joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400811b0
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x70], rax
or r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140081232
mov dword [rsp + 0x60], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140081254
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ca2e0
nop
add rsp, 0x78
pop rdi
pop rsi
ret
mov edx, dword [rsp + 0x60]
add edx, 0xffffffff
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x140081239
test edx, edx
js 0x140081239
mov dword [rsp + 0x6c], 0x104
lea r8, [rsi + 0xc]
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x6c]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140081239
jmp 0x14008123f

Function at 0x140081350
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 8]
lea edx, [rax - 1]
mov dword [rcx + 8], edx
test eax, eax
jle 0x1400813b2
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400813b2
mov dword [rsp + 0x54], 0x104
lea r8, [rsi + 0xc]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x54]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400813b8
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ca2e0
nop
add rsp, 0x60
pop rsi
ret
Function at 0x140083070
Capabilities:
Get hostname

Disassembly:
push rsi
push rbx
sub rsp, 0x258
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rcx, str..._.._base_win_win_util.cc
mov edx, 0x1b
call fcn.140060b70
test eax, eax
jle 0x1400830df
lea rdx, str..._.._base_win_win_util.cc
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov r8d, 0x45c
mov r9d, 0xffffffff
call fcn.140060c10
lea rcx, [rsp + 0x58]
lea rdx, str.Checking_if_internal_user
mov r8d, 0x19
call fcn.140007184
mov rcx, rsi
call fcn.140061070
mov byte [rsp + 0x27], 0
mov word [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0x100
lea rsi, [rsp + 0x50]
lea r8, [rsp + 0x4c]
mov ecx, 3
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140083172
lea rax, str..corp.microsoft.com
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x13
mov qword [rsp + 0x28], rsi
cmp word [rsp + 0x50], 0
je 0x14008314e
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
cmp word [rsp + rax*2 + 0x52], 0
lea rax, [rax + 1]
jne 0x140083140
jmp 0x140083150
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x38]
mov r8d, 1
call fcn.14006cf00
test al, al
je 0x140083172
mov bl, 1
jmp 0x140083182
lea rcx, [rsp + 0x27]
call fcn.140082cf0
mov ebx, eax
and bl, byte [rsp + 0x27]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, ebx
add rsp, 0x258
pop rbx
pop rsi
ret
Function at 0x1400834b0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, dword [0x14026b5f8]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140083510
lea rsi, [0x14026b5f0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401ca2e0
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x14026b5f8]
call fcn.1401ca090
cmp dword [0x14026b5f8], 0xffffffff
jne 0x1400834ec
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call fcn.1401cd0e0
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.1401c9f10
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x14026b658]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400835d1
lea r8, [0x14026b628]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov r9d, edi
call fcn.140083790
mov qword [0x14026b5f0], rsi
lea rcx, [0x14026b5f8]
call fcn.1401ca128
jmp 0x1400834ec
lea rcx, [0x14026b658]
call fcn.1401ca090
cmp dword [0x14026b658], 0xffffffff
jne 0x1400835a2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x14026b648], xmm2
movups xmmword [0x14026b638], xmm1
movups xmmword [0x14026b628], xmm0
lea rcx, [0x14026b658]
call fcn.1401ca128
jmp 0x1400835a2

Function at 0x140083660
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14026b658]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400836ea
movzx eax, word [0x14026b628]
cmp rax, 0xc
ja case.0x1400836b2.1
xor esi, esi
lea rcx, [0x140083754]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov esi, 3
jmp case.0x1400836b2.0
mov esi, 5
jmp case.0x1400836b2.0
mov esi, 2
jmp case.0x1400836b2.0
mov esi, 1
jmp case.0x1400836b2.0
mov esi, 4
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x14026b658]
call fcn.1401ca090
cmp dword [0x14026b658], 0xffffffff
jne 0x140083695
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [0x14026b648], xmm2
movups xmmword [0x14026b638], xmm1
movups xmmword [0x14026b628], xmm0
lea rcx, [0x14026b658]
call fcn.1401ca128
jmp 0x140083695
Function at 0x140085dd0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x14026b688]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x140085f3f
jp 0x140085f3f
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x14026b698]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140085f5e
mov eax, dword [0x14026b6a8]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140085f98
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x14026b6a0]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x1402010b0]
subpd xmm1, xmmword [0x1402010c0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x14020c570]
ucomisd xmm1, xmm0
ja 0x140085f3f
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x14026b690]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x1402010b0]
subpd xmm1, xmmword [0x1402010c0]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addsd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x14026b688], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401ca2e0
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x14026b698]
call fcn.1401ca090
cmp dword [0x14026b698], 0xffffffff
jne 0x140085e51
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x14026b690], rdx
lea rcx, [0x14026b698]
call fcn.1401ca128
jmp 0x140085e51
lea rcx, [0x14026b6a8]
call fcn.1401ca090
cmp dword [0x14026b6a8], 0xffffffff
jne 0x140085e76
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x14026b6a0], rax
lea rcx, [0x14026b6a8]
call fcn.1401ca128
jmp 0x140085e76
Function at 0x14008aa40
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x200], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmmword [rsp + 0x1d0], xmm0
mov dword [rsp + 0x1f0], 0
cmp byte [rcx + 0x17], 0
jns 0x14008aa88
mov rcx, qword [rsi]
lea r8, [rsp + 0x1d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14008ab81
mov rcx, rsi
call fcn.14007abd0
movzx r8d, al
xor r8d, 5
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14008aabc
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14008ac0d
lea rcx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
mov edx, 0x3a
call fcn.140060b70
mov dil, 1
test eax, eax
jle 0x14008acd3
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x90]
mov r8d, 0x61
mov r9d, 0xffffffff
call fcn.140060c10
lea rcx, [rsp + 0x98]
lea rdx, str.Scheduled_for_deletion:
mov r8d, 0x18
call fcn.140007184
mov r14, rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14003b7ee
lea rsi, [rsp + 0x78]
mov rcx, rsi
mov rdx, rbx
call fcn.14008d710
xor ebx, ebx
cmp byte [rsi + 0x17], bl
jns 0x14008ab51
mov rsi, qword [rsp + 0x78]
mov rcx, r14
mov rdx, rsi
call fcn.140061a30
cmp byte [rsp + 0x8f], bl
jns 0x14008ab6f
mov rcx, qword [rsp + 0x78]
call fcn.1401c9f6c
lea rcx, [rsp + 0x90]
call fcn.140061070
jmp 0x14008acd3
mov ecx, 1
call fcn.140060b40
test al, al
je 0x14008acd1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x90]
mov r8d, 0x41
mov r9d, 1
call fcn.1400618b0
lea rdi, [rsp + 0xa0]
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov rdx, rsi
call fcn.14003b7ee
lea rsi, [rsp + 0x78]
mov rcx, rsi
mov rdx, rbx
call fcn.14008d710
xor ebx, ebx
cmp byte [rsi + 0x17], bl
jns 0x14008abf0
mov rsi, qword [rsp + 0x78]
mov rcx, rdi
mov rdx, rsi
call fcn.140061a30
lea rdx, str._does_not_exist.
mov r8d, 0x10
jmp 0x14008aca9
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14008acd1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rcx, [rsp + 0x90]
mov r8d, 0x4c
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0xa0]
lea rdx, str.Could_not_schedule
mov r8d, 0x13
call fcn.140007184
mov rdi, rax
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.14003b7ee
lea rsi, [rsp + 0x78]
mov rcx, rsi
mov rdx, rbx
call fcn.14008d710
xor ebx, ebx
cmp byte [rsi + 0x17], bl
jns 0x14008ac91
mov rsi, qword [rsp + 0x78]
mov rcx, rdi
mov rdx, rsi
call fcn.140061a30
lea rdx, str._for_deletion.
mov r8d, 0xe
mov rcx, rax
call fcn.140007184
cmp byte [rsp + 0x8f], bl
jns 0x14008acc4
mov rcx, qword [rsp + 0x78]
call fcn.1401c9f6c
lea rcx, [rsp + 0x90]
call fcn.140061980
xor edi, edi
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14008b8e6
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov r15, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, qword [rcx]
mov rdi, qword [rcx + 8]
cmp rdi, rsi
je 0x14008b92a
lea rbx, [r15 + 0x18]
add rdi, 0xffffffffffffffd0
mov rcx, rbx
mov rdx, rdi
call fcn.140012db0
cmp rsi, rdi
jne 0x14008b916
mov qword [r15 + 8], rsi
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
lea rdi, [rsp + 0x60]
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.140080130
mov rdi, qword [rdi]
test rdi, rdi
je 0x14008b9f4
lea r14, [rsp + 0x5c]
mov dword [r14], 0
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.14001c3c0
mov rax, qword [rbx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14008b9fb
cmp eax, 0xea
jne 0x14008ba32
mov ebx, 0x8000ffff
cmp dword [rsp + 0x3c], 7
jne 0x14008ba40
mov edx, dword [rsp + 0x5c]
test dl, 1
jne 0x14008ba40
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
cmp rcx, rdx
jae 0x14008ba02
sub rdx, rcx
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.14001c3c0
mov rax, qword [rbx]
jmp 0x14008ba0c
mov ebx, 0x80070002
jmp 0x14008ba54
mov ebx, 0x80070002
jmp 0x14008ba40
jbe 0x14008ba0c
add rdx, rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x3c]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008ba7c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008ba54
mov qword [rsp + 0x48], rcx
call fcn.1401c9f6c
lea rcx, [rsp + 0x60]
call fcn.140080370
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov r8, r15
call fcn.14008b309
mov ebx, eax
jmp 0x14008ba40
Function at 0x140092a94
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor edi, edi
test eax, eax
je 0x140092b08
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x140092b08
mov rcx, rsi
call fcn.14003bb52
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.14003c156
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14003bd32
mov dil, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x238
pop rdi
pop rsi
ret
Function at 0x1400a2584
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov r14, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, edx
call fcn.1400a270d
mov ebx, eax
mov rcx, qword [0x14026b7f8]
test rcx, rcx
je 0x1400a25cc
mov rax, qword [rcx]
mov rdx, r14
mov r8d, ebx
call qword [rax + 8]
jmp 0x1400a26a4
call fcn.1400a2774
add ebx, dword [rax + 0x30]
mov r15, qword [0x140270578]
mov eax, ebx
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xorps xmm6, xmm6
test rax, rax
je 0x1400a269a
mov rsi, rax
mov rcx, r15
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400a269a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400a269a
mov rdi, rax
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
and ebx, 0xf
je 0x1400a2668
test eax, eax
je 0x1400a2668
mov ecx, eax
mov rax, rdi
add rax, rcx
dec ebx
movzx ecx, word [rdi]
lea rdi, [rdi + rcx*2]
add rdi, 2
cmp rdi, rax
setb cl
add ebx, 0xffffffff
jae 0x1400a2668
cmp rdi, rax
jb 0x1400a264d
test cl, cl
je 0x1400a269a
movzx ebx, word [rdi]
test rbx, rbx
je 0x1400a269a
add rdi, 2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
cmp bx, 0xb
jae 0x1400a26c5
lea r15, [rsp + 0x20]
mov byte [r15 + 0x17], bl
jmp 0x1400a26eb
xor eax, eax
mov qword [r14], rax
movups xmmword [r14 + 8], xmm6
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ca2e0
mov rax, r14
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea esi, [rbx + 8]
and esi, 0xfffffff8
lea rcx, [rsi + rsi]
call fcn.1401c9f10
mov r15, rax
mov qword [rsp + 0x20], rax
bts rsi, 0x3f
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
lea r8, [rbx + rbx]
mov rcx, r15
mov rdx, rdi
call fcn.1401cccd0
mov word [r15 + rbx*2], 0
mov rax, qword [rsp + 0x20]
movups xmm6, xmmword [rsp + 0x28]
jmp 0x1400a269c
Function at 0x1400a4e80
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x14026b890]
test rax, rax
jne 0x1400a4ec4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x14026b890]
test rax, rax
je 0x1400a4eb1
cmp eax, 2
jne 0x1400a4f1c
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1400a4f7b
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140060c10
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch
mov r8d, 0x1d
call fcn.140007184
mov rcx, rsi
call fcn.140061070
jmp 0x1400a4f7b
mov eax, 1
lock xadd qword [0x14026b8c8], rax
test rax, rax
jle 0x1400a4f3c
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14026b848], eax
mov qword [0x14026b840], rsi
mov rcx, qword [0x140267e08]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401ca2e0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret

Function at 0x1400a6d33
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a6dc3
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400a6dd7
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400a6dfc
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400a6d94
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400a6dde
cmp eax, 0xffffffff
je 0x1400a6e02
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ca2e0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [rsp + 0x2c]
jmp 0x1400a6ddc
int3
Function at 0x1400a7413
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400a734f
test rax, rax
jne 0x1400a74aa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400a74aa
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1400a74a8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xf3
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x40]
lea rdx, [0x140211a92]
mov r8d, 0xc
call fcn.140007184
mov rcx, rsi
call fcn.140061980
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
Function at 0x1400a9274
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp dword [0x14026fd80], 0
mov r8, qword [rcx]
je 0x1400a92a6
mov rcx, qword [rsi + 0x28]
mov rdx, rdi
mov r9d, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14000e52d
movsxd rax, ebx
mov rcx, rdi
mov rdx, r8
mov r8, rax
call fcn.1401cccd0
mov ecx, dword [rsi + 0x4c]
mov r8d, ebx
mov rdx, rdi
call fcn.1400a8ed4
mov dword [rsi + 0x4c], eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400aee5f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
xor ecx, ecx
lea r8, [0x14026b8e0]
mov edx, 8
mov eax, ecx
mov esi, eax
shr esi, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, esi
dec edx
jne 0x1400aee74
mov dword [r8 + rcx*4], eax
inc rcx
cmp rcx, 0x100
jne 0x1400aee6d
mov eax, 0x100
mov ecx, dword [r8 + rax*4 - 0x400]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r8 + rdx*4]
mov dword [r8 + rax*4], ecx
inc rax
cmp rax, 0x800
jne 0x1400aee9d
lea rax, [0x1400f6df0]
mov qword [0x14026d8e0], rax
mov qword [0x14026b8d8], rax
lea rsi, [0x1400f6ec0]
mov qword [0x14026d8e8], rsi
call fcn.1400f7008
test eax, eax
jne 0x1400aeef1
mov qword [0x14026b8d8], rsi
add rsp, 0x20
pop rsi
ret

Function at 0x1400aef00
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov r14, rdx
mov ebp, ecx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, str.CreateLocalWmiConnection
lea r8, str..._.._base_win_wmi.cc
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov r9d, 0x1d
call fcn.140060640
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.1400cfc10
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x20], rdi
lea rcx, [0x14021e478]
lea r9, [0x1402141e0]
xor edi, edi
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400af087
mov qword [rsp + 0x68], 0
mov rsi, qword [rsp + 0x70]
lea rax, [0x1402141f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
lea rbx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400d0cd0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsi]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
mov esi, eax
mov rcx, rbx
call fcn.1400d0d20
test esi, esi
js 0x1400af069
test bpl, bpl
je 0x1400af047
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor edi, edi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1400af069
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
mov rcx, qword [r14]
mov qword [r14], rax
test rcx, rcx
je 0x1400af084
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dil, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400af087
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400af087
mov dil, 1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400af0a0
mov qword [rsp + 0x70], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0x90]
call fcn.1400cfee0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret