joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004a530
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x14004a560
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.140133524
lea eax, [rax + rax]
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov r9d, 1
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004a7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx], 0
je 0x14004a8f2
cmp dword [rsi + 8], 0
js 0x14004a8f2
lea r15, [rsi + 0x10]
mov rbx, qword [rsi + 0x28]
mov edx, ebx
mov dword [rsp + 0x44], ebx
lea r14, [rsi + 0x30]
mov eax, dword [rsi + 0x38]
mov rdi, qword [rsi + 0x30]
sub eax, edi
add eax, 0xfffffffe
and eax, 0xfffffffe
lea r12, [rsi + 0x48]
mov dword [rsi + 0x48], eax
lea r13, [rsi + 0x4c]
mov rcx, r15
call fcn.1400445c0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x14004a8ee
mov edx, dword [rsi + 0x48]
add rdx, 1
shr rdx, 1
add edx, 1
mov rdi, qword [rsi + 0x30]
mov rax, qword [rsi + 0x38]
sub rax, rdi
mov rcx, rax
sar rcx, 1
cmp rcx, rdx
jae 0x14004a8a1
mov word [rsp + 0x42], 0
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x42]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rcx, r14
call fcn.14004aca0
mov rdi, qword [rsi + 0x30]
mov rax, qword [rsi + 0x38]
sub rax, rdi
add eax, 0xfffffffe
and eax, 0xfffffffe
mov dword [rsi + 0x48], eax
cmp dword [rsp + 0x44], ebx
mov edx, 0x4000
cmovne edx, ebx
mov dword [rsp + 0x44], edx
mov rcx, r15
call fcn.1400445c0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14004a936
lea rax, [rsi + 0x10]
cmp qword [rsi + 0x28], 8
jb 0x14004a900
mov rax, qword [rax]
mov word [rax], 0
mov rax, qword [rsi + 0x30]
mov word [rax], 0
mov dword [rsi + 0x48], 0
xor esi, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r12]
add rax, 1
and rax, 0xfffffffffffffffe
mov rcx, qword [r14]
mov word [rcx + rax], 0
mov sil, 1
jmp 0x14004a917

Function at 0x14004aa40
Capabilities:
Query or enumerate registry value

Disassembly:
add dword [rcx + 8], 0xffffffff
jmp fcn.14004a7b0
Function at 0x14004aa70
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rax, r8
mov rsi, rcx
mov rcx, qword [0x14017b750]
xor rcx, rsp
mov qword [rsp + 0x70], rcx
or r9d, 0x20019
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rdx
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004aaf5
mov dword [rsp + 0x60], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14004ab17
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14011a890
nop
add rsp, 0x78
pop rdi
pop rsi
ret
mov edx, dword [rsp + 0x60]
add edx, 0xffffffff
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004aafc
test edx, edx
js 0x14004aafc
mov dword [rsp + 0x6c], 0x104
lea r8, [rsi + 0xc]
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x6c]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004aafc
jmp 0x14004ab02

Function at 0x14004ac10
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 8]
lea edx, [rax - 1]
mov dword [rcx + 8], edx
test eax, eax
jle 0x14004ac77
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004ac77
mov dword [rsp + 0x54], 0x104
add rsi, 0xc
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x54]
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004ac7b
jmp 0x14004ac80
add rsi, 0xc
mov word [rsi], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14011a890
nop
add rsp, 0x60
pop rsi
ret
Function at 0x14004ce08
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0
cmp qword [rcx + 0x18], 7
jbe 0x14004ce46
mov rcx, qword [rsi]
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14004cefb
mov rcx, rsi
call fcn.140035100
movzx eax, al
mov r8d, 5
sub r8d, eax
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14004ce7c
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14004cf56
lea rcx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
mov edx, 0x3a
call fcn.140037730
mov dil, 1
test eax, eax
jle 0x14004cfcc
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rbx, [rsp + 0x58]
mov r8d, 0x5d
mov r9d, 0xffffffff
mov rcx, rbx
call fcn.1400377b0
lea rcx, [rsp + 0x60]
lea rdx, str.Scheduled_for_deletion:
call fcn.140002c8d
cmp qword [rsi + 0x18], 7
jbe 0x14004cee3
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140038e50
mov rcx, rbx
call fcn.140037c30
jmp 0x14004cfcc
mov ecx, 1
call fcn.140037700
test al, al
je 0x14004cfca
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rdi, [rsp + 0x58]
mov r8d, 0x3e
mov r9d, 1
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x68]
cmp qword [rsi + 0x18], 7
jbe 0x14004cf45
mov rsi, qword [rsi]
mov rdx, rsi
call fcn.140038e50
lea rdx, str._does_not_exist.
jmp 0x14004cfba
mov ecx, 2
call fcn.140037700
test al, al
je 0x14004cfca
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rdi, [rsp + 0x58]
mov r8d, 0x49
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x68]
lea rdx, str.Could_not_schedule
call fcn.140002c8d
cmp qword [rsi + 0x18], 7
jbe 0x14004cfa8
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140038e50
lea rdx, str._for_deletion.
mov rcx, rax
call fcn.140002c8d
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004d7e7
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x80], rax
call fcn.14004d972
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
lea rdi, [rsp + 0x68]
mov rdx, 0xffffffff80000002
mov r9d, 1
mov rcx, rdi
call fcn.1400494f0
mov rbx, qword [rdi]
test rbx, rbx
je 0x14004d8f8
lea r14, [rsp + 0x64]
mov dword [r14], 0
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov edx, 1
mov rcx, rdi
mov r8, rdi
call fcn.14004e32e
mov rax, qword [rdi]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14004d8ff
cmp eax, 0xea
jne 0x14004d8e8
mov edi, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x14004d904
mov edx, dword [rsp + 0x64]
test dl, 1
jne 0x14004d904
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8, rdi
call fcn.14004e32e
mov rax, qword [rdi]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004d959
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14004d904
mov edi, 0x80070002
jmp 0x14004d930
mov edi, 0x80070002
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14004d930
lea rsi, [rsp + 0x40]
mov r8, qword [rsi + 0x10]
sub r8, rdx
mov rcx, rsi
call fcn.140006904
xorps xmm0, xmm0
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
lea rcx, [rsp + 0x68]
call fcn.140049730
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov r8, rsi
call fcn.14004d46a
mov edi, eax
jmp 0x14004d904
Function at 0x140051a40
Capabilities:
Delete directory

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp qword [rcx + 0x30], 0
je 0x140051a9b
lea r12, [rsi + 0x20]
lea rbx, [rsp + 0x140]
mov rcx, r12
mov rdx, rbx
call fcn.14002fcd0
mov dl, 1
mov rcx, r12
call fcn.140034570
test al, al
je 0x140051ae9
xor ebp, ebp
jmp 0x140051b68
mov ecx, 2
call fcn.140037700
test al, al
je 0x140051ae2
lea rdx, str..._.._chrome_installer_util_self_cleaning_temp_dir.cc
lea rsi, [rsp + 0x30]
mov r8d, 0x48
mov r9d, 2
mov rcx, rsi
call fcn.1400377b0
lea rcx, [rsp + 0x38]
lea rdx, str.Attempting_to_Delete_an_uninitialized_SelfCleaningTempDir.
call fcn.140002c8d
mov rcx, rsi
call fcn.140037c30
xor esi, esi
jmp 0x140051ca9
mov ecx, 1
call fcn.140037700
test al, al
je 0x140051b55
lea rdx, str..._.._chrome_installer_util_self_cleaning_temp_dir.cc
lea rdi, [rsp + 0x30]
mov r8d, 0x54
mov r9d, 1
mov rcx, rdi
call fcn.1400377b0
lea rcx, [rsp + 0x38]
lea rdx, str.Failed_to_delete_temporary_directory
call fcn.140002c8d
cmp qword [rsi + 0x38], 7
mov rdx, r12
jbe 0x140051b36
mov rdx, qword [rsi + 0x20]
mov rcx, rax
call fcn.140038e50
lea rdx, str.._Scheduling_for_deletion_at_reboot.
mov rcx, rax
call fcn.140002c8d
mov rcx, rdi
call fcn.140037c30
mov rcx, r12
call fcn.14004cfe9
mov bpl, 1
test al, al
je 0x140051c9a
cmp qword [rsi + 0x10], 0
je 0x140051c61
mov r14, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [rsp + 0x30]
lea r13, str.Error_removing_directory
jmp 0x140051bad
mov rcx, rbx
mov rdx, rdi
call fcn.14002fcd0
mov rcx, rbx
mov rdx, rdi
call fcn.14002ef10
mov rcx, rdi
call fcn.14002ee30
test bpl, 1
jne 0x140051c46
cmp qword [rsp + 0x158], 7
mov rcx, rbx
jbe 0x140051bcd
mov rcx, qword [rsp + 0x140]
call r14
test eax, eax
jne 0x140051c4e
mov ecx, 1
call fcn.140037700
mov bpl, 1
test al, al
je 0x140051c46
call r15
cmp eax, 0x91
je 0x140051c46
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov r8d, 0x61
mov r9d, 1
mov rcx, rdi
lea rdx, str..._.._chrome_installer_util_self_cleaning_temp_dir.cc
call fcn.140038c40
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.140002c8d
cmp qword [rsp + 0x158], 7
mov rdx, rbx
jbe 0x140051c36
mov rdx, qword [rsp + 0x140]
mov rcx, rax
call fcn.140038e50
mov rcx, rdi
call fcn.140038d80
mov rcx, rbx
call fcn.14004ce08
mov rcx, rbx
mov rdx, rsi
call fcn.14002efb0
test al, al
je 0x140051b8f
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x140051c6e
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0
mov word [rax], 0
cmp qword [rsi + 0x38], 8
jb 0x140051c86
mov r12, qword [r12]
mov qword [rsi + 0x30], 0
mov word [r12], 0
mov sil, 1
jmp 0x140051c9c
xor esi, esi
lea rcx, [rsp + 0x140]
call fcn.14002ee30
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140052fea
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor edi, edi
test eax, eax
je 0x14005305e
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x14005305e
mov rcx, rsi
call fcn.140009fa8
mov edx, 1
mov r8w, 0x2e
mov rcx, rsi
call fcn.14001af4c
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14000a134
mov dil, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x238
pop rdi
pop rsi
ret
Function at 0x14005f3c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
movdqa xmmword [rsp + 0x70], xmm6
mov r14, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ecx, edx
call fcn.14005f594
mov ebx, eax
mov rcx, qword [0x14017c910]
test rcx, rcx
je 0x14005f414
mov rax, qword [rcx]
mov rdx, r14
mov r8d, ebx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005f570
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], 0
call fcn.14005f5ff
add ebx, dword [0x14017c938]
mov r15, qword [0x140182148]
mov eax, ebx
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14005f53d
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005f53d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14005f53d
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
and ebx, 0xf
je 0x14005f4d6
test eax, eax
je 0x14005f4d6
mov ecx, eax
mov rax, rdi
add rax, rcx
mov edx, 1
sub edx, ebx
movzx ecx, word [rdi]
lea rdi, [rdi + rcx*2]
add rdi, 2
cmp rdi, rax
setb cl
test edx, edx
je 0x14005f4d6
inc edx
cmp rdi, rax
jb 0x14005f4ba
test cl, cl
je 0x14005f53d
movzx r8d, word [rdi]
test r8, r8
je 0x14005f53d
add rdi, 2
mov eax, 7
movq xmm6, rax
pslldq xmm6, 8
lea rsi, [rsp + 0x20]
movdqu xmmword [rsi + 0x10], xmm6
xor ebx, ebx
mov word [rsi], bx
mov rcx, rsi
mov rdx, rdi
call fcn.1400060c2
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140006a9a
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
movdqu xmmword [rsi + 0x10], xmm6
mov word [rsi], bx
mov rcx, rsi
call fcn.140006a9a
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rcx]
movaps xmm1, xmmword [rcx + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqa xmmword [rcx + 0x10], xmm0
mov word [rcx], 0
call fcn.140006a9a
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14011a890
mov rax, r14
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400615e7
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x130], rax
mfence
mov rax, qword [0x14017c998]
test rax, rax
jne 0x140061631
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mfence
mov rax, qword [0x14017c998]
test rax, rax
je 0x14006161b
cmp eax, 2
jne 0x140061679
mov ecx, 2
call fcn.140037700
test al, al
je 0x14006170b
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x82
mov r9d, 2
mov rcx, rsi
call fcn.1400377b0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x1400616fe
mov eax, 1
lock xadd qword [0x14017c9d0], rax
test rax, rax
jle 0x140061699
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14017c950], eax
mov qword [0x14017c948], rsi
mov rcx, qword [0x14017b730]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140037700
test al, al
je 0x14006170b
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0xae
mov r9d, 2
mov rcx, rsi
call fcn.1400377b0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
call fcn.140002c8d
mov rcx, rsi
call fcn.140037c30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14011a890
xor eax, eax
add rsp, 0x138
pop rdi
pop rsi
ret
Function at 0x14006243e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
xor ecx, ecx
lea r8, [0x14017c9e0]
mov edx, 8
mov eax, ecx
mov esi, eax
shr esi, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, esi
dec edx
jne 0x140062453
mov dword [r8 + rcx*4], eax
inc rcx
cmp rcx, 0x100
jne 0x14006244c
mov ecx, 0x100
mov eax, dword [r8 + rcx*4 - 0x400]
movzx edx, al
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [r8 + rcx*4], eax
inc rcx
cmp rcx, 0x800
jne 0x14006247c
lea rax, [0x14009eb28]
mov qword [0x14017e9e0], rax
mov qword [0x14017c9d8], rax
lea rsi, [0x14009ebf6]
mov qword [0x14017e9e8], rsi
call fcn.14009ed1c
test eax, eax
jne 0x1400624d1
mov qword [0x14017c9d8], rsi
add rsp, 0x20
pop rsi
ret
Function at 0x140066c50
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov rax, rcx
cmp qword [rcx + 0x18], 7
jbe 0x140066c61
mov rax, qword [rax]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarpin
xor ecx, ecx
xor r9d, r9d
mov r8, rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg al
add rsp, 0x38
ret

Function at 0x140066ca0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov rax, rcx
cmp qword [rcx + 0x18], 7
jbe 0x140066cb1
mov rax, qword [rax]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarunpin
xor ecx, ecx
xor r9d, r9d
mov r8, rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg al
add rsp, 0x38
ret
Function at 0x14006d7f4
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x14006d84b
bt ebx, 8
jae 0x14006d830
mov eax, ebx
and eax, 0x200
jne 0x14006d84b
cmp edi, 2
lea rax, [0x14017ef30]
lea rcx, [0x14017f130]
cmove rcx, rax
cmp word [rcx], 0
je 0x14006d86a
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14011a890
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14006d84b
cmp byte [0x14017ef20], 0
setne al
bt ebx, 8
jb 0x14006d84b
shr ebx, 9
and ebx, 1
or bl, al
je 0x14006d84b
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x14006d8ca
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
xor r15d, r15d
mov r13d, 1
mov eax, 0
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x14006d96c
movzx edx, word [rdi + rbx*2]
cmp edx, 0x5c
je 0x14006d905
test dx, dx
jne 0x14006d98e
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x14006d933
cmp ebp, 2
jne 0x14006d929
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x14006d933
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
movzx edx, dx
cmp edx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x14006d94f
dec r14
movzx edx, word [rax + 2]
add rax, 2
cmp edx, 0x5c
je 0x14006d93f
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x14006d995
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x14006d98e
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.14012ba6c
test eax, eax
je 0x14006d8f3
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x14006d96c
cmp dword [rsp + 0x2c], 0
je 0x14006d84b
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x14006d9b4
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140133524
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.14000e33c
jmp 0x14006d84b
Function at 0x14006e8a0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140047620
cmp qword [rsp + 0x70], 7
jbe 0x14006e8eb
mov rbx, qword [rsp + 0x58]
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x14006e943
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14006e93e
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14006eb06
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14011a568
test ebp, ebp
je 0x14006ea0e
mov r14b, 1
test rsi, rsi
je 0x14006eae8
mov ecx, ebp
add rcx, rcx
call fcn.14011a570
mov rbx, rax
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140047620
cmp qword [rsp + 0x70], 7
jbe 0x14006e98d
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x14006e9e4
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14006e9df
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14006eb06
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14011a568
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x14006ea16
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14006ea00
jmp 0x14006ea18
xor r14d, r14d
jmp 0x14006eae8
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140047a70
mov rax, qword [rsi + 0x18]
cmp rdi, rsi
je 0x14006ea9f
cmp rax, 0x10
jb 0x14006ea72
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14006ea6d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14006eb06
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14011a568
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
jmp 0x14006ead7
cmp rax, 0x10
jb 0x14006ead7
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14006ead2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14006eb06
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14011a568
mov qword [rsp + 0x70], 0xf
mov rcx, rbx
call fcn.14011a568
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14011a890
mov eax, r14d
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140128920
ud2