joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d430
Capabilities:
Check if file exists
Create directory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov r12, rdx
mov rdi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, str.CreateDirectoryAndGetError
lea r8, [0x14007e8a8]
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x258
call fcn.140021a10
lea rcx, [rsp + 0x28]
mov rdx, rbx
xor r8d, r8d
call fcn.140021c90
cmp qword [rdi + 0x18], 7
mov rbx, rdi
jbe 0x14000d497
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d4ce
mov bl, 1
test al, 0x10
jne 0x14000d5f3
test r12, r12
je 0x14000d4bc
mov dword [r12], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x14000d5f3
lea rbp, [rsp + 0x78]
mov rcx, rdi
mov rdx, rbp
call fcn.14000a7b0
mov rax, qword [rdi + 0x10]
cmp qword [rsp + 0x88], rax
jne 0x14000d53b
test rax, rax
je 0x14000d524
cmp qword [rdi + 0x18], 7
mov rcx, rdi
jbe 0x14000d4fe
mov rcx, qword [rdi]
cmp qword [rsp + 0x90], 7
jbe 0x14000d50e
mov rbp, qword [rsp + 0x78]
xor edx, edx
movzx esi, word [rbp + rdx*2]
cmp si, word [rcx + rdx*2]
jne 0x14000d53b
add rdx, 1
cmp rax, rdx
jne 0x14000d510
test r12, r12
je 0x14000d531
mov dword [r12], 0xfffffffc
mov ecx, 2
jmp 0x14000d5e1
lea rcx, [rsp + 0x78]
mov rdx, r12
call fcn.14000d430
test al, al
je 0x14000d5e7
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x14000d5e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0xb7
jne 0x14000d5cf
lea rdx, str.DirectoryExists
lea r8, [0x14007e8a8]
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x1bd
call fcn.140021a10
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140021c90
cmp qword [rdi + 0x18], 7
jbe 0x14000d5b2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, r14
call fcn.140021dc0
cmp edi, 0xffffffff
je 0x14000d5cf
and edi, 0x10
jne 0x14000d5e9
test r12, r12
je 0x14000d5df
mov ecx, ebp
call fcn.140026360
mov dword [r12], eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rcx, [rsp + 0x78]
call fcn.140009970
lea rcx, [rsp + 0x28]
call fcn.140021dc0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14005aa40
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14000dde0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r15d, r8d
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov qword [rsp + 0x20], r14
xor ebp, ebp
lea rsi, [rsp + 0x2a0]
mov rcx, rsi
xor r8d, r8d
mov r9d, 3
call fcn.140026bb0
lea rdi, [rsp + 0x280]
mov rcx, rsi
mov rdx, rdi
call fcn.140026d40
cmp qword [rsp + 0x290], 0
je 0x14000df84
lea rsi, [rsp + 0x2a0]
lea rbx, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
nop word [rax + rax]
mov rcx, rsi
mov rdx, rbx
call fcn.140026cb0
mov edx, dword [rsp + 0x30]
test dl, 1
je 0x14000deb8
test r15b, r15b
jne 0x14000de99
mov rcx, rbx
call fcn.140026940
test al, al
jne 0x14000deb8
mov edx, dword [rsp + 0x30]
and edx, 0xfffffffe
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x14000deb2
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.140026940
test al, al
je 0x14000df10
xor ebp, ebp
test r15b, r15b
je 0x14000df45
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.14000dde0
mov ebp, eax
test eax, eax
jne 0x14000df45
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x14000def5
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14000df45
jmp 0x14000df2f
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x14000df26
mov rcx, qword [rsp + 0x280]
call r12
xor ebp, ebp
test eax, eax
jne 0x14000df45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
or eax, 1
cmp eax, 3
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, rbx
call fcn.140002d90
mov rcx, rsi
mov rdx, rbx
call fcn.140026d40
mov rcx, rdi
mov rdx, rbx
call fcn.140009a50
mov rcx, rbx
call fcn.140009970
cmp qword [rsp + 0x290], 0
mov r13d, ebp
jne 0x14000de70
lea rcx, [rsp + 0x280]
call fcn.140009970
lea rcx, [rsp + 0x2a0]
call fcn.140026be0
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.14005aa40
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000eca0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000ed23
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14000ecee
call fcn.140021a30
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.140027e20
mov rcx, qword [rsi]
call fcn.140027db0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x14000ed1c
mov qword [rsi], rdi
call fcn.140021a30
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140027de0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
or al, 0xf4
xchg byte [rsi + 0x1f], al
invalid
hlt
invalid
mov dh, 0x90
jae 0x14013bd0f
movsd dword [rdi], dword [rsi]
add byte [rax + 0x72490c0a], dh
std
std
mov edi, 0x7006fe3f
mov edi, 0xe1035aee
invalid
Function at 0x140016280
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r15, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r15 + 0x30]
mov rax, qword [r15 + 8]
mov r8, qword [r15 + 0x18]
lea rdi, [rdx + rdx]
add rdi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x140016303
mov rdx, qword [rdx]
mov rsi, rcx
cmp rcx, rax
je 0x140016312
mov rsi, qword [r8 + rdi*8]
mov rsi, qword [rsi]
cmp rsi, rdx
je 0x14001632b
cmp dword [rdx + 0x10], ebx
jne 0x140016300
cmp rdx, rax
je 0x14001632b
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x1400163a0
mov rdi, qword [rax]
mov r12, qword [rdi + 8]
mov ecx, 0x38
call fcn.14005a670
mov rsi, rax
test rdi, rdi
mov rax, r12
cmove rax, rsi
mov rcx, rdi
cmove rcx, rsi
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov eax, dword [r13]
mov dword [rsi + 0x10], eax
lea rcx, [rsi + 0x18]
call fcn.140009790
mov rax, qword [r15 + 0x10]
movabs rcx, 0x492492492492491
cmp rax, rcx
je 0x1400163b3
add rax, 1
mov qword [r15 + 0x10], rax
mov qword [rdi + 8], rsi
mov qword [r12], rsi
mov rax, qword [r15 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r15
mov rdx, r14
call fcn.1400163d0
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.14005ae60
ud2
Function at 0x14001b3a0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14001b488
mov ebx, eax
mov edx, eax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
lea rsi, [rsp + 0x20]
movdqu xmmword [rsi + 0x10], xmm0
mov word [rsi], 0
mov rcx, rsi
xor r8d, r8d
call fcn.14001c680
cmp qword [rsi + 0x18], 7
jbe 0x14001b40d
mov rsi, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14001b45f
mov edx, eax
cmp qword [rsp + 0x30], rdx
jbe 0x14001b45f
lea rdi, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.14001b4c0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
jmp 0x14001b477
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [r14 + 0x10], xmm0
mov rdi, r14
mov word [rdi], 0
lea rcx, [rsp + 0x20]
call fcn.140001460
jmp 0x14001b4a3
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [r14 + 0x10], xmm0
mov word [r14], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005aa40
mov rax, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14001b500
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x14001b50e
mov rcx, qword [rcx]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x14001bab0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
movdqa xmmword [rsp + 0x70], xmm6
mov rdi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp qword [rcx + 0x18], 7
mov rsi, rcx
jbe 0x14001bae2
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001bb15
test al, 0x10
jne 0x14001bc42
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14001bca0
xor edi, edi
jmp 0x14001bc75
mov eax, 7
movq xmm6, rax
pslldq xmm6, 8
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], 0
lea rdx, [0x14007f564]
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.14001bd20
cmp rax, 0xffffffffffffffff
je 0x14001bbaa
lea rbx, [rsp + 0x20]
movdqu xmmword [rbx + 0x10], xmm6
xor ebp, ebp
mov word [rbx], bp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rax
call fcn.14001d340
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140001460
movdqu xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
movdqu xmmword [rbx + 0x10], xmm6
mov word [rbx], bp
mov rcx, rbx
call fcn.140001460
mov rcx, rdi
call fcn.14001bab0
test al, al
je 0x14001bc5d
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14001bc6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x14001bc2e
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
lea r14, [rsp + 0x20]
movdqu xmmword [r14 + 0x10], xmm0
mov word [r14], 0
mov rcx, rsi
call fcn.14006e7d0
mov rcx, r14
mov rdx, rsi
mov r8, rax
call fcn.140001a10
cmp qword [r14 + 0x18], 7
mov rcx, r14
jbe 0x14001bc14
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
mov rcx, r14
call fcn.140001460
cmp ebp, 0xffffffff
je 0x14001bc2e
and ebp, 0x10
jne 0x14001bc6b
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.14001bca0
jmp 0x14001bc69
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14001bca0
mov dil, 1
jmp 0x14001bc75
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.14001bca0
xor edi, edi
lea rcx, [rsp + 0x40]
call fcn.140001460
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14001bca0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi + 0x10], r9
mov qword [rdi + 8], r8
mov qword [rdi], rdx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.140002e10
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x1400a4860]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.1400603a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005aa40
nop
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14001d380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r13, rdx
neg r13
mov rdi, 0xffffffffffffffff
jae 0x14001d48b
mov r12, qword [rsp + 0x190]
test r12, r12
je 0x14001d48b
mov rbx, r9
mov rsi, r8
mov r15, rdx
mov r14, rcx
xor ebp, ebp
lea rcx, [rsp + 0x20]
mov r8d, 0x100
xor edx, edx
call fcn.14005f150
lea rax, [r12 + r12]
movzx ecx, word [rbx + rbp]
cmp rcx, 0xff
ja 0x14001d43d
movzx ecx, cl
mov byte [rsp + rcx + 0x20], 1
add rbp, 2
cmp rax, rbp
jne 0x14001d3ed
not rsi
cmp r13, rsi
cmova rsi, r13
add rsi, rsi
xor rsi, 0xfffffffffffffffe
jmp 0x14001d422
add rsi, 0xfffffffffffffffe
movzx eax, word [r14 + rsi]
cmp rax, 0xff
ja 0x14001d436
cmp byte [rsp + rax + 0x20], 0
jne 0x14001d485
test rsi, rsi
jne 0x14001d41e
jmp 0x14001d48b
dec r15
cmp r15, rsi
cmovae r15, rsi
lea rdi, [r14 + r15*2]
jmp 0x14001d451
add rdi, 0xfffffffffffffffe
movzx ecx, word [rdi]
mov rax, rbx
mov rdx, r12
cmp word [rax], cx
je 0x14001d46a
add rax, 2
dec rdx
jne 0x14001d45a
jmp 0x14001d46f
test rax, rax
jne 0x14001d47d
cmp rdi, r14
jne 0x14001d44d
mov rdi, 0xffffffffffffffff
jmp 0x14001d48b
sub rdi, r14
sar rdi, 1
jmp 0x14001d48b
sar rsi, 1
mov rdi, rsi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14005aa40
mov rax, rdi
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001d7b0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14001d81f
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.14001d740
test al, al
jne 0x14001d82d
add rbx, 8
cmp rbx, 0x18
jne 0x14001d7ed
xor esi, esi
jmp 0x14001d830
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14005aa40
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001deb0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm6
mov r14, rdx
mov r12, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdx, qword [0x1400a5060]
test rdx, rdx
jne 0x14001dff6
mov ecx, 0x20
call fcn.14005a670
mov rsi, rax
mov eax, 7
movq xmm6, rax
pslldq xmm6, 8
movdqu xmmword [rsi + 0x10], xmm6
xor ebx, ebx
mov word [rsi], bx
mov qword [0x1400a5060], rsi
mov ecx, 0x20
call fcn.14005a670
mov rdi, rax
movdqu xmmword [rax + 0x10], xmm6
mov word [rax], bx
mov qword [0x1400a5068], rax
call fcn.14001a9b0
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0x48]
movdqu xmmword [r15 + 0x10], xmm6
mov word [r15], bx
lea rbp, str.user_data_dir
mov rcx, rbp
call fcn.14006e7d0
mov rcx, r15
mov rdx, rbp
mov r8, rax
call fcn.140001a10
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbp, rax
lea r13, [rsp + 0x28]
movdqu xmmword [r13 + 0x10], xmm6
mov word [r13], bx
mov rcx, rax
call fcn.14006e7d0
mov rcx, r13
mov rdx, rbp
mov r8, rax
call fcn.140001a10
lea rbp, [rsp + 0x68]
mov rcx, rbp
mov rdx, r13
mov r8, r15
call fcn.14001afe0
mov rcx, rbp
mov rdx, qword [rsp + 0x20]
mov r8, rsi
mov r9, rdi
call fcn.14001da80
mov esi, eax
mov rcx, rbp
call fcn.140001460
mov rcx, r13
call fcn.140001460
mov rcx, r15
call fcn.140001460
test sil, sil
je 0x14001e03a
mov rdx, qword [0x1400a5060]
cmp rdx, r12
je 0x14001e011
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14001e009
mov rdx, qword [rdx]
mov rcx, r12
call fcn.140001a10
mov bl, 1
test r14, r14
je 0x14001e03a
mov rdx, qword [0x1400a5068]
cmp rdx, r14
je 0x14001e03a
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14001e032
mov rdx, qword [rdx]
mov rcx, r14
call fcn.140001a10
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14005aa40
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001f810
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x130], rax
mfence
mov rax, qword [0x1400a50c0]
test rax, rax
jne 0x14001f85a
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mfence
mov rax, qword [0x1400a50c0]
test rax, rax
je 0x14001f844
cmp eax, 2
jne 0x14001f8a2
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x14001f934
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140023180
lea rcx, [rsp + 0x28]
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x14001f927
mov eax, 1
lock xadd qword [0x1400a50f8], rax
test rax, rax
jle 0x14001f8c2
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1400a5078], eax
mov qword [0x1400a5070], rsi
mov rcx, qword [0x1400a22f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x14001f934
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xaf
mov r9d, 2
call fcn.140023180
lea rcx, [rsp + 0x28]
lea rdx, str.crash_server_did_not_respond__self_terminating
call fcn.14000d630
mov rcx, rsi
call fcn.140023620
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14005aa40
xor eax, eax
add rsp, 0x138
pop rdi
pop rsi
ret
Function at 0x140024fd0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x80], 0
je 0x140025050
cmp qword [rsi + 0x68], 0
je 0x14002508a
cmp byte [rsi + 0x71], 0
je 0x14002508a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140025086
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
test eax, eax
je 0x140025054
cmp eax, 1
je 0x140025058
cmp eax, 3
jne 0x140025086
jmp 0x14002508a
xor edi, edi
jmp 0x1400250a1
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x140025080
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call fcn.1400696b0
cmp rbx, rax
jne 0x140025086
cmp byte [rsi + 0x71], 0
je 0x14002508a
xor ebx, ebx
jmp 0x14002508d
mov rbx, rsi
mov rcx, qword [rsi + 0x80]
call fcn.140068620
xor edi, edi
test eax, eax
cmove rdi, rbx
mov byte [rsi + 0x7c], 0
mov byte [rsi + 0x71], 0
lea rax, [rsi + 8]
mov qword [rsi + 0x18], rax
lea rax, [rsi + 0x10]
mov qword [rsi + 0x20], rax
lea rax, [rsi + 0x28]
mov qword [rsi + 0x38], rax
lea rax, [rsi + 0x30]
mov qword [rsi + 0x40], rax
lea rax, [rsi + 0x48]
mov qword [rsi + 0x50], rax
lea rax, [rsi + 0x4c]
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x80], 0
mov rax, qword [0x1400a5230]
mov qword [rsi + 0x74], rax
mov qword [rsi + 0x68], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005aa40
mov rax, rdi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140025230
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x14002535e
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14002528e
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x14002528e
add ecx, 0xffffffff
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x1400253b5
cmp qword [rdi + 0x80], 0
je 0x140025362
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x1400252c8
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140025369
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov rbp, qword [rcx]
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea r15, [rsp + 0x60]
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0x5f]
mov r8, r14
call qword [rbp + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x140025395
mov rbx, qword [rsp + 0x48]
sub rbx, r15
je 0x14002534e
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x60]
mov edx, 1
mov r8, rbx
call fcn.1400696b0
cmp rbx, rax
jne 0x1400253b3
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], r14
mov eax, 0xffffffff
jmp 0x1400253ae
xor esi, esi
jmp 0x1400253b5
mov esi, 0xffffffff
jmp 0x1400253b5
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call fcn.140068c10
mov edi, eax
cmp eax, 0xffffffff
cmovne edi, esi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
jmp 0x1400253c7
cmp eax, 3
jne 0x1400253b3
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call fcn.140068c10
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005aa40
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140025810
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r15, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400258b7
mov rsi, r14
test r14, r14
jle 0x140025961
mov rsi, r14
nop
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140025890
mov rax, qword [rbx + 0x50]
movsxd rdi, dword [rax]
test rdi, rdi
jle 0x140025890
cmp rsi, rdi
cmovle rdi, rsi
mov rcx, r15
mov r8, rdi
call fcn.14005ece0
add r15, rdi
sub rsi, rdi
mov rax, qword [rbx + 0x50]
sub dword [rax], edi
mov rax, qword [rbx + 0x38]
movsxd rcx, edi
add qword [rax], rcx
jmp 0x1400258ad
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140025961
mov byte [r15], al
add r15, 1
add rsi, 0xffffffffffffffff
test rsi, rsi
jg 0x140025840
jmp 0x140025961
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140025907
test r14, r14
jle 0x140025907
mov rax, qword [rbx + 0x50]
mov eax, dword [rax]
test eax, eax
jle 0x140025907
movsxd rdi, eax
cmp rdi, r14
cmovg rdi, r14
mov rcx, r15
mov r8, rdi
call fcn.14005ece0
add r15, rdi
mov rsi, r14
sub rsi, rdi
mov rax, qword [rbx + 0x50]
sub dword [rax], edi
mov rax, qword [rbx + 0x38]
movsxd rcx, edi
add qword [rax], rcx
test rsi, rsi
jg 0x14002590f
jmp 0x140025961
mov rsi, r14
test rsi, rsi
jle 0x140025961
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140025961
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x14002594e
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, r15
mov r8, rsi
call fcn.140068de0
sub rsi, rax
sub r14, rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret