joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e978e
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1402f4550]
mov ecx, dword [0x1402f0db0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1401e9813
lea rcx, [0x1402f4550]
call fcn.14010d4bc
cmp dword [0x1402f4550], 0xffffffff
jne 0x1401e9813
lea rcx, [0x1402a136c]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14006e48d
mov qword [0x1402f4548], rax
lea rcx, [0x1402f4550]
call fcn.14010d064
mov rax, qword [0x1402f4548]
test rax, rax
je 0x1401e9a34
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x140318008]
test eax, eax
je 0x1401e99e3
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
jne 0x1401e9908
movaps xmm0, xmmword [0x14029bb90]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1401e9a40
test al, al
je 0x1401e9916
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
je 0x1401e9901
call fcn.1401e9c7e
test al, al
je 0x1401e9957
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1401e8ef9
mov sil, 1
test al, al
je 0x1401e9994
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14010fba0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
call fcn.1401ea305
jmp 0x1401e98c0
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1401e988c
cmp dword [0x1402f4050], 2
jg 0x1401e99dc
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21f
mov r9d, 2
call fcn.1400c0e80
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
jmp 0x1401e99cf
cmp dword [0x1402f4050], 2
jg 0x1401e99dc
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x228
mov r9d, 2
call fcn.1400c0e80
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x1401e99cf
cmp dword [0x1402f4050], 2
jg 0x1401e99dc
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22d
mov r9d, 2
call fcn.1400c0e80
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
call fcn.14017d289
mov rcx, rsi
call fcn.140089d40
xor esi, esi
jmp 0x1401e98e4
cmp dword [0x1402f4050], 2
jg 0x1401e9a34
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4c
mov r9d, 2
call fcn.1401cdc40
lea rcx, [rsp + 0x40]
lea rdx, [0x1402b12db]
mov r8d, 0xe
call fcn.14017d289
mov rcx, rbx
call fcn.1401cdcc0
mov byte [rsi + 0x81], 0
jmp 0x1401e9857
Function at 0x1401f06f5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1402efc50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x1401f0875
mov ecx, 1
mov edx, 0x2d8
call fcn.140077340
test rax, rax
je 0x1401f0895
mov rsi, rax
lea rdi, [0x1402fc7a0]
mov rcx, rdi
call fcn.1400cdd64
movabs rax, 0x100000000001
mov qword [rsi + 0x2bc], rax
lea rax, [fcn.1401645d0]
mov qword [rsi + 0x188], rax
lea rax, [0x14021a180]
mov qword [rsi + 0x190], rax
lea rax, [0x14021a1a0]
mov qword [rsi + 0x198], rax
lea rax, [0x14021a1c0]
mov qword [rsi + 0x1a0], rax
movabs rax, 0x100000001
mov qword [rsi + 0x1ac], rax
mov dword [rsi + 0x2a8], 1
lea rax, [0x1402a31bd]
mov qword [rsi + 0x2b0], rax
lea rax, [0x14021da40]
mov qword [rsi + 0x70], rax
mov rcx, rdi
call fcn.1400cdd71
mov ecx, dword [0x1402efc50]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rdi
mov rdx, rax
mov r8, rdi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401f086f
mov rdx, qword [rsp + 0x40]
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x1401f0950]
lea rcx, [rsp + 0x38]
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x1401f088d
mov qword [rsi + 8], rcx
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x10], rax
mov dword [rsi], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010fba0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401f086f
mov ecx, 2
call fcn.14010d740
lea rcx, str.libxml2:_Failed_to_allocate_globals_for_thread_nlibxml2:_See_xmlCheckThreadLocalStorage_n
mov edx, 0x57
mov r8d, 1
mov r9, rax
call fcn.14010dbec
call fcn.1401272f0
int3
Function at 0x1402084f0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x140301ec0]
test rax, rax
jne 0x140208534
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x140301ec0]
test rax, rax
je 0x140208521
cmp eax, 2
jne 0x140208587
cmp dword [0x1402f4050], 2
jg 0x1402085ea
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x95
mov r9d, 2
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch
mov r8d, 0x1d
call fcn.14017d289
mov rcx, rsi
call fcn.140089d40
jmp 0x1402085ea
mov eax, 1
lock xadd qword [0x140301ef8], rax
inc rax
cmp rax, 2
jl 0x1402085ab
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140301e80], eax
mov qword [0x140301e78], rsi
mov rcx, qword [0x1402efc68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14010fba0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x140223a0f
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x140223a4e
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x140223a1e
mov dword [rsi], 7
jmp 0x140223a1e
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400a393d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140223a2a
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140223a2a
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140223b00
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x140223a20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140223a1e
Function at 0x140227e78
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp dword [rcx + 0x10108], 0
mov r9d, dword [rcx + 0xd4]
je 0x140227f3a
test r9d, r9d
je 0x140227f90
xor eax, eax
mov ecx, 0xff
mov r10d, dword [rsi + 0x10128]
mov r8d, dword [rsi + 0x10130]
mov edx, r8d
and edx, 0xfffd
mov r11d, r8d
or r11d, 2
xor edx, 3
imul edx, r11d
shr edx, 8
mov r11, qword [rsi + 0x10138]
mov bl, byte [rsi + rax + 0x100]
xor bl, r10b
movzx edi, bl
shr r10d, 8
xor r10d, dword [r11 + rdi*4]
mov dword [rsi + 0x10128], r10d
and r10d, ecx
add r10d, dword [rsi + 0x1012c]
imul r10d, r10d, 0x8088405
inc r10d
mov dword [rsi + 0x1012c], r10d
shr r10d, 0x18
mov edi, r8d
and edi, ecx
xor edi, r10d
shr r8d, 8
xor r8d, dword [r11 + rdi*4]
mov dword [rsi + 0x10130], r8d
xor byte [rsi + rax + 0x100], dl
inc rax
cmp r9, rax
jne 0x140227ea6
lea r8, [rsi + 0x100]
mov rdx, qword [rsi + 0x58]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x38]
call qword [0x140318008]
mov edx, dword [rsi + 0x84]
mov r8d, dword [rsi + 0xd4]
xor ecx, ecx
cmp eax, r8d
setne cl
add qword [rsi + 0x10118], r8
neg ecx
add qword [rsi + 0x10120], rdx
xor eax, eax
mov dword [rsi + 0x84], eax
mov dword [rsi + 0xd4], eax
mov eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor r9d, r9d
jmp 0x140227f3a

Function at 0x1402289a1
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
push rbx
movabs rax, 0x2345678912345678
mov qword [rdx], rax
mov dword [rdx + 8], 0x34567890
mov bl, byte [rcx]
test bl, bl
je 0x140228a23
inc rcx
mov eax, 0x12345678
mov r10d, 0x23456789
mov r9d, 0x34567890
mov r11d, 0xff
mov esi, eax
xor sil, bl
movzx esi, sil
shr eax, 8
xor eax, dword [r8 + rsi*4]
mov dword [rdx], eax
mov esi, eax
and esi, r11d
add esi, r10d
imul r10d, esi, 0x8088405
inc r10d
mov dword [rdx + 4], r10d
mov esi, r10d
shr esi, 0x18
mov edi, r9d
and edi, r11d
xor edi, esi
shr r9d, 8
xor r9d, dword [r8 + rdi*4]
mov dword [rdx + 8], r9d
mov bl, byte [rcx]
inc rcx
test bl, bl
jne 0x1402289d8
pop rbx
pop rdi
pop rsi
ret

Function at 0x14022bc12
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140153500
test al, al
jne 0x14022bc29
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140230aa0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
js 0x140230ab2
mov rsi, rdx
test rdx, rdx
jne 0x140230ab9
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.140230b00
test edi, edi
je 0x140230ab2
cmp byte [rsi + rdi - 1], 0xa
je 0x140230ab2
lea rcx, [0x1402a1deb]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140230b00
Function at 0x140230b00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140230b4e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x140230b8c
cmp rdi, rsi
jae 0x140230b8c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x140230b47
jmp 0x140230b44
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010fba0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140243b9a
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140243c8b
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp byte [r8 + 0x17], 0
jns 0x140243c00
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x140243ca6
mov rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010fba0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x140243c7c
Function at 0x1402485d4
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140248634
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010fba0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140261244
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14029bb90]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14017cee6
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14027162c
test al, al
je 0x14026132d
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402613df
mov rcx, r14
call fcn.14017cee6
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14027162c
test al, al
je 0x1402613a3
cmp dword [rbx], 0x4550
jne 0x140261424
mov sil, 1
test rdi, rdi
je 0x14026130c
mov qword [rdi], r14
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14010fba0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14005e390
test al, al
je 0x14026139c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14017d289
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140261382
and r8d, 0x7f
jmp 0x140261389
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.14017d289
mov rcx, rdi
call fcn.140089d40
xor esi, esi
jmp 0x14026130c
mov ecx, 1
call fcn.14005e390
test al, al
je 0x14026139c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140261367
mov ecx, 1
call fcn.14005e390
test al, al
je 0x14026139c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14026136d
mov ecx, 1
call fcn.14005e390
test al, al
je 0x14026139c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14026136d
Function at 0x14026146e
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402e0038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14029bb90]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14017cee6
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14027162c
test al, al
je 0x140261585
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14026153f
mov rcx, r14
call fcn.14017cee6
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14027162c
test al, al
je 0x140261617
cmp dword [rbx], 0x4550
jne 0x140261656
mov sil, 1
test rdi, rdi
je 0x1402615f6
mov qword [rdi], r14
jmp 0x1402615f6
mov ecx, 1
call fcn.14005e390
test al, al
je 0x1402615f4
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402615c5
mov ecx, 1
call fcn.14005e390
test al, al
je 0x1402615f4
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14017d289
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402615da
and r8d, 0x7f
jmp 0x1402615e1
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.14017d289
mov rcx, rdi
call fcn.140089d40
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14010fba0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14005e390
test al, al
je 0x1402615f4
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402615bf
mov ecx, 1
call fcn.14005e390
test al, al
je 0x1402615f4
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400c0e80
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402615c5
Function at 0x140271100
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x98]
mov edx, dword [rsp + 0x90]
mov rcx, qword [0x1402e0038]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.1400cbff2
mov rbx, qword [rbx]
lea rax, [rbx + 1]
cmp rax, 1
ja 0x1402711b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rax, qword [rsp + 0x38]
inc rax
cmp rax, 2
jb 0x140271197
call fcn.140096510
mov rcx, qword [rsp + 0x38]
call fcn.140095cd0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010fba0
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea esi, [rcx + rcx*4]
jmp 0x14027117a

Function at 0x140001000
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, str.Roblox
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rax
test rax, rax
je 0x140001083
lea rdx, str.Roblox_found__n
call fcn.1400010b0
lea rdx, str.Bypassed__Telegram__kryyaasoft
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Roblox_bypassed_successfuly__n
call fcn.1400010b0
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Roblox
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rcx, str.call_LagSwitch.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea rdx, str.Roblox_not_found__n
call fcn.1400010b0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140001bd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c22
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c24
xor al, al
add rsp, 0x28
ret