joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010a8c0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rcx], 0
mov eax, dword [0x1401d52c8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [rax + 0x228]
mov qword [rsi + 8], rcx
mov rcx, qword [rax + 0x228]
mov qword [rax + 0x228], rsi
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x38], 0
mov dword [rsi + 0x40], 0
mov byte [rsi + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x58], r8
mov qword [rsi + 0x60], r9
movzx eax, byte [0x1401d7e2f]
test al, al
setne byte [rsi + 0x30]
je 0x14010a95e
lea rdi, [rsi + 0x20]
mov rax, qword [0x1401c8548]
lea rcx, [rsp + 0x28]
call qword [0x1401b8a50]
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14010c6b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1401de2a0]
mov ecx, dword [0x1401d52c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14010c7da
mov ecx, dword [0x1401d466c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14010c70f
mov rcx, qword [0x1401de290]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1401de298]
jne 0x14010c70f
cmp qword [rax + rcx], 0
jne 0x14010c796
mov ecx, 4
call fcn.140150d68
mov rsi, rax
mov dword [rax], 0
mov ecx, dword [0x1401d466c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14010c751
mov rcx, qword [0x1401de290]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1401de298]
jne 0x14010c751
mov rdi, qword [rax + rcx]
jmp 0x14010c753
xor edi, edi
mov ecx, dword [0x1401d466c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14010c7ce
mov rcx, qword [0x1401de290]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x1401de298]
mov rdx, qword [0x1401de290]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
test rdi, rdi
je 0x14010c796
mov rcx, rdi
call fcn.140150da4
mov ecx, dword [0x1401d466c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14010c7c5
mov rcx, qword [0x1401de290]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1401de298]
jne 0x14010c7c5
mov rax, qword [rax + rcx]
jmp 0x14010c7c7
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
test rsi, rsi
je 0x14010c789
call fcn.1400c81d0
jmp 0x14010c765
lea rcx, [0x1401de2a0]
call fcn.140150ec0
cmp dword [0x1401de2a0], 0xffffffff
jne 0x14010c6db
mov qword [0x1401de298], 0
lea rcx, [0x1401de290]
mov qword [0x1401de290], 0xffffffffffffffff
lea rdx, [0x140063770]
call fcn.1400c8040
lea rcx, [0x1401de2a0]
call fcn.140150f58
jmp 0x14010c6db
Function at 0x14010fe02
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14010fe2c
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010fe4b
mov edi, eax
bt eax, 0xa
jae 0x14010fe43
test bl, bl
je 0x14010fea8
and edi, 0x10
shr edi, 4
jmp 0x14010feaa
cmp dword [0x1401d8070], 2
jg 0x14010fea8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140027c01
mov rcx, rax
mov rdx, rsi
call fcn.140065d30
mov rcx, rdi
call fcn.140073c70
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret

Function at 0x14010fec7
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14010fef2
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14010ffe3
test bl, bl
je 0x14010ff84
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14010ff84
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.14010fe02
test al, al
jne 0x14010ffe3
cmp dword [0x1401d8070], 2
jg 0x14010ffe1
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.140072910
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.140065d30
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.140027c01
mov rcx, rdi
call fcn.140072e50
jmp 0x14010ffe1
cmp dword [0x1401d8070], 2
jg 0x14010ffe1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140027c01
mov rcx, rax
mov rdx, rsi
call fcn.140065d30
mov rcx, rdi
call fcn.140073c70
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x140110000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140110027
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14011003d
test eax, 0x410
sete sil
jmp 0x14011009c
cmp dword [0x1401d8070], 2
jg 0x14011009a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140027c01
mov rcx, rax
mov rdx, rsi
call fcn.140065d30
mov rcx, rdi
call fcn.140073c70
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140152280
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x1401100b8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1401100df
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140110117
and eax, 0x410
cmp eax, 0x410
jne 0x140110117
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140152280
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.1401101ab
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140110123
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14011018f
cmp dword [0x1401d8070], 2
jg 0x14011018d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140027c01
mov rcx, rax
mov rdx, rsi
call fcn.140065d30
mov rcx, rdi
call fcn.140073c70
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x1401101ab
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1401101d3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x14011023c
cmp dword [0x1401d8070], 2
jg 0x14011023c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140027c01
mov rcx, rax
mov rdx, rsi
call fcn.140065d30
mov rcx, rbx
call fcn.140073c70
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140152280
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x140110aac
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, 0xffffffff
cmp r8, rdi
cmovae r8, rdi
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140110af8
mov esi, dword [rsp + 0x2c]
cmp rsi, rdi
jne 0x140110aff
int3
mov rsi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140110b16
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140110bb0
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x140110bc4
mov rcx, rdi
call r15
cmp eax, 3
jne 0x140110be9
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x140110b79
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140110bcb
cmp eax, 0xffffffff
je 0x140110bef
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [rsp + 0x2c]
jmp 0x140110bc9
int3

Function at 0x140111247
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.140111170
test rax, rax
jne 0x1401112da
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1401112da
cmp dword [0x1401d8070], 2
jg 0x1401112d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.140073ae0
lea rcx, [rsp + 0x40]
lea rdx, [0x1401b1f5f]
mov r8d, 0xc
call fcn.140027c01
mov rcx, rsi
call fcn.140073c70
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140152280
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
Function at 0x14011815a
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1401990c0]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x1401182ad
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1401543c0
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x1401182b4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x18
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x110]
mov rax, qword [rax + 0x10]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x140118347
mov eax, dword [0x1401dec40]
mov ecx, dword [0x1401d52c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140118311
mov rax, qword [0x1401dec38]
test rax, rax
lea rcx, [0x1401b26fc]
cmovne rcx, rax
lea rbx, [rsp + 0x40]
mov qword [rbx + 8], rcx
mov dword [rbx + 0x10], 1
jmp 0x1401182b4
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x1401182bd
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140152280
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401dec40]
call fcn.140150ec0
cmp dword [0x1401dec40], 0xffffffff
jne 0x140118286
call fcn.14011834b
mov qword [0x1401dec38], rax
lea rcx, [0x1401dec40]
call fcn.140150f58
jmp 0x140118286
int3

Function at 0x14011858c
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140118650]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1401185e7
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140152280
nop
add rsp, 0x68
pop rdi
pop rsi
ret
lea rdx, str.Start
lea r8, str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, 0x1b
call fcn.140075ed0
lea rdx, [0x14019e6ac]
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov r8, rsi
call fcn.14007fc00
mov rcx, qword [rdi]
add rcx, 0x10
lea rdx, [0x1401aff40]
mov r8d, 0xc
call fcn.140027c01
mov rcx, rdi
call fcn.14007fcc0
jmp 0x1401185d2
Function at 0x14012d4c2
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x14012d522
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140152280
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14012d5e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1401990c0]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x20]
cmp eax, 0x100
jb 0x14012d67f
cmp dword [0x1401d8070], 1
jg 0x14012d67f
cmp dword [0x1401c8550], 0
je 0x14012d67f
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x10a
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.140027c01
mov rcx, rsi
call fcn.140072e50
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140152280
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
Function at 0x1401455b2
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401990c0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1400269fa
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14014e8f0
test al, al
je 0x140145683
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401456d3
mov rcx, r14
call fcn.1400269fa
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rdi
call fcn.14014e8f0
test al, al
je 0x140145765
cmp dword [rdi], 0x4550
jne 0x1401457aa
mov dil, 1
test rbx, rbx
je 0x140145744
mov qword [rbx], r14
jmp 0x140145744
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145744
cmp dword [0x1401c8550], 0
je 0x140145744
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x140145719
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145744
cmp dword [0x1401c8550], 0
je 0x140145744
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
call fcn.140027c01
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14014572f
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140027c01
mov rcx, rdi
call fcn.140072e50
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145744
cmp dword [0x1401c8550], 0
je 0x140145744
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401456cb
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145744
cmp dword [0x1401c8550], 0
je 0x140145744
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140145719
Function at 0x1401457f6
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401c6028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401990c0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1400269fa
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14014e8f0
test al, al
je 0x1401458c7
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140145917
mov rcx, r14
call fcn.1400269fa
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rdi
call fcn.14014e8f0
test al, al
je 0x1401459a9
cmp dword [rdi], 0x4550
jne 0x1401459ee
mov dil, 1
test rbx, rbx
je 0x140145988
mov qword [rbx], r14
jmp 0x140145988
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145988
cmp dword [0x1401c8550], 0
je 0x140145988
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x14014595d
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145988
cmp dword [0x1401c8550], 0
je 0x140145988
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
call fcn.140027c01
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140145973
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140027c01
mov rcx, rdi
call fcn.140072e50
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140152280
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145988
cmp dword [0x1401c8550], 0
je 0x140145988
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14014590f
xor edi, edi
cmp dword [0x1401d8070], 1
jg 0x140145988
cmp dword [0x1401c8550], 0
je 0x140145988
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140072910
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14014595d
Function at 0x14014e3ea
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x98]
mov edx, dword [rsp + 0x90]
mov rcx, qword [0x1401c6028]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rbx, [rsp + 0x38]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.140028a00
mov rbx, qword [rbx]
lea rax, [rbx + 1]
cmp rax, 1
ja 0x14014e466
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14014e49d
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea esi, [rcx + rcx*4]
lea rcx, [rsp + 0x38]
call fcn.140028a50
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140152280
mov eax, esi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140151428
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1401514a0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1401514a0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1401514a0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140151494
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1401514b2
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140151482
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1401514a2

Function at 0x140151b4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140151b96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140151b96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140151b96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140151b96
cmp dword [rcx + 0x84], 0xe
jbe 0x140151b96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140151b98
xor al, al
add rsp, 0x28
ret