joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e140
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
lea rax, [0x1401d7600]
mov qword [rcx], rax
lea rax, [rcx + 0x70]
xorps xmm6, xmm6
movups xmmword [rcx + 0x50], xmm6
xor ebx, ebx
mov qword [rcx + 0x60], rbx
movups xmmword [rcx + 0x70], xmm6
movups xmmword [rcx + 8], xmm6
mov byte [rcx + 0x18], 0
movups xmmword [rcx + 0x1c], xmm6
movups xmmword [rcx + 0x2c], xmm6
movups xmmword [rcx + 0x39], xmm6
mov qword [rcx + 0x68], rax
movups xmmword [rcx + 0x80], xmm6
movups xmmword [rcx + 0x90], xmm6
movups xmmword [rcx + 0xa0], xmm6
movups xmmword [rcx + 0xb0], xmm6
movups xmmword [rcx + 0xc0], xmm6
mov edi, 0x3f800000
mov dword [rcx + 0xd0], edi
mov dword [rcx + 0xd8], ebx
movups xmmword [rcx + 0xe0], xmm6
movups xmmword [rcx + 0xf0], xmm6
mov dword [rcx + 0x100], edi
movups xmmword [rcx + 0x108], xmm6
movups xmmword [rcx + 0x118], xmm6
mov dword [rcx + 0x128], edi
movups xmmword [rcx + 0x130], xmm6
movups xmmword [rcx + 0x140], xmm6
mov dword [rcx + 0x150], edi
movups xmmword [rcx + 0x158], xmm6
movups xmmword [rcx + 0x168], xmm6
mov dword [rcx + 0x178], edi
mov qword [rcx + 0x198], rbx
movups xmmword [rcx + 0x180], xmm6
mov dword [rcx + 0x190], ebx
mov dword [rcx + 0x1a0], 1
add rcx, 0x1a8
call fcn.14001e410
lea rcx, [rsi + 0x2f0]
movups xmmword [rsi + 0x2d8], xmm6
mov qword [rsi + 0x2e8], rbx
xor edx, edx
call fcn.140001360
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.140001360
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.140001360
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
mov dword [rsi + 0x328], edi
movups xmmword [rsi + 0x330], xmm6
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x359], xmm6
movups xmmword [rsi + 0x370], xmm6
movups xmmword [rsi + 0x380], xmm6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsi + 0x190], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov ecx, dword [rsi + 0x1a0]
mov rax, qword [rsi + 0x1b0]
shr rax, 6
test cl, 2
je 0x14001e33f
test rax, rax
mov ecx, 0x3e8
cmovne rcx, rax
int3
test cl, 8
jne 0x14001e368
test cl, 0x10
jne 0x14001e372
test rax, rax
mov ecx, 0xfa0
cmovne rcx, rax
int3
test rax, rax
mov ecx, 0x100
jmp 0x14001e2f8
test rax, rax
mov ecx, 0x7a1200
jmp 0x14001e351

Function at 0x14001f660
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140108da0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14001f6ff
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.140103b6c
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
int3
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140106510
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140020230
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r13, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp byte [r8 + 0x17], 0
js 0x14002050b
mov word [r13], 0
mov byte [r13 + 0x17], 0
test r14, r14
je 0x140020359
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x48]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140020359
lea rbp, [rsp + 0x50]
mov rax, qword [rbp]
movzx r12d, word [rax]
movzx esi, word [rax + 2]
mov rdi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rdi
mov r15d, eax
call rdi
mov edi, eax
mov r8d, 0x208
mov rcx, rbp
mov dl, 0xaa
call fcn.140108da0
cmp byte [rbx + 0x17], 0
mov rax, rbx
jns 0x1400202ea
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r12d
lea r9, str.StringFileInfo_04hx_04hx_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rbp
int3
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140106510
nop
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [r13]
mov word [rax], 0
mov qword [r13 + 8], 0
jmp 0x140020275

Function at 0x140020630
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov byte [rsi + 0xde9], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x50]
test rax, rax
je 0x1400206d0
mov eax, dword [0x14020a490]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140020694
lea rcx, [0x14020a488]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400bbf20
lea rcx, [0x14020a490]
int3
add rsp, 0x20
pop rsi
ret

Function at 0x14002b9e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14002bacc
cmp qword [rsi], 0
jne 0x14002bacc
cmp dword [rsi + 0x14], 0
jne 0x14002bacc
cmp qword [rsi + 8], 0
jne 0x14002bacc
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x14002ba4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14002ba9e
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14002ba47
mov qword [rsi], rbx
call fcn.1400c8a40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x14002ba89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14002bab4
lea rax, [rbp + 1]
cmp rax, 2
jb 0x14002ba81
mov qword [rsi + 8], rbp
call fcn.1400c8a40
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400c8a40
mov rcx, qword [rsi]
int3
call fcn.1400c8a40
mov rcx, qword [rsi + 8]
int3
mov rcx, rsi
int3
Function at 0x140036010
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140029170
test al, al
je 0x14003603e
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14003605f
mov rcx, rdi
int3
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x1400360f4
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x140036082
call fcn.1400e5d40
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
jne 0x140036102
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x1400360b6
call fcn.1400c8a40
mov rcx, qword [rsi + 0x28]
int3
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x140036117
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jb 0x1400360e6
call fcn.1400c8a40
mov rcx, qword [rsi + 0x18]
int3
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140036170
mov qword [rsi + 0x60], rcx
call fcn.1401039b0
jmp 0x14003606c
mov rcx, rdi
int3
call fcn.1400c8a40
mov rcx, qword [rsi + 0x20]
int3

Function at 0x1400363a0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 1
je 0x1400363e2
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x1400363c7
mov rcx, rdi
int3
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x1400363e9
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1401398b0
mov edi, 2
jmp 0x1400363c7
jb 0x1400363f3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x140036403
cvtsi2ss xmm0, rax
jmp 0x140036418
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.14011c424
cvttss2si rcx, xmm0
movss xmm1, dword [0x1401c6f98]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rbx, 3
jb 0x1400364ca
mov rcx, rbx
shr rcx, 1
movabs r8, 0x5555555555555555
and r8, rcx
mov rdx, rbx
sub rdx, r8
movabs r8, 0x3333333333333333
mov rcx, rdx
shr rcx, 2
and rdx, r8
and rcx, r8
add rcx, rdx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x1400364ca
cmp rax, 2
jb 0x1400364d2
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400364d2
mov rcx, rax
int3
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jae 0x1400363eb
jmp 0x1400363d0

Function at 0x140037060
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.140103b6c
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140037ef0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
cmp r8, rax
mov ebx, 0xffffffff
cmovb ebx, r8d
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037fbd
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140037f85
cmp eax, 0xffffffff
je 0x140037f96
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140106510
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x140037f99
mov eax, dword [rsp + 0x2c]
jmp 0x140037f65
int3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x140037f58
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140037f67

Function at 0x14003a290
Capabilities:
Patch process command line

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov r14, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x14020aa78]
test rax, rax
je 0x14003a3e9
mov rax, qword [0x14020aa78]
test rax, rax
je 0x14003a425
mov rcx, qword [0x14020aa78]
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003a42b
mov rsi, rax
movups xmm0, xmmword [0x1401e9648]
lea r8, [rsp + 0x70]
movaps xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [0x1401e9638]
movaps xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [0x1401e9628]
movaps xmmword [r8], xmm0
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, r14
xor edx, edx
mov r9d, 0x30
call rax
test eax, eax
jne 0x14003a3c9
xorps xmm0, xmm0
lea r8, [rsp + 0x40]
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
xor edi, edi
mov qword [r8 + 0x20], rdi
lea rbx, [rsp + 0x38]
mov qword [rbx], rdi
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rbx
mov r9d, 0x28
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14003a3c9
cmp qword [rsp + 0x38], 0x28
jne 0x14003a3c9
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x36]
mov word [rsi], 0
mov qword [rsp + 0x20], rbx
mov r9d, 2
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [rsi]
mov dl, byte [rsi + 1]
xor cl, 0x4d
xor dl, 0x5a
xor ebx, ebx
or dl, cl
cmovne rdi, rbx
cmp qword [rsp + 0x38], 2
cmovne rdi, rbx
test eax, eax
cmove rdi, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140106510
mov rax, rdi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401e9660]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
lea rax, [0x1401d6318]
lea rcx, [rsp + 0x70]
mov qword [rcx], rax
mov qword [rcx + 8], rsi
call fcn.14001a3d0
test al, al
je 0x14003a430
xor eax, eax
lock cmpxchg qword [0x14020aa78], rsi
jmp 0x14003a2c1
int3
int3
int3
Function at 0x14003d0d0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15, qword [rsp + 0x120]
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x14003d285
mov edi, r9d
mov r14d, edx
mov rsi, rcx
xor ecx, ecx
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rbx, rax
cmp qword [rsi], rax
je 0x14003d15c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003d262
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14003d151
mov qword [rsi], rbx
call fcn.1400c8a40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi]
lea rax, [rbx + 1]
cmp rax, 1
jbe 0x14003d28c
xor ebp, ebp
lea rcx, [rsp + 0x30]
mov r8d, 0x90
xor edx, edx
call fcn.140108da0
mov dword [rsp + 0x28], 0
test r14d, r14d
jne 0x14003d23c
mov dword [rsp + 0x40], 0x400
mov ebp, 0x400
mov eax, 0xff
or ebp, 8
mov dword [rsp + 0x58], 1
mov edx, eax
mov ecx, ebp
mov dword [rsp + 0x28], edx
mov ebp, edx
test r15, r15
je 0x14003d1c9
or ecx, 0x100
mov qword [rsp + 0xa0], r15
or ecx, 0x2000
lea r8, [rsp + 0x30]
mov dword [r8 + 0x10], ecx
mov rcx, rbx
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14003d27b
not edi
and ebp, edi
lea r8, [rsp + 0x28]
mov dword [r8], ebp
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor esi, esi
test eax, eax
je 0x14003d27b
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140106510
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec r14d
cmp r14d, 3
ja case.default.0x14003d25f
mov edx, 0xc8
mov eax, 0xd8
lea rcx, [0x14003d2c0]
movsxd r8, dword [rcx + r14*4]
add r8, rcx
xor ecx, ecx
jmp r8
call fcn.1400c8a40
mov rcx, qword [rsi]
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14003d21a
mov esi, 0x4df
jmp 0x14003d21a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140106510
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa0
jmp 0x14003d21a

Function at 0x14003d520
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140200ec8]
cmp ecx, 0xffffffff
je 0x14003d545
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14003d540
Function at 0x14003d550
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov eax, dword [0x14020abf0]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003d5bd
mov ecx, dword [0x140200ec8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and rax, 0xfffffffffffffffc
je 0x14003d5b1
movsxd rdx, dword [0x14020abe8]
shl rdx, 4
mov esi, dword [rax + rdx + 8]
cmp esi, dword [0x14020abec]
jne 0x14003d5b1
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14003d5f9
mov dword [rdi], ecx
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x14020abf0]
int3
mov ecx, dword [rax]
jmp 0x14003d5b1
Function at 0x140047950
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x168], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x140047a2c
and eax, 0xfeff
cmp eax, 6
je 0x140047a2c
mov eax, dword [0x14020b120]
mov ecx, dword [0x1402029e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400479f3
lea rcx, [0x14020b120]
int3
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x14020b118]
mov esi, eax
test eax, eax
je 0x140047a39
test esi, esi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140106510
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
jmp 0x140047a0f
mov ecx, 2
call fcn.1400cea70
test al, al
je 0x140047a0a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x21
mov r9d, 2
int3

Function at 0x140047cb0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov esi, ecx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rbx, edx
movsxd rax, ecx
sub rbx, rax
inc rbx
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rsp + 0x28], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140047d3b
mov rax, 0xffffffffffffffff
xor edx, edx
div rbx
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x28]
cmp rax, rcx
ja 0x140047ce5
xor edx, edx
div rbx
add esi, edx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140106510
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140051d40
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x140051d69
call fcn.1400c8a40
mov qword [rsi], 0
test rbx, rbx
je 0x140051da1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140051dc5
cmp rbp, 2
jb 0x140051d98
mov qword [rsi], rbx
call fcn.1400c8a40
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140051ddb
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400c8a40
mov rcx, qword [rsi]
int3
call fcn.1400c8a40
mov rcx, qword [rdi]
int3

Function at 0x1400554a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1401ff028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14005551e
mov rax, 0xffffffffffffffff
xor edx, edx
div rsi
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x20]
cmp rax, rcx
ja 0x1400554c8
xor edx, edx
div rsi
mov rsi, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140106510
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x14005b440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rdi, r8
mov rax, rdx
mov r14, rcx
mov rcx, qword [0x1401ff028]
xor rcx, rsp
mov qword [rsp + 0x38], rcx
lea r12, [r14 + 8]
movaps xmm6, xmmword [0x1401d8770]
lea r15, [rsp + 0x20]
xor ebp, ebp
cmp rax, qword [rdi]
jb 0x14005b4bd
mov rcx, rax
sub rcx, qword [rdi + 8]
movsxd rdx, dword [rdi + 0x1c]
cmp rcx, rdx
je 0x14005b67d
mov r9d, dword [rdi + 0x5c]
movaps xmmword [rsp + 0x20], xmm6
mov rcx, rdi
mov rdx, r15
mov r8, rax
call fcn.14004a3d0
mov rax, qword [rsp + 0x20]
cmp byte [rsp + 0x28], 0
jne 0x14005b67d
movzx ebx, byte [rax]
lea rsi, [rax + 1]
test bl, bl
jns 0x14005b4fe
movzx ecx, byte [rsi]
mov edx, ecx
shl edx, 7
add ebx, edx
add ebx, 0xffffff80
test cl, cl
js 0x14005b4e2
add rax, 2
mov rsi, rax
jmp 0x14005b4fe
movaps xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov rdx, rax
mov r8d, ebx
call fcn.14017c690
mov ebx, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x14005b679
mov eax, ebx
shr eax, 3
cmp eax, 3
je 0x14005b554
cmp eax, 2
je 0x14005b58d
cmp eax, 1
jne 0x14005b592
cmp bl, 8
jne 0x14005b592
movzx r8d, byte [rsi]
lea rax, [rsi + 1]
test r8b, r8b
jns 0x14005b624
movzx eax, byte [rax]
mov ecx, eax
shl ecx, 7
add r8d, ecx
add r8d, 0xffffff80
test al, al
js 0x14005b60a
add rsi, 2
mov rax, rsi
jmp 0x14005b624
cmp bl, 0x18
jne 0x14005b592
movzx r8d, byte [rsi]
lea rax, [rsi + 1]
test r8b, r8b
jns 0x14005b647
movzx eax, byte [rax]
mov ecx, eax
shl ecx, 7
add r8d, ecx
add r8d, 0xffffff80
test al, al
js 0x14005b62d
add rsi, 2
mov rax, rsi
jmp 0x14005b647
cmp bl, 0x10
je 0x14005b5e1
test ebx, ebx
je 0x14005b682
mov eax, ebx
and eax, 7
cmp eax, 4
je 0x14005b682
mov rdx, qword [r12]
test dl, 1
je 0x14005b5d4
and rdx, 0xfffffffffffffffe
add rdx, 8
mov ecx, ebx
mov r8, rsi
mov r9, rdi
int3
test rax, rax
jne 0x14005b47d
jmp 0x14005b679
mov rcx, r12
int3
movzx r8d, byte [rsi]
lea rax, [rsi + 1]
test r8b, r8b
jns 0x14005b66d
movzx eax, byte [rax]
mov ecx, eax
shl ecx, 7
add r8d, ecx
add r8d, 0xffffff80
test al, al
js 0x14005b653
add rsi, 2
mov rax, rsi
jmp 0x14005b66d
movaps xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov rdx, rsi
call fcn.1401af250
mov r8d, dword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
or ebp, 1
mov dword [r14 + 0x18], r8d
jmp 0x14005b5c6
movaps xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov rdx, rsi
call fcn.1401af250
mov r8d, dword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
or ebp, 4
mov dword [r14 + 0x20], r8d
jmp 0x14005b5c6
movaps xmmword [rsp + 0x20], xmm6
mov rcx, r15
mov rdx, rsi
call fcn.1401af250
mov r8d, dword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
or ebp, 2
mov dword [r14 + 0x1c], r8d
jmp 0x14005b5c6
xor esi, esi
jmp 0x14005b687
mov rsi, rax
jmp 0x14005b687
dec ebx
mov dword [rdi + 0x50], ebx
or dword [r14 + 0x10], ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140106510
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14005f8a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov r13, r8
mov r12, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
mov rdi, qword [r8]
mov qword [r8], 0
lea rbx, [rdi + 1]
cmp rbx, 2
jb 0x14005f8df
call fcn.1400c8a40
cmp qword [rsi + 0x18], rdi
je 0x14005f915
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14005f9e1
cmp rbx, 2
jb 0x14005f90d
mov qword [rsi + 0x18], rdi
call fcn.1400c8a40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov qword [rsi + 0x20], rax
mov rdi, qword [r12]
mov qword [r12], rax
lea r15, [rdi + 1]
cmp r15, 2
jb 0x14005f932
call fcn.1400c8a40
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
cmp qword [rsi + 0x20], rdi
je 0x14005f980
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x14005f9fc
cmp r15, 2
jb 0x14005f970
mov qword [rsi + 0x20], rdi
call fcn.1400c8a40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x98]
xor eax, eax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], r14
mov qword [rsi + 0x38], rax
mov qword [rsi + 0x40], rbx
xorps xmm0, xmm0
movups xmmword [rsi + 0x48], xmm0
movups xmmword [rsi + 0x58], xmm0
mov qword [rsi + 0x68], rax
mov rcx, qword [rbp + 8]
sub rcx, qword [rbp]
jne 0x14005fa17
mov rax, qword [r12]
inc rax
cmp rax, 2
jae 0x14005faa0
mov rax, qword [r13]
inc rax
cmp rax, 2
jae 0x14005fabb
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400c8a40
mov rcx, qword [rsi + 0x18]
int3
call fcn.1400c8a40
mov rcx, qword [rsi + 0x20]
int3
mov rbx, rcx
sar rbx, 2
movabs rdi, 0xf0f0f0f0f0f0f0f1
imul rbx, rdi
movabs rax, 0x3c3c3c3c3c3c3c4
cmp rbx, rax
jae 0x14005fad6
int3
call fcn.1400c8a40
mov rcx, qword [r12]
int3
call fcn.1400c8a40
mov rcx, qword [r13]
int3
add rsi, 0x58
mov rcx, rsi
int3