joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011ef40
Capabilities:
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x178], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14011f037
lea rcx, [rsp + 0x68]
xor ebx, ebx
mov r8d, 0x110
xor edx, edx
call fcn.1401772e0
mov dword [rsp + 0x5c], 0x11c
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov qword [rsp + 0x60], 6
mov word [rsp + 0x170], 0
lea rcx, [rsp + 0x5c]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x14011f02c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x18
xor ecx, ecx
call fcn.14011f0a0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 1
lea rbx, [rsp + 0x40]
test byte [rsi], 1
je 0x14011f043
mov rsi, qword [rsi + 0x10]
jmp 0x14011f047
mov edi, 3
xor ebx, ebx
test byte [rsi], 1
jne 0x14011f031
add rsi, 2
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140174050
mov rax, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret

Function at 0x14011f470
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14011f520]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14011f4cb
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140174050
nop
add rsp, 0x68
pop rdi
pop rsi
ret
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, 0x1b
call fcn.140063850
lea rdx, str.platform_thread_
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov r8, rsi
call fcn.14006e2f0
lea rdx, [0x1401cd23a]
mov rcx, rdi
call fcn.1400146e0
mov rcx, rdi
call fcn.14006e420
jmp 0x14011f4b6
Function at 0x140120c10
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x140204338]
mov ecx, dword [0x140201350]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x30]
jg 0x140120ea2
mov rax, qword [0x140204330]
test rax, rax
je 0x140120d00
mov dword [rsp + 0x174], 0xaaaaaaaa
lea rdx, [rsp + 0x174]
mov rcx, rdi
call qword [0x1401ec708]
test eax, eax
je 0x140120caa
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x140120d07
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x140120d3c
mov ecx, 2
call fcn.140060510
test al, al
je 0x140120d00
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4d
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x40]
lea rdx, [0x1401c764a]
mov r8d, 0xe
call fcn.140001af0
mov rcx, rbx
call fcn.140061a90
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x30], 9
sete byte [rsi + 0x80]
movzx edx, byte [rsi + 0x81]
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
and dl, 1
mov rcx, rdi
mov r8, rsi
call fcn.140120ef0
test al, al
je 0x140120dc5
mov rdx, qword [rsi + 0x28]
cmp byte [rsi + 0x80], 1
jne 0x140120e31
mov rcx, rdi
mov r8, rsi
call fcn.140121220
test al, al
jne 0x140120e44
mov ecx, 2
call fcn.140060510
test al, al
je 0x140120e12
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22a
mov r9d, 2
call fcn.1400605e0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x140120e05
mov ecx, 2
call fcn.140060510
test al, al
je 0x140120e12
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x221
mov r9d, 2
call fcn.1400605e0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.140001af0
mov rcx, rsi
call fcn.140060b40
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140174050
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
mov r8, rsi
call fcn.140121940
test al, al
je 0x140120d7f
movzx edx, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.14011fff0
mov sil, 1
test al, al
jne 0x140120e14
mov ecx, 2
call fcn.140060510
test al, al
je 0x140120e12
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22f
mov r9d, 2
call fcn.1400605e0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x140120e05
lea rcx, [0x140204338]
call fcn.140173e10
cmp dword [0x140204338], 0xffffffff
jne 0x140120c5b
lea rcx, [0x1401b57ac]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14011f3f0
mov qword [0x140204330], rax
lea rcx, [0x140204338]
call fcn.140173ea8
jmp 0x140120c5b
Function at 0x1401298e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x170], rax
test dl, dl
je 0x14012996d
lea rax, [0x140146720]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x1401d3720]
lea r8, str.NtMapViewOfSection
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.140128e80
lea rax, [0x140146790]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.140128e80
jmp 0x140129978
cmp qword [rsi + 0x18], 0
je 0x140129af6
mov rax, qword [rsi]
mov rdi, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, rdi
xor edx, edx
mov r9d, 0x2000
call r13
mov r14, rax
mov r12, qword [rsi + 0x18]
shl r12, 6
lea rbx, [r12 + 0x60]
mov rcx, rbx
call fcn.140128d00
mov r15, rax
mov edx, r15d
and edx, 0xfffff000
add rdx, r14
and r15d, 0xfff
add r12, 0x105f
and r12, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, rdi
mov r8, r12
mov r9d, 0x1000
call r13
mov r14, rax
test rax, rax
je 0x140129b1e
add r14, r15
lea r15, [rsp + 0x68]
mov r8d, 0x108
mov rcx, r15
mov dl, 0xaa
call fcn.1401772e0
mov rcx, rsi
mov rdx, r15
mov r8, r14
mov r9, rbx
call fcn.140129f60
mov rax, qword [rsp + 0x168]
test rax, rax
je 0x140129b69
cmp rax, 1
jne 0x140129ae6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x108]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, 0x2a
test eax, eax
je 0x140129af8
cmp qword [rsp + 0x40], 0x20
jne 0x140129af8
mov dword [rsp + 0x60], 0xaaaaaaaa
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8, rbx
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp qword [rsp + 0x168], 1
jne 0x140129bb4
mov rcx, qword [rsi]
mov qword [rsp + 0x20], 0xa0
lea rdx, str.g_originals
lea r9, [0x1402043c0]
lea r8, [rsp + 0x68]
call fcn.140103d20
mov ebp, eax
jmp 0x140129af8
cmp rax, 2
jne 0x140129baf
mov ebp, dword [rsp + 0x68]
jmp 0x140129af8
xor ebp, ebp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140174050
mov eax, ebp
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.PatchNtdll
lea r8, str....._sandboxwin_srcinterception.cc
lea r12, [rsp + 0x68]
mov rcx, r12
mov r9d, 0x17d
call fcn.140063850
lea rdx, str.thunk_base
lea r13, [rsp + 0x38]
mov rcx, r13
mov r8d, 0xffffffff
mov r9, r12
call fcn.14006e190
mov rcx, r13
call fcn.14006e420
jmp 0x140129a00
lea rdx, str.has_value
lea r8, str....._base_typesexpected_internal.h
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r9d, 0xea
call fcn.140063850
lea rdx, str._is_moved_from__
lea rdi, [rsp + 0x60]
mov rcx, rdi
mov r8d, 0xffffffff
mov r9, rsi
call fcn.14006e190
mov rcx, rdi
call fcn.14006e420
call fcn.1400d85e0
call fcn.1400d85e0
int3
Function at 0x14012d140
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x30], rax
test rdx, rdx
je 0x14012d1e3
cmp dword [0x140204470], ecx
jg 0x14012d1e3
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
movsxd r12, eax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add r12, rsi
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
cmp rsi, r12
jae 0x14012d1d7
mov dword [rsp + 0x2c], 0
mov r8d, r12d
sub r8d, esi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rsi
mov r9, r14
call r15
test eax, eax
je 0x14012d1d7
mov eax, dword [rsp + 0x2c]
add rsi, rax
test eax, eax
jne 0x14012d1a0
test edi, edi
je 0x14012d1e3
cmp byte [r12 - 1], 0xa
jne 0x14012d1ff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140174050
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
xor eax, eax
lea rdi, [0x1401b19bf]
lea rbx, [rsp + 0x2c]
nop dword [rax + rax]
test rax, rax
jne 0x14012d1e3
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
mov r9, rbx
call r15
test eax, eax
je 0x14012d1e3
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14012d220
jmp 0x14012d1e3
Function at 0x140154070
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov edx, 0x200
mov r13, qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, 0xffffffff
lea rdi, [rsp + 0x28]
cmp rdx, 0x201
jae 0x1401540f0
jmp 0x1401540df
jae 0x14015416e
cmp rdx, 0x201
jae 0x1401540f0
mov rbx, rdx
lea r14, [rsp + 0x48]
mov r15d, 0x200
jmp 0x14015411c
sub rdx, qword [rsp + 0x38]
jb 0x1401541de
mov rcx, rdi
call fcn.140152af0
mov rbx, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
cmp rbx, rsi
cmovae rbx, rsi
mov qword [rsp + 0x38], rbx
mov r15, rbx
xor ecx, ecx
call r13
mov ecx, ebx
mov rdx, r14
call rbp
test eax, eax
jne 0x14015413d
mov r12d, eax
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
mov eax, r12d
test ecx, ecx
jne 0x14015418f
mov edx, eax
cmp rbx, rdx
jne 0x1401540d0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1401541ea
add rbx, rbx
cmp rbx, rsi
cmovae rbx, rsi
mov rdx, rbx
cmp rdx, 0x201
jb 0x1401540df
jmp 0x1401540f0
mov rax, rdx
cmp r15, rdx
jb 0x140154202
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, r14
mov r8, rax
call fcn.140153030
jmp 0x1401541b2
call fcn.140155860
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.140002470
mov rcx, rdi
call fcn.1401535d0
mov rax, rsi
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_std_src_syspalwindowsmod.rs
call fcn.1401af0a0
lea rcx, str.internal_error:_entered_unreachable_code_s
lea r8, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.1401af250
lea r8, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_std_src_syspalwindowsmod.rs
mov rcx, rax
mov rdx, r15
call fcn.1401af130
int3
Function at 0x140154220
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov rdi, qword [rdx + 8]
mov edx, 0x200
mov rbp, qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r13d, 0xffffffff
cmp rdx, 0x201
jae 0x1401542a0
jmp 0x14015428f
jae 0x140154324
cmp rdx, 0x201
jae 0x1401542a0
mov r14, rdx
lea r15, [rsp + 0x48]
mov r12d, 0x200
jmp 0x1401542ce
sub rdx, qword [rsp + 0x38]
jb 0x140154394
lea rcx, [rsp + 0x28]
call fcn.140152af0
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
cmp r14, r13
cmovae r14, r13
mov qword [rsp + 0x38], r14
mov r12, r14
xor ecx, ecx
call rbp
mov rcx, rdi
mov rdx, r15
mov r8d, r14d
call rsi
test eax, eax
jne 0x1401542f0
mov ebx, eax
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
mov eax, ebx
test ecx, ecx
jne 0x140154345
mov edx, eax
cmp r14, rdx
jne 0x140154280
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1401543a0
add r14, r14
cmp r14, r13
cmovae r14, r13
mov rdx, r14
cmp rdx, 0x201
jb 0x14015428f
jmp 0x1401542a0
mov rax, rdx
cmp r12, rdx
jb 0x1401543b8
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, r15
mov r8, rax
call fcn.140153030
jmp 0x140154368
call fcn.140155860
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.140002470
mov rcx, rdi
call fcn.1401535d0
mov rax, rsi
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_std_src_syspalwindowsmod.rs
call fcn.1401af0a0
lea rcx, str.internal_error:_entered_unreachable_code_s
lea r8, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.1401af250
lea r8, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_std_src_syspalwindowsmod.rs
mov rcx, rax
mov rdx, r12
call fcn.1401af130
int3
Function at 0x140155d60
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x1401d7ac0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140155d95
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x78], rcx
test r9, r9
mov qword [rsp + 0x70], r9
lea rcx, [rsp + 0x78]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x140155df7
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140155e2b
test eax, eax
js 0x140155e0b
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.140155cb0
mov rcx, rax
call fcn.14012e830
mov ecx, 7
int 0x29
ud2
Function at 0x14015e6c0
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x198
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x190], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14015ebd0
lea r9, [rsp + 0x150]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.14016aeb0
test al, al
je 0x14015e799
movzx eax, word [rsp + 0x150]
cmp eax, 0x5a4d
jne 0x14015e7df
mov rcx, r14
call fcn.14015ebd0
movsxd r14, dword [rsp + 0x18c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14016aeb0
test al, al
je 0x14015e872
cmp dword [rbx], 0x4550
jne 0x14015e8b1
mov sil, 1
test rdi, rdi
je 0x14015e853
mov qword [rdi], r14
jmp 0x14015e853
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015e851
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x14015e81f
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015e851
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
call fcn.140001af0
movzx r8d, byte [rsi]
test r8b, 1
je 0x14015e838
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x14015e83e
shr r8d, 1
inc rsi
mov rcx, rax
mov rdx, rsi
call fcn.140001af0
mov rcx, rdi
call fcn.140060b40
xor esi, esi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140174050
mov eax, esi
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015e851
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14015e7d7
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015e851
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14015e81f
Function at 0x14015e900
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x198
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x190], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14015ebd0
lea r9, [rsp + 0x150]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.14016aeb0
test al, al
je 0x14015e9d9
movzx eax, word [rsp + 0x150]
cmp eax, 0x5a4d
jne 0x14015ea1f
mov rcx, r14
call fcn.14015ebd0
movsxd r14, dword [rsp + 0x18c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14016aeb0
test al, al
je 0x14015eab2
cmp dword [rbx], 0x4550
jne 0x14015eaf1
mov sil, 1
test rdi, rdi
je 0x14015ea93
mov qword [rdi], r14
jmp 0x14015ea93
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015ea91
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x14015ea5f
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015ea91
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
call fcn.140001af0
movzx r8d, byte [rsi]
test r8b, 1
je 0x14015ea78
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x14015ea7e
shr r8d, 1
inc rsi
mov rcx, rax
mov rdx, rsi
call fcn.140001af0
mov rcx, rdi
call fcn.140060b40
xor esi, esi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140174050
mov eax, esi
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015ea91
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14015ea17
mov ecx, 1
call fcn.140060510
test al, al
je 0x14015ea91
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14015ea5f
Function at 0x140164640
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, r8
mov r8, rdx
mov rbx, rcx
mov rdi, qword [rsp + 0x98]
mov edx, dword [rsp + 0x90]
mov qword [rdi], 0
mov rcx, qword [rcx]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x30], 0
xor esi, esi
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1401646bf
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp r14, 0xffffffffffffffff
je 0x1401646ab
call fcn.140063870
mov rsi, r14
jmp 0x1401646ad
xor esi, esi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsi + 1]
cmp rax, 1
ja 0x1401646c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140164706
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rsi
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [rcx + rcx*4]
mov rax, rsi
inc rax
cmp rax, 2
jb 0x14016471f
call fcn.140063870
mov rcx, rsi
call fcn.140041930
mov eax, edi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1401875f4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14018773c

Function at 0x14018a770
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1401de0e8]
mov rbp, rcx
call fcn.1401a402c
xor edi, edi
test rax, rax
je 0x14018a856
mov ebx, edi
call fcn.14018a40c
mov r14d, dword [rax]
call fcn.14018a40c
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.1401900e0
mov rsi, rax
test rax, rax
je 0x14018a7e7
call fcn.14018a40c
mov dword [rax], r14d
jmp 0x14018a811
call fcn.14018a40c
cmp dword [rax], 0x22
jne 0x14018a84e
call fcn.14018a40c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1401900e0
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14018a84e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x14018a815
cmp rax, 3
je 0x14018a830
mov rcx, rsi
call fcn.14018a6cc
test al, al
je 0x14018a841
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14018a841
mov dil, 1
mov rcx, rbx
call fcn.140193770
mov al, dil
jmp 0x14018a858
mov rcx, rbx
call fcn.140193770
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140174050
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret