joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038710
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rbx, [rsp + 0x58]
mov r8d, 0x2c8
mov rcx, rbx
mov dl, 0xaa
call fcn.14014b2c0
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.140038a90
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x14022cb50]
movaps xmmword [rsi], xmm0
mov rcx, rbx
mov rdx, rsi
call fcn.140038fb0
movsx rax, byte [rsi + 0x17]
mov rcx, rax
test rax, rax
jns 0x1400387a5
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14003886c
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [rsp + 0x58]
lea rbx, [rsp + 0x28]
xor r13d, r13d
cmp byte [rsp + 0x58], 0
je 0x1400388b1
mov edx, dword [rsp + 0x5c]
test dl, 1
jne 0x1400388bb
test dl, 0x10
jne 0x1400388aa
cmp byte [rsp + 0x57], 0
mov rcx, rsi
jns 0x1400387fc
mov rcx, qword [rsp + 0x40]
call r15
test eax, eax
jne 0x1400388aa
call r12
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
cmove ebp, r14d
test r13d, r13d
cmovne ebp, r13d
mov rcx, rdi
mov rdx, rbx
call fcn.140038fb0
cmp byte [rsp + 0x57], 0
jns 0x140038839
mov rcx, qword [rsp + 0x40]
call fcn.140146640
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x40], xmm0
movsx rax, byte [rsp + 0x57]
mov rcx, rax
test rax, rax
jns 0x140038860
mov rcx, qword [rsp + 0x48]
mov r13d, ebp
test rcx, rcx
jne 0x1400387cc
test al, al
jns 0x14003887a
mov rcx, qword [rsp + 0x40]
call fcn.140146640
lea rcx, [rsp + 0x58]
call fcn.1400388f0
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140149190
mov eax, ebp
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x140038816
call fcn.140183190
jmp 0x1400387ed
xor ebp, ebp
test dl, 0x10
jne 0x140038816
test al, al
jns 0x1400388d1
mov rcx, qword [rsp + 0x40]
jmp 0x1400388d6
lea rcx, [rsp + 0x40]
and edx, 0xffffffee
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1400387ed
Function at 0x14003c190
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140149130
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.14014b2c0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003c243
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14003c247
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.14003c2a0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140149190
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14003c224
cmp eax, 2
jne 0x14003c28f
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.14014b2c0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14003c296
lea rdx, [rsp + 0x40]
jmp 0x14003c21a
mov edi, 0x3f4
jmp 0x14003c224
mov edi, 0xea
jmp 0x14003c224

Function at 0x14003d6d0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003d798
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x14003d760
cmp eax, 0xffffffff
je 0x14003d771
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140149190
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x14003d774
mov eax, dword [rsp + 0x2c]
jmp 0x14003d740
int3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x14003d733
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14003d742
Function at 0x14003dfc0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14003dfe8
call fcn.1400bbc10
cmp qword [rsi], r14
je 0x14003e017
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003e026
cmp r15, 2
jb 0x14003e00f
mov qword [rsi], r14
call fcn.1400bbc10
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400bbc10
mov rbx, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x14003e057
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x14003e001
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003e098
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14003e092
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x14003e038
xor ecx, ecx
mov dl, 1
jmp 0x14003e08b
xor ecx, ecx
jmp 0x14003e089
Function at 0x14003f580
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x14003f77c
mov rbx, r9
mov edi, r8d
mov ebp, edx
mov rsi, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov r15, qword [rsi]
cmp r15, rax
je 0x14003f60a
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003f6f6
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14003f5fe
mov qword [rsi], r14
call fcn.1400bbc10
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsi]
lea rax, [r15 + 1]
cmp rax, 1
jbe 0x14003f786
xor r14d, r14d
lea rcx, [rsp + 0x28]
mov r8d, 0x90
xor edx, edx
call fcn.14014b2c0
test ebp, ebp
jne 0x14003f6dd
mov ecx, 0xff
mov r14d, 0x408
mov dword [rsp + 0x50], 1
mov eax, r14d
mov dword [rsp + 0x24], ecx
mov r14d, ecx
test rbx, rbx
je 0x14003f664
or eax, 0x100
mov qword [rsp + 0x98], rbx
or eax, 0x2000
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x28]
mov rcx, r15
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14003f76f
not edi
and r14d, edi
lea r8, [rsp + 0x24]
mov dword [r8], r14d
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x14003f76f
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140149190
mov eax, esi
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp ebp, 1
jne 0x14003f7af
mov ecx, 0xd8
mov r14d, 8
jmp 0x14003f640
call fcn.1400bbc10
mov r12, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x14003f72a
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r12
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x14003f5ec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003f7d0
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14003f769
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x14003f708
xor ecx, ecx
mov dl, 1
jmp 0x14003f762
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14003f6b9
mov esi, 0x4df
jmp 0x14003f6b9
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140149190
nop
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xc8
cmp ebp, 2
je 0x14003f648
mov eax, 0
cmp ebp, 3
je 0x14003f652
jmp 0x14003f66d
xor ecx, ecx
jmp 0x14003f760
Function at 0x1400412e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x140260028]
xor rdx, rsp
mov qword [rsp + 0x40], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x38]
mov qword [r8], rdx
or r9d, 8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400413b2
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1400413b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400413ae
call fcn.1400bbc10
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
mov bpl, 1
test rbx, rbx
je 0x140041391
cmp rbx, 0xffffffffffffffff
je 0x1400413b9
call fcn.1400bbc10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsi], rbx
call fcn.1400bbc10
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140149190
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x140041357
mov byte [rsi], 0
xor ebp, ebp
jmp 0x140041391
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140041389
Function at 0x140046d90
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x10040
call fcn.140149130
sub rsp, rax
mov rsi, rdx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x10038], rax
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rax
mov r8, rdi
call fcn.1400fbea0
test rsi, rsi
je 0x140046e5d
lea rbx, [rsp + 0x3a]
mov r8d, 0xfffe
mov rcx, rbx
mov dl, 0xaa
call fcn.14014b2c0
cmp byte [rsp + 0x37], 0
jns 0x140046e00
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x140046e2f
cmp eax, 0x7fff
jae 0x140046e82
mov edx, eax
lea rcx, [rsp + 0x3a]
mov r8, rsi
call fcn.14004c600
cmp byte [rsp + 0x37], 0
jns 0x140046e40
mov rcx, qword [rsp + 0x20]
call fcn.140146640
mov rcx, qword [rsp + 0x10038]
xor rcx, rsp
call fcn.140149190
mov eax, ebx
add rsp, 0x10040
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsp + 0x37], 0
js 0x140046e6b
lea rcx, [rsp + 0x20]
jmp 0x140046e70
mov rcx, qword [rsp + 0x20]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x140046e2f
int3

Function at 0x140047010
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x140047149
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x40]
mov qword [rbx], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov r14, rax
call r15
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne bl
je 0x140047150
mov r15, qword [rsp + 0x40]
cmp qword [rsi], r15
je 0x1400470bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400470d7
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400470b4
mov qword [rsi], r15
call fcn.1400bbc10
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140149190
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400bbc10
mov r14, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x140047108
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x1400470a2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004715d
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140047143
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x1400470e9
xor ecx, ecx
mov dl, 1
jmp 0x14004713c
mov bl, 1
jmp 0x1400470bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400470b4
xor ecx, ecx
jmp 0x14004713a
Function at 0x140048db0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140048f6c
cmp qword [rsi], 0
jne 0x140048f6c
cmp dword [rsi + 0x14], 0
jne 0x140048f6c
cmp qword [rsi + 8], 0
jne 0x140048f6c
xor eax, eax
mov r15, qword [rdi]
cmp rax, r15
je 0x140048e26
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140048eaf
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140048e1e
mov qword [rsi], r15
call fcn.1400bbc10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 8]
cmp qword [rsi + 8], r15
je 0x140048e60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140048e78
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140048e58
mov qword [rsi + 8], r15
call fcn.1400bbc10
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400bbc10
mov r14, qword [rsi + 8]
cmp qword [0x1402723f8], 0
je 0x140048f28
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rsi + 8], 0
jmp 0x140048e45
call fcn.1400bbc10
mov r14, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x140048ee3
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x140048e0c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140048f8d
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140048f22
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x140048ec1
xor ecx, ecx
mov dl, 1
jmp 0x140048f1b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140048f91
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140048f66
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x140048e8f
xor ecx, ecx
mov dl, 1
jmp 0x140048f5c
mov rcx, rsi
call fcn.14013bbf0
lea rcx, [rsi + 8]
call fcn.14013bbf0
mov qword [rsi + 0x10], 0
mov rax, qword [rsi]
jmp 0x140048dec
xor ecx, ecx
jmp 0x140048f19
xor ecx, ecx
jmp 0x140048f5a

Function at 0x140049720
Capabilities:
Check if file exists

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov al, byte [rcx + 8]
cmp al, byte [rdx + 8]
je 0x14004974b
test al, al
jne 0x14004975e
test rsi, rsi
je 0x14004975c
mov rcx, rsi
call fcn.14003dfc0
mov byte [rsi + 8], 1
add rsp, 0x20
pop rsi
ret
test al, al
je 0x140049745
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140049770
ud2
mov rcx, rsi
call fcn.140036280
mov byte [rsi + 8], 0
jmp 0x140049745
Function at 0x140049770
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x140049797
call fcn.1400bbc10
cmp qword [rsi], r14
je 0x1400497c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400497d5
cmp r15, 2
jb 0x1400497be
mov qword [rsi], r14
call fcn.1400bbc10
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400bbc10
mov rbx, qword [rsi]
cmp qword [0x1402723f8], 0
je 0x140049806
mov rcx, qword [0x1402723f8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x1402529a0]
mov qword [rsi], 0
jmp 0x1400497b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402437e7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049847
lea rcx, [sym.GptBrowser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140049841
call qword [0x1402529a0]
mov rcx, rax
xor edx, edx
call fcn.140049fa0
jmp 0x1400497e7
xor ecx, ecx
mov dl, 1
jmp 0x14004983a
xor ecx, ecx
jmp 0x140049838
Function at 0x140049d10
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x140049e96
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x140049e96
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rbx, rax
mov r15, qword [rdi + 8]
cmp r15, rax
je 0x140049da4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x140049ebb
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140049d95
mov qword [rdi + 8], rbx
call fcn.1400bbc10
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 8]
mov rbx, r15
inc rbx
cmp rbx, 2
jb 0x140049f57
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.140146648
mov r14, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.140146648
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x140262688]
je 0x140049ef1
mov rax, r14
and rax, r12
cmp rax, qword [0x140262688]
je 0x140049f62
mov qword [rdi + 0x18], r14
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14004e960]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp qword [rdi + 0x10], rax
je 0x140049e8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x140049ed6
mov rax, r15
inc rax
cmp rax, 2
jb 0x140049e81
mov qword [rdi + 0x10], r15
call fcn.1400bbc10
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x10]
inc r15
cmp r15, 1
jbe 0x140049efb
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x140049f6f
mov eax, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400bbc10
mov rcx, qword [rdi + 8]
call fcn.1401365c0
mov qword [rdi + 8], 0
jmp 0x140049d80
call fcn.1400bbc10
mov rcx, qword [rdi + 0x10]
call fcn.1401365c0
mov qword [rdi + 0x10], 0
jmp 0x140049e6c
call fcn.140004bf0
jmp 0x140049e0f
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x140262688]
jne 0x140049f10
call fcn.140004bf0
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x140049f57
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x140049f3e
mov rcx, rdi
call fcn.1400b3c10
mov rcx, rdi
call fcn.140146640
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x140049f86
mov rcx, rbx
call fcn.140146640
mov r14d, 0x3b
jmp 0x140049e96
mov rcx, r14
call fcn.140004ab0
jmp 0x140049e22
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x1402529a0]
jmp 0x140049ea9
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x1402529a0]
jmp 0x140049f4f
Function at 0x14004d7d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [rsi], ecx
jne 0x14004d978
mov dword [0x140270280], ebx
lea rbp, [0x140270280]
movabs rax, 0x100000000
mov qword [0x1402703a0], rax
movaps xmm6, xmmword [0x14022cb50]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov r14, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, rdi
call r14
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [0x1402703a8], rcx
mov r15d, 0x20
mov qword [0x1402703b0], r15
mov r12d, 0x40
mov qword [0x1402703b8], r12
mov dword [0x1402703c0], ebx
mov qword [0x140270288], rbx
lea rax, [0x140270288]
mov r13, 0xffffffffb37cc16a
xor rax, r13
mov qword [0x140270290], rax
mov qword [0x140270298], rbp
mov dword [0x1402702a8], ebx
lea rcx, [0x1402702b0]
mov r8d, 0xf0
xor edx, edx
call fcn.14014b2c0
mov dword [0x1402703c8], ebx
lea rbp, [0x1402703c8]
mov qword [0x1402704e8], rbx
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdi, [rsp + 0x20]
mov rcx, rdi
call r14
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [0x1402704f0], rcx
mov qword [0x1402704f8], r15
mov qword [0x140270500], r12
mov dword [0x140270508], ebx
mov qword [0x1402703d0], rbx
lea rax, [0x1402703d0]
xor rax, r13
mov qword [0x1402703d8], rax
mov qword [0x1402703e0], rbp
mov dword [0x1402703f0], ebx
lea rcx, [0x1402703f8]
mov r8d, 0xf0
xor edx, edx
call fcn.14014b2c0
mov eax, 0xdd
xchg dword [rsi], eax
cmp eax, 0x5a308d2
je 0x14004d998
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140149190
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r9d, edx
lea r8, [0x1402323f0]
mov rcx, rsi
mov edx, 3
call fcn.1400501d0
test eax, eax
jne 0x14004d955
jmp 0x14004d80a
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140149190
mov rcx, rsi
mov dl, 1
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140184cf0