joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023e9b0
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1402fccc0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x217
call fcn.1400c6940
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140066fa0
mov al, byte [rsi + 0x17]
test al, al
jns 0x14023ea3c
cmp qword [rsi + 8], 0x103
ja 0x14023ea5a
test al, al
jns 0x14023ea43
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.140067230
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140156fe0
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14023ed80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1402fccc0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x2ca
call fcn.1400c6940
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140066fa0
cmp byte [rsi + 0x17], 0
jns 0x14023ee04
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14023ee3b
lea rcx, [rsp + 0x60]
call fcn.140067230
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140156fe0
mov eax, edi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rsi, [rsp + 0x40]
mov qword [rsi], rdi
mov rcx, rsi
mov rdx, rax
call fcn.14009e8ea
mov rax, qword [rsi]
inc rax
test rax, 0xfffffffffffffffe
setne dil
cmp rax, 2
jb 0x14023ee12
call fcn.1400bcc80
mov rcx, qword [rsp + 0x40]
call fcn.1400d2f70
jmp 0x14023ee12
Function at 0x14023f730
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx eax, word [rcx + 0x28]
mov word [rsp + 0x260], ax
movzx eax, word [rcx + 0x2a]
mov word [rsp + 0x262], ax
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov word [rsp + 0x264], ax
movzx eax, word [rbx + 0x2a]
mov word [rsp + 0x266], ax
movzx eax, word [rbx + 0x28]
mov word [rsp + 0x268], ax
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call rsi
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
xor esi, esi
lea r14, [rsp + 0x50]
lea r15, str.StringFileInfo_04x_04x_ls
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140159120
movzx eax, word [rsp + rsi*4 + 0x262]
movzx ecx, word [rsp + rsi*4 + 0x260]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
mov r9, r15
call fcn.14023f8b0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0xaaaaaaaa
mov rcx, qword [rbx + 0x20]
mov rdx, r14
mov r8, r12
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne al
mov rdx, qword [rsp + 0x48]
test rdx, rdx
setne cl
mov r8d, dword [rsp + 0x44]
test r8d, r8d
setne bpl
and bpl, cl
and bpl, al
cmp bpl, 1
je 0x14023f898
inc rsi
cmp rsi, 4
jne 0x14023f7d7
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140156fe0
mov eax, ebp
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
dec r8d
mov rcx, qword [rsp + 0x38]
call fcn.140127070
jmp 0x14023f872

Function at 0x14023fd60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x14023fddc
mov r14, rcx
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
je 0x14023fddc
mov rsi, r9
mov rdi, r8
mov rbx, rdx
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
je 0x14023fda8
cmp ecx, 0x10b
jne 0x14023fdcb
lea rdx, [rax + 0x74]
lea rcx, [rax + 0x78]
jmp 0x14023fdb6
lea rdx, [rax + 0x84]
lea rcx, [rax + 0x88]
cmp dword [rdx], 7
jb 0x14023fdcb
mov edx, dword [rcx + 0x30]
test rdx, rdx
je 0x14023fdcb
mov ecx, dword [rcx + 0x34]
cmp ecx, 0x1c
jae 0x14023fdf3
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [rax + 0x50]
shr ecx, 2
imul r15, rcx, 0x24924925
shr r15, 0x20
lea r12, [rdx + r14]
add r12, 0x14
xor r13d, r13d
jmp 0x14023fe1d
inc r13d
cmp r13d, r15d
je 0x14023fdcb
add r12, 0x1c
cmp dword [r12 - 8], 0xd
jne 0x14023fe11
mov ecx, dword [r12]
test rcx, rcx
je 0x14023fe11
mov edx, dword [r12 - 4]
lea eax, [rdx + rcx]
cmp eax, ebp
jae 0x14023fe11
add rcx, r14
mov qword [rsp + 0x20], rsi
mov r8, rbx
mov r9, rdi
call fcn.14023fb70
test eax, eax
je 0x14023fe11
jmp 0x14023fdcb
Function at 0x1402443b0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov sil, 1
cmp qword [0x1403629c8], 0
je 0x1402443f4
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x258
pop rdi
pop rsi
ret
mov rcx, qword [0x1403629b8]
test rcx, rcx
je 0x140244492
test byte [0x140356398], 1
je 0x1402443d8
cmp byte [rcx + 0x17], 0
jns 0x140244416
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403629c8], rax
inc rax
cmp rax, 1
ja 0x1402443d8
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140159120
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x140244580
xor esi, esi
jmp 0x1402443d8
mov ecx, 0x18
call fcn.140153bd4
mov rsi, rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140159120
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1402fccc0]
movups xmmword [rsi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
mov rcx, rsi
mov rdx, rdi
call fcn.1400c7802
movzx eax, byte [rsi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rsi + 8]
mov rcx, qword [rsi]
mov r8, rsi
cmovs r8, rcx
test rdx, rdx
je 0x140244549
lea r10, [rdx + rdx]
test r10, r10
je 0x140244549
lea r9, [r10 - 2]
cmp word [r8 + r10 - 2], 0x5c
mov r10, r9
jne 0x14024450b
cmp r9, 0xfffffffffffffffe
je 0x140244549
mov r8, r9
sar r8, 1
cmp rdx, r8
jbe 0x140244669
lea rdx, [r8 + 1]
test al, al
jns 0x14024456e
mov qword [rsi + 8], rdx
mov word [rcx + r8*2 + 2], 0
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rsi
call fcn.1401300e2
mov qword [0x1403629b8], 0
jmp 0x14024448b
cmp r9, 0x14
jae 0x140244663
mov byte [rsi + 0x17], dl
mov rcx, rsi
jmp 0x140244541
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14015468c
mov rcx, qword [0x1403629b8]
mov rdx, rdi
mov r8, rax
call fcn.14010a634
mov rcx, qword [0x1403629b8]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x140244656
mov rax, qword [rcx + 8]
test rax, rax
je 0x140244666
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1402445e3
lea rdx, [0x14030b7ec]
mov r8d, 1
call fcn.1401300e2
mov rcx, qword [0x1403629b8]
lea rdx, str.debug.log
mov r8d, 9
call fcn.1401300e2
mov rcx, qword [0x1403629b8]
cmp byte [rcx + 0x17], 0
jns 0x140244605
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403629c8], rax
inc rax
cmp rax, 1
ja 0x1402443d8
mov qword [0x1403629c8], 0
jmp 0x14024448b
test rax, rax
je 0x140244666
mov rdx, rcx
jmp 0x1402445c2
int3
int3
int3
Function at 0x1402475b0
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x140247771
mov word [rsi], 0
mov byte [rsi + 0x17], 0
test rbx, rbx
je 0x14024773c
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14024773c
lea r14, [rsp + 0x50]
mov rax, qword [r14]
movzx ebp, word [rax]
movzx r15d, word [rax + 2]
mov word [rsp + 0x260], bp
mov word [rsp + 0x262], r15w
mov r12, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r12
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], r15w
mov word [rsp + 0x268], bp
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call r12
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
mov r15, 0xfffffffffffffffe
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140159120
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x1402476bd
mov rax, qword [rdi]
movzx ecx, word [rsp + r15*2 + 0x264]
movzx edx, word [rsp + r15*2 + 0x266]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
lea r9, [0x140311e20]
call fcn.14023f8b0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, rbx
mov rdx, r14
mov r8, r12
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140247761
mov rbp, qword [rsp + 0x48]
test rbp, rbp
je 0x140247761
mov rcx, rbp
call fcn.14015468c
mov rcx, rsi
mov rdx, rbp
mov r8, rax
call fcn.14010a634
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140156fe0
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add r15, 2
cmp r15, 5
jbe 0x1402476a1
jmp 0x14024773c
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
jmp 0x1402475f2
Function at 0x14024c474
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
test r8, r8
je 0x14024c59b
mov rcx, qword [rcx + 8]
movsxd r9, dword [rcx + 0x3c]
cmp dword [rcx + r9 + 0x84], 0
je 0x14024c59b
add r9, rcx
xor eax, eax
cmp word [r9 + 0x14], 0x78
jb 0x14024c594
add r9, 0x88
je 0x14024c594
mov eax, dword [r9]
test rax, rax
je 0x14024c59b
add rax, rcx
je 0x14024c59b
cmp rdx, 0xffff
jbe 0x14024c58e
mov r10d, dword [rax + 0x18]
mov r11d, dword [rax + 0x20]
lea r9, [rcx + r11]
test r11, r11
cmove r9, r11
test r10, r10
je 0x14024c59b
lea r10, [r9 + r10*4]
mov r11b, byte [rdx]
inc rdx
mov rsi, r9
jmp 0x14024c52c
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ebx, byte [rbx]
cmp bpl, bl
je 0x14024c573
movzx ebp, bpl
sub ebp, ebx
cmovs r10, rdi
add rdi, 4
test ebp, ebp
cmovg rsi, rdi
cmp rsi, r10
je 0x14024c59b
mov rdi, r10
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
shr rdi, 0x3f
add rdi, rbx
and rdi, 0xfffffffffffffffe
mov r14d, dword [rsi + rdi*2]
lea rbx, [rcx + r14]
test r14, r14
cmove rbx, r14
test r11b, r11b
je 0x14024c505
mov r14, rdx
mov ebp, r11d
cmp bpl, byte [rbx]
jne 0x14024c507
inc rbx
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x14024c55e
jmp 0x14024c505
mov edx, dword [rax + 0x24]
add rcx, rdx
test rdx, rdx
cmove rcx, rdx
sub rdi, r9
sar rdi, 1
movzx edx, word [rcx + rdi]
add dx, word [rax + 0x10]
mov word [r8], dx
mov al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x14024c594

Function at 0x14025c6f0
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.140159120
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x14025c732
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x14025c726

Function at 0x140263e57
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test r8, r8
je 0x140263e96
mov rsi, r8
test rcx, rcx
je 0x140263e98
mov rdi, rdx
mov rdx, rsi
call fcn.1401182fe
cmp eax, 1
jne 0x140263e98
test rdi, rdi
je 0x140263ea2
mov rcx, rdi
mov rdx, rsi
mov r8d, 0xffffffff
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400e9335
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14011fc90
Function at 0x1402714e0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1403633b8]
test rax, rax
jne 0x140271524
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1403633b8]
test rax, rax
je 0x140271511
cmp eax, 2
je 0x14027158a
mov eax, 1
lock xadd qword [0x1403633f0], rax
test rax, rax
jle 0x140271549
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140363370], eax
mov qword [0x140363368], rsi
mov rcx, qword [0x1403565e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1402715d2
cmp dword [0x1403629c0], 2
jg 0x1402715d2
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x93
mov r9d, 2
call fcn.140117f40
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch
mov r8d, 0x1d
call fcn.140097cc9
mov rcx, rsi
call fcn.14009caf0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140156fe0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1402880ed
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ecx, dword [0x140356d60]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x14028813f
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140127edd
mov rsi, qword [rax]
call fcn.140127f03
mov rcx, qword [rax]
lea rdx, str.xmlGetGlobalState:_out_of_memory_n
mov rax, rsi
call qword [0x14037e008]
xor esi, esi
jmp 0x14028810c
mov ecx, 1
mov edx, 0x3c8
call fcn.1400a2a30
test rax, rax
je 0x14028811b
mov rsi, rax
mov rcx, rax
call fcn.140261395
mov ecx, 0x10
call fcn.14003ee90
test rax, rax
je 0x1402881dc
mov rdi, rax
mov qword [rax + 8], rsi
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call r15
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r14
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [0x140356d60]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [0x140288220]
xor edx, edx
mov r8, rdi
call fcn.140168798
jmp 0x14028810c
call fcn.140127edd
mov rdi, qword [rax]
call fcn.140127f03
mov rcx, qword [rax]
lea rdx, str.xmlGetGlobalState:_out_of_memory_n
mov rax, rdi
call qword [0x14037e008]
mov rcx, rsi
add rcx, 0x358
call fcn.140116958
mov rcx, rsi
call fcn.14012ca40
jmp 0x14028813b

Function at 0x14028a687
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r11d, dword [rcx + 0x18]
test rdx, rdx
je 0x14028a6d1
movzx r10d, byte [rdx]
mov eax, r10d
shl eax, 5
sub eax, r10d
sub eax, r10d
add eax, r11d
test r10d, r10d
je 0x14028a6d4
inc rdx
movzx r10d, r10b
mov r11d, eax
shl r11d, 5
mov esi, eax
shr esi, 3
add esi, r11d
add esi, r10d
xor eax, esi
mov r10b, byte [rdx]
inc rdx
test r10b, r10b
jne 0x14028a6ac
jmp 0x14028a6d4
mov eax, r11d
mov r10d, eax
shl r10d, 5
mov edx, eax
shr edx, 3
add edx, r10d
xor edx, eax
test r8, r8
je 0x14028a718
mov al, byte [r8]
test al, al
je 0x14028a718
inc r8
movzx eax, al
mov r10d, edx
shl r10d, 5
mov r11d, edx
shr r11d, 3
add r11d, eax
add r11d, r10d
xor edx, r11d
mov al, byte [r8]
inc r8
test al, al
jne 0x14028a6f4
mov r8d, edx
shl r8d, 5
mov eax, edx
shr eax, 3
add eax, r8d
xor eax, edx
test r9, r9
je 0x14028a75c
mov dl, byte [r9]
test dl, dl
je 0x14028a75c
inc r9
movzx edx, dl
mov r8d, eax
shl r8d, 5
mov r10d, eax
shr r10d, 3
add r10d, edx
add r10d, r8d
xor eax, r10d
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x14028a738
xor edx, edx
div dword [rcx + 8]
mov eax, edx
pop rsi
ret
Function at 0x140293792
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140255940
test al, al
je 0x1402937c0
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], 0
test rdi, rdi
je 0x1402937e1
mov rcx, rdi
call fcn.1402a8844
mov rcx, rdi
call fcn.140153bcc
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x1402937fc
mov edx, 1
call fcn.140292e40
mov rcx, qword [rsi + 0x48]
mov qword [rsi + 0x48], 0
test rcx, rcx
je 0x140293812
call fcn.14012ca40
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x140293825
lock dec dword [rcx]
jne 0x140293825
call fcn.14014c4fe
mov rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], 0
test rdi, rdi
je 0x140293846
mov rcx, rdi
call fcn.1402a8844
mov rcx, rdi
call fcn.140153bcc
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x14029387f
call fcn.1400bcc80
mov rdi, qword [rsi + 0x28]
mov rcx, qword [0x140362b78]
test rcx, rcx
je 0x14029389f
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x14037e008]
mov qword [rsi + 0x28], 0
lea rcx, [rsi + 0x20]
call fcn.140149f20
lea rcx, [rsi + 0x18]
call fcn.140149f20
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140076060
call fcn.140053470
mov rcx, qword [0x140362b78]
jmp 0x140293868
Function at 0x1402a440c
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x1402a44fd
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp byte [r8 + 0x17], 0
jns 0x1402a4472
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x1402a4518
mov rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x1402a44ee
Function at 0x1402c12fc
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1402fccc0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140094432
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140093c78
test al, al
je 0x1402c1413
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402c13cd
mov rcx, r14
call fcn.140094432
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140093c78
test al, al
je 0x1402c14a5
cmp dword [rbx], 0x4550
jne 0x1402c14e4
mov sil, 1
test rdi, rdi
je 0x1402c1484
mov qword [rdi], r14
jmp 0x1402c1484
mov ecx, 1
call fcn.14008daf0
test al, al
je 0x1402c1482
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140117f40
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402c1453
mov ecx, 1
call fcn.14008daf0
test al, al
je 0x1402c1482
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140117f40
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140097cc9
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402c1468
and r8d, 0x7f
jmp 0x1402c146f
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140097cc9
mov rcx, rdi
call fcn.14009caf0
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14008daf0
test al, al
je 0x1402c1482
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140117f40
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402c144d
mov ecx, 1
call fcn.14008daf0
test al, al
je 0x1402c1482
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140117f40
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402c1453
Function at 0x1402d01e8
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x98]
mov edx, dword [rsp + 0x90]
mov rcx, qword [0x140346038]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.14009e8ea
mov rbx, qword [rbx]
lea rax, [rbx + 1]
cmp rax, 1
ja 0x1402d029a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [rsp + 0x38]
inc rax
cmp rax, 2
jae 0x1402d0289
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140156fe0
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400bcc80
mov rcx, qword [rsp + 0x38]
call fcn.1400d2f70
jmp 0x1402d0270
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea esi, [rcx + rcx*4]
jmp 0x1402d0262