joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b0280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1401b0288
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x1401b02e6
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x1401b02c6
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.140114268
cmp eax, 0xffffffff
je 0x1401b0363
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1401b0304
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x1401b036d
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x1401b0340
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x1401b02c6
mov edi, edi
test rdi, rdi
jle 0x1401b0412
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.140114210
cmp eax, 0xffffffff
jne 0x1401b0342
mov edi, 0xffffffff
jmp 0x1401b02c6
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x1401b03fb
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1401b0363
mov rcx, qword [rsi + 0x40]
call fcn.140114268
cmp eax, 0xffffffff
je 0x1401b0363
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1401b037e
cmp eax, 2
je 0x1401b0363
cmp eax, 3
je 0x1401b0329
jmp 0x1401b0331
movzx edi, byte [rsp + 0x57]
jmp 0x1401b02c6
Function at 0x1401b0570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1401b0578
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x1401b05d6
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x1401b05b6
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.140114268
cmp eax, 0xffffffff
je 0x1401b065b
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1401b05f4
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1401b0664
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x1401b0635
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x1401b05b6
mov edi, edi
test rdi, rdi
jle 0x1401b0709
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.140114210
cmp eax, 0xffffffff
jne 0x1401b0637
mov di, 0xffff
jmp 0x1401b05b6
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x1401b06f2
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1401b065b
mov rcx, qword [rsi + 0x40]
call fcn.140114268
cmp eax, 0xffffffff
je 0x1401b065b
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1401b0675
cmp eax, 2
je 0x1401b065b
cmp eax, 3
je 0x1401b061b
jmp 0x1401b0625
movzx edi, word [rsp + 0x56]
jmp 0x1401b05b6
Function at 0x1401b7880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov r15b, byte [rbp + 0x78]
test byte [r9 + 8], 1
jne 0x1401b78df
movzx eax, word [rbp + 0x70]
movzx edx, r15b
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov word [rsp + 0x20], ax
mov rdx, r14
mov r8, rdi
call qword [rbx + 0x30]
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x140313e30]
call fcn.1400e5038
mov r12, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1401b7919
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rbp - 0x20]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [0x1402ae190]
movaps xmmword [r13], xmm0
mov rax, qword [r12]
xor r15b, 1
movzx esi, r15b
mov rcx, r12
mov rdx, r13
call qword [rax + rsi*8 + 0x28]
movzx ebx, byte [r13 + 0x17]
test bl, bl
mov rcx, qword [r13]
mov r8, qword [r13 + 8]
mov rax, rbx
cmovs rax, r8
test rax, rax
je 0x1401b79d1
test bl, bl
mov rsi, rcx
cmovns rsi, r13
test rdi, rdi
je 0x1401b79c0
movzx eax, word [rsi]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1401b79c4
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1401b7996
xor edi, edi
mov bl, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
add rsi, 2
test bl, bl
mov rax, r13
cmovs rax, rcx
movzx edx, bl
cmovs rdx, r8
lea rax, [rax + rdx*2]
cmp rsi, rax
jne 0x1401b7971
jmp 0x1401b79d1
xor edi, edi
jmp 0x1401b79a1
mov rbx, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [rbx + 0x60]
jmp 0x1401b798e
shr bl, 7
mov qword [r14], rdi
test bl, bl
je 0x1401b78cb
call fcn.140112038
jmp 0x1401b78cb

Function at 0x1401c7240
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
mov rcx, qword [r8]
cmovns rcx, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
cmovs rax, qword [r8 + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.1400d94d0
cmp byte [rsi + 0x17], 0
jns 0x1401c729b
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1400d94d0
cmp byte [rdi + 0x17], 0
jns 0x1401c72c0
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x1401c72df
mov rcx, qword [rsp + 0x48]
call fcn.140112038
cmp byte [rsp + 0x87], 0
jns 0x1401c72f3
mov rcx, qword [rsp + 0x70]
call fcn.140112038
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401ca500
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
sub r9, r8
je 0x1401ca53a
mov rdx, r9
shr rdx, 2
xor eax, eax
lea r10, [0x1402d0c00]
movzx r11d, dl
movzx esi, byte [r8 + rax]
xor esi, r11d
shr edx, 8
xor edx, dword [r10 + rsi*4]
inc rax
cmp r9, rax
jne 0x1401ca51d
jmp 0x1401ca53c
xor edx, edx
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret

Function at 0x1401d0100
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdx, str.DeleteEmptyKey
lea r8, str..._.._base_win_registry.cc
lea rbx, [rsp + 0x68]
mov rcx, rbx
mov r9d, 0x12a
call fcn.1400c0870
mov qword [rbx], 0
mov r9d, 0x20019
or r9d, dword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rbx
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x1401d018b
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x64]
mov dword [rax], 0
mov rcx, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1401d016e
mov ebx, 0x91
cmp dword [rsp + 0x64], 0
jne 0x1401d016e
mov r8d, dword [rdi + 8]
mov rcx, qword [rdi]
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
jmp 0x1401d016e

Function at 0x1401d0200
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.DeleteValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x20]
mov r9d, 0x145
call fcn.1400c0870
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1401ef0e0
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x1c0
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
lea r9, [rsp + 0x16c]
mov dword [r9], 0x44
xorps xmm0, xmm0
lea r8, [rsp + 0x170]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov dword [r8 + 0x40], 0
xor esi, esi
mov ecx, 0x16
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1401ef171
lea r8, [rsp + 0x168]
mov dword [r8], 0
lea rdx, [rsp + 0x170]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1401ef18c
cmp dword [rsp + 0x168], 0
setne sil
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
add rsp, 0x1c0
pop rsi
ret
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x1401ef1e2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_install_util.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x19e
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x38]
lea rdx, str.Failed_to_check_token_membership_for_WinLocalSystemSid.
mov r8d, 0x37
call fcn.1400ff874
mov rcx, rsi
call fcn.140183e60
xor esi, esi
jmp 0x1401ef171

Function at 0x140209583
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1402095ad
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402095ee
mov edi, eax
test bl, bl
jne 0x1402096a7
mov eax, edi
and eax, 0x400
je 0x1402096a7
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x1402095cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x81
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400ff874
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.1400c0b10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14020967c
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400ff874
cmp byte [rsp + 0x57], 0
jns 0x140209698
mov rcx, qword [rsp + 0x40]
call fcn.140112038
lea rcx, [rsp + 0x58]
call fcn.140183e60
jmp 0x1402095cf
and edi, 0x10
shr edi, 4
jmp 0x1402095d1
Function at 0x1402290b1
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14020b175
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14020b190
and eax, 0x410
cmp eax, 0x410
je 0x14020b284
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14020b19c
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x14020b1c5
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140115e50
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14020b27d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400ff874
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1400c0b10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14020b257
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400ff874
cmp byte [rsp + 0x4f], 0
jns 0x14020b273
mov rcx, qword [rsp + 0x38]
call fcn.140112038
lea rcx, [rsp + 0x50]
call fcn.140183e60
xor edi, edi
jmp 0x14020b1a9
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140115e50
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp 0x1402290b1
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1402290d9
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x140229107
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140115e50
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x1402290e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400ff874
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400c0b10
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x140229195
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1400ff874
cmp byte [rsp + 0x57], 0
jns 0x1402291b1
mov rcx, qword [rsp + 0x40]
call fcn.140112038
lea rcx, [rsp + 0x58]
call fcn.140183e60
jmp 0x1402290e5
Function at 0x14025a8d5
Capabilities:
Encode data using xor

Disassembly:
push rsi
test rdx, rdx
je 0x14025a919
movzx r10d, byte [rdx]
mov r11d, r10d
shl r11d, 5
sub r11d, r10d
sub r11d, r10d
test r10d, r10d
je 0x14025a91c
inc rdx
movsx r10d, r10b
mov eax, r11d
shl eax, 5
mov esi, r11d
shr esi, 3
add esi, eax
add esi, r10d
xor r11d, esi
mov r10b, byte [rdx]
inc rdx
test r10b, r10b
jne 0x14025a8f4
jmp 0x14025a91c
xor r11d, r11d
mov eax, r11d
shl eax, 5
mov r10d, r11d
shr r10d, 3
add r10d, eax
xor r10d, r11d
test r8, r8
je 0x14025a95e
mov al, byte [r8]
test al, al
je 0x14025a95e
inc r8
movsx eax, al
mov edx, r10d
shl edx, 5
mov esi, r10d
shr esi, 3
add esi, eax
add esi, edx
xor r10d, esi
mov al, byte [r8]
inc r8
test al, al
jne 0x14025a93e
mov edx, r10d
shl edx, 5
mov eax, r10d
shr eax, 3
add eax, edx
xor eax, r10d
test r9, r9
je 0x14025a99d
mov dl, byte [r9]
test dl, dl
je 0x14025a99d
inc r9
movsx r8d, dl
mov esi, eax
shl esi, 5
mov edx, eax
shr edx, 3
add edx, r8d
add edx, esi
xor eax, edx
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x14025a97e
xor edx, edx
div dword [rcx + 8]
mov eax, edx
pop rsi
ret

Function at 0x14025eb8e
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x14025ebd9
cmp byte [rcx], 0x4d
jne 0x14025ebd9
cmp byte [rcx + 1], 0x5a
jne 0x14025ebd9
mov r9d, dword [rcx + 0x3c]
xor eax, eax
test r9b, 7
jne 0x14025ebdb
cmp r9d, 0x40
jb 0x14025ebdb
cmp r9, rdx
jae 0x14025ebdb
mov r10, rdx
sub r10, r9
cmp r10, 0x18
jb 0x14025ebdb
cmp byte [rcx + r9], 0x50
jne 0x14025ebd9
cmp byte [rcx + r9 + 1], 0x45
jne 0x14025ebd9
cmp byte [rcx + r9 + 2], 0
je 0x14025ebdc
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x14025ebd9
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x14025ebdb
cmp rdx, 2
jb 0x14025ebdb
cmp word [rcx + r9], r8w
sete al
jmp 0x14025ebdb
Function at 0x140286ab8
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1402ae190]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.1402753b0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.14028602a
test al, al
je 0x140286b7f
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140286c0b
mov rcx, rdi
call fcn.1402753b0
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.14028602a
test al, al
je 0x140286c50
cmp dword [r15], 0x4550
jne 0x140286c8f
mov sil, 1
test r14, r14
je 0x140286bea
mov qword [r14], rdi
jmp 0x140286bea
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140286be8
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14019a740
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1400ff874
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140286bd5
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400ff874
mov rcx, rdi
call fcn.140001d00
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140286be8
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14019a740
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140286bbf
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140286be8
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14019a740
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140286bb9
mov ecx, 1
call fcn.1400f34e0
test al, al
je 0x140286be8
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14019a740
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140286bbf

Function at 0x140291af0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140291b27
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140291b01
ret

Function at 0x140291b80
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140291bb8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140291b91
ret
Function at 0x140006520
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x848
mov rax, qword [0x140036150]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov dil, dl
lea r9, [r11 + 0x20]
mov ebx, ecx
mov ebp, 0x3ff
mov edx, ebp
lea rcx, [rsp + 0x30]
call fcn.140002218
xor esi, esi
test eax, eax
js 0x1400065d2
movsxd rcx, eax
cmp rcx, rbp
ja 0x1400065d2
movzx eax, byte [rsp + 0x42f]
cmove eax, esi
mov byte [rsp + 0x42f], al
test dil, dil
je 0x1400065c1
mov ecx, ebx
call fcn.1400065f8
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, str._hs__HRESULT__0x_08x____hs_
mov dword [rsp + 0x20], ebx
lea edx, [rbp + 1]
lea rcx, [rsp + 0x430]
call fcn.140006eb8
test eax, eax
js 0x1400065d2
lea rcx, [rsp + 0x430]
jmp 0x1400065c6
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140001450
add rsp, 0x848
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007e20
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x448
mov rax, qword [0x140036150]
xor rax, rsp
mov qword [rsp + 0x430], rax
cmp dword [0x140036808], 0
jne 0x140007f01
mov dword [0x140036808], 1
mov r9, rcx
lea rcx, [rsp + 0x30]
test r8, r8
je 0x140007e79
mov qword [rsp + 0x28], r8
lea r8, str.Assertion_failed_in__hs__i__n_hs
mov dword [rsp + 0x20], edx
mov edx, 0x400
call fcn.140006eb8
jmp 0x140007e8e
mov dword [rsp + 0x20], edx
lea r8, str.Assertion_failed_in__hs__i_
mov edx, 0x400
call fcn.140006eb8
test eax, eax
js 0x140007ec5
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea r9, str.ASSERT:__hs
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x4000000
call fcn.1400066ac
jmp 0x140007eee
lea rcx, str.Assert_failed_to_build_string.
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
nop dword [rax + rax]
lea r9, str.ASSERT:_Assert_failed_to_build_string.
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call fcn.1400066ac
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_DebugBreak]
nop dword [rax + rax]
and dword [0x140036808], 0
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140001450
add rsp, 0x448
ret