joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b874
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x140181940]
mov ecx, dword [0x14017ea38]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009baae
mov rax, qword [0x140181938]
test rax, rax
je 0x14009b942
lea rdx, [rsp + 0x34]
mov rcx, rdi
call rax
test eax, eax
je 0x14009b8f2
cmp dword [rsp + 0x34], 0
setne byte [rsi + 0x89]
je 0x14009b949
mov byte [rsi + 0x88], 0
mov dl, 1
jmp 0x14009b96e
mov ecx, 2
call fcn.140037700
test al, al
je 0x14009b942
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rbx, [rsp + 0x38]
mov r8d, 0x4b
mov r9d, 2
mov rcx, rbx
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, [0x140151dcc]
call fcn.140002c8d
mov rcx, rbx
call fcn.140038d80
mov byte [rsi + 0x89], 0
lea rbx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rbx]
cmp eax, 9
sete byte [rsi + 0x88]
cmp byte [rsi + 0x89], 0
setne dl
lea rax, [rsi + 0x38]
lea r9, [rsi + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.14009baf7
test al, al
je 0x14009b9a4
cmp byte [rsi + 0x88], 0
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
mov r8, rsi
je 0x14009b9e7
call fcn.14009bce1
jmp 0x14009b9ec
mov ecx, 2
call fcn.140037700
test al, al
je 0x14009ba8f
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x218
mov r9d, 2
mov rcx, rsi
call fcn.1400377b0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
jmp 0x14009ba82
call fcn.14009c261
test al, al
je 0x14009ba48
mov dl, byte [rsi + 0x88]
mov rcx, rdi
mov r8, rsi
call fcn.14009b0bc
mov sil, 1
test al, al
jne 0x14009ba91
mov ecx, 2
call fcn.140037700
test al, al
je 0x14009ba8f
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x226
mov r9d, 2
mov rcx, rsi
call fcn.1400377b0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
jmp 0x14009ba82
mov ecx, 2
call fcn.140037700
test al, al
je 0x14009ba8f
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x221
mov r9d, 2
mov rcx, rsi
call fcn.1400377b0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
call fcn.140002c8d
mov rcx, rsi
call fcn.140037c30
xor esi, esi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140181940]
call fcn.14011a6c0
mov eax, dword [0x140181940]
cmp eax, 0xffffffff
jne 0x14009b8bf
lea rcx, [0x140148686]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14009b060
mov qword [0x140181938], rax
lea rcx, [0x140181940]
call fcn.14011a728
jmp 0x14009b8bf
Function at 0x1400a2e30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400a2e72
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400a2e7d
add rdi, rbx
sub rsi, rbx
jne 0x1400a2e50
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
int3

Function at 0x1400a376d
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14017b750]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0xc]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a37ff
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rbp - 0xc]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0xc]
test eax, eax
jne 0x1400a3813
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400a3838
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400a37d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400a381a
cmp eax, 0xffffffff
je 0x1400a383d
mov esi, eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
call fcn.14011a890
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbp - 0xc]
jmp 0x1400a3818
int3

Function at 0x1400a3e1b
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rdi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400a3d63
test rax, rax
jne 0x1400a3eac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400a3eac
mov ecx, 2
call fcn.140037700
test al, al
je 0x1400a3eaa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov r8d, 0xf3
mov r9d, 2
mov rcx, rsi
call fcn.140038c40
lea rcx, [rsp + 0x40]
lea rdx, [0x140159726]
call fcn.140002c8d
mov rcx, rsi
call fcn.140038d80
xor esi, esi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x148
pop rdi
pop rsi
ret

Function at 0x1400acc1a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rdx]
mov rcx, rdi
call fcn.140133270
test rax, rax
je 0x1400acc61
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs r8, 0x100000001b3
movzx esi, byte [rdi + rdx]
xor rcx, rsi
imul rcx, r8
inc rdx
cmp rax, rdx
jne 0x1400acc46
and ecx, 0x7fffffff
jmp 0x1400acc66
mov ecx, 0x4222325
mov edx, 0x1f31d
call fcn.14012f1e8
imul ecx, eax, 0xfffff4ec
shr rax, 0x20
imul eax, eax, 0x41a7
lea edx, [rax + rcx]
add edx, 0x7fffffff
add eax, ecx
cmovns edx, eax
movsxd rax, edx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400b8fe0
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
xor edx, edx
mov r8d, 0x238
mov rcx, rsi
call fcn.14011eed0
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x1400b9018
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x1400b9028
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400b90c0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400b90d9
mov dword [rsi], eax
mov al, 1
jmp 0x1400b90db
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400ba3ec
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, rdx
mov r15d, ecx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x14015e820]
lea r9, [0x14015b078]
xor edi, edi
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400ba510
xor ebx, ebx
lea rbp, [rsp + 0x50]
mov qword [rbp], rbx
mov rdi, qword [rsp + 0x58]
lea rdx, [0x14015b088]
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1400ba9a0
mov rdx, qword [rsi]
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbp
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor r8d, r8d
xor r9d, r9d
mov rcx, rdi
call qword [rax + 0x18]
mov edi, eax
mov rcx, rsi
call fcn.1400ba9c0
test edi, edi
js 0x1400ba4f5
test r15b, r15b
je 0x1400ba4df
mov rcx, qword [rsp + 0x50]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1400ba4f5
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov qword [r14], rax
mov dil, 1
jmp 0x1400ba510
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ba50e
mov qword [rsp + 0x50], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edi, edi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400ba529
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400c0b9c
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
jmp 0x1400ddea8
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400dded1
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ddf0a
and eax, 0x410
cmp eax, 0x410
jne 0x1400ddf0a
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp 0x1400ddff1
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x1400ddf17
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1400ddfd4
mov ecx, 2
call fcn.140037700
test al, al
je 0x1400ddfd2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x94
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, str.DeleteFile
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400ddf84
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400ddfba
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400de01a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400de0d7
mov ecx, 2
call fcn.140037700
test al, al
je 0x1400de0d5
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x2f
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, str.RemoveDirectory
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400de087
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400de0bd
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400cf8f4
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400cf98c]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400cf959
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14011a890
nop
add rsp, 0x150
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x19
mov r9d, 3
mov rcx, rsi
call fcn.140038c40
mov rcx, rsi
call fcn.140038d80
jmp 0x1400cf93f

Function at 0x1400d5090
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x7fffffff
jbe 0x1400b913c
xor eax, eax
ret
jmp 0x1400d5090
push rsi
xor eax, eax
test rcx, rcx
je 0x1400d51cd
test edx, edx
jle 0x1400d51cd
mov r11d, edx
shr r11d, 2
je 0x1400d514c
lea r10d, [r11 - 1]
mov r9d, r11d
mov esi, edx
mov r8, rcx
test dl, 4
je 0x1400d50ea
movzx r9d, word [rcx]
add r9d, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, r9d
shl r9d, 0x10
xor r9d, eax
lea r8, [rcx + 4]
mov esi, r9d
shr esi, 0xb
add esi, r9d
mov r9d, r10d
lea r10, [r10*4 + 4]
cmp r11d, 1
je 0x1400d5147
add r9d, 2
nop dword [rax]
movzx eax, word [r8]
add eax, esi
movzx esi, word [r8 + 2]
shl esi, 0xb
xor esi, eax
shl eax, 0x10
xor eax, esi
mov esi, eax
shr esi, 0xb
add esi, eax
movzx eax, word [r8 + 4]
add eax, esi
movzx esi, word [r8 + 6]
shl esi, 0xb
xor esi, eax
shl eax, 0x10
xor eax, esi
mov esi, eax
shr esi, 0xb
add esi, eax
add r9d, 0xfffffffe
add r8, 8
cmp r9d, 2
jg 0x1400d5100
add rcx, r10
jmp 0x1400d514e
mov esi, edx
and dl, 3
cmp dl, 1
je 0x1400d517c
cmp dl, 2
je 0x1400d518e
cmp dl, 3
jne 0x1400d51a1
movzx eax, word [rcx]
add esi, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, esi
mov ecx, esi
shl ecx, 0x10
xor eax, ecx
mov esi, eax
shr esi, 0xb
jmp 0x1400d519f
movsx eax, byte [rcx]
add esi, eax
mov eax, esi
shl eax, 0xa
xor eax, esi
mov esi, eax
shr esi, 1
jmp 0x1400d519f
movzx eax, word [rcx]
add esi, eax
mov eax, esi
shl eax, 0xb
xor eax, esi
mov esi, eax
shr esi, 0x11
add esi, eax
lea eax, [rsi*8]
xor eax, esi
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret
Function at 0x1400ddea8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
jmp 0x1400ddea8
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400dded1
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ddf0a
and eax, 0x410
cmp eax, 0x410
jne 0x1400ddf0a
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp 0x1400ddff1
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x1400ddf17
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1400ddfd4
mov ecx, 2
call fcn.140037700
test al, al
je 0x1400ddfd2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x94
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, str.DeleteFile
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400ddf84
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400ddfba
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400de01a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400de0d7
mov ecx, 2
call fcn.140037700
test al, al
je 0x1400de0d5
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x2f
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, str.RemoveDirectory
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400de087
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400de0bd
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400ddff1
Capabilities:
Delete directory

Disassembly:
jmp 0x1400ddea8
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400dded1
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ddf0a
and eax, 0x410
cmp eax, 0x410
jne 0x1400ddf0a
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp 0x1400ddff1
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x1400ddf17
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1400ddfd4
mov ecx, 2
call fcn.140037700
test al, al
je 0x1400ddfd2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x94
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, str.DeleteFile
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400ddf84
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400ddfba
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400de01a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400de0d7
mov ecx, 2
call fcn.140037700
test al, al
je 0x1400de0d5
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x2f
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, str.RemoveDirectory
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x1400de087
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400de0bd
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400dfff8
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x158], rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x1400e0070
mov ecx, 1
call fcn.140037700
test al, al
je 0x1400e0070
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x50]
mov r8d, 0xa1
mov r9d, 1
mov rcx, rsi
call fcn.1400377b0
lea rcx, [rsp + 0x58]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
call fcn.140002c8d
mov rcx, rsi
call fcn.140037c30
mov esi, dword [rsp + 0x40]
cmp esi, 0x100
jb 0x1400e007f
mov sil, 0xff
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x160
pop rsi
ret
Function at 0x1400ea140
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400ea160
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400ea160
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret