joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024fa0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140200380]
cmp rdi, 1
jbe 0x140024fc9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400b2380
lea rcx, [0x140200380]
call fcn.14000d630
test al, al
je 0x14002500f
mov qword [0x140200388], 0
lea rbx, [0x140200380]
lea rdi, [0x140200388]
mov rcx, rdi
xor edx, edx
call fcn.14000d6e0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14000d5b0
jmp 0x140024fb7
mov rdi, qword [0x140200380]
jmp 0x140024fb7

Function at 0x1400250e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401feb78]
cmp rdi, 1
jbe 0x14002512a
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140025170
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401feb78]
call fcn.14000d630
test al, al
je 0x14002517c
mov qword [0x1401feb80], 0
lea rbx, [0x1401feb78]
lea rdi, [0x1401feb80]
mov rcx, rdi
xor edx, edx
call fcn.14000d6e0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14000d5b0
jmp 0x1400250f7
test rsi, rsi
je 0x140025122
call fcn.140001340
jmp 0x140025109
mov rdi, qword [0x1401feb78]
jmp 0x1400250f7

Function at 0x140026960
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140200af8]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140026995
lea rcx, [0x140200af0]
add rsp, 0x28
jmp fcn.1400e6e80
lea rcx, [0x140200af8]
call fcn.1400f0548
cmp dword [0x140200af8], 0xffffffff
jne 0x140026985
mov qword [0x140200af0], 0
lea rcx, [0x140200af0]
xor edx, edx
call fcn.14000d6e0
lea rcx, [0x140200af8]
call fcn.1400f07ac
jmp 0x140026985

Function at 0x140026ad0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
lea rax, [0x1401cdcd0]
mov qword [rcx], rax
lea rax, [rcx + 0x20]
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x140026b54
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x140026b5f
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140026b4c
mov qword [rsi + 0x18], rdi
call fcn.1400c18d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400c18d0
mov rcx, qword [rsi + 0x18]
call fcn.1400def50
mov qword [rsi + 0x18], 0
jmp 0x140026b39
Function at 0x140029220
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140200b40], 0
jne 0x14002925d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140029250
mov dword [rdi], eax
mov dword [0x140200b48], eax
mov qword [0x140200b40], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x14002c130
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rax, qword [rcx]
jne 0x14002c22f
test rax, rax
jne 0x14002c22f
cmp dword [rsi + 0x14], 0
jne 0x14002c22d
xor eax, eax
cmp qword [rsi + 8], 0
mov edx, 0
jne 0x14002c22f
mov rdi, qword [r14]
cmp rdx, rdi
je 0x14002c1ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002c1fc
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002c19f
mov qword [rsi], rdi
call fcn.1400c18d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi + 8]
mov rdi, qword [r14 + 8]
cmp rax, rdi
je 0x14002c1e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14002c215
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002c1dc
mov qword [rsi + 8], rdi
call fcn.1400c18d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [r14 + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [r14 + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400c18d0
mov rcx, qword [rsi]
call fcn.1400def50
mov qword [rsi], 0
jmp 0x14002c18d
call fcn.1400c18d0
mov rcx, qword [rsi + 8]
call fcn.1400def50
mov qword [rsi + 8], 0
jmp 0x14002c1c9
xor eax, eax
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x14002c277
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jae 0x14002c25a
mov rdx, rax
mov qword [rsi + 0x10], 0
mov rax, rcx
jmp 0x14002c171
call fcn.1400c18d0
mov rcx, qword [rsi + 8]
call fcn.1400def50
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
jmp 0x14002c247
call fcn.1400c18d0
mov rcx, qword [rsi]
call fcn.1400def50
mov qword [rsi], 0
xor eax, eax
jmp 0x14002c239

Function at 0x14002d930
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1400f080c
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002e1c0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140003880
test al, al
je 0x14002e1ee
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14002e20f
mov rcx, rdi
call fcn.14002e2e0
mov rcx, rdi
call fcn.1400f0498
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x14002e2a4
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x14002e232
call fcn.1400dec10
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
jne 0x14002e2b2
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x14002e266
call fcn.1400c18d0
mov rcx, qword [rsi + 0x28]
call fcn.1400def50
mov qword [rsi + 0x28], 0
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x14002e2c7
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jb 0x14002e296
call fcn.1400c18d0
mov rcx, qword [rsi + 0x18]
call fcn.1400def50
mov qword [rsi + 0x18], 0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14002e320
mov qword [rsi + 0x60], rcx
call fcn.1400f0498
jmp 0x14002e21c
mov rcx, rdi
call fcn.14002e2e0
mov rcx, rdi
call fcn.1400f0498
jmp 0x14002e243
call fcn.1400c18d0
mov rcx, qword [rsi + 0x20]
call fcn.1400def50
mov qword [rsi + 0x20], 0
jmp 0x14002e273

Function at 0x14002ec30
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401fe5e8]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002ec8c
movzx eax, word [0x1401fe5b8]
cmp ax, 9
jne 0x14002ecee
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401fe5e8]
call fcn.1400f0548
cmp dword [0x1401fe5e8], 0xffffffff
jne 0x14002ec65
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x1401fe5d8], xmm2
movups xmmword [0x1401fe5c8], xmm1
movups xmmword [0x1401fe5b8], xmm0
lea rcx, [0x1401fe5e8]
call fcn.1400f07ac
jmp 0x14002ec65
xor esi, esi
test ax, ax
je 0x14002ec77
cmp ax, 6
jne 0x14002ed05
mov esi, 2
jmp 0x14002ec77
cmp ax, 0xc
jne 0x14002ed15
mov esi, 3
jmp 0x14002ec77
mov esi, 4
jmp 0x14002ec77
Function at 0x140030180
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003024d
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140030215
cmp eax, 0xffffffff
je 0x140030226
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x140030229
mov eax, dword [rsp + 0x2c]
jmp 0x1400301f5
int3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400301e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400301f7
Function at 0x140034b10
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp byte [rcx + 0x6c], 0
je 0x140034ca4
mov r12, rdx
lea rdx, [rsp + 0x50]
mov qword [rdx], 0
call fcn.140034cd0
test eax, eax
jne 0x140034cab
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x48]
mov qword [r8], rbp
mov r14, qword [rsp + 0x50]
mov rcx, r14
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x140034cb4
mov rbx, qword [rsp + 0x48]
xor r15d, r15d
test rbx, rbx
je 0x140034c7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x140034c9d
call fcn.1400c18d0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rsi, [rsp + 0x40]
mov qword [rsi], rbp
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rdi
mov rbp, rax
call rdi
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0xf01ff
mov rcx, rax
mov rdx, rbx
mov r8, rbp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140034cbe
mov rdi, qword [rsp + 0x40]
xor ebp, ebp
cmp qword [r12], rdi
je 0x140034c2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [r12]
inc rax
cmp rax, 2
jae 0x140034c82
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140034c27
mov qword [r12], rdi
call fcn.1400c18d0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140034c46
call fcn.1400c18d0
mov rcx, rbx
call fcn.1400def50
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140034c5d
call fcn.1400c18d0
mov rcx, r14
call fcn.1400def50
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebp
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x140034bb0
call fcn.1400c18d0
mov rcx, qword [r12]
call fcn.1400def50
mov qword [r12], 0
jmp 0x140034c14
xor ebx, ebx
jmp 0x140034ba8
mov ebp, 0x3f0
jmp 0x140034c5d
mov ebp, eax
mov r14, qword [rsp + 0x50]
jmp 0x140034c46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x140034c46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x140034c2f
Function at 0x140035c80
Capabilities:
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, qword [0x1401fcbd0]
test rdi, rdi
je 0x140035cd5
lea rbx, [0x1401d3333]
mov rcx, rdi
mov rdx, rbx
call fcn.1400eaf60
test al, al
jne 0x140035d05
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1400eaf60
test al, al
jne 0x140035d05
mov eax, dword [rsi]
mov dword [0x1401f6f48], eax
mov bl, 1
test al, 1
jne 0x140035dbb
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
cmp qword [0x1401fcbd8], 0
jne 0x140035e4c
mov rax, qword [0x1401fcbe0]
mov qword [0x1401fcbd8], rax
mov ecx, 0x20
call fcn.1400f045c
mov r14, rax
lea rax, str.vmodule
lea r8, [rsp + 0x50]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea r15, [rsp + 0x60]
mov rcx, rdi
mov rdx, r15
call fcn.1400dea30
lea r8, [rsp + 0x28]
mov qword [r8], rbx
mov qword [r8 + 8], 1
lea rbx, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.1400dea30
lea r9, [0x1401fcbe8]
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401430d0
mov qword [0x1401fcbe0], r14
cmp byte [rbx + 0x17], 0
jns 0x140035da1
mov rcx, qword [rsp + 0x38]
call fcn.1400f0498
cmp byte [rsp + 0x77], 0
jns 0x140035cd5
mov rcx, qword [rsp + 0x60]
call fcn.1400f0498
jmp 0x140035cd5
mov rcx, qword [0x1401fcbf8]
test rcx, rcx
jne 0x140035dd5
mov rcx, qword [0x1401fcbf0]
test rcx, rcx
je 0x140035df9
jmp 0x140035e1b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401fcbf8], 0
mov rcx, qword [0x1401fcbf0]
test rcx, rcx
jne 0x140035e1b
and byte [0x1401f6f48], 0xfe
mov ecx, 0x18
call fcn.1400f045c
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1401fcbf0], rax
mov rdx, qword [rsi + 8]
call fcn.1400dad60
cmp dword [rsi + 0x14], 0
jne 0x140035e40
mov rcx, qword [0x1401fcbf0]
cmp byte [rcx + 0x17], 0
jns 0x140035e3a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140143320
mov ebx, eax
jmp 0x140035ce7
int3
Function at 0x140037280
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
mov eax, 0xffffffff
cmovb eax, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400372e8
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
je 0x1400372f1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
mov rsi, 0xffffffffffffffff
jmp 0x1400372d1
int3
Function at 0x140038e10
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140038ee9
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x40]
mov qword [r14], 0
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbp
mov rbx, rax
call rbp
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, rbx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x140038eed
mov rbx, qword [rsp + 0x40]
cmp qword [rsi], rbx
je 0x140038eb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140038ed3
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140038eac
mov qword [rsi], rbx
call fcn.1400c18d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400c18d0
mov rcx, qword [rsi]
call fcn.1400def50
mov qword [rsi], 0
jmp 0x140038e9a
mov bl, 1
jmp 0x140038eb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x140038eac
Function at 0x140038fe0
Capabilities:
Patch process command line

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov r14, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x1402009d8]
test rax, rax
je 0x140039139
mov rax, qword [0x1402009d8]
test rax, rax
je 0x140039175
mov rcx, qword [0x1402009d8]
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003917b
mov rsi, rax
movups xmm0, xmmword [0x1401df288]
lea r8, [rsp + 0x70]
movaps xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [0x1401df278]
movaps xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [0x1401df268]
movaps xmmword [r8], xmm0
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, r14
xor edx, edx
mov r9d, 0x30
call rax
test eax, eax
jne 0x140039119
xorps xmm0, xmm0
lea r8, [rsp + 0x40]
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
xor edi, edi
mov qword [r8 + 0x20], rdi
lea rbx, [rsp + 0x38]
mov qword [rbx], rdi
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rbx
mov r9d, 0x28
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140039119
cmp qword [rsp + 0x38], 0x28
jne 0x140039119
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x36]
mov word [rsi], 0
mov qword [rsp + 0x20], rbx
mov r9d, 2
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [rsi]
mov dl, byte [rsi + 1]
xor cl, 0x4d
xor dl, 0x5a
xor ebx, ebx
or dl, cl
cmovne rdi, rbx
cmp qword [rsp + 0x38], 2
cmovne rdi, rbx
test eax, eax
cmove rdi, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400f32c0
mov rax, rdi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401df2a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
lea rax, [0x1401c9c58]
lea rcx, [rsp + 0x70]
mov qword [rcx], rax
mov qword [rcx + 8], rsi
call fcn.140014f00
test al, al
je 0x140039180
xor eax, eax
lock cmpxchg qword [0x1402009d8], rsi
jmp 0x140039011
int3
int3
int3
Function at 0x140039870
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r14, rdx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, dword [rcx + 0x54]
cmp edx, 5
je 0x140039966
lea rax, [rsp + 0x38]
mov qword [rax], 0
mov rbx, qword [rcx + 0x60]
mov r9d, dword [rcx + 0x58]
mov qword [rsp + 0x20], rbx
mov rcx, rax
xor r8d, r8d
call fcn.140039a40
test eax, eax
jne 0x14003998a
lea rcx, [rsp + 0x38]
lea rdi, [rsp + 0x30]
mov rdx, rdi
call fcn.1400399e0
mov rbx, qword [rdi]
mov qword [rdi], 0
lea rsi, [rbx + 1]
cmp rsi, 2
jb 0x1400398ee
call fcn.1400c18d0
cmp qword [r14], rbx
je 0x14003991d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [r14]
inc rax
cmp rax, 2
jae 0x140039950
cmp rsi, 2
jb 0x140039915
mov qword [r14], rbx
call fcn.1400c18d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
inc rax
cmp rax, 2
jae 0x140039991
xor edi, edi
lea rcx, [rsp + 0x38]
call fcn.1400399b0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400c18d0
mov rcx, qword [r14]
call fcn.1400def50
mov qword [r14], 0
jmp 0x140039907
mov rax, qword [r14]
xor edi, edi
inc rax
cmp rax, 2
jb 0x140039937
call fcn.1400c18d0
mov rcx, qword [r14]
call fcn.1400def50
mov qword [r14], 0
jmp 0x140039937
mov edi, 0x2f
jmp 0x14003992d
call fcn.1400c18d0
mov rcx, qword [rsp + 0x30]
call fcn.1400def50
jmp 0x14003992b
Function at 0x140039a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15, qword [rsp + 0x120]
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x140039bf5
mov edi, r9d
mov r14d, edx
mov rsi, rcx
xor ecx, ecx
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rbx, rax
cmp qword [rsi], rax
je 0x140039acc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140039bd2
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140039ac1
mov qword [rsi], rbx
call fcn.1400c18d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi]
lea rax, [rbx + 1]
cmp rax, 1
jbe 0x140039bfc
xor ebp, ebp
lea rcx, [rsp + 0x30]
mov r8d, 0x90
xor edx, edx
call fcn.1400f5b50
mov dword [rsp + 0x28], 0
test r14d, r14d
jne 0x140039bac
mov dword [rsp + 0x40], 0x400
mov ebp, 0x400
mov eax, 0xff
or ebp, 8
mov dword [rsp + 0x58], 1
mov edx, eax
mov ecx, ebp
mov dword [rsp + 0x28], edx
mov ebp, edx
test r15, r15
je 0x140039b39
or ecx, 0x100
mov qword [rsp + 0xa0], r15
or ecx, 0x2000
lea r8, [rsp + 0x30]
mov dword [r8 + 0x10], ecx
mov rcx, rbx
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x140039beb
not edi
and ebp, edi
lea r8, [rsp + 0x28]
mov dword [r8], ebp
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x140039beb
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec r14d
cmp r14d, 3
ja case.default.0x140039bcf
mov edx, 0xc8
mov eax, 0xd8
lea rcx, [0x140039c30]
movsxd r8, dword [rcx + r14*4]
add r8, rcx
xor ecx, ecx
jmp r8
call fcn.1400c18d0
mov rcx, qword [rsi]
call fcn.1400def50
mov qword [rsi], 0
jmp 0x140039aad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140039b8a
mov esi, 0x4df
jmp 0x140039b8a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400f32c0
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa0
jmp 0x140039b8a
Function at 0x14003e9f0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor r14d, r14d
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14003ea88
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x14003eb60
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400aa980]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14003ebb9
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f32c0
nop
add rsp, 0x40
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.140163f80
mov rcx, rsi
call fcn.140163fa0
lea rdx, [0x1401de628]
mov r8d, 0xc
mov rcx, rax
call fcn.1400d6670
mov rcx, rsi
call fcn.140163fb0
jmp 0x14003eba5

Function at 0x14003f820
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401c8a80]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x1401d1461]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x3ba
call fcn.1400d4e70
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d4e90
cmp byte [rdi + 0x17], 0
jns 0x14003f896
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rsi
call fcn.1400dcae0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret