joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f8280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1402e6d80]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x2ba
call fcn.1400b5b90
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140062770
cmp byte [rsi + 0x17], 0
jns 0x1401f8304
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1401f833b
lea rcx, [rsp + 0x60]
call fcn.140062a80
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14013d520
mov eax, edi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rsi, [rsp + 0x40]
mov qword [rsi], rdi
mov rcx, rsi
mov rdx, rax
call fcn.14007ceb6
mov rax, qword [rsi]
inc rax
test rax, 0xfffffffffffffffe
setne dil
cmp rax, 2
jb 0x1401f8312
call fcn.1400a6030
mov rcx, qword [rsp + 0x40]
call fcn.1400ccd80
jmp 0x1401f8312

Function at 0x1401f8ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x1401f8f5c
mov r14, rcx
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
je 0x1401f8f5c
mov rsi, r9
mov rdi, r8
mov rbx, rdx
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
je 0x1401f8f28
cmp ecx, 0x10b
jne 0x1401f8f4b
lea rdx, [rax + 0x74]
lea rcx, [rax + 0x78]
jmp 0x1401f8f36
lea rdx, [rax + 0x84]
lea rcx, [rax + 0x88]
cmp dword [rdx], 7
jb 0x1401f8f4b
mov edx, dword [rcx + 0x30]
test rdx, rdx
je 0x1401f8f4b
mov ecx, dword [rcx + 0x34]
cmp ecx, 0x1c
jae 0x1401f8f73
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [rax + 0x50]
shr ecx, 2
imul r15, rcx, 0x24924925
shr r15, 0x20
lea r12, [rdx + r14]
add r12, 0x14
xor r13d, r13d
jmp 0x1401f8f9d
inc r13d
cmp r13d, r15d
je 0x1401f8f4b
add r12, 0x1c
cmp dword [r12 - 8], 0xd
jne 0x1401f8f91
mov ecx, dword [r12]
test rcx, rcx
je 0x1401f8f91
mov edx, dword [r12 - 4]
lea eax, [rdx + rcx]
cmp eax, ebp
jae 0x1401f8f91
add rcx, r14
mov qword [rsp + 0x20], rsi
mov r8, rbx
mov r9, rdi
call fcn.1401f8cf0
test eax, eax
je 0x1401f8f91
jmp 0x1401f8f4b
Function at 0x1401fe3f0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov sil, 1
cmp qword [0x14033b1b0], 0
je 0x1401fe434
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0x258
pop rdi
pop rsi
ret
mov rcx, qword [0x14033b1a0]
test rcx, rcx
je 0x1401fe4d2
test byte [0x14032a9b8], 1
je 0x1401fe418
cmp byte [rcx + 0x17], 0
jns 0x1401fe456
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14033b1b0], rax
inc rax
cmp rax, 1
ja 0x1401fe418
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14013f660
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401fe5c0
xor esi, esi
jmp 0x1401fe418
mov ecx, 0x18
call fcn.14013a6b4
mov rsi, rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14013f660
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1402e6d80]
movups xmmword [rsi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rax
mov rcx, rsi
mov rdx, rdi
call fcn.1400b3e36
movzx eax, byte [rsi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rsi + 8]
mov rcx, qword [rsi]
mov r8, rsi
cmovs r8, rcx
test rdx, rdx
je 0x1401fe589
lea r10, [rdx + rdx]
test r10, r10
je 0x1401fe589
lea r9, [r10 - 2]
cmp word [r8 + r10 - 2], 0x5c
mov r10, r9
jne 0x1401fe54b
cmp r9, 0xfffffffffffffffe
je 0x1401fe589
mov r8, r9
sar r8, 1
cmp rdx, r8
jbe 0x1401fe6a9
lea rdx, [r8 + 1]
test al, al
jns 0x1401fe5ae
mov qword [rsi + 8], rdx
mov word [rcx + r8*2 + 2], 0
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rsi
call fcn.140116148
mov qword [0x14033b1a0], 0
jmp 0x1401fe4cb
cmp r9, 0x14
jae 0x1401fe6a3
mov byte [rsi + 0x17], dl
mov rcx, rsi
jmp 0x1401fe581
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14013ad74
mov rcx, qword [0x14033b1a0]
mov rdx, rdi
mov r8, rax
call fcn.1400b5d8c
mov rcx, qword [0x14033b1a0]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1401fe696
mov rax, qword [rcx + 8]
test rax, rax
je 0x1401fe6a6
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1401fe623
lea rdx, [0x1402ec490]
mov r8d, 1
call fcn.140116148
mov rcx, qword [0x14033b1a0]
lea rdx, str.debug.log
mov r8d, 9
call fcn.140116148
mov rcx, qword [0x14033b1a0]
cmp byte [rcx + 0x17], 0
jns 0x1401fe645
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14033b1b0], rax
inc rax
cmp rax, 1
ja 0x1401fe418
mov qword [0x14033b1b0], 0
jmp 0x1401fe4cb
test rax, rax
je 0x1401fe6a6
mov rdx, rcx
jmp 0x1401fe602
int3
int3
int3
Function at 0x14020148e
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x140201642
mov word [rsi], 0
mov byte [rsi + 0x17], 0
test rbx, rbx
je 0x14020160d
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14020160d
lea r14, [rsp + 0x50]
mov rax, qword [r14]
movzx ebp, word [rax]
movzx r15d, word [rax + 2]
mov word [rsp + 0x260], bp
mov word [rsp + 0x262], r15w
mov r12, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r12
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], r15w
mov word [rsp + 0x268], bp
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call r12
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
mov rbp, 0xfffffffffffffffe
lea r15, [0x1402f3320]
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14013f660
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x1402015a2
mov rax, qword [rdi]
movzx ecx, word [rsp + rbp*2 + 0x264]
movzx edx, word [rsp + rbp*2 + 0x266]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
mov r9, r15
call fcn.14007cd40
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, rbx
mov rdx, r14
mov r8, r12
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140201632
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140201632
mov rcx, rsi
call fcn.140109550
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14013d520
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rbp, 2
cmp rbp, 5
jbe 0x140201586
jmp 0x14020160d
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
jmp 0x1402014d0
Function at 0x140205527
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x188], rax
cmp byte [rcx + 0x17], 0
jns 0x140205551
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14020557a
mov edi, eax
test bl, bl
jne 0x14020556f
mov eax, edi
and eax, 0x400
jne 0x140205648
and edi, 0x10
shr edi, 4
jmp 0x14020564a
cmp dword [0x14033b1a8], 2
jg 0x140205648
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x48]
mov r8d, 0x82
mov r9d, 2
call fcn.1401fea80
lea rcx, [rsp + 0x58]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401970a4
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1402055d6
mov rdx, qword [rsi + 8]
jmp 0x1402055db
mov edx, eax
and edx, 0x7f
test rdx, rdx
js 0x140205667
test al, al
cmovs rsi, qword [rsi]
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov rcx, rsi
mov r8, rbx
call fcn.140111960
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
js 0x140205618
and r8d, 0x7f
jmp 0x140205622
mov r8, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
call fcn.1401970a4
cmp byte [rsp + 0x47], 0
jns 0x14020563e
mov rcx, qword [rsp + 0x30]
call fcn.14013a6ac
lea rcx, [rsp + 0x48]
call fcn.1401feb00
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14013d520
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x14020566b
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x188], rax
cmp byte [rcx + 0x17], 0
jns 0x140205696
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14020579d
test bl, bl
je 0x1402056be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1402057ba
cmp dword [0x14033b1a8], 2
jg 0x14020579b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x30]
mov r8d, 0x62
mov r9d, 2
call fcn.1401fea80
lea rcx, [rsp + 0x40]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401970a4
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
js 0x14020571b
mov edx, eax
and edx, 0x7f
jmp 0x14020571f
mov rdx, qword [rsi + 8]
test rdx, rdx
js 0x14020589f
test al, al
cmovs rsi, qword [rsi]
xorps xmm0, xmm0
lea rbx, [rsp + 0x170]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov rcx, rsi
mov r8, rbx
call fcn.140111960
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
js 0x14020575f
and r8d, 0x7f
jmp 0x14020576f
mov r8, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rcx, rdi
mov rdx, rbx
call fcn.1401970a4
cmp byte [rsp + 0x187], 0
jns 0x140205791
mov rcx, qword [rsp + 0x170]
call fcn.14013a6ac
lea rcx, [rsp + 0x30]
call fcn.1401feb00
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14013d520
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140205527
test al, al
jne 0x14020579d
cmp dword [0x14033b1a8], 2
jg 0x14020579b
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x30]
mov r8d, 0x5d
mov r9d, 2
call fcn.14012fd40
movzx eax, byte [rsi + 0x17]
test al, al
js 0x140205800
mov edx, eax
and edx, 0x7f
jmp 0x140205804
mov rdx, qword [rsi + 8]
test rdx, rdx
js 0x1402058a2
test al, al
cmovs rsi, qword [rsi]
lea rdi, [rsp + 0x40]
xorps xmm0, xmm0
lea rbx, [rsp + 0x170]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov rcx, rsi
mov r8, rbx
call fcn.140111960
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
js 0x140205849
and r8d, 0x7f
jmp 0x140205859
mov r8, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rcx, rdi
mov rdx, rbx
call fcn.1401970a4
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1401970a4
cmp byte [rsp + 0x187], 0
jns 0x140205890
mov rcx, qword [rsp + 0x170]
call fcn.14013a6ac
lea rcx, [rsp + 0x30]
call fcn.1400a0470
jmp 0x14020579b
int3
int3
Function at 0x1402058a6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x188], rax
cmp byte [rcx + 0x17], 0
jns 0x1402058ce
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402058ff
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
cmp dword [0x14033b1a8], 2
jg 0x1402059c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x48]
mov r8d, 0x75
mov r9d, 2
call fcn.1401fea80
lea rcx, [rsp + 0x58]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401970a4
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x14020595b
mov rdx, qword [rsi + 8]
jmp 0x140205960
mov edx, eax
and edx, 0x7f
test rdx, rdx
js 0x1402059d0
test al, al
cmovs rsi, qword [rsi]
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov rcx, rsi
mov r8, rbx
call fcn.140111960
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
js 0x140205999
and r8d, 0x7f
jmp 0x1402059a3
mov r8, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
call fcn.1401970a4
cmp byte [rsp + 0x47], 0
jns 0x1402059bf
mov rcx, qword [rsp + 0x30]
call fcn.14013a6ac
lea rcx, [rsp + 0x48]
call fcn.1401feb00
xor esi, esi
jmp 0x1402058e2
int3

Function at 0x1402079f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov rcx, qword [rcx + 8]
movsxd r8, dword [rcx + 0x3c]
cmp dword [rcx + r8 + 0x84], 0
je 0x140207b35
add r8, rcx
xor eax, eax
cmp word [r8 + 0x14], 0x78
jb 0x140207b2e
add r8, 0x88
je 0x140207b2e
mov r8d, dword [r8]
test r8, r8
je 0x140207b35
add r8, rcx
je 0x140207b35
cmp rdx, 0xffff
jbe 0x140207b39
mov eax, dword [r8 + 0x18]
mov r10d, dword [r8 + 0x20]
lea r9, [rcx + r10]
test r10, r10
cmove r9, r10
test rax, rax
je 0x140207b35
lea r10, [r9 + rax*4]
mov r11b, byte [rdx]
inc rdx
xor eax, eax
mov rsi, r9
jmp 0x140207aa7
xor ebp, ebp
lea rdi, [rsi + rdi*2]
movzx ebx, byte [rbx]
cmp bpl, bl
je 0x140207aee
movzx ebp, bpl
sub ebp, ebx
cmovs r10, rdi
add rdi, 4
test ebp, ebp
cmovg rsi, rdi
cmp rsi, r10
je 0x140207b2e
mov rdi, r10
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
shr rdi, 0x3f
add rdi, rbx
and rdi, 0xfffffffffffffffe
mov r14d, dword [rsi + rdi*2]
lea rbx, [rcx + r14]
test r14, r14
cmove rbx, r14
test r11b, r11b
je 0x140207a7c
mov r14, rdx
mov ebp, r11d
cmp bpl, byte [rbx]
jne 0x140207a7e
inc rbx
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140207ad9
jmp 0x140207a7c
mov r10d, dword [r8 + 0x10]
mov eax, dword [r8 + 0x24]
lea rdx, [rcx + rax]
test rax, rax
cmove rdx, rax
sub rdi, r9
sar rdi, 1
movzx edx, word [rdx + rdi]
add dx, r10w
mov eax, dword [r8 + 0x1c]
add rcx, rax
test rax, rax
cmove rcx, rax
movzx eax, dx
lea rax, [rcx + rax*4]
mov ecx, r10d
shl rcx, 2
sub rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x140207b2e
mov r10d, dword [r8 + 0x10]
jmp 0x140207b0f
Function at 0x14021bb10
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x14021bb4f
test r15, r15
je 0x14021bc40
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x14021bb99
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.14013efb0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x14021bb2d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x14021bc43
lea rcx, [r12*8]
call fcn.14013a6b4
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x14021bc0d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x14021bc3d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x14021bbf5
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x14021bb2d
mov rcx, r14
call fcn.14013a6ac
mov r15, qword [rsi + 0x10]
jmp 0x14021bb2d
int3
int3
int3

Function at 0x14021bc50
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14021bc92
mov r14, rbx
add r14, 0xfffffffffffffff8
je 0x14021bd87
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x14021bcdf
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
shl r12, 2
and r12, 0xfffffffffffffff8
lea r14, [r15 + r12]
sub r15, rbx
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.14013efb0
mov qword [rsi + 8], r14
add qword [rsi + 0x10], r12
jmp 0x14021bc6f
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x14021bd8a
lea rcx, [r12*8]
call fcn.14013a6b4
lea r14, [r12*2 + 6]
and r14, 0xfffffffffffffff8
add r14, rax
mov rcx, r14
sub r15, rbx
je 0x14021bd57
mov rdx, r15
sar rdx, 3
and r15, 0xfffffffffffffff8
mov rcx, r15
add rcx, r14
shl rdx, 3
xor r8d, r8d
mov r9, r14
add r9, r8
je 0x14021bd84
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14021bd3f
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
test rbx, rbx
je 0x14021bc6f
mov rcx, rbx
call fcn.14013a6ac
mov r14, qword [rsi + 8]
jmp 0x14021bc6f
int3
int3
int3
Function at 0x1402208e0
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.14013f660
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x140220922
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x140220916
Function at 0x140221152
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x140341370]
mov ecx, dword [0x140337e40]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1402213ba
mov rax, qword [0x140341368]
test rax, rax
je 0x140221238
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [case.0x14017aab5.0]
test eax, eax
je 0x1402211e7
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x14022123f
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x140221274
cmp dword [0x14033b1a8], 2
jg 0x140221238
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.1401fea80
lea rcx, [rsp + 0x40]
lea rdx, [0x1402f878b]
mov r8d, 0xe
call fcn.1401970a4
mov rcx, rbx
call fcn.1401feb00
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x1402e6d80]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.140221401
test al, al
jne 0x1402212f7
cmp dword [0x14033b1a8], 2
jg 0x1402212d8
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.14012fd40
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1401970a4
mov rcx, rsi
call fcn.1400a0470
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14013d520
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
je 0x140221311
call fcn.140221641
jmp 0x140221316
call fcn.140221c7f
test al, al
jne 0x14022135a
cmp dword [0x14033b1a8], 2
jg 0x1402212d8
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.14012fd40
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x1402212cb
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1402209c9
mov sil, 1
test al, al
jne 0x1402212da
cmp dword [0x14033b1a8], 2
jg 0x1402212d8
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.14012fd40
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x1402212cb
lea rcx, [0x140341370]
call fcn.14013b388
cmp dword [0x140341370], 0xffffffff
jne 0x14022119d
lea rcx, [0x1402e7370]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400723d4
mov qword [0x140341368], rax
lea rcx, [0x140341370]
call fcn.14013a7d4
jmp 0x14022119d