax, qword [r15]
mov rcx, r15
call qword [rax]
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a7c70
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x130
xor ebx, ebx
mov rax, rdx
mov dword [rsp + 0x140], ebx
cmp qword [rcx + 0x10], rbx
jne 0x1400a7ca1
mov rcx, qword [rax]
lea rdx, [0x140152914]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400a7cbd
cmp qword [rcx + 0x18], 8
jb 0x1400a7cab
mov rcx, qword [rcx]
mov r8, rcx
lea rdx, [0x140152914]
mov rcx, rax
call fcn.14005dd00
mov edi, eax
test eax, eax
je 0x1400a7d1b
mov r9d, 2
cmp dword [0x14017c080], r9d
jg 0x1400a7d08
mov r8d, 0xae
lea rdx, str..._.._chrome_installer_util_channel_info.cc
lea rcx, [rsp + 0x20]
call fcn.1400681c0
lea rdx, str.Failed_writing_channel_info__result:
lea rcx, [rax + 8]
call fcn.14002bcb4
mov rcx, rax
mov edx, edi
call fcn.140028ef4
mov ebx, 1
test bl, 1
je 0x1400a7d17
lea rcx, [rsp + 0x20]
call fcn.140068220
xor al, al
jmp 0x1400a7d1d
mov al, 1
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x1400b2b0c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x38], 0
lea rax, [rbp + 0x38]
mov r14, rdx
mov qword [rsp + 0x20], rax
mov esi, 1
lea r9, [0x1401567a0]
mov r8d, esi
lea rcx, [0x14013be60]
xor edx, edx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400b2b5c
xor sil, sil
jmp 0x1400b2c0b
and qword [rbp + 0x30], 0
lea rcx, str.ROOTCIMV2
mov rdi, qword [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov rbx, rax
and qword [rsp + 0x38], 0
xor r8d, r8d
and qword [rsp + 0x30], 0
mov rdx, rbx
mov rax, qword [rdi]
mov rcx, rdi
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [rax + 0x18]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x1400b2bf4
and dword [rsp + 0x38], 0
mov eax, 3
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea edx, [rax + 7]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1400b2bf4
mov rax, qword [rbp + 0x30]
xor ecx, ecx
mov qword [rbp + 0x30], rcx
mov qword [r14], rax
jmp 0x1400b2bfb
mov rcx, qword [rbp + 0x30]
xor sil, sil
test rcx, rcx
je 0x1400b2c0b
and qword [rbp + 0x30], 0
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400b2c1f
and qword [rbp + 0x38], 0
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rbx, qword [rsp + 0x70]
mov al, sil
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x1400b53c0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rsi, rcx
mov ecx, 0x78
call fcn.140111b94
mov rdi, rax
xor edx, edx
lea rax, [0x140162f48]
lea r8d, [rdx + 0x70]
mov qword [rdi], rax
lea rcx, [rdi + 8]
call fcn.140113400
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov dword [rdi + 8], 0x6a09e667
mov dword [rdi + 0xc], 0xbb67ae85
mov dword [rdi + 0x10], 0x3c6ef372
mov dword [rdi + 0x14], 0xa54ff53a
mov dword [rdi + 0x18], 0x510e527f
mov dword [rdi + 0x1c], 0x9b05688c
mov dword [rdi + 0x20], 0x1f83d9ab
mov dword [rdi + 0x24], 0x5be0cd19
mov dword [rdi + 0x74], 0x20
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c1094
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x10
lea r10, [0x14017c680]
xor ebx, ebx
mov r8, r10
mov edx, ebx
mov r9d, 8
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
dec ecx
not ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9, 1
jne 0x1400c10ae
mov dword [r8], edx
inc ebx
add r8, 4
cmp ebx, 0x100
jb 0x1400c10a6
mov r9d, 0x800
cmp ebx, r9d
jae 0x1400c110f
lea r8, [r10 + rbx*4]
lea eax, [rbx - 0x100]
inc ebx
mov edx, dword [r10 + rax*4]
movzx ecx, dl
shr edx, 8
mov eax, dword [r10 + rcx*4]
xor eax, edx
mov dword [r8], eax
lea r8, [r8 + 4]
cmp ebx, r9d
jb 0x1400c10eb
xor ecx, ecx
lea rax, [0x1400c3d20]
mov qword [0x14017e680], rax
mov r11d, 0xf00
xor eax, eax
cpuid
mov r8d, ebx
mov r9d, ecx
mov r10d, edx
xor ecx, ecx
mov eax, 1
cpuid
mov ebx, eax
mov ecx, eax
shr ebx, 8
and eax, 0xf0
mov edx, ebx
and ecx, r11d
and edx, 0xff000
and ebx, r11d
or ebx, eax
or edx, ecx
shr edx, 8
lea rax, [0x140159318]
shr ebx, 4
xor ecx, ecx
cmp dword [rax - 8], r8d
jne 0x1400c1179
cmp dword [rax - 4], r10d
jne 0x1400c1179
cmp dword [rax], r9d
je 0x1400c1187
inc ecx
add rax, 0xc
cmp ecx, 3
jb 0x1400c1168
or ecx, 0xffffffff
test ecx, ecx
je 0x1400c11b4
sub ecx, 1
je 0x1400c11a1
cmp ecx, 1
jne 0x1400c11de
cmp edx, 6
jb 0x1400c11de
jne 0x1400c11d0
cmp ebx, 0xf
jmp 0x1400c11ce
cmp edx, 5
jb 0x1400c11de
jne 0x1400c11d0
cmp ebx, 6
jb 0x1400c11de
cmp ebx, 0xa
je 0x1400c11de
jmp 0x1400c11d0
cmp edx, 6
jb 0x1400c11de
jne 0x1400c11d0
cmp ebx, 0x36
ja 0x1400c11d0
movabs rcx, 0x6000c010000000
bt rcx, rbx
jb 0x1400c11de
lea rax, [0x1400c3e00]
mov qword [0x14017e680], rax
add rsp, 0x10
pop rbx
ret
Function at 0x1400c7140
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x248], ebx
jmp 0x1400c7166
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lock or dword [rsp], ebx
mov rax, qword [0x14017a928]
test rax, rax
je 0x1400c715b
cmp eax, 2
jne 0x1400c71c5
cmp dword [0x14017c080], eax
jg 0x1400c71b2
mov r9d, eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
mov r8d, 0x82
lea rcx, [rsp + 0x20]
call fcn.1400681c0
lea rdx, str.crash_server_failed_to_launch__self_terminating
lea rcx, [rax + 8]
call fcn.14002bcb4
mov ebx, 1
test bl, 1
je 0x1400c7262
lea rcx, [rsp + 0x20]
jmp 0x1400c725d
mov eax, 1
lock xadd qword [0x14017c568], rax
inc rax
cmp rax, 1
jle 0x1400c71e7
xor edx, edx
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [0x140175d30]
mov dword [0x14017a920], eax
mov qword [0x14017a918], rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14017c080], 2
jg 0x1400c7250
mov r9d, 2
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
mov r8d, 0xae
lea rcx, [rsp + 0x128]
call fcn.1400681c0
lea rdx, str.crash_server_did_not_respond__self_terminating
lea rcx, [rax + 8]
call fcn.14002bcb4
mov ebx, 2
test bl, 2
je 0x1400c7262
lea rcx, [rsp + 0x128]
call fcn.140068220
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x240]
xor eax, eax
add rsp, 0x230
pop rdi
ret
Function at 0x1400c867c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
cmp ecx, 6
jb 0x1400c869f
jne 0x1400c8698
shr ax, 8
cmp al, 1
jbe 0x1400c869f
call fcn.1400fc6f4
jmp 0x1400c86ac
lea rcx, [0x14017a930]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 8
call fcn.140111b94
mov qword [0x14017a968], rax
and qword [rax], 0
add rsp, 0x28
ret

Function at 0x1400c96b8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x250
xor ebx, ebx
lea r8, [rax + 0x18]
mov rsi, rdx
mov dword [rsp + 0x270], ebx
mov edx, ebx
xor r9d, r9d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400c9754
lea edi, [rbx + 2]
cmp dword [0x14017c080], edi
jg 0x1400c972e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0xe9
call fcn.140068d00
lea rdx, [0x14015f198]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, edi
test dil, bl
je 0x1400c973d
lea rcx, [rsp + 0x30]
call fcn.140068d80
xor al, al
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
cmp qword [rsp + 0x270], rbx
jne 0x1400c973d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400c97c2
lea edi, [rax + 2]
cmp dword [0x14017c080], edi
jg 0x1400c97b0
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rcx, [rsp + 0x140]
mov dword [rsp + 0x20], eax
mov r8d, 0xf3
call fcn.140068d00
lea rdx, [0x14015f200]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
test bl, 1
je 0x1400c973d
lea rcx, [rsp + 0x140]
jmp 0x1400c9738
mov r8d, 0x28
mov rdx, rsi
mov rcx, rdi
call fcn.1400fd17c
jmp 0x1400c973f
Function at 0x1400cfe40
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x470
mov rax, qword gs:[0x30]
xor ebx, ebx
mov bpl, r9b
mov dword [rsp + 0x498], ebx
mov r14b, r8b
mov rdi, rdx
mov rsi, rcx
mov r10, qword [rax + 0x48]
cmp qword [rdx + 0x4d0], r10
jne 0x1400cfea8
mov rcx, rdx
mov dword [rdx + 0x4f8], ebx
call fcn.14010fd10
mov al, 1
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, eax
cmp eax, 0xffffffff
jne 0x1400cff0d
cmp dword [0x14017c080], 2
jg 0x1400cfefa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 2
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x97
call fcn.140068d00
lea rdx, [0x140159ee8]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 1
test bl, 1
je 0x1400cff09
lea rcx, [rsp + 0x30]
call fcn.140068d80
xor al, al
jmp 0x1400cfe90
mov eax, ebx
cmp r14b, 1
mov r8d, 0x4d0
sete al
xor edx, edx
sub ecx, eax
mov dword [rdi + 0x4f8], ecx
mov rcx, rdi
call fcn.140113400
mov rdx, rdi
mov rcx, rsi
test bpl, bpl
je 0x1400cffab
mov dword [rdi], 0x10001f
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
jne 0x1400d001a
cmp dword [0x14017c080], 2
jg 0x1400cff95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 2
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rsp + 0x140]
mov dword [rsp + 0x20], eax
mov r8d, 0xa8
call fcn.140068d00
lea rdx, [0x140159ed0]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 2
test bl, 2
je 0x1400cff09
lea rcx, [rsp + 0x140]
jmp 0x1400cff04
mov dword [rdi + 0x30], 0x10001f
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1400d001a
cmp dword [0x14017c080], 2
jg 0x1400d0004
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 2
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rsp + 0x250]
mov dword [rsp + 0x20], eax
mov r8d, 0xb0
call fcn.140068d00
lea rdx, [0x140159e98]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 4
test bl, 4
je 0x1400cff09
lea rcx, [rsp + 0x250]
jmp 0x1400cff04
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x1400cfe8e
cmp dword [0x14017c080], 2
jg 0x1400d0073
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 2
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rsp + 0x360]
mov dword [rsp + 0x20], eax
mov r8d, 0xb6
call fcn.140068d00
lea rdx, [0x140159e88]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 8
test bl, 8
je 0x1400cff09
lea rcx, [rsp + 0x360]
jmp 0x1400cff04
Function at 0x1400ed210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa8
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdi, [rcx + 8]
mov qword [r11 - 0x50], 0xf
mov r14, r8
mov qword [r11 - 0x58], 0
mov rsi, rdx
mov byte [rsp + 0x70], 0
mov rbp, rcx
lea rdx, [r11 - 0x68]
or rbx, 0xffffffffffffffff
mov rcx, rdi
mov r8, rbx
mov r15, r9
call fcn.14004bf90
test al, al
jne 0x1400ed380
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x20]
cmp ecx, 1
jbe 0x1400ed2b3
cmp eax, 5
jne 0x1400ed28e
mov ecx, 0x3e8
jmp 0x1400ed2b8
cmp qword [rdi + 0x18], 8
jb 0x1400ed298
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x3e9
mov edx, 0x3eb
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x1400ed2b8
mov ecx, 0x3ea
test r14, r14
je 0x1400ed2c0
mov dword [r14], ecx
test r15, r15
je 0x1400ed321
test ecx, ecx
je 0x1400ed30d
sub ecx, 0x3e8
je 0x1400ed2fb
sub ecx, 1
je 0x1400ed2f2
sub ecx, 1
je 0x1400ed2e9
cmp ecx, 1
jne 0x1400ed30d
lea rdx, str.File_doesnt_exist.
jmp 0x1400ed302
lea rdx, str.File_locked.
jmp 0x1400ed302
lea rdx, str.Cant_read_file.
jmp 0x1400ed302
lea rdx, str.Access_denied.
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400ed302
jmp 0x1400ed316
lea rdx, [0x14014a2ed]
xor ebx, ebx
mov r8, rbx
mov rcx, r15
call fcn.14002a1a4
mov rax, qword [rsp + 0x88]
mov qword [rsi], 0
cmp rax, 0x10
jb 0x1400ed421
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x1400ed41c
test cl, 0x1f
jne 0x1400ed444
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400ed44a
sub rcx, rax
cmp rcx, 8
jb 0x1400ed450
cmp rcx, 0x27
jbe 0x1400ed419
jmp 0x1400ed456
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
lea rdx, [rsp + 0x58]
mov r8d, dword [rbp + 0x28]
mov r9, r14
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [0x140162980]
mov qword [rsp + 0x48], rcx
movups xmm0, xmmword [rsp + 0x40]
mov qword [rbp + 0x30], rcx
mov rcx, rsi
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x20], r15
call fcn.14008d2c0
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jb 0x1400ed421
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x1400ed41c
test cl, 0x1f
jne 0x1400ed45c
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400ed462
sub rcx, rax
cmp rcx, 8
jb 0x1400ed468
cmp rcx, 0x27
ja 0x1400ed46e
mov rcx, rax
call fcn.140111e78
mov rax, rsi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140111850
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
Function at 0x1400f8ecc
Capabilities:
Check os version
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov dil, dl
mov rbx, rcx
test dl, dl
je 0x1400f8f1e
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400f8f1e
xor eax, eax
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rax
lea rax, [0x14015e290]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], 1
cmp qword [rbx + 0x18], 8
jb 0x1400f8f28
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rsi
mov eax, 0x200
neg dil
mov r9d, 2
mov rcx, rbx
sbb edx, edx
and dword [rsp + 0x30], 0
and edx, 0x80000
mov dword [rsp + 0x28], eax
add edx, 3
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret