joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402746b0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1403989f0]
mov ecx, dword [0x14038f0a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140274931
mov rax, qword [0x1403989e8]
test rax, rax
je 0x14027479b
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x14036e550]
test eax, eax
je 0x140274745
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x1402747a2
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1402747d3
mov ecx, 2
call fcn.140124e30
test al, al
je 0x14027479b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4d
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x40]
lea rdx, [0x1403273b0]
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.1400fe0b0
mov rcx, rbx
call fcn.1401dd910
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x1402faf80]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
mov dl, byte [rsi + 0x81]
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
and dl, 1
mov rcx, rdi
mov r8, rsi
call fcn.140274980
test al, al
jne 0x14027485e
mov ecx, 2
call fcn.140124e30
test al, al
je 0x14027483f
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x221
mov r9d, 2
call fcn.140073d90
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1400fe0b0
mov rcx, rsi
call fcn.140074360
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14016c920
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
mov rdx, qword [rsi + 0x28]
cmp byte [rsi + 0x80], 1
jne 0x140274878
mov rcx, rdi
mov r8, rsi
call fcn.140274bc0
jmp 0x140274883
mov rcx, rdi
mov r8, rsi
call fcn.140275270
test al, al
jne 0x1402748cc
mov ecx, 2
call fcn.140124e30
test al, al
je 0x14027483f
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22a
mov r9d, 2
call fcn.140073d90
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x140274832
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.140273b80
mov sil, 1
test al, al
jne 0x140274841
mov ecx, 2
call fcn.140124e30
test al, al
je 0x14027483f
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22f
mov r9d, 2
call fcn.140073d90
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x140274832
lea rcx, [0x1403989f0]
call fcn.14016b42c
cmp dword [0x1403989f0], 0xffffffff
jne 0x1402746fb
lea rcx, [0x140309b64]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400bf880
mov qword [0x1403989e8], rax
lea rcx, [0x1403989f0]
call fcn.14016b4e0
jmp 0x1402746fb
Function at 0x14027a550
Capabilities:
Read http header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov r14, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r12, [rsp + 0x54]
mov dword [r12], 0
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebp, 0x80004005
cmovne ebp, ecx
cmp ebp, 0x8007007a
je 0x14027a5de
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016c920
mov eax, ebp
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x30]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1402faf80]
movaps xmmword [r15], xmm0
mov edx, dword [rsp + 0x54]
shr edx, 1
mov rcx, r15
call fcn.1401aeca0
mov r9, qword [r15]
cmp r9, qword [r15 + 8]
je 0x14027a66d
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
mov rcx, r14
mov edx, ebx
mov r8, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14027a67e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebp, 0x80004005
cmovne ebp, ecx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14027a5c0
mov rax, qword [rsp + 0x38]
cmp rax, rcx
je 0x14027a66f
add rax, 0xfffffffffffffffe
jne 0x14027a662
ud2
mov qword [rsp + 0x38], rcx
call fcn.14016b3e8
jmp 0x14027a5c0
mov edx, dword [rsp + 0x54]
test dl, 1
jne 0x14027a6b2
shr edx, 1
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140037650
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov r9, r8
sub r9, rdx
sar r9, 1
mov rcx, rsi
call fcn.14027a8f0
xor ebp, ebp
jmp 0x14027a64f
int3

Function at 0x14027a6c0
Capabilities:
Read http header

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
or edx, 0x20000000
lea rax, [rsp + 0x34]
mov dword [rax], 4
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor esi, esi
test eax, eax
jne 0x14027a71b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14016c920
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x140280530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14028055a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140280579
mov edi, eax
shr eax, 0xa
xor bl, 1
test al, bl
jne 0x1402805da
and edi, 0x10
shr edi, 4
jmp 0x1402805dc
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1402805da
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400fe0b0
mov rcx, rax
mov rdx, rsi
call fcn.1401deb10
mov rcx, rdi
call fcn.1401dd910
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14016c920
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret

Function at 0x140280600
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14028062b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1402806b2
test bl, bl
je 0x14028064f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1402806cf
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1402806b0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x40]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400fe0b0
mov rcx, rax
mov rdx, rsi
call fcn.1401deb10
mov rcx, rdi
call fcn.1401dd910
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14016c920
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140280530
test al, al
jne 0x1402806b2
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1402806b0
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.140073d90
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.1401deb10
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1400fe0b0
mov rcx, rdi
call fcn.140074360
jmp 0x1402806b0
Function at 0x140280740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x140280767
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140280797
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14016c920
mov eax, esi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1402807f8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400fe0b0
mov rcx, rax
mov rdx, rsi
call fcn.1401deb10
mov rcx, rdi
call fcn.1401dd910
xor esi, esi
jmp 0x14028077b

Function at 0x140280800
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x140280827
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x1402808dd
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140280851
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1402808c1
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1402808bf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x38]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.1400fe0b0
mov rcx, rax
mov rdx, rsi
call fcn.1401deb10
mov rcx, rdi
call fcn.1401dd910
xor edi, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14016c920
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14016c920
mov rcx, rsi
add rsp, 0x168
pop rdi
pop rsi
jmp fcn.140280900

Function at 0x140280900
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x140280928
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x140280956
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14016c920
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140124e30
test al, al
je 0x140280934
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x40]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400fe0b0
mov rcx, rax
mov rdx, rsi
call fcn.1401deb10
mov rcx, rbx
call fcn.1401dd910
jmp 0x140280934
Function at 0x140282360
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.1401a5320
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
jne 0x14028239c
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1402823a8
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140298940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x14039c7d0]
mov ecx, dword [0x14038f0a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1402989a2
cmp rdi, rsi
je 0x14029899e
mov eax, 0xffffffff
lea rcx, [0x14039c3d0]
mov dl, byte [rdi]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [rcx + rdx*4]
inc rdi
cmp rdi, rsi
jne 0x14029897f
not eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140298996
lea rcx, [0x14039c7d0]
call fcn.14016b42c
cmp dword [0x14039c7d0], 0xffffffff
jne 0x14029896e
lea rbx, [0x14039c3d0]
mov r8d, 0x400
mov rcx, rbx
mov dl, 0xaa
call fcn.1401a5320
xor eax, eax
mov ecx, 0xedb88320
mov r8d, eax
shr r8d, 1
mov edx, eax
and edx, 1
neg edx
and edx, ecx
xor edx, r8d
mov r9d, edx
shr r9d, 1
mov r8d, eax
shl r8d, 0x1e
sar r8d, 0x1f
and r8d, ecx
xor r8d, r9d
mov r9d, r8d
shr r9d, 6
mov r10d, eax
shl r10d, 0x1d
sar r10d, 0x1f
and r10d, 0x76dc419
mov r11d, eax
shl r11d, 0x1c
sar r11d, 0x1f
and r11d, 0xedb8832
xor r11d, r10d
mov r10d, eax
shl r10d, 0x1b
sar r10d, 0x1f
and r10d, 0x1db71064
xor r10d, r11d
mov r11d, eax
shl r11d, 0x1a
sar r11d, 0x1f
and r11d, 0x3b6e20c8
xor r11d, r10d
xor r11d, r9d
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, r11d
shl r8d, 0x1a
sar r8d, 0x1f
and r8d, ecx
xor r8d, edx
mov dword [rbx], r8d
inc rax
add rbx, 4
cmp rax, 0x100
jne 0x1402989d5
lea rcx, [0x14039c7d0]
call fcn.14016b4e0
jmp 0x14029896e
Function at 0x1402b6340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.1402b0c00

Function at 0x1402b7820
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x1402faf80]
lea r14, [rsp + 0xc0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, r14
call fcn.14024ba00
and byte [r14], 0xf8
mov al, byte [r14 + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [r14 + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.1401a5320
lea r8, [0x1403647d0]
mov rcx, r15
mov rdx, r14
call fcn.14015d810
mov rcx, rdi
mov rdx, r15
call fcn.1402b67e0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.14016c920
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1402c7e40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r12, r9
mov r13, r8
mov r15, rdx
mov rbp, rcx
mov r14, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x110]
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x90], rax
test rdi, rdi
jne 0x1402c7e8e
call fcn.14024b5f0
mov rdi, rax
test r14, r14
cmove r14, rdi
mov rcx, rdi
call fcn.14009c950
mov rsi, rax
lea rax, [rax*2 + 2]
cmp rax, r15
ja 0x1402c7ee3
lea rax, [rsi + rsi]
mov rbx, rax
not rbx
lea rcx, [r15 + rbx]
dec rcx
cmp rcx, r12
jae 0x1402c7f2c
mov dword [rsp + 0x20], 0x6a
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
jmp 0x1402c7f01
mov dword [rsp + 0x20], 0x64
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
call fcn.140282060
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14016c920
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [r15 - 1]
mov qword [rsp + 0x40], rcx
cmp rcx, rax
ja 0x1402c7f44
mov dword [rsp + 0x20], 0x6f
jmp 0x1402c7eeb
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
mov byte [rbp], 0
lea r8, [rsi + rbp]
inc r8
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], r8
xor r9d, r9d
call fcn.14009c960
xor ecx, ecx
mov edi, 0
test eax, eax
je 0x1402c80b0
mov rdi, qword [rsp + 0x40]
sub rdi, r12
add rbx, rdi
mov rcx, qword [rsp + 0x38]
je 0x1402c7fb3
mov rax, qword [rsp + 0x38]
lea rcx, [rax + rsi]
xor edx, edx
mov r8, rbx
call fcn.1401a5320
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 1]
mov qword [rsp + 0x48], rax
mov rax, rsi
not rax
add rdi, rcx
mov byte [rax + rdi], 1
test r12, r12
mov rbx, rcx
je 0x1402c7feb
add rbp, rsi
add rbp, r15
sub rbp, r12
sub rbp, rsi
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.1401a4c80
mov r13, qword [rsp + 0x48]
mov rcx, r13
mov rdx, rsi
call fcn.140130c80
test eax, eax
je 0x1402c80ba
mov r15, qword [rsp + 0x40]
sub r15, rsi
mov rcx, r15
call fcn.140137cb0
xor edi, edi
test rax, rax
je 0x1402c80c0
mov r12, rax
mov qword [rsp + 0x20], r14
mov rcx, rax
mov rdx, r15
mov r8, r13
mov r9, rsi
call fcn.14009ec20
test eax, eax
je 0x1402c80ad
cmp qword [rsp + 0x40], rsi
je 0x1402c805e
cmp r15, 1
mov rax, r15
adc rax, 0
xor ecx, ecx
mov dl, byte [r12 + rcx]
xor byte [rbx + rcx], dl
inc rcx
cmp rax, rcx
jne 0x1402c804f
movaps xmm0, xmmword [0x1402faf80]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rsp + 0x20], r14
mov rdx, rsi
mov r8, rbx
mov r9, r15
call fcn.14009ec20
test eax, eax
je 0x1402c80ad
mov edi, 1
test rsi, rsi
je 0x1402c80ad
xor eax, eax
mov cl, byte [rsp + rax + 0x50]
xor byte [r13 + rax], cl
inc rax
cmp rsi, rax
jne 0x1402c809c
mov rcx, r12
call fcn.140137d10
jmp 0x1402c7f06
xor ecx, ecx
xor edi, edi
jmp 0x1402c80b0
xor ecx, ecx
jmp 0x1402c80b0
Function at 0x1402cbf00
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x1402cbf60
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14016c920
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1402cc020
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x190
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x188], rax
movaps xmm0, xmmword [0x1402faf80]
lea rsi, [rsp + 0x150]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x1402cc0b3
mov ecx, 1
call fcn.140124e30
test al, al
je 0x1402cc0b3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x10a
mov r9d, 1
call fcn.140073d90
lea rcx, [rsp + 0x30]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.1400fe0b0
mov rcx, rsi
call fcn.140074360
mov eax, dword [rsp + 0x170]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14016c920
mov eax, esi
add rsp, 0x190
pop rsi
ret
Function at 0x1402da890
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1402da8cf
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1402da89f
mov dword [rsi], 7
jmp 0x1402da89f
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400e8940
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1402da8ab
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1402da8ab
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x1402da981
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1402da8a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402da89f

Function at 0x1402e1130
Capabilities:
Decompress data using quicklz

Disassembly:
mov r8d, dword [rdx]
mov eax, r8d
and eax, 0xf800d000
xor eax, 0xf0008000
mov r9d, r8d
not r9d
test r9d, 0x3c00000
setne r9b
mov r10d, ecx
and r10d, 1
or r10d, eax
sete r10b
lea eax, [rcx + 0x100000]
cmp eax, 0x200000
setb al
and al, r9b
and al, r10b
cmp al, 1
jne 0x1402e11cf
mov r9d, ecx
shr r9d, 1
and r9d, 0x7ff
and r8d, 0xf3c08000
mov r10d, ecx
shl r10d, 6
and r10d, 0x4000000
mov r11d, ecx
shl r11d, 4
and r11d, 0x3f0000
or r11d, r10d
mov r10d, ecx
shr r10d, 5
and r10d, 0x2000
or r10d, r11d
shr ecx, 8
and ecx, 0x800
or ecx, r10d
or ecx, r9d
or ecx, r8d
mov dword [rdx], ecx
ret

Function at 0x1402e11d0
Capabilities:
Decompress data using quicklz

Disassembly:
test cl, 1
jne 0x1402e11fa
mov eax, edx
and eax, 0xf800d000
cmp eax, 0xf0008000
setne al
mov r9d, edx
not r9d
test r9d, 0x3c00000
sete r9b
or r9b, al
je 0x1402e11fd
xor eax, eax
ret
mov eax, edx
shr eax, 4
and eax, 0x3f000
mov r9d, edx
and r9d, 0x7ff
lea eax, [rax + r9*2]
mov r9d, edx
shr r9d, 6
and r9d, 0x100000
mov r10d, edx
shl r10d, 8
and r10d, 0x80000
or r10d, r9d
shl edx, 5
and edx, 0x40000
or edx, r10d
or edx, eax
shl edx, 0xb
sar edx, 0xb
lea eax, [rcx + rdx]
add eax, 4
and eax, 0xfffffffe
mov dword [r8], eax
mov al, 1
jmp 0x1402e11fc

Function at 0x1402e1260
Capabilities:
Decompress data using quicklz

Disassembly:
mov eax, edx
or eax, ecx
test al, 1
je 0x1402e126b
xor eax, eax
ret
sub edx, ecx
mov eax, edx
and eax, 1
lea ecx, [rdx + rax]
add ecx, 0xfffffffc
mov rdx, r8
jmp fcn.1402e1130