joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401c8a80]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1ce
call fcn.1400d4e70
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d4e90
cmp byte [rdi + 0x17], 0
jns 0x140010dc6
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1400dcae0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x140010f60
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a0
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x498], rax
movaps xmm0, xmmword [0x1401c8a80]
lea rbp, [rsp + 0x30]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rdx, [0x1401d1401]
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x290]
mov rcx, rsi
mov r9d, 0x19b
call fcn.1400d4e70
mov rcx, rbp
mov rdx, rsi
xor r8d, r8d
call fcn.1400d4e90
lea rbp, [rsp + 0x290]
mov r8d, 0x208
mov rcx, rbp
mov dl, 0xaa
call fcn.1400f5b50
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140010ffe
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, rbp
call fcn.1400dc200
mov rcx, rbp
call fcn.1400bcb60
lea rbp, [rsp + 0x80]
mov r8d, 0x208
mov rcx, rbp
mov dl, 0xaa
call fcn.1400f5b50
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x140011038
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, rbp
call fcn.1400dc200
mov rcx, rbp
call fcn.1400bcb60
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14001105a
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140011066
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400110c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140016570
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x140011099
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400110a2
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test r14, r14
je 0x1400110cc
test eax, eax
jne 0x1400110cc
cmp ebp, 0xfffffffc
je 0x1400110f6
mov dword [r14], ebp
xor edi, edi
jmp 0x1400110cc
mov dil, 1
lea rcx, [rsp + 0x30]
call fcn.1400dcae0
mov rcx, qword [rsp + 0x498]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x4a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140147200
mov ebp, eax
jmp 0x1400110c2
Function at 0x140011fa0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea rbx, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, rbx
mov dl, 0xaa
call fcn.1400f5b50
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.140012220
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401c8a80]
movaps xmmword [rdi], xmm0
mov rcx, rbx
mov rdx, rdi
call fcn.140012560
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x140012036
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400120f6
lea rbx, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
xor r12d, r12d
mov r8d, 0x250
mov rcx, rbx
mov dl, 0xaa
call fcn.1400f5b50
mov rcx, r15
mov rdx, rbx
call fcn.1400121e0
mov edx, dword [rsp + 0x48]
test dl, 1
jne 0x140012133
test dl, 0x10
jne 0x140012154
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x140012096
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400121bf
call r13
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r12d, r12d
cmovne ebp, r12d
mov rcx, r15
mov rdx, rbx
call fcn.140012560
mov rcx, rdi
mov rdx, rbx
call fcn.1400ea020
mov rcx, rbx
call fcn.1400dcad0
movzx eax, byte [rsp + 0x47]
test al, al
jns 0x1400120ea
mov rax, qword [rsp + 0x38]
mov r12d, ebp
test rax, rax
jne 0x140012056
lea rcx, [rsp + 0x30]
call fcn.1400dcad0
lea rcx, [rsp + 0x298]
call fcn.140011e40
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test dl, 0x10
je 0x140012143
xor ebp, ebp
test r14b, r14b
je 0x1400120b7
and edx, 0xfffffffe
cmp byte [rsp + 0x47], 0
jns 0x1400121c6
mov rcx, qword [rsp + 0x30]
jmp 0x1400121cb
xor ebp, ebp
test r14b, r14b
je 0x1400120b7
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rdx, rsi
mov r8b, 1
call fcn.140011fa0
mov ebp, eax
test eax, eax
jne 0x1400120b7
cmp byte [rsp + 0x47], 0
jns 0x14001218f
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x1400120b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x1400120b7
xor ebp, ebp
jmp 0x1400120b7
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [rsp + 0x48]
jmp 0x14001207e
Function at 0x140013660
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400dec60
mov qword [rsi], 0
test rax, rax
je 0x1400136b3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400136e7
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400136ab
mov qword [rsi], rbx
call fcn.1400c18d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.1400dec90
lea rcx, [rsi + 0x20]
call fcn.1400dec30
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400c18d0
mov rcx, qword [rsi]
call fcn.1400def50
mov qword [rsi], 0
jmp 0x140013699

Function at 0x140013810
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140013858
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140013861
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140013848
mov qword [rdi], rsi
call fcn.1400c18d0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400c18d0
mov rcx, qword [rdi]
call fcn.1400def50
mov qword [rdi], 0
jmp 0x140013836
Function at 0x140013c70
Capabilities:
Get file size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1401c8a80]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.GetLength
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x9c
call fcn.1400d4e70
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d4e90
mov qword [rbx + 8], r14
mov qword [rbx], 0
mov rcx, qword [0x1401feac8]
test rcx, rcx
jne 0x140013d7a
lea rdi, [rsp + 0xb0]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, eax
mov rbx, qword [rdi]
cmp qword [rsp + 0x40], 0
jne 0x140013da0
test byte [0x1401f7030], 0x19
jne 0x140013dc1
xor edi, edi
cmp esi, 1
sbb rdi, rdi
or rdi, rbx
lea rcx, [rsp + 0x60]
call fcn.1400dcbb0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x140013d0a
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.140142c60
jmp 0x140013d0a
mov rcx, qword [0x1401feac8]
test rcx, rcx
je 0x140013d2e
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x140013d2e
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], r14
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x1401f7030]
lea r9, [0x1401d1322]
mov rcx, rdi
mov dl, 0x45
call fcn.1400c3ef0
mov rdi, qword [rdi]
test rdi, rdi
je 0x140013e21
mov r15, qword [rsp + 0x48]
lea r14, [rsp + 0xb0]
mov rcx, r14
xor edx, edx
call fcn.1400ec270
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], r15
mov rcx, r14
call fcn.1400c3f10
lea rcx, [rsp + 0x40]
call fcn.1400ec280
jmp 0x140013d3b
Function at 0x140014f00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140014f37
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140014f37
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140014f37
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
ret
Function at 0x140016700
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
movaps xmm6, xmmword [0x1401c8a80]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.ReadAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x57
call fcn.1400d4e70
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d4e90
movabs rbx, 0xaaaaaaaaaaaaaaaa
test esi, esi
js 0x14001685b
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 0
mov rcx, qword [0x1401feac8]
test rcx, rcx
jne 0x140016831
lea r9, [rsp + 0xb0]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140016862
mov esi, dword [rsp + 0xb0]
cmp qword [rsp + 0x40], 0
jne 0x140016878
test byte [0x1401f7030], 0x19
jne 0x14001689d
lea rcx, [rsp + 0x60]
call fcn.1400dcbb0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x1400167af
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x40]
mov r8, r15
call fcn.140142c60
jmp 0x1400167af
mov esi, 0xffffffff
jmp 0x1400167f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400167e5
mov rcx, qword [0x1401feac8]
test rcx, rcx
je 0x1400167f1
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x1400167f1
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rbx
movaps xmmword [rdi], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x1401f7030]
lea r9, [0x1401d1322]
mov rcx, rdi
mov dl, 0x45
call fcn.1400c3ef0
mov rbx, qword [rdi]
test rbx, rbx
je 0x1400168fd
mov r14, qword [rsp + 0x48]
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
call fcn.1400ec270
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r14
mov rcx, rdi
call fcn.1400c3f10
lea rcx, [rsp + 0x40]
call fcn.1400ec280
jmp 0x1400167fe

Function at 0x140018500
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401f6f88]
cmp ecx, 0xffffffff
je 0x140018525
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x140018520
Function at 0x140018530
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov eax, dword [0x140200ae8]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001859d
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x140018591
movsxd rdx, dword [0x140200ae0]
shl rdx, 4
mov esi, dword [rax + rdx + 8]
cmp esi, dword [0x140200ae4]
jne 0x140018591
mov rax, qword [rax + rdx]
test rax, rax
jne 0x1400185d9
mov dword [rdi], ecx
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140200ae8]
call fcn.1400f0548
cmp dword [0x140200ae8], 0xffffffff
jne 0x14001855a
mov qword [0x140200ae0], 0
lea rcx, [0x140200ae0]
xor edx, edx
call fcn.14000d6e0
lea rcx, [0x140200ae8]
call fcn.1400f07ac
jmp 0x14001855a
mov ecx, dword [rax]
jmp 0x140018591

Function at 0x140019530
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov rbp, r8
mov rsi, rdx
mov r15, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebx, 0x10
mov ecx, 0x10
call fcn.1400f045c
mov r14, rax
mov qword [rax], rsi
test rbp, rbp
setne byte [rax + 8]
mov dword [rax + 0xc], edi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x14001e130]
xor ecx, ecx
mov rdx, r15
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400195d1
test rbp, rbp
je 0x140019601
mov qword [rbp], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400195ea
mov ebp, eax
cmp eax, 0x5af
je 0x1400195ea
cmp ebp, 0xe
jne 0x14001960c
mov rcx, r15
call fcn.1401467b0
test r14, r14
je 0x1400195af
mov rcx, r14
call fcn.1400f0498
jmp 0x1400195af
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400195af
mov eax, dword [0x1401fe560]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001967b
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, ebp
call fcn.14004e100
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x1401fe558]
call fcn.1400bcb60
cmp byte [rsi + 0x17], 0
jns 0x1400195f2
mov rcx, qword [rsp + 0x38]
call fcn.1400f0498
jmp 0x1400195f2
lea rcx, [0x1401fe560]
call fcn.1400f0548
cmp dword [0x1401fe560], 0xffffffff
jne 0x14001962d
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400270d0
mov qword [0x1401fe558], rax
lea rcx, [0x1401fe560]
call fcn.1400f07ac
jmp 0x14001962d
Function at 0x140019ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r15, [rsp + 0x34]
mov dword [r15], 0xaaaaaaaa
mov qword [rsp + 0x20], r15
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140019d69
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x28]
mov qword [rbp], rax
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r12d, eax
mov r14, qword [rbp]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140019d69
test r12d, r12d
setne al
cmp r14, rsi
sete sil
and sil, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x140019d4b
Function at 0x14001bd70
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400f5b50
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14001be0f
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.1400f080c
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.1400dcf00
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.14001be40
mov rcx, r14
mov rdx, rsi
call fcn.1400ea020
mov rcx, rsi
call fcn.1400dcad0
mov rcx, rbx
call fcn.1400dcad0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14001ebc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x140201560]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001ec3b
lea rcx, [0x140201558]
call fcn.1400e6e80
test rax, rax
jne 0x14001ec2a
mov ecx, 4
call fcn.1400f045c
mov rsi, rax
mov dword [rax], 0
lea rcx, [0x140201558]
call fcn.1400e6e80
test rax, rax
jne 0x14001ec7f
lea rcx, [0x140201558]
mov rdx, rsi
call fcn.1400b2380
lea rcx, [0x140201558]
add rsp, 0x20
pop rsi
jmp fcn.1400e6e80
lea rcx, [0x140201560]
call fcn.1400f0548
cmp dword [0x140201560], 0xffffffff
jne 0x14001ebe6
mov qword [0x140201558], 0
lea rcx, [0x140201558]
lea rdx, [0x14004ce30]
call fcn.14000d6e0
lea rcx, [0x140201560]
call fcn.1400f07ac
jmp 0x14001ebe6
mov rcx, rax
call fcn.1400f0498
jmp 0x14001ec1b

Function at 0x14001f600
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x88]
mov byte [rsi + 0xde9], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x50]
test rax, rax
je 0x14001f6a0
mov eax, dword [0x1402003f8]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001f664
lea rcx, [0x1402003f0]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400b2380
lea rcx, [0x1402003f8]
call fcn.1400f0548
cmp dword [0x1402003f8], 0xffffffff
jne 0x14001f650
mov qword [0x1402003f0], 0
lea rcx, [0x1402003f0]
xor edx, edx
call fcn.14000d6e0
lea rcx, [0x1402003f8]
call fcn.1400f07ac
jmp 0x14001f650
add rsp, 0x20
pop rsi
ret
Function at 0x140020410
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400f5b50
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400204a5
cmp word [rsp + 0x70], 0
je 0x1400204a5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1400f080c
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400dcf00
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.14001bd70
test al, al
je 0x1400204d0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400ed250
jmp 0x1400204ef
lea rax, [0x1401d141a]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1400dcf00
lea rcx, [rsp + 0x40]
call fcn.1400dcad0
jmp 0x140020487

Function at 0x140020f70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140020fe5
movabs rax, 0x1fffffffffffff
and rax, qword [rsp + 0x20]
cvtsi2sd xmm0, rax
mov edx, 0xffffffcb
call fcn.1400f0d64
movapd xmm6, xmm0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
int3
Function at 0x140023030
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x178], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14002310c
and eax, 0xfeff
cmp eax, 6
je 0x14002310c
mov eax, dword [0x140201448]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400230d3
lea rcx, [0x140201448]
call fcn.1400f0548
cmp dword [0x140201448], 0xffffffff
jne 0x1400230d3
lea rcx, [0x1401d169e]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.140037420
mov qword [0x140201440], rax
lea rcx, [0x140201448]
call fcn.1400f07ac
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x140201440]
mov esi, eax
test eax, eax
je 0x140023119
test esi, esi
setne bl
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
jmp 0x1400230ef
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x1400230ea
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x21
mov r9d, 2
call fcn.1401438e0
lea rcx, [rsp + 0x40]
lea rdx, str.InitializeCriticalSectionEx
mov r8d, 0x1b
call fcn.1400d6670
mov rcx, rdi
call fcn.1401439d0
jmp 0x1400230ea

Function at 0x140023390
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov r15, rdx
lea rcx, [rsp + 0x20]
mov qword [rcx], r14
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14002341d
mov rdi, 0xfffffffffffffffe
sub rdi, r15
mov rax, qword [rsp + 0x20]
cmp rax, rdi
ja 0x140023420
xor edx, edx
div rbx
add esi, edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
int3
lea r15, [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rcx, r15
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140023447
mov rax, qword [rsp + 0x20]
cmp rax, rdi
jbe 0x1400233fb
jmp 0x140023425
int3