joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011a010
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
lea r15, [rcx + 0x18]
mov rcx, r15
call fcn.14009b9c0
mov r8, qword [r13 + 0x28]
test r8, r8
je 0x14011a188
mov rax, r12
shr rax, 0x20
lea edx, [r12*8]
add rdx, 8
xor rdx, rax
movabs rbx, 0x9ddfea08eb382d69
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rdx, rax
xor rdx, rcx
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rbx
mov rax, r8
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, r8
sub rax, rdx
movabs rdx, 0x3333333333333333
mov rbx, rax
and rbx, rdx
shr rax, 2
and rax, rdx
add rax, rbx
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs rdi, 0x101010101010101
imul rdi, rax
shr rdi, 0x38
cmp rdi, 1
ja 0x14011a1ea
lea rbx, [r8 - 1]
and rbx, rcx
mov rax, qword [r13 + 0x20]
mov rax, qword [rax + rbx*8]
test rax, rax
je 0x14011a188
mov rsi, qword [rax]
test rsi, rsi
je 0x14011a188
lea r9, [r8 - 1]
mov rax, qword [rsi + 8]
cmp rax, rcx
jne 0x14011a177
cmp qword [rsi + 0x10], r12
je 0x14011a127
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14011a10e
jmp 0x14011a188
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [0x140218438]
cmp rdi, 1
jbe 0x14011a1a1
mov rcx, rdi
call fcn.1400ae0e0
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call fcn.1400ae120
mov rcx, qword [r14 + 0x28]
mov rdx, r12
call qword [rcx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rdi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400ae120
cmp edi, 1
ja 0x14011a206
and rax, r9
cmp rax, rbx
je 0x14011a11d
mov rcx, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea rcx, [0x140218438]
call fcn.1400c2120
test al, al
je 0x14011a21c
mov qword [0x140218440], 0
lea rbx, [0x140218438]
lea rdi, [0x140218440]
mov rcx, rdi
xor edx, edx
call fcn.1400ae170
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400c21c0
jmp 0x14011a13d
mov rbx, rcx
cmp rcx, r8
jb 0x14011a0f1
mov rax, rcx
xor edx, edx
div r8
mov rbx, rdx
jmp 0x14011a0f1
cmp rax, r8
jb 0x14011a183
xor edx, edx
div r8
mov rax, rdx
jmp 0x14011a183
mov rdi, qword [0x140218438]
jmp 0x14011a13d
Function at 0x14011d790
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
jmp 0x14013dec0
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14013dee7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14013df1f
and eax, 0x410
cmp eax, 0x410
jne 0x14013df1f
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov rcx, rsi
add rsp, 0x1a8
pop rdi
pop rsi
jmp 0x14013e010
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14013df2b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14013df48
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14013df64
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x94
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14013dfe3
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x57], 0
jns 0x14013dfff
mov rcx, qword [rsp + 0x40]
call fcn.140180390
lea rcx, [rsp + 0x58]
call fcn.1400560d0
jmp 0x14013df46
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14013e037
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x14013e054
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14013e070
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14013e0ef
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x57], 0
jns 0x14013e10b
mov rcx, qword [rsp + 0x40]
call fcn.140180390
lea rcx, [rsp + 0x58]
call fcn.1400560d0
jmp 0x14013e052
Function at 0x14011d7a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movdqa xmmword [rsp + 0x20], xmm6
mov rbx, rdx
mov rdi, rcx
mov eax, dword [0x140218390]
mov ecx, dword [0x140214838]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14011d80e
cmp rdi, rbx
je 0x14011d7ff
mov eax, 0xffffffff
lea rcx, [0x140217f90]
movzx edx, byte [rdi]
movzx esi, al
xor esi, edx
shr eax, 8
xor eax, dword [rcx + rsi*4]
inc rdi
cmp rbx, rdi
jne 0x14011d7e5
not eax
jmp 0x14011d801
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140218390]
call fcn.1401804b0
cmp dword [0x140218390], 0xffffffff
jne 0x14011d7d4
movdqa xmm0, xmmword [0x1401b86b0]
xor eax, eax
movdqa xmm1, xmmword [0x1401b86d0]
movdqa xmm2, xmmword [0x1401c5320]
lea rcx, [0x140217f90]
movdqa xmm3, xmmword [0x1401b86c0]
movdqa xmm4, xmm0
psrld xmm4, 1
movdqa xmm5, xmm0
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
movdqu xmmword [rax + rcx], xmm5
paddd xmm0, xmm3
add rax, 0x10
cmp rax, 0x400
jne 0x14011d84c
lea rcx, [0x140218390]
call fcn.140180548
jmp 0x14011d7d4

Function at 0x140123d20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1402183b8]
mov ecx, dword [0x140214838]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140123d55
lea rcx, [0x1402183b0]
add rsp, 0x28
jmp fcn.1400ae0e0
lea rcx, [0x1402183b8]
call fcn.1401804b0
cmp dword [0x1402183b8], 0xffffffff
jne 0x140123d45
mov qword [0x1402183b0], 0
lea rcx, [0x1402183b0]
xor edx, edx
call fcn.1400ae170
lea rcx, [0x1402183b8]
call fcn.140180548
jmp 0x140123d45

Function at 0x140138a40
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140138ae0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x140138a99
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140180700
nop
add rsp, 0x40
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.1400b16b0
mov rcx, rsi
call fcn.1400b16a0
lea rdx, [0x1401c5075]
mov r8d, ntohl
mov rcx, rax
call fcn.140006490
mov rcx, rsi
call fcn.140075f20
jmp 0x140138a85
Function at 0x14013dec0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
jmp 0x14013dec0
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14013dee7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14013df1f
and eax, 0x410
cmp eax, 0x410
jne 0x14013df1f
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov rcx, rsi
add rsp, 0x1a8
pop rdi
pop rsi
jmp 0x14013e010
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14013df2b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14013df48
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14013df64
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x94
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14013dfe3
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x57], 0
jns 0x14013dfff
mov rcx, qword [rsp + 0x40]
call fcn.140180390
lea rcx, [rsp + 0x58]
call fcn.1400560d0
jmp 0x14013df46
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14013e037
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x14013e054
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14013e070
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14013e0ef
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x57], 0
jns 0x14013e10b
mov rcx, qword [rsp + 0x40]
call fcn.140180390
lea rcx, [rsp + 0x58]
call fcn.1400560d0
jmp 0x14013e052
Function at 0x14013e010
Capabilities:
Delete directory

Disassembly:
jmp 0x14013dec0
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14013dee7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14013df1f
and eax, 0x410
cmp eax, 0x410
jne 0x14013df1f
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov rcx, rsi
add rsp, 0x1a8
pop rdi
pop rsi
jmp 0x14013e010
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14013df2b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14013df48
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14013df64
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x94
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14013dfe3
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x57], 0
jns 0x14013dfff
mov rcx, qword [rsp + 0x40]
call fcn.140180390
lea rcx, [rsp + 0x58]
call fcn.1400560d0
jmp 0x14013df46
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14013e037
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x14013e054
mov ecx, 2
call fcn.140055330
test al, al
jne 0x14013e070
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140180700
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.140055fe0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140006490
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14005fea0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14013e0ef
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140006490
cmp byte [rsp + 0x57], 0
jns 0x14013e10b
mov rcx, qword [rsp + 0x40]
call fcn.140180390
lea rcx, [rsp + 0x58]
call fcn.1400560d0
jmp 0x14013e052
Function at 0x1401478f0
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x140147949
cmp byte [rcx], 0x4d
jne 0x140147949
cmp byte [rcx + 1], 0x5a
jne 0x140147949
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x14014794b
cmp r9, rdx
jae 0x14014794b
cmp r9d, 0x40
jb 0x14014794b
mov r10d, r9d
and r10d, 7
test r10, r10
jne 0x14014794b
cmp byte [rcx + r9], 0x50
jne 0x140147949
cmp byte [rcx + r9 + 1], 0x45
jne 0x140147949
cmp byte [rcx + r9 + 2], 0
jne 0x140147949
cmp byte [rcx + r9 + 3], 0
je 0x14014794c
xor eax, eax
ret
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x14014794b
cmp rdx, 2
jb 0x14014794b
cmp word [rcx + r9], r8w
sete al
ret
Function at 0x14014ea40
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rsi, [rsp + 0x168]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x14014ea82
mov ecx, 1
call fcn.140055330
test al, al
jne 0x14014eab1
mov eax, dword [rsp + 0x188]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140180700
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xb1
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.140006490
mov rcx, rsi
call fcn.140055870
jmp 0x14014ea82
Function at 0x140165810
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rsi, [rcx + 0x18]
mov rcx, rsi
call fcn.140165ce0
lea r9, [rsp + 0x168]
mov r8d, 0x40
mov rcx, r14
mov rdx, rax
call fcn.14016a8c0
test al, al
je 0x1401658c4
movzx eax, word [rsp + 0x168]
cmp eax, 0x5a4d
jne 0x14016590d
mov rcx, rsi
call fcn.140165ce0
movsxd rdi, dword [rsp + 0x1a4]
add rdi, rax
mov r8d, 0x108
mov rcx, r14
mov rdx, rdi
mov r9, rbx
call fcn.14016a8c0
test al, al
je 0x140165956
cmp dword [rbx], 0x4550
jne 0x140165999
mov sil, 1
test r15, r15
je 0x140165a04
mov qword [r15], rdi
jmp 0x140165a04
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165a02
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x1401659d9
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165a02
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1401659d9
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165a02
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140165902
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165a02
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
call fcn.140006490
movzx r8d, byte [r14 + 0x17]
test r8b, r8b
jns 0x1401659ef
mov r8, qword [r14 + 8]
mov r14, qword [r14]
mov rcx, rax
mov rdx, r14
call fcn.140006490
mov rcx, rdi
call fcn.140055870
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140180700
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140165a30
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14020eb28]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rsi, [rcx + 0x18]
mov rcx, rsi
call fcn.140165ce0
lea r9, [rsp + 0x168]
mov r8d, 0x40
mov rcx, r14
mov rdx, rax
call fcn.14016a8c0
test al, al
je 0x140165ae4
movzx eax, word [rsp + 0x168]
cmp eax, 0x5a4d
jne 0x140165b2d
mov rcx, rsi
call fcn.140165ce0
movsxd rdi, dword [rsp + 0x1a4]
add rdi, rax
mov r8d, 0xf8
mov rcx, r14
mov rdx, rdi
mov r9, rbx
call fcn.14016a8c0
test al, al
je 0x140165b76
cmp dword [rbx], 0x4550
jne 0x140165bb9
mov sil, 1
test r15, r15
je 0x140165c24
mov qword [r15], rdi
jmp 0x140165c24
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165c22
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x140165bf9
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165c22
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140165bf9
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165c22
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140165b22
mov ecx, 1
call fcn.140055330
test al, al
je 0x140165c22
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400553e0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
call fcn.140006490
movzx r8d, byte [r14 + 0x17]
test r8b, r8b
jns 0x140165c0f
mov r8, qword [r14 + 8]
mov r14, qword [r14]
mov rcx, rax
mov rdx, r14
call fcn.140006490
mov rcx, rdi
call fcn.140055870
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140180700
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400613e0
Capabilities:
Log keystrokes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov cl, 1
xor eax, eax
lock cmpxchg byte [rdi + 0x10], cl
jne 0x14006142e
mov ebx, dword [rdi + 0x1d0]
xor ecx, ecx
mov al, 1
lock cmpxchg byte [rdi + 0x10], cl
jne 0x14006143f
call qword [sym.imp.user32.dll_GetForegroundWindow]
and ebx, 0x2002
cmp ebx, 2
jne 0x14006145e
cmp rax, rsi
je 0x14006145e
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14018f400
lea rcx, [rdi + 0x10]
mov r8d, 0x3b9aca00
call fcn.140269b40
jmp 0x1400613f8
add rdi, 0x10
mov rcx, rdi
xor edx, edx
call fcn.14026a240
call qword [sym.imp.user32.dll_GetForegroundWindow]
and ebx, 0x2002
cmp ebx, 2
je 0x14006141a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140072050
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp + 0x1c], 8
lea rdx, [rbp + 0x1c]
mov ecx, 0x67
mov r8d, 8
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 0x24], eax
test eax, eax
je 0x14007217f
lea rax, [rbp + 0x24]
mov qword [rbp - 0x10], rax
lea rax, [0x1402507e0]
mov qword [rbp - 8], rax
lea rax, str.Hata:_NtQuery___
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov rdi, rbp
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1402410a0
mov rcx, rdi
call fcn.140240b10
mov r8, rdx
test rax, rax
je 0x140072190
mov rcx, rax
mov qword [rbp], 1
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp - 0x20], 0x20
mov byte [rbp - 0x18], 3
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x30], rdi
lea rax, [0x140272750]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x50]
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], r8
call qword [r8 + 0x20]
test al, al
jne 0x1400721a9
mov rax, qword [rbp + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp]
movups xmmword [rsi], xmm0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
call qword [rax]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14007219b
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.1401047d0
jmp 0x14007219b
mov eax, dword [rbp + 0x20]
mov r8d, eax
shr r8d, 0xa
and r8d, eax
and r8d, 1
mov byte [rsi + 8], r8b
mov qword [rsi], 0
mov rax, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
lea rax, [0x140272808]
mov qword [rsp + 0x20], rax
lea rcx, [0x140272780]
lea r9, [0x1402729e8]
lea r8, [rbp - 0x10]
mov edx, 0x37
call fcn.14026cd70
ud2