joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087bb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140087be0
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140087c62
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140087c2e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140087c36
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140087bd5
mov qword [rsp + 8], 0xe3
jmp 0x140087c7a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140087d01
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140087ccb
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140087cd3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140087c6d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140087d55
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140087d5d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140088880
Capabilities:
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x20], 0x41
mov byte [rsp + 0x30], 0x1d
mov byte [rsp + 0x31], 0x1e
mov byte [rsp + 0x32], 0x1f
mov byte [rsp + 0x33], 0x20
mov byte [rsp + 0x34], 0x21
mov byte [rsp + 0x35], 0x22
mov byte [rsp + 0x36], 0x23
mov byte [rsp + 0x37], 0x24
mov byte [rsp + 0x38], 0x25
mov byte [rsp + 0x39], 0x26
mov byte [rsp + 0x3a], 0x27
mov byte [rsp + 0x3b], 0x28
mov byte [rsp + 0x3c], 0x29
mov byte [rsp + 0x3d], 0x10
mov byte [rsp + 0x3e], 0x11
mov byte [rsp + 0x3f], 0x12
mov byte [rsp + 0x40], 0x13
mov byte [rsp + 0x41], 0x14
mov byte [rsp + 0x42], 0x15
mov byte [rsp + 0x43], 0x16
mov byte [rsp + 0x44], 0x17
mov byte [rsp + 0x45], 0x18
mov byte [rsp + 0x46], 0x19
mov byte [rsp + 0x47], 0x1a
mov byte [rsp + 0x48], 0x1b
mov byte [rsp + 0x49], 0x1c
mov byte [rsp + 0x4a], 0x3d
mov byte [rsp + 0x4b], 0x3e
mov byte [rsp + 0x4c], 0x3f
mov byte [rsp + 0x4d], 0x40
mov byte [rsp + 0x4e], 0x41
mov byte [rsp + 0x4f], 0x42
mov byte [rsp + 0x50], 0x43
mov byte [rsp + 0x51], 0x44
mov byte [rsp + 0x52], 0x45
mov byte [rsp + 0x53], 0x46
mov byte [rsp + 0x54], 0x47
mov byte [rsp + 0x55], 0x48
mov byte [rsp + 0x56], 0x49
mov byte [rsp + 0x57], 0x30
mov byte [rsp + 0x58], 0x31
mov byte [rsp + 0x59], 0x32
mov byte [rsp + 0x5a], 0x33
mov byte [rsp + 0x5b], 0x34
mov byte [rsp + 0x5c], 0x35
mov byte [rsp + 0x5d], 0x36
mov byte [rsp + 0x5e], 0x37
mov byte [rsp + 0x5f], 0x38
mov byte [rsp + 0x60], 0x39
mov byte [rsp + 0x61], 0x3a
mov byte [rsp + 0x62], 0x3b
mov byte [rsp + 0x63], 0x3c
mov byte [rsp + 0x64], 0xff
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 1
mov byte [rsp + 0x67], 2
mov byte [rsp + 0x68], 3
mov byte [rsp + 0x69], 4
mov byte [rsp + 0x6a], 5
mov byte [rsp + 0x6b], 6
mov byte [rsp + 0x6c], 7
mov byte [rsp + 0x6d], 8
mov byte [rsp + 0x6e], 0xfa
mov byte [rsp + 0x6f], 0xfe
mov byte [rsp + 0x70], 0xcf
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1a78], eax
jle 0x140088a49
lea rcx, [0x1400e1a78]
call fcn.14008ee08
cmp dword [0x1400e1a78], 0xffffffff
jne 0x140088a49
lea rdx, [rsp + 0x30]
lea rcx, [0x1400e1af0]
call fcn.14008e4f0
lea rcx, [0x1400bf3c0]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1a78]
call fcn.14008ed9c
lea rax, [0x1400e1af0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x98
ret
Function at 0x14008a320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0x14
mov byte [rsp + 0x28], 0x3b
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x42
mov byte [rsp + 0x2b], 0x51
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x4d
mov byte [rsp + 0x2e], 0x53
mov byte [rsp + 0x2f], 0x48
mov byte [rsp + 0x30], 0x4c
mov byte [rsp + 0x31], 0x44
mov byte [rsp + 0x32], 0x10
mov byte [rsp + 0x33], 0x13
mov byte [rsp + 0x34], 0xf
mov byte [rsp + 0x35], 0x3e
mov byte [rsp + 0x36], 0x10
mov byte [rsp + 0x37], 0xd
mov byte [rsp + 0x38], 0x43
mov byte [rsp + 0x39], 0x4b
mov byte [rsp + 0x3a], 0x4b
mov byte [rsp + 0x3b], 0xdf
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1c30], eax
jle 0x14008a402
lea rcx, [0x1400e1c30]
call fcn.14008ee08
cmp dword [0x1400e1c30], 0xffffffff
jne 0x14008a402
lea rdx, [rsp + 0x28]
lea rcx, [0x1400e19b8]
call fcn.1400818d0
lea rcx, [0x1400bf920]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1c30]
call fcn.14008ed9c
lea rax, [0x1400e19b8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x58
ret
Function at 0x14008aef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0x12
mov byte [rsp + 0x28], 0x65
mov byte [rsp + 0x29], 0x65
mov byte [rsp + 0x2a], 0x37
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x5f
mov byte [rsp + 0x2d], 0x4b
mov byte [rsp + 0x2e], 0x78
mov byte [rsp + 0x2f], 0x81
mov byte [rsp + 0x30], 0x56
mov byte [rsp + 0x31], 0x72
mov byte [rsp + 0x32], 0x77
mov byte [rsp + 0x33], 0x72
mov byte [rsp + 0x34], 0x5b
mov byte [rsp + 0x35], 0x6d
mov byte [rsp + 0x36], 0x7b
mov byte [rsp + 0x37], 0x4d
mov byte [rsp + 0x38], 0x57
mov byte [rsp + 0x39], 9
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1c68], eax
jle 0x14008afc8
lea rcx, [0x1400e1c68]
call fcn.14008ee08
cmp dword [0x1400e1c68], 0xffffffff
jne 0x14008afc8
lea rdx, [rsp + 0x28]
lea rcx, [0x1400e1a30]
call fcn.140082c50
lea rcx, [0x1400bf7c0]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1c68]
call fcn.14008ed9c
lea rax, [0x1400e1a30]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x58
ret

Function at 0x14008b1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0x23
mov byte [rsp + 0x28], 0x54
mov byte [rsp + 0x29], 0x50
mov byte [rsp + 0x2a], 0x47
mov byte [rsp + 0x2b], 0x55
mov byte [rsp + 0x2c], 0x58
mov byte [rsp + 0x2d], 0x42
mov byte [rsp + 0x2e], 0x53
mov byte [rsp + 0x2f], 0x46
mov byte [rsp + 0x30], 0x5d
mov byte [rsp + 0x31], 0x57
mov byte [rsp + 0x32], 0x4e
mov byte [rsp + 0x33], 0x78
mov byte [rsp + 0x34], 0x62
mov byte [rsp + 0x35], 0x73
mov byte [rsp + 0x36], 0x66
mov byte [rsp + 0x37], 0x2d
mov byte [rsp + 0x38], 0x21
mov byte [rsp + 0x39], 0x4a
mov byte [rsp + 0x3a], 0x6f
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x3c], 0x2f
mov byte [rsp + 0x3d], 0x5d
mov byte [rsp + 0x3e], 0x57
mov byte [rsp + 0x3f], 0x4e
mov byte [rsp + 0x40], 0x78
mov byte [rsp + 0x41], 0x62
mov byte [rsp + 0x42], 0x73
mov byte [rsp + 0x43], 0x66
mov byte [rsp + 0x44], 0x21
mov byte [rsp + 0x45], 0x55
mov byte [rsp + 0x46], 0x70
mov byte [rsp + 0x47], 0x70
mov byte [rsp + 0x48], 0x6d
mov byte [rsp + 0x49], 0x74
mov byte [rsp + 0x4a], 1
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1ad8], eax
jle 0x14008b2dd
lea rcx, [0x1400e1ad8]
call fcn.14008ee08
cmp dword [0x1400e1ad8], 0xffffffff
jne 0x14008b2dd
lea rdx, [rsp + 0x28]
lea rcx, [0x1400e1d48]
call fcn.14008da70
lea rcx, [0x1400bf760]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1ad8]
call fcn.14008ed9c
lea rax, [0x1400e1d48]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x68
ret
Function at 0x14008b300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0xc
mov byte [rsp + 0x28], 0x42
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x41
mov byte [rsp + 0x2b], 0x4f
mov byte [rsp + 0x2c], 0x59
mov byte [rsp + 0x2d], 0x41
mov byte [rsp + 0x2e], 0x40
mov byte [rsp + 0x2f], 0xd
mov byte [rsp + 0x30], 0x51
mov byte [rsp + 0x31], 0x4a
mov byte [rsp + 0x32], 0x51
mov byte [rsp + 0x33], 0xdf
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1b90], eax
jle 0x14008b3ba
lea rcx, [0x1400e1b90]
call fcn.14008ee08
cmp dword [0x1400e1b90], 0xffffffff
jne 0x14008b3ba
lea rdx, [rsp + 0x28]
lea rcx, [0x1400e1ba0]
call fcn.140083710
lea rcx, [0x1400bf740]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1b90]
call fcn.14008ed9c
lea rax, [0x1400e1ba0]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x48
ret

Function at 0x14008b3e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0xe
mov byte [rsp + 0x28], 0x42
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x41
mov byte [rsp + 0x2b], 0x4f
mov byte [rsp + 0x2c], 0x59
mov byte [rsp + 0x2d], 0x41
mov byte [rsp + 0x2e], 0x40
mov byte [rsp + 0x2f], 0x15
mov byte [rsp + 0x30], 0x13
mov byte [rsp + 0x31], 0xd
mov byte [rsp + 0x32], 0x51
mov byte [rsp + 0x33], 0x4a
mov byte [rsp + 0x34], 0x51
mov byte [rsp + 0x35], 0xdf
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1a2c], eax
jle 0x14008b4a4
lea rcx, [0x1400e1a2c]
call fcn.14008ee08
cmp dword [0x1400e1a2c], 0xffffffff
jne 0x14008b4a4
lea rdx, [rsp + 0x28]
lea rcx, [0x1400e1a68]
call fcn.140083a90
lea rcx, [0x1400bf720]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1a2c]
call fcn.14008ed9c
lea rax, [0x1400e1a68]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x48
ret

Function at 0x14008c6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0xc
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x29], 0x7c
mov byte [rsp + 0x2a], 0x79
mov byte [rsp + 0x2b], 0x7f
mov byte [rsp + 0x2c], 0x7d
mov byte [rsp + 0x2d], 0x6c
mov byte [rsp + 0x2e], 0x72
mov byte [rsp + 0x2f], 0x39
mov byte [rsp + 0x30], 0x7d
mov byte [rsp + 0x31], 0x76
mov byte [rsp + 0x32], 0x7d
mov byte [rsp + 0x33], 0xb
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1adc], eax
jle 0x14008c78a
lea rcx, [0x1400e1adc]
call fcn.14008ee08
cmp dword [0x1400e1adc], 0xffffffff
jne 0x14008c78a
lea rdx, [rsp + 0x28]
lea rcx, [0x1400e1da8]
call fcn.140083710
lea rcx, [0x1400bf440]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1adc]
call fcn.14008ed9c
lea rax, [0x1400e1da8]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x48
ret
Function at 0x14008c7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0xe
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x29], 0x7c
mov byte [rsp + 0x2a], 0x71
mov byte [rsp + 0x2b], 0x7d
mov byte [rsp + 0x2c], 0x70
mov byte [rsp + 0x2d], 0x74
mov byte [rsp + 0x2e], 0x81
mov byte [rsp + 0x2f], 0x7b
mov byte [rsp + 0x30], 0x7d
mov byte [rsp + 0x31], 0x39
mov byte [rsp + 0x32], 0x7d
mov byte [rsp + 0x33], 0x76
mov byte [rsp + 0x34], 0x7d
mov byte [rsp + 0x35], 0xb
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1400e1bf4], eax
jle 0x14008c874
lea rcx, [0x1400e1bf4]
call fcn.14008ee08
cmp dword [0x1400e1bf4], 0xffffffff
jne 0x14008c874
lea rdx, [rsp + 0x28]
lea rcx, [0x1400e1bd0]
call fcn.140083a90
lea rcx, [0x1400bf420]
call fcn.14008f1c4
nop
lea rcx, [0x1400e1bf4]
call fcn.14008ed9c
lea rax, [0x1400e1bd0]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ed40
add rsp, 0x48
ret

Function at 0x14008faac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008faf6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008faf6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008faf6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008faf6
cmp dword [rcx + 0x84], 0xe
jbe 0x14008faf6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008faf8
xor al, al
add rsp, 0x28
ret
Function at 0x1400079c0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140007a09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140007a25
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140007a01
mov qword [rsi], rdi
call fcn.1400b34e0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140007a97
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400b34e0
mov r14, qword [rsi]
cmp qword [0x140243968], 0
je 0x140007a56
mov rcx, qword [0x140243968]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140223bc8]
mov qword [rsi], 0
jmp 0x1400079ef
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14021595f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007a9a
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140007a91
call qword [0x140223bc8]
mov rcx, rax
xor edx, edx
call fcn.140047ac0
jmp 0x140007a37
xor ecx, ecx
mov dl, 1
jmp 0x140007a8a
int3
xor ecx, ecx
jmp 0x140007a88

Function at 0x140007b80
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x140231028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401fd0c0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, [0x14020eec7]
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x440
call fcn.1400c8fe0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400b4360
mov qword [rsp + 0x80], 0xb
mov al, byte [0x14024358b]
test al, al
jne 0x140007c3c
cmp byte [rsi + 0x17], 0
jns 0x140007c07
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea rcx, [rsp + 0x40]
call fcn.1400f4cf0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14012c2d0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
lea r9, [rsp + 0x90]
mov qword [r9], rdi
lea rax, str.ScopedBlockingCall
lea r8, [rsp + 0x88]
mov qword [r8], rax
lea rdx, [rsp + 0x80]
call fcn.140183b80
jmp 0x140007bfe
Function at 0x140007c70
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x140007c9c
call fcn.1400b34e0
cmp qword [rsi], r15
je 0x140007ccb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140007cf6
cmp r12, 2
jb 0x140007cc3
mov qword [rsi], r15
call fcn.1400b34e0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140007d68
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400b34e0
mov r14, qword [rsi]
cmp qword [0x140243968], 0
je 0x140007d27
mov rcx, qword [0x140243968]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140223bc8]
mov qword [rsi], 0
jmp 0x140007cb5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14021595f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007d75
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140007d62
call qword [0x140223bc8]
mov rcx, rax
xor edx, edx
call fcn.140047ac0
jmp 0x140007d08
xor ecx, ecx
mov dl, 1
jmp 0x140007d5b
mov rcx, rdi
call fcn.14011cc80
jmp 0x140007ce5
xor ecx, ecx
jmp 0x140007d59

Function at 0x140007d80
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140231028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140007eaf
lea rax, [rsp + 0x35]
mov byte [rax + 2], 0x15
lea rcx, str.ExitCodeWatcherThread
lea rdx, [rsp + 0x20]
cmp rdx, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x140007eb2
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.140007ee0
cmp byte [rdi + 0x17], 0
js 0x140007ec5
mov dword [rsi + 0x90], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x98], 0
test rax, rax
je 0x140007e79
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x98]
inc rax
cmp rax, 2
jae 0x140007e91
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140007e71
mov qword [rsi + 0x98], rdi
call fcn.1400b34e0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012c2d0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400b34e0
mov rcx, qword [rsi + 0x98]
call fcn.140117b90
mov qword [rsi + 0x98], 0
jmp 0x140007e5b
int3
lea rcx, [0x14020233c]
lea rdx, str....._third_partylibc_srcinclude__stringchar_traits.h:145:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
call fcn.140163630
mov rcx, qword [rsp + 0x20]
call fcn.1401298a0
jmp 0x140007e13
Function at 0x140014660
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x1400146dd
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400146ac
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14001469a
mov qword [rdi], rsi
call fcn.1400b34e0
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.1400b34e0
mov r14, qword [rdi]
cmp qword [0x140243968], 0
je 0x1400146e7
mov rcx, qword [0x140243968]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140223bc8]
mov qword [rdi], 0
jmp 0x140014688
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14021595f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014728
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140014722
call qword [0x140223bc8]
mov rcx, rax
xor edx, edx
call fcn.140047ac0
jmp 0x1400146be
xor ecx, ecx
mov dl, 1
jmp 0x14001471b
xor ecx, ecx
jmp 0x140014719

Function at 0x140014c70
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1402403d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x120], 0
je 0x140014d2d
mov eax, dword [0x1402403d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x188], 1
je 0x140014d29
mov ecx, dword [rsi + 0x1928]
test ecx, ecx
jne 0x140014d29
mov ecx, 1
lock xadd dword [rsi + 0x1928], ecx
cmp ecx, 0x7fffffff
je 0x140014d37
test rsi, rsi
je 0x140014d3a
lea rbx, [rax + 0x188]
call fcn.14001e7d0
mov edx, 0x570
mov rcx, rax
xor r8d, r8d
call fcn.14001e890
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.1400e0ab0
mov ecx, dword [0x140243cb0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rbx], rdi
lock dec dword [rsi + 0x1928]
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x140014d1e
call fcn.14012bac8
jmp 0x140014c9a
int3
int3
Function at 0x140015d00
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140231028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140243700]
mov ecx, dword [0x1402403d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140015d60
lea rsi, [0x1402436f8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14012c2d0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140243700]
call fcn.1401299b4
cmp dword [0x140243700], 0xffffffff
jne 0x140015d3c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.14012e410
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.1401298a8
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140243748]
mov ecx, dword [0x1402403d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140015e20
lea r8, [0x140243718]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140031ae0
mov qword [0x1402436f8], rsi
lea rcx, [0x140243700]
call fcn.140129a1c
jmp 0x140015d3c
lea rcx, [0x140243748]
call fcn.1401299b4
cmp dword [0x140243748], 0xffffffff
jne 0x140015df1
xorps xmm0, xmm0
movups xmmword [0x140243738], xmm0
movups xmmword [0x140243728], xmm0
movups xmmword [0x140243718], xmm0
lea rcx, [0x140243718]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140243748]
call fcn.140129a1c
jmp 0x140015df1