joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9850
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x308
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r12, rcx
mov r14, qword [rsp + 0x390]
mov rbx, qword [rsp + 0x380]
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x80], rdi
call fcn.14008f820
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, rax
call fcn.1400913d0
test al, al
je 0x1400a9915
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x378]
mov edx, dword [rsp + 0x370]
mov r8d, dword [rsp + 0x368]
mov r9, qword [rsp + 0x360]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
mov rcx, rdi
mov rdx, rsi
mov r8, r15
call r12
mov esi, 1
test eax, eax
jne 0x1400a9a4c
call fcn.14008f820
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, rax
call fcn.1400913b0
xor esi, esi
test al, al
je 0x1400a9a4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x18
mov r8d, 1
mov rcx, r14
call fcn.140096490
test al, al
je 0x1400a9a42
call fcn.1400963c0
mov rsi, rax
test rsi, rsi
je 0x1400a9a42
mov qword [rsp + 0x78], 0
lea rbx, [rsp + 0xf0]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1400a9996
mov qword [rsp + 0x78], rbx
lea rbx, [rsp + 0x68]
mov rcx, rbx
mov rdx, rsi
call fcn.140097220
xorps xmm0, xmm0
lea rax, [rsp + 0x90]
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax], xmm0
mov qword [rax + 0x50], 0
lea rcx, [rsp + 0x58]
mov dword [rcx], 0x18
mov qword [rcx + 8], r14
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x380]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x80]
lea r9, [rsp + 0x88]
mov edx, 0xd
mov rcx, rbx
call fcn.1400a9a70
test eax, eax
je 0x1400a9a21
mov al, 1
jmp 0x1400a9a3e
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp dword [rsp + 0x98], 0
sete sil
xor eax, eax
test al, al
je 0x1400a9a4c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
add rsp, 0x308
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400abdc0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.1400027c0
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400abe2a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400ae7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp qword [rcx + 0x50], 0
jne 0x1400ae7ad
cmp dword [rcx + 0x60], 0
je 0x1400ae7b2
jmp 0x1400ae8a0
jmp 0x1400ae810
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov byte [rsi + 0x64], 0
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 8], rax
cmp rcx, rax
je 0x1400ae860
lea rdi, [rsi + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
xor r8d, r8d
mov rcx, rdi
call fcn.14007b400
cmp rax, 0xffffffffffffffff
je 0x1400ae864
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 8], rax
cmp rcx, rax
jne 0x1400ae833
xor ebx, ebx
jmp 0x1400ae891
mov rax, qword [rsi + 0x10]
mov bl, 1
jmp 0x1400ae88b
movzx edx, byte [rax]
xor r8d, r8d
mov rcx, rdi
call fcn.14007b400
cmp rax, 0xffffffffffffffff
jne 0x1400ae891
mov rax, qword [rsi + 0x10]
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400ae86c
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], 0
xor edi, edi
mov byte [rsp + 0x22], dil
mov rsi, rcx
mov byte [rsi + 0x64], dil
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 8], rax
cmp rcx, rax
je 0x1400ae956
lea rdi, [rsp + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx r8d, byte [rax]
mov rcx, rsi
mov rdx, rdi
call fcn.1400ae970
test al, al
jne 0x1400ae917
test byte [rsi + 0x60], 1
jne 0x1400ae94f
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 8], rax
cmp rcx, rax
jne 0x1400ae8e1
xor edi, edi
jmp 0x1400ae956
mov rax, qword [rsi + 0x10]
mov dil, 1
cmp rax, qword [rsi + 0x18]
je 0x1400ae956
lea rbx, [rsp + 0x20]
movzx r8d, byte [rax]
mov rcx, rsi
mov rdx, rbx
call fcn.1400ae970
test al, al
je 0x1400ae956
mov rax, qword [rsi + 0x10]
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400ae929
jmp 0x1400ae956
mov byte [rsi + 0x64], 1
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400edc60
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400af080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x1400af08c
jmp fcn.1400398f0
xor eax, eax
ret
Function at 0x1400afba0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x30], 0
je 0x1400afbfe
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400edc60
mov rcx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14003b0f0
lea r13, [0x1401823a0]
lea r15, [rsp + 0x40]
mov qword [r15 - 8], r13
mov rcx, r15
mov rdx, rsi
call fcn.140012870
lea r14, [rsp + 0x60]
mov rcx, r14
call fcn.140021820
lea r12, [rsp + 0x38]
mov r8, 0xffffffffffffffff
mov rcx, rdi
mov rdx, r12
call fcn.1400afa20
mov ebx, eax
mov qword [r12], r13
mov rcx, r14
call fcn.1400219c0
mov rcx, r15
call fcn.1400138f0
test bl, bl
je 0x1400afca0
mov rax, qword [rdi + 0x10]
mov r15, qword [rax + 0x28]
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.14002a5f0
mov bl, 1
cmp r15, qword [r14]
je 0x1400afca2
mov rax, qword [rdi + 0x10]
mov rax, qword [rax + 0x28]
lea r14, [rsp + 0x38]
mov qword [r14], rax
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.1400195a0
mov rcx, rsi
mov rdx, rdi
mov r8, r14
call fcn.14003b100
jmp 0x1400afca2
xor ebx, ebx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400edc60
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400b5ec0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
mfence
mov rax, qword [0x140197c40]
test rax, rax
jne 0x1400b5f0a
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mfence
mov rax, qword [0x140197c40]
test rax, rax
je 0x1400b5ef4
cmp eax, 2
jne 0x1400b5f52
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400b5fe4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x82
mov r9d, 2
mov rcx, rsi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x1400b5fd7
mov eax, 1
lock xadd qword [0x140197c78], rax
test rax, rax
jle 0x1400b5f72
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140197bf8], eax
mov qword [0x140197bf0], rsi
mov rcx, qword [0x140192990]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400b5fe4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov r8d, 0xae
mov r9d, 2
mov rcx, rsi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
call fcn.140001700
mov rcx, rsi
call fcn.140015290
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400edc60
xor eax, eax
add rsp, 0x138
pop rdi
pop rsi
ret
Function at 0x1400be850
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x60], rax
test edi, edi
je 0x1400be8ab
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x1400be8ab
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov dword [rax], 0x18
lea rcx, [0x140183d68]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
jmp 0x1400be8ad
xor eax, eax
movzx edx, dil
shl edx, 0x13
or edx, 3
cmp qword [rsi + 0x18], 7
jbe 0x1400be8c1
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rax
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov r8d, 6
mov r9d, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400edc60
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400be910
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x140
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x138], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x1400be9e3
and eax, 0xfeff
cmp eax, 6
je 0x1400be9e3
mov eax, dword [0x140197cb0]
mov ecx, dword [0x140195c08]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x1400bea0a
xor edx, edx
mov r8d, 0x10000000
mov rcx, rsi
call qword [0x140197ca8]
mov sil, 1
test eax, eax
jne 0x1400be9ef
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400be9df
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x21
mov r9d, 2
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x38]
lea rdx, str.InitializeCriticalSectionEx
call fcn.140001700
mov rcx, rsi
call fcn.140017200
xor esi, esi
jmp 0x1400be9ef
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
add rsp, 0x140
pop rsi
ret
lea rcx, [0x140197cb0]
call fcn.1400ee1f0
mov eax, dword [0x140197cb0]
cmp eax, 0xffffffff
jne 0x1400be977
lea rcx, [0x140155a9e]
lea rdx, str.::InitializeCriticalSectionEx
mov r8d, 1
call fcn.1400beb70
mov qword [0x140197ca8], rax
lea rcx, [0x140197cb0]
call fcn.1400ee190
jmp 0x1400be977
Function at 0x1400bf380
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rsi + 8], rdi
mov eax, dword [0x140197cc0]
mov ecx, dword [0x140195c08]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 8]
jg 0x1400bf5be
mov rax, qword [0x140197cb8]
test rax, rax
je 0x1400bf44e
lea rdx, [rsp + 0x34]
mov rcx, rdi
call rax
test eax, eax
je 0x1400bf3fe
cmp dword [rsp + 0x34], 0
setne byte [rsi + 0x89]
je 0x1400bf455
mov byte [rsi + 0x88], 0
mov al, 1
jmp 0x1400bf47a
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400bf44e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rbx, [rsp + 0x38]
mov r8d, 0x4b
mov r9d, 2
mov rcx, rbx
call fcn.1400170c0
lea rcx, [rsp + 0x48]
lea rdx, [0x1401567e7]
call fcn.140001700
mov rcx, rbx
call fcn.140017200
mov byte [rsi + 0x89], 0
lea rbx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rbx]
cmp eax, 9
sete byte [rsi + 0x88]
cmp byte [rsi + 0x89], 0
setne al
lea rcx, [rsi + 0x38]
lea r9, [rsi + 0x30]
mov qword [rsp + 0x20], rcx
movzx edx, al
mov rcx, rdi
mov r8, rsi
call fcn.1400bf610
test al, al
je 0x1400bf4b3
cmp byte [rsi + 0x88], 0
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
mov r8, rsi
je 0x1400bf4f6
call fcn.1400bf800
jmp 0x1400bf4fb
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400bf59f
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x218
mov r9d, 2
mov rcx, rsi
call fcn.140015d90
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
jmp 0x1400bf592
call fcn.1400bfd80
test al, al
je 0x1400bf558
movzx edx, byte [rsi + 0x88]
mov rcx, rdi
mov r8, rsi
call fcn.1400bebe0
mov sil, 1
test al, al
jne 0x1400bf5a1
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400bf59f
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x226
mov r9d, 2
mov rcx, rsi
call fcn.140015d90
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
jmp 0x1400bf592
mov ecx, 2
call fcn.140015cf0
test al, al
je 0x1400bf59f
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x221
mov r9d, 2
mov rcx, rsi
call fcn.140015d90
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
call fcn.140001700
mov rcx, rsi
call fcn.140015290
xor esi, esi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140197cc0]
call fcn.1400ee1f0
mov eax, dword [0x140197cc0]
cmp eax, 0xffffffff
jne 0x1400bf3cb
lea rcx, [0x140155a9e]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400beb70
mov qword [0x140197cb8], rax
lea rcx, [0x140197cc0]
call fcn.1400ee190
jmp 0x1400bf3cb
Function at 0x1400c1f60
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400c2020]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
jne 0x1400c1ffc
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x19
mov r9d, 3
mov rcx, rsi
call fcn.1400170c0
lea rcx, [rsp + 0x48]
lea rdx, str.Check_failed:_platform_thread_.
call fcn.140001700
lea rdx, [0x1401722a1]
mov rcx, rax
call fcn.140001700
mov rcx, rsi
call fcn.140017200
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.1400edc60
nop
add rsp, 0x150
pop rsi
ret
Function at 0x1400c4ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rdx]
mov rcx, rsi
call fcn.1400f3f20
test rax, rax
je 0x1400c4ee3
movabs rcx, 0xcbf29ce484222325
movabs r8, 0x100000001b3
movzx edx, byte [rsi]
xor rcx, rdx
imul rcx, r8
inc rsi
dec rax
jne 0x1400c4ec9
and ecx, 0x7fffffff
jmp 0x1400c4ee8
mov ecx, 0x4222325
mov edx, 0x1f31d
call fcn.1401192e0
imul ecx, eax, 0xfffff4ec
shr rax, 0x20
imul eax, eax, 0x41a7
lea edx, [rax + rcx]
add edx, 0x7fffffff
add eax, ecx
cmovns edx, eax
movsxd rax, edx
add rsp, 0x20
pop rsi
ret

Function at 0x1400d7580
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rsi + 0x48], 0x1003f
mov eax, dword [rdi + 0x234]
mov dword [rsi + 0x4c], eax
mov eax, dword [rdi + 0x238]
mov dword [rsi + 0x50], eax
mov eax, dword [rdi + 0x23c]
mov dword [rsi + 0x54], eax
mov eax, dword [rdi + 0x240]
mov dword [rsi + 0x58], eax
mov eax, dword [rdi + 0x24c]
mov dword [rsi + 0x5c], eax
mov eax, dword [rdi + 0x250]
mov dword [rsi + 0x60], eax
lea rdx, [rsi + 0x64]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.1400ddc80
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0xd4], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0xd8], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0xdc], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0xe0], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0xe4], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0xe8], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0xec], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0xf0], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0xf4], eax
mov eax, dword [rdi]
mov dword [rsi + 0xf8], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0xfc], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x100], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x104], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x108], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x110], eax
add rsi, 0x114
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f0ce0

Function at 0x1400df240
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x158], rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x1400df2b8
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400df2b8
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x50]
mov r8d, 0xa1
mov r9d, 1
mov rcx, rsi
call fcn.140015d90
lea rcx, [rsp + 0x58]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
call fcn.140001700
mov rcx, rsi
call fcn.140015290
mov esi, dword [rsp + 0x40]
cmp esi, 0x100
jb 0x1400df2c7
mov sil, 0xff
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
add rsp, 0x160
pop rsi
ret
Function at 0x1400e5890
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.1400ecff0
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.1400e7570
test al, al
je 0x1400e5942
movzx eax, word [rsp + 0x130]
cmp eax, 0x5a4d
jne 0x1400e5985
mov rcx, rdi
call fcn.1400ecff0
movsxd rdi, dword [rsp + 0x16c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.1400e7570
test al, al
je 0x1400e59c5
cmp dword [rbx], 0x4550
jne 0x1400e5a05
mov sil, 1
test r14, r14
je 0x1400e5a67
mov qword [r14], rdi
jmp 0x1400e5a67
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5a65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x12e
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
jmp 0x1400e5a3f
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5a65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x134
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x1400e5a3f
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5a65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x13c
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1400e5a3f
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5a65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x142
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
call fcn.140001700
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400e5a52
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400032d0
mov rcx, rdi
call fcn.140015290
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400e5a90
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.1400ecff0
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.1400e7570
test al, al
je 0x1400e5b42
movzx eax, word [rsp + 0x130]
cmp eax, 0x5a4d
jne 0x1400e5b85
mov rcx, rdi
call fcn.1400ecff0
movsxd rdi, dword [rsp + 0x16c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.1400e7570
test al, al
je 0x1400e5bc5
cmp dword [rbx], 0x4550
jne 0x1400e5c05
mov sil, 1
test r14, r14
je 0x1400e5c67
mov qword [r14], rdi
jmp 0x1400e5c67
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5c65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x12e
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
jmp 0x1400e5c3f
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5c65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x134
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x1400e5c3f
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5c65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x13c
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1400e5c3f
mov ecx, 1
call fcn.140015cf0
test al, al
je 0x1400e5c65
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x142
mov r9d, 1
mov rcx, rdi
call fcn.140015d90
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
call fcn.140001700
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400e5c52
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400032d0
mov rcx, rdi
call fcn.140015290
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400ed570
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400ed59e
lea ecx, [rax + 0x19]
int 0x29
test byte [rsp + 0x44], 0x44
je 0x1400ed5f3
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x54]
xor edx, edx
lea ecx, [r9 - 1]
mov eax, ecx
lea r8, [r9 - 1]
and eax, edi
and ecx, ebx
add eax, ecx
not r8
dec rax
and r8, rbx
add rax, r9
div r9
xor edx, edx
mov rcx, rax
mov rax, rdi
div r9
add eax, ecx
je 0x1400ed5f3
lock or dword [r8], 0
add r8, r9
sub rax, 1
jne 0x1400ed5e5
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret