joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a2370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1401a2404
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.1401ba810
test al, al
jne 0x1401a23cc
add rdi, 0x70
cmp rdi, r12
jne 0x1401a23b1
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1401a2404
cmp byte [rdi + 0x27], 0
js 0x1401a23de
lea rcx, [rdi + 0x10]
jmp 0x1401a23e2
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1401a2404
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14012d2c0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1401a2590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov esi, 1
cmp r14, r12
je 0x1401a260b
mov rdi, r9
mov ebp, r8d
mov rbx, rcx
lea r15, [rsp + 0x20]
mov rcx, r14
mov rdx, r15
call fcn.1401ba810
test al, al
jne 0x1401a25f0
add r14, 0x70
cmp r14, r12
jne 0x1401a25d5
mov r14, r12
cmp r14, qword [rbx + 0x58]
je 0x1401a260b
mov eax, dword [r14 + 0x68]
cmp eax, ebp
je 0x1401a2629
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012d2c0
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp byte [r14 + 0x27], 0
js 0x1401a2636
lea rcx, [r14 + 0x10]
jmp 0x1401a263a
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401a260b
shr eax, 3
and eax, 2
mov esi, eax
jne 0x1401a260b
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x1401a260b
Function at 0x1401a7c40
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x140249948]
test rax, rax
jne 0x1401a7c84
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x140249948]
test rax, rax
je 0x1401a7c71
cmp eax, 2
jne 0x1401a7ccd
cmp dword [0x140243868], 2
jg 0x1401a7d64
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x90
mov r9d, 2
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1401a7d57
mov eax, 1
lock xadd qword [0x140249980], rax
inc rax
cmp rax, 2
jl 0x1401a7cf1
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140249908], eax
mov qword [0x140249900], rsi
mov rcx, qword [0x14023f7d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140243868], 2
jg 0x1401a7d64
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 2
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140106fa0
mov rcx, rsi
call fcn.14000cf70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14012d2c0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1401b5a40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
js 0x1401b5a52
mov rsi, rdx
test rdx, rdx
jne 0x1401b5a59
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call 0x1401b5aa0
test edi, edi
je 0x1401b5a52
cmp byte [rsi + rdi - 1], 0xa
je 0x1401b5a52
lea rcx, [0x140203697]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1401b5aa0
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x1401b5b17
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x1401b5b17
add rdi, rax
test ecx, ecx
jne 0x1401b5add
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012d2c0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401b5aa0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
js 0x1401b5a52
mov rsi, rdx
test rdx, rdx
jne 0x1401b5a59
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call 0x1401b5aa0
test edi, edi
je 0x1401b5a52
cmp byte [rsi + rdi - 1], 0xa
je 0x1401b5a52
lea rcx, [0x140203697]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1401b5aa0
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x1401b5b17
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x1401b5b17
add rdi, rax
test ecx, ecx
jne 0x1401b5add
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012d2c0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401b7c30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call fcn.140060110
test rax, rax
jne 0x1401b7c6e
mov rcx, rdi
call fcn.140059420
test al, al
je 0x1401b7c6e
mov r8d, 0x28
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14005b8d0
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401b9f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1401b9fba
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401b9ff8
mov edi, eax
bt eax, 0xa
jae 0x1401b9ff0
test bl, bl
jne 0x1401b9ff0
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14012d2c0
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
and edi, 0x10
shr edi, 4
jmp 0x1401b9fd3
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401b9fd1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1401876d0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140106fa0
mov rcx, rax
mov rdx, rsi
call fcn.140188560
mov rcx, rdi
call fcn.140187750
jmp 0x1401b9fd1

Function at 0x1401ba060
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1401ba08b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1401ba112
test bl, bl
je 0x1401ba0af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1401ba12f
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401ba110
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.1401876d0
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140106fa0
mov rcx, rax
mov rdx, rsi
call fcn.140188560
mov rcx, rdi
call fcn.140187750
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14012d2c0
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.1401b9f90
test al, al
jne 0x1401ba112
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401ba110
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.14001eab0
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.140188560
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.140106fa0
mov rcx, rdi
call fcn.14000cf70
jmp 0x1401ba110
Function at 0x1401ba1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1401ba1c7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401ba1f7
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14012d2c0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401ba258
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.1401876d0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140106fa0
mov rcx, rax
mov rdx, rsi
call fcn.140188560
mov rcx, rdi
call fcn.140187750
xor esi, esi
jmp 0x1401ba1db
Function at 0x1401c1a10
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x14024a478]
mov ecx, dword [0x1402403d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401c1c8c
mov rax, qword [0x14024a470]
test rax, rax
je 0x1401c1afb
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x1402233e0]
test eax, eax
je 0x1401c1aa5
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x1401c1b02
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1401c1b37
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401c1afb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4c
mov r9d, 2
call fcn.1401876d0
lea rcx, [rsp + 0x40]
lea rdx, [0x140217080]
mov r8d, 0xe
call fcn.140106fa0
mov rcx, rbx
call fcn.140187750
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x1401fd000]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1401c1ce0
test al, al
jne 0x1401c1bbf
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401c1ba0
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21f
mov r9d, 2
call fcn.14001eab0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.140106fa0
mov rcx, rsi
call fcn.14000cf70
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14012d2c0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
jne 0x1401c1bd9
call fcn.1401c25a0
jmp 0x1401c1bde
call fcn.1401c1f20
test al, al
jne 0x1401c1c27
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401c1ba0
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x228
mov r9d, 2
call fcn.14001eab0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x1401c1b93
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1401c1010
mov sil, 1
test al, al
jne 0x1401c1ba2
mov ecx, 2
call fcn.1401290e0
test al, al
je 0x1401c1ba0
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22d
mov r9d, 2
call fcn.14001eab0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x1401c1b93
lea rcx, [0x14024a478]
call fcn.14012ad90
cmp dword [0x14024a478], 0xffffffff
jne 0x1401c1a5b
lea rcx, [0x1402061a4]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14009a980
mov qword [0x14024a470], rax
lea rcx, [0x14024a478]
call fcn.14012ad24
jmp 0x1401c1a5b
Function at 0x1401cf400
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x1401cf460
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012d2c0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401e2530
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401fd000]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140168a20
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1401eb430
test al, al
je 0x1401e2647
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401e2601
mov rcx, r14
call fcn.140168a20
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1401eb430
test al, al
je 0x1401e26d3
cmp dword [rbx], 0x4550
jne 0x1401e2712
mov sil, 1
test rdi, rdi
je 0x1401e26b2
mov qword [rdi], r14
jmp 0x1401e26b2
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e26b0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1401e2687
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e26b0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140106fa0
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x1401e269d
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140106fa0
mov rcx, rdi
call fcn.14000cf70
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14012d2c0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e26b0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401e2681
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e26b0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1401e2687
Function at 0x1401e2760
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401fd000]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140168a20
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1401eb430
test al, al
je 0x1401e2877
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401e2831
mov rcx, r14
call fcn.140168a20
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1401eb430
test al, al
je 0x1401e2903
cmp dword [rbx], 0x4550
jne 0x1401e2942
mov sil, 1
test rdi, rdi
je 0x1401e28e2
mov qword [rdi], r14
jmp 0x1401e28e2
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e28e0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1401e28b7
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e28e0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140106fa0
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x1401e28cd
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140106fa0
mov rcx, rdi
call fcn.14000cf70
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14012d2c0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e28e0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401e28b1
mov ecx, 1
call fcn.1401290e0
test al, al
je 0x1401e28e0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14001eab0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1401e28b7
Function at 0x140001070
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, rdx
mov rbp, rcx
mov edx, 1
mov ecx, 0x100000
call fcn.14000961c
mov rdi, rax
test rax, rax
je 0x140001103
xor r9d, r9d
mov r8d, 0x100000
mov rdx, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140001103
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140001103
mov eax, ebx
mov rdx, rbp
imul rcx, rax, 0x128
movzx eax, word [rcx + rdi + 0x2e]
add rax, 0x30
lea rsi, [rcx + rdi]
add rcx, rax
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001139
inc ebx
cmp ebx, dword [rdi]
jb 0x1400010d4
lea rcx, str.ntoskrnl.exe_base_address_not_found._n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140005430
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x140001103
lea rdx, str.FLTMGR.sys
mov rcx, rbp
call fcn.14001af40
test eax, eax
jne 0x1400011d1
mov eax, dword [0x140024a80]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [str.C:windows_system32drivers_]
mov dword [rsp + 0x38], eax
mov rdx, rbp
movzx eax, byte [0x140024a84]
movaps xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [0x140024a78]
movsd qword [rsp + 0x30], xmm0
xorps xmm0, xmm0
mov byte [rsp + 0x3c], al
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x7d], eax
movups xmmword [rsp + 0x4d], xmm0
mov word [rsp + 0x81], ax
movups xmmword [rsp + 0x5d], xmm0
mov byte [rsp + 0x83], al
movups xmmword [rsp + 0x6d], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x1400011da
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000110f
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
sub rbx, rdi
add rax, rbx
jmp 0x140001111
Function at 0x1400032d0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
mov r14d, ecx
mov r8d, ecx
mov ebx, 0x1000
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
jne 0x140003319
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, r14d
lea rcx, str._RemovePPL__Failed_to_open__d__error__lu_n
mov r8d, eax
call fcn.140001010
xor eax, eax
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov edx, 1
mov rcx, rbx
mov qword [rsp + 0x58], rdi
call fcn.14000961c
xor edi, edi
lea r9, [rsp + 0x50]
mov r8d, ebx
mov dword [rsp + 0x50], edi
mov rdx, rax
mov rsi, rax
lea ecx, [rdi + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140003392
mov rcx, rsi
call fcn.14000ca20
add ebx, ebx
cmp ebx, 0x20000000
ja 0x140003396
mov ecx, ebx
mov edx, 1
call fcn.14000961c
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140003354
test eax, eax
jns 0x1400033b7
lea rcx, str._RemovePPL__NtQuerySystemInformation_failed_to_obtain_handle__n
call fcn.140001010
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400033a2
mov rcx, rdi
mov r8d, eax
nop dword [rax + rax]
lea rax, [rcx + rcx*4]
cmp qword [rsi + rax*8 + 0x18], r8
lea rcx, [rsi + rax*8]
jne 0x1400033e8
movzx eax, bp
cmp qword [rcx + 0x20], rax
je 0x1400033f3
inc edi
mov ecx, edi
cmp rcx, rdx
jb 0x1400033d0
jmp 0x1400033a2
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x1400033a2
mov eax, dword [0x14002bc78]
cmp eax, 0x3fab
ja 0x14000344e
je 0x14000348f
cmp eax, 0x2580
je 0x140003447
cmp eax, 0x2800
je 0x140003440
cmp eax, 0x295a
je 0x140003439
cmp eax, 0x3839
je 0x140003432
cmp eax, 0x3ad7
jmp 0x14000346b
mov eax, 0x6c2
jmp 0x140003494
mov eax, 0x6b2
jmp 0x140003494
mov eax, 0x6aa
jmp 0x140003494
mov eax, 0x67a
jmp 0x140003494
mov ecx, eax
sub ecx, 0x42ee
je 0x14000348f
sub ecx, 0x275
je 0x14000348f
sub ecx, 0x257
je 0x14000348f
cmp ecx, 1
je 0x14000348f
cmp eax, 0x4a61
jb 0x14000347b
mov eax, 0x87a
jmp 0x140003494
mov edx, r14d
lea rcx, str._RemovePPL__The_offset_address_of__d_was_not_found__this_Windows_version_requires_adaptation__n
call fcn.140001010
jmp 0x1400033a2
mov eax, 0x6ca
add rdx, rax
mov byte [rsp + 0x48], 0
mov r8d, 1
lea rcx, [rsp + 0x48]
call fcn.140004ba0
mov eax, 1
jmp 0x1400033a4