joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fb480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400fb5a0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400fb4e0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400fb4e0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400fb4e0
Function at 0x1401063f0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
jmp 0x14011d7d0
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14011d7f9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14011d832
and eax, 0x410
cmp eax, 0x410
jne 0x14011d832
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp 0x14011d920
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14011d83f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14011d8fc
mov ecx, 2
call fcn.14003be50
test al, al
je 0x14011d8fa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x94
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteFile
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14011d8ac
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14004e5d0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14011d8e2
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009ce0
mov rcx, rsi
call fcn.140006b00
mov rcx, rdi
call fcn.14003ce70
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14011d949
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x14011da06
mov ecx, 2
call fcn.14003be50
test al, al
je 0x14011da04
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x2f
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x50]
lea rdx, str.RemoveDirectory
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14011d9b6
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14004e5d0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14011d9ec
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009ce0
mov rcx, rsi
call fcn.140006b00
mov rcx, rdi
call fcn.14003ce70
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x140109790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov eax, dword [0x1401ed430]
mov ecx, dword [0x1401ea448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x1401097f3
cmp rdi, rbx
je 0x1401097e9
mov eax, 0xffffffff
lea rcx, [0x1401ed030]
movzx edx, byte [rdi]
movzx esi, al
xor esi, edx
shr eax, 8
xor eax, dword [rcx + rsi*4]
inc rdi
cmp rbx, rdi
jne 0x1401097cf
not eax
jmp 0x1401097eb
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401ed430]
call fcn.14014b390
mov eax, dword [0x1401ed430]
cmp eax, 0xffffffff
jne 0x1401097be
xor r9d, r9d
lea r8, [0x1401ed030]
mov edx, 8
mov ecx, r9d
mov eax, ecx
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
dec edx
jne 0x14010981c
mov dword [r8 + r9*4], ecx
inc r9
cmp r9, 0x100
jne 0x140109814
lea rcx, [0x1401ed430]
call fcn.14014b400
jmp 0x1401097be

Function at 0x14010da50
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x7fffffff
jbe 0x1400ce6fc
xor eax, eax
ret
jmp 0x14010da50
push rsi
xor eax, eax
test rcx, rcx
je 0x14010db81
test edx, edx
jle 0x14010db81
mov r8d, edx
and r8d, 3
mov r11d, edx
shr r11d, 2
je 0x14010db02
lea r10d, [r11 - 1]
test dl, 4
jne 0x14010da89
mov r9d, r11d
mov rsi, rcx
jmp 0x14010dab1
movzx r9d, word [rcx]
add r9d, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, r9d
shl r9d, 0x10
xor r9d, eax
lea rsi, [rcx + 4]
mov edx, r9d
shr edx, 0xb
add edx, r9d
mov r9d, r10d
lea r10, [r10*4 + 4]
cmp r11d, 1
je 0x14010daff
nop
movzx eax, word [rsi]
add eax, edx
movzx edx, word [rsi + 2]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
movzx eax, word [rsi + 4]
add eax, edx
movzx edx, word [rsi + 6]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
add rsi, 8
add r9d, 0xfffffffe
jg 0x14010dac0
add rcx, r10
cmp r8d, 1
je 0x14010db30
cmp r8d, 2
je 0x14010db42
cmp r8d, 3
jne 0x14010db55
movzx eax, word [rcx]
add edx, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, edx
mov ecx, edx
shl ecx, 0x10
xor eax, ecx
mov edx, eax
shr edx, 0xb
jmp 0x14010db53
movsx eax, byte [rcx]
add edx, eax
mov eax, edx
shl eax, 0xa
xor eax, edx
mov edx, eax
shr edx, 1
jmp 0x14010db53
movzx eax, word [rcx]
add edx, eax
mov eax, edx
shl eax, 0xb
xor eax, edx
mov edx, eax
shr edx, 0x11
add edx, eax
lea eax, [rdx*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret
Function at 0x140119f40
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140119fe0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x140119fa5
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14014b5e0
nop
add rsp, 0x150
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x19
mov r9d, 3
call fcn.14003cd30
mov rcx, rsi
call fcn.14003ce70
jmp 0x140119f8b
Function at 0x14011d7d0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
jmp 0x14011d7d0
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14011d7f9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14011d832
and eax, 0x410
cmp eax, 0x410
jne 0x14011d832
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp 0x14011d920
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14011d83f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14011d8fc
mov ecx, 2
call fcn.14003be50
test al, al
je 0x14011d8fa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x94
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteFile
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14011d8ac
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14004e5d0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14011d8e2
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009ce0
mov rcx, rsi
call fcn.140006b00
mov rcx, rdi
call fcn.14003ce70
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14011d949
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x14011da06
mov ecx, 2
call fcn.14003be50
test al, al
je 0x14011da04
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x2f
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x50]
lea rdx, str.RemoveDirectory
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14011d9b6
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14004e5d0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14011d9ec
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009ce0
mov rcx, rsi
call fcn.140006b00
mov rcx, rdi
call fcn.14003ce70
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x14011d920
Capabilities:
Delete directory

Disassembly:
jmp 0x14011d7d0
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14011d7f9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14011d832
and eax, 0x410
cmp eax, 0x410
jne 0x14011d832
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp 0x14011d920
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14011d83f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14011d8fc
mov ecx, 2
call fcn.14003be50
test al, al
je 0x14011d8fa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x94
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteFile
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14011d8ac
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14004e5d0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14011d8e2
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009ce0
mov rcx, rsi
call fcn.140006b00
mov rcx, rdi
call fcn.14003ce70
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14011d949
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x14011da06
mov ecx, 2
call fcn.14003be50
test al, al
je 0x14011da04
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x2f
mov r9d, 2
call fcn.14003cd30
lea rcx, [rsp + 0x50]
lea rdx, str.RemoveDirectory
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14011d9b6
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14004e5d0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14011d9ec
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009ce0
mov rcx, rsi
call fcn.140006b00
mov rcx, rdi
call fcn.14003ce70
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014b5e0
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x14012c970
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x170
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x168], rax
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x14012c9e8
mov ecx, 1
call fcn.14003be50
test al, al
je 0x14012c9e8
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov r8d, 0xb0
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x60]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
call fcn.140002b70
mov rcx, rsi
call fcn.14003c3a0
mov esi, dword [rsp + 0x48]
cmp esi, 0x100
jb 0x14012c9f7
mov sil, 0xff
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x170
pop rsi
ret
Function at 0x140141000
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rcx + 0x20]
mov rcx, rdi
call fcn.140141490
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.140149600
test al, al
je 0x1401410b2
movzx eax, word [rsp + 0x130]
cmp eax, 0x5a4d
jne 0x1401410f5
mov rcx, rdi
call fcn.140141490
movsxd rdi, dword [rsp + 0x16c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.140149600
test al, al
je 0x140141135
cmp dword [rbx], 0x4550
jne 0x140141175
mov sil, 1
test r14, r14
je 0x1401411d7
mov qword [r14], rdi
jmp 0x1401411d7
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401411d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.could_not_read_dos_header_from
jmp 0x1401411af
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401411d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x1401411af
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401411d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401411af
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401411d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.invalid_signature_in_nt_headers_of
call fcn.140002b70
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1401411c2
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140009ce0
mov rcx, rdi
call fcn.14003c3a0
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140141200
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rcx + 0x20]
mov rcx, rdi
call fcn.140141490
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.140149600
test al, al
je 0x1401412b2
movzx eax, word [rsp + 0x130]
cmp eax, 0x5a4d
jne 0x1401412f5
mov rcx, rdi
call fcn.140141490
movsxd rdi, dword [rsp + 0x16c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.140149600
test al, al
je 0x140141335
cmp dword [rbx], 0x4550
jne 0x140141375
mov sil, 1
test r14, r14
je 0x1401413d7
mov qword [r14], rdi
jmp 0x1401413d7
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401413d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.could_not_read_dos_header_from
jmp 0x1401413af
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401413d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x1401413af
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401413d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401413af
mov ecx, 1
call fcn.14003be50
test al, al
je 0x1401413d5
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14003bf00
lea rcx, [rsp + 0x28]
lea rdx, str.invalid_signature_in_nt_headers_of
call fcn.140002b70
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1401413c2
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140009ce0
mov rcx, rdi
call fcn.14003c3a0
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140143960
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx + 0x48], 0x1003f
mov eax, dword [rdx + 0x234]
mov dword [rcx + 0x4c], eax
mov eax, dword [rdx + 0x238]
mov dword [rcx + 0x50], eax
mov eax, dword [rdx + 0x23c]
mov dword [rcx + 0x54], eax
mov eax, dword [rdx + 0x240]
mov dword [rcx + 0x58], eax
mov eax, dword [rdx + 0x24c]
mov dword [rcx + 0x5c], eax
mov eax, dword [rdx + 0x250]
mov dword [rcx + 0x60], eax
lea rdx, [rcx + 0x64]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.14011a150
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0xd4], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0xd8], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0xdc], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0xe0], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0xe4], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0xe8], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0xec], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0xf0], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0xf4], eax
mov eax, dword [rdi]
mov dword [rsi + 0xf8], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0xfc], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x100], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x104], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x108], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x110], eax
add rsi, 0x114
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14016f270
Function at 0x1401526a4
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401526b7
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14015caec
lea rdx, [0x1401e1840]
lea rcx, [rsp + 0x20]
call fcn.14016de0c
int3

Function at 0x14015dafc
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1401ed640]
jmp fcn.1401526a4

Function at 0x14015de88
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1401ed640]
xor edx, edx
jmp fcn.1401526a4

Function at 0x14016a068
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14016a4b0]
mov r9, qword [r9 + 8]
jmp fcn.140157dd8

Function at 0x14016a090
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14016a4c0]
mov r9, qword [r9 + 8]
jmp fcn.140157dd8

Function at 0x140175174
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401752a4
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call fcn.10018a000
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100002960
add rsp, 0x28
jmp 0x100002454