joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402ad200
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
movzx eax, word [0x1404ad86c]
test ax, ax
jne 0x1402ad244
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [rbp - 0x18]
xor eax, eax
lock cmpxchg word [0x1404ad86c], dx
movzx edx, word [0x1404ad86c]
test dx, dx
jne 0x1402ad244
call fcn.1402b9bb8
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rbp + 0x30]
lea rax, [rbp + 0x38]
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x1402ad280
call fcn.1402b9bb8
jmp 0x1402ad352
mov ecx, dword [rbp + 0x2c]
mov eax, dword [rbp + 0x28]
mov rdx, qword [rbx + 8]
shl rcx, 0x20
add rcx, rax
test rdx, rdx
jne 0x1402ad2c1
mov eax, dword [rbp + 0x30]
mov qword [rbx + 8], rcx
mov ecx, dword [rbp + 0x34]
shl rcx, 0x20
add rcx, rax
mov eax, dword [rbp + 0x38]
mov qword [rbx + 0x10], rcx
mov ecx, dword [rbp + 0x3c]
shl rcx, 0x20
add rcx, rax
mov qword [rbx + 0x18], rcx
jmp 0x1402ad352
cmp rcx, rdx
jbe 0x1402ad352
mov eax, dword [rbp + 0x30]
xorps xmm1, xmm1
mov r8d, dword [rbp + 0x34]
mov r9d, dword [rbp + 0x3c]
movsd xmm2, qword [0x14038ac00]
shl r8, 0x20
add r8, rax
shl r9, 0x20
mov eax, dword [rbp + 0x38]
add r9, rax
mov rax, r9
sub rax, qword [rbx + 0x10]
sub rax, qword [rbx + 0x18]
add rax, r8
cvtsi2sd xmm1, rax
jns 0x1402ad30a
addsd xmm1, xmm2
mov rax, rcx
xorps xmm0, xmm0
sub rax, rdx
cvtsi2sd xmm0, rax
jns 0x1402ad31e
addsd xmm0, xmm2
divsd xmm1, xmm0
movzx eax, word [0x1404ad86c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov qword [rbx + 8], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rbx + 0x18], r9
mov qword [rbx + 0x10], r8
divsd xmm1, xmm0
mulsd xmm1, qword [0x14038abe0]
call fcn.1402ada30
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x1402af8e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x44]
mov rbx, rcx
mov r9d, dword [rcx + 0x9c]
mov edx, dword [rbx + 0x94]
mov esi, dword [rbx + 0x58]
mov ecx, dword [rbx + 0x44]
sub esi, edx
add ecx, 0xfffffefa
sub esi, r9d
add ecx, edi
cmp edx, ecx
jb 0x1402af9a1
mov rcx, qword [rbx + 0x50]
mov r8, rdi
lea rdx, [rcx + rdi]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov r9d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x68]
sub dword [rbx + 0x98], edi
sub dword [rbx + 0x94], edi
sub dword [rbx + 0x84], edi
lea r8, [rax + r9*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x1402af954
mov rax, qword [rbx + 0x60]
mov r9d, edi
lea r8, [rax + rdi*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x1402af97f
add esi, edi
mov rcx, qword [rbx]
cmp dword [rcx + 8], 0
je 0x1402afa1b
mov edx, dword [rbx + 0x9c]
mov r8d, esi
mov eax, dword [rbx + 0x94]
add rdx, rax
add rdx, qword [rbx + 0x50]
call fcn.1402af698
add dword [rbx + 0x9c], eax
mov r9d, dword [rbx + 0x9c]
cmp r9d, 3
jb 0x1402afa05
mov eax, dword [rbx + 0x94]
mov rdx, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x7c]
mov dword [rbx + 0x70], r8d
cmp r9d, 0x106
jae 0x1402afa1b
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jne 0x1402af909
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1402b0d14
Capabilities:
Compute adler32 checksum

Disassembly:
push rbx
sub rsp, 0x20
mov r11d, r8d
mov rbx, rdx
cmp r8d, 0x20
jbe 0x1402b0d5a
mov dword [rsp + 0x40], ecx
test rdx, rdx
jne 0x1402b0d39
mov eax, 1
jmp 0x1402b0ef9
mov rax, qword [0x1404bdae8]
lea r8, [rsp + 0x40]
mov edx, r11d
mov rcx, rbx
call qword [case.0x140245398.0]
mov eax, dword [rsp + 0x40]
jmp 0x1402b0ef9
mov r9d, ecx
movzx r10d, cx
shr r9d, 0x10
cmp r11d, 1
jne 0x1402b0d9d
movzx ecx, byte [rdx]
mov r11d, 0xfff1
add ecx, r10d
cmp ecx, r11d
lea edx, [rcx - 0xfff1]
cmovb edx, ecx
lea ecx, [rdx + r9]
cmp ecx, r11d
lea eax, [rcx - 0xfff1]
cmovb eax, ecx
shl eax, 0x10
or eax, edx
jmp 0x1402b0ef9
test rbx, rbx
je 0x1402b0d2f
cmp r11d, 0x10
jae 0x1402b0def
test r8d, r8d
je 0x1402b0dbf
movzx eax, byte [rbx]
inc rbx
add r10d, eax
add r9d, r10d
add r11d, 0xffffffff
jne 0x1402b0dad
mov r11d, 0xfff1
lea r8d, [r10 - 0xfff1]
cmp r10d, r11d
mov eax, 0x80078071
cmovb r8d, r10d
mul r9d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r9d
shl eax, 0x10
or eax, r8d
jmp 0x1402b0ef9
test r8d, r8d
je 0x1402b0eef
mov rcx, r11
shr rcx, 4
movzx eax, byte [rbx]
add r11d, 0xfffffff0
add r10d, eax
movzx eax, byte [rbx + 1]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 2]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 3]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 4]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 5]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 6]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 7]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 8]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 9]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xa]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xb]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xc]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xd]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xe]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xf]
add r9d, r10d
add rbx, 0x10
add r10d, eax
add r9d, r10d
sub rcx, 1
jne 0x1402b0dff
test r11d, r11d
je 0x1402b0ec7
movzx eax, byte [rbx]
inc rbx
add r10d, eax
add r9d, r10d
add r11d, 0xffffffff
jne 0x1402b0eb5
mov eax, 0x80078071
mul r10d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xffff000f
mul r9d
add r10d, ecx
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r9d, ecx
shl r9d, 0x10
or r9d, r10d
mov eax, r9d
add rsp, 0x20
pop rbx
ret
Function at 0x1402b7970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, dword [r8]
mov rdi, r8
lea rsi, [0x140000000]
not eax
mov r11d, edx
mov r10, rcx
cmp edx, 0xf
jl 0x1402b7a7a
mov r9d, ecx
mov qword [rsp + 0x10], rbx
and r9d, 7
je 0x1402b79d3
neg r9d
and r9d, 7
sub r11d, r9d
nop dword [rax]
movzx edx, byte [r10]
mov ecx, eax
xor rdx, rcx
inc r10
shr ecx, 8
movzx r8d, dl
mov eax, dword [rsi + r8*4 + 0x36f280]
xor eax, ecx
sub r9d, 1
jne 0x1402b79b0
mov ebx, r11d
sar ebx, 3
and r11d, 7
nop dword [rax]
mov rdx, qword [r10]
add r10, 8
mov ecx, eax
mov r9, rdx
shr r9, 0x20
mov r8d, edx
xor r8, rcx
mov rax, r8
shr rax, 0x10
movzx edx, al
mov rax, r8
shr rax, 8
movzx ecx, al
mov eax, dword [rsi + rdx*4 + 0x36ee80]
xor eax, dword [rsi + rcx*4 + 0x385440]
mov rcx, r9
shr rcx, 0x10
movzx edx, cl
mov rcx, r9
shr rcx, 8
xor eax, dword [rsi + rdx*4 + 0x385c40]
movzx edx, cl
mov rcx, r8
shr rcx, 0x18
xor eax, dword [rsi + rdx*4 + 0x36ea80]
xor eax, dword [rsi + rcx*4 + 0x386040]
mov rcx, r9
shr rcx, 0x18
xor eax, dword [rsi + rcx*4 + 0x36f280]
movzx ecx, r8b
xor eax, dword [rsi + rcx*4 + 0x36fa80]
movzx ecx, r9b
xor eax, dword [rsi + rcx*4 + 0x385840]
sub ebx, 1
jne 0x1402b79e0
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x1402b7aa4
nop
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [rsi + r8*4 + 0x36f280]
xor eax, ecx
sub r11d, 1
jne 0x1402b7a80
mov rsi, qword [rsp + 0x18]
not eax
mov dword [rdi], eax
pop rdi
ret
Function at 0x1402b9188
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov esi, r8d
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x1402b9278
test edx, edx
je 0x1402b9278
cmp r8d, 0x80
jae 0x1402b9278
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402b91cf
mov eax, ebp
jmp 0x1402b927d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
cmp eax, 0xb7
je 0x1402b91c8
cmp eax, 3
je 0x1402b91f5
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1402b927d
lea rax, [rsp + 0x50]
mov edx, 0x5c
mov qword [rsp + 0x28], rax
mov r8d, edi
lea rax, [rsp + 0x68]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1402b8b58
test eax, eax
js 0x1402b927d
cmp dword [rsp + 0x50], ebp
jne 0x1402b922a
mov eax, 0x80070003
jmp 0x1402b927d
mov edx, dword [rsp + 0x68]
lea r8d, [rsi + 1]
mov rcx, rbx
mov edi, edx
mov word [rbx + rdx*2], bp
call fcn.1402b9188
test eax, eax
js 0x1402b927d
mov eax, 0x5c
xor edx, edx
mov rcx, rbx
mov word [rbx + rdi*2], ax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1402b91c8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
cmp eax, 0xb7
je 0x1402b91c8
jmp 0x1402b91e3
mov eax, 0x80070057
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402b92fc
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, dword [rcx + 0x808]
xor edi, edi
mov r13, qword [rcx + 0x800]
mov rbp, r8
mov sil, byte [rcx + 0x80c]
mov rbx, rcx
mov dword [rsp + 0x38], eax
test r8, r8
je 0x1402b946a
mov r14b, byte [r11 + 0xb]
lea r9, [0x14036f280]
mov r15b, byte [r11 + 0xa]
mov r12b, byte [r11 + 9]
mov cl, byte [rdi + rdx]
cmp cl, sil
jne 0x1402b936c
cmp cl, r14b
jne 0x1402b936c
cmp cl, r15b
jne 0x1402b936c
cmp cl, r12b
je 0x1402b944b
movzx edx, cl
movzx eax, r12b
mov byte [rsp + 0x38], al
movzx r12d, r15b
movzx r15d, r14b
mov r11d, dword [r9 + rax*4]
movzx r14d, sil
mov sil, cl
mov r8d, dword [r9 + r12*4]
mov r10d, dword [r9 + r15*4]
mov eax, r10d
shr eax, 8
movzx ecx, al
mov eax, r11d
shr eax, 0x10
movzx eax, al
xor rcx, rax
movzx eax, byte [r9 + rdx*4]
mov r9d, dword [r9 + r14*4]
xor rcx, rax
mov eax, r9d
shr eax, 8
inc qword [rbx + rcx*8]
movzx ecx, al
mov eax, r8d
shr eax, 0x10
movzx eax, al
xor rcx, rax
movzx eax, r11b
xor rcx, rax
shr r11d, 8
lea rax, [0x14036f280]
mov edx, dword [rax + rdx*4]
mov eax, r10d
shr eax, 0x10
inc qword [rbx + rcx*8]
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
xor rcx, rax
shr edx, 0x10
movzx eax, r8b
xor rcx, rax
shr r8d, 8
mov eax, r9d
shr eax, 0x10
inc qword [rbx + rcx*8]
movzx ecx, al
movzx eax, r11b
xor rcx, rax
movzx eax, r10b
xor rcx, rax
movzx eax, dl
mov rdx, qword [rsp + 0x40]
inc qword [rbx + rcx*8]
movzx ecx, r8b
xor rcx, rax
movzx eax, r9b
xor rcx, rax
lea r9, [0x14036f280]
inc qword [rbx + rcx*8]
add r13, 5
inc rdi
cmp rdi, rbp
jb 0x1402b9351
mov byte [rsp + 0x3b], r14b
mov byte [rsp + 0x3a], r15b
mov byte [rsp + 0x39], r12b
mov eax, dword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
mov dword [rbx + 0x808], eax
mov byte [rbx + 0x80c], sil
mov qword [rbx + 0x800], r13
mov rbx, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1402baa50
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0xc8]
sub rsp, 0x1b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rsi, rdx
mov rdi, rcx
mov byte [rdx], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rcx + 0x40]
mov rax, qword [rdi + 0x48]
mov rbx, qword [rax]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x140245398.0]
mov r8, qword [rax + 0x10]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x48]
mov rax, qword [rbx + 0x50]
call qword [case.0x140245398.0]
mov ebx, eax
test eax, eax
js 0x1402bab5f
and dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
lea r8, [rsp + 0x50]
xor edx, edx
mov rax, qword [rax + 0x18]
call qword [case.0x140245398.0]
mov ebx, eax
test eax, eax
js 0x1402bab5f
mov eax, 0x5a4d
cmp word [rsp + 0x50], ax
jne 0x1402bab5d
cmp dword [rsp + 0x30], 0x40
jne 0x1402bab5d
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
movsxd rdx, dword [rbp - 0x74]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rbp - 0x70]
mov rax, qword [rax + 0x18]
call qword [case.0x140245398.0]
mov ebx, eax
test eax, eax
js 0x1402bab5f
mov eax, dword [rsp + 0x30]
add eax, 0xffffff08
test eax, 0xffffffef
jne 0x1402bab5d
cmp dword [rbp - 0x70], 0x4550
sete al
mov byte [rsi], al
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1402bab76
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [case.0x140245398.0]
mov eax, ebx
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402bb480
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rsp + 0x60]
mov esi, r9d
mov rbp, r8
mov rbx, rcx
and dword [rdi], 0
cmp qword [rcx + 0x30], 0
je 0x1402bb4b2
cmp rdx, qword [rcx + 0x30]
je 0x1402bb4eb
mov rcx, qword [rcx + 0x18]
lea r8, [rsp + 0x40]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1402bb4eb
and qword [rbx + 0x30], 0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1402bb51b
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x60]
and dword [rsp + 0x60], 0
mov r8d, esi
and qword [rsp + 0x20], 0
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1402bb4d4
mov ecx, dword [rsp + 0x60]
add qword [rbx + 0x30], rcx
xor eax, eax
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1402cd414
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r8d, dword [rcx]
lea rsi, [rcx + 0x20]
mov r14, rdx
lea rbx, [rcx + 0x60]
mov rdi, rcx
mov ebp, 0x40
mov byte [r8 + rcx + 0x20], 0x80
inc r8d
cmp r8d, 0x38
jbe 0x1402cd486
mov edx, ebp
mov eax, r8d
add rcx, 0x20
sub edx, r8d
add rcx, rax
call fcn.1402e6080
mov eax, dword [0x14049e8b0]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
test al, 0x42
jne 0x1402cd47e
call fcn.1402ce840
jmp 0x1402cd483
call fcn.1402cd528
xor r8d, r8d
mov edx, ebp
mov eax, r8d
lea rcx, [rdi + 0x20]
sub edx, r8d
add rcx, rax
call fcn.1402e6080
mov rax, qword [rdi + 0x10]
lea r9, [rsp + 0x40]
shl rax, 3
mov r8, rbp
bswap rax
mov qword [rdi + 0x58], rax
mov rdx, rsi
mov eax, dword [0x14049e8b0]
mov rcx, rbx
test al, 0x42
jne 0x1402cd4c8
call fcn.1402ce840
jmp 0x1402cd4cd
call fcn.1402cd528
mov rcx, rbx
mov r8d, 4
mov rax, qword [rcx]
lea rcx, [rcx + 8]
rol rax, 0x20
bswap rax
mov qword [r14], rax
lea r14, [r14 + 8]
sub r8, 1
jne 0x1402cd4d6
mov edx, 0x80
mov rcx, rdi
call fcn.1402e6080
movups xmm0, xmmword [0x140386b00]
mov rbp, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140386b10]
movups xmmword [rbx + 0x10], xmm1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1402da518
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x1402da559
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402da6aa
test al, 0x10
jne 0x1402da6aa
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.1401ea218
nop
xor ebx, ebx
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], rbx
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.1401e95f0
test al, al
jne 0x1402da678
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1402da69a
mov dword [rbp - 0x49], 0x8000ffff
lea rax, [rbp - 0x49]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 4
lea rax, str.Failed_to_analyze_version_of_tool
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], 0x44
cmp qword [rdi + 0x18], 8
jb 0x1402da5e3
mov rdi, qword [rdi]
lea rdx, [0x140344690]
mov r8, rdx
mov rax, rbx
or rcx, 0xffffffffffffffff
test rdi, rdi
je 0x1402da608
mov r8, rdi
mov rax, rcx
inc rax
cmp word [rdi + rax*2], bx
jne 0x1402da5ff
mov qword [rbp + 0x27], r8
lea eax, [rax*2 + 2]
mov dword [rbp + 0x2f], eax
mov dword [rbp + 0x33], ebx
lea r8, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae r8, qword [rbp - 0x39]
mov rax, rbx
test r8, r8
je 0x1402da63f
mov rdx, r8
mov rax, rcx
inc rax
cmp word [r8 + rax*2], bx
jne 0x1402da635
mov qword [rbp + 0x37], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 0x3f], eax
mov dword [rbp + 0x43], ebx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403e6f76]
mov rcx, r10
call fcn.140001158
jmp 0x1402da69a
mov eax, dword [rsi]
cmp eax, dword [rbp - 0x59]
jne 0x1402da695
mov eax, dword [rsi + 4]
cmp eax, dword [rbp - 0x55]
jne 0x1402da695
mov eax, dword [rsi + 8]
cmp eax, dword [rbp - 0x51]
jne 0x1402da695
mov eax, dword [rsi + 0xc]
cmp eax, dword [rbp - 0x4d]
setae al
mov bl, al
lea rcx, [rbp - 0x39]
call fcn.14004e0f0
mov al, bl
jmp 0x1402da730
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1402da72e
lea rax, str.Tool_does_not_exist_at_path
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x38
xor ebx, ebx
cmp qword [rdi + 0x18], 8
jb 0x1402da6d8
mov rdi, qword [rdi]
lea rdx, [0x140344690]
mov rcx, rbx
test rdi, rdi
je 0x1402da6f7
mov rdx, rdi
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], bx
jne 0x1402da6ee
mov qword [rbp + 0x17], rdx
lea eax, [rcx*2 + 2]
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], ebx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403e7023]
mov rcx, r10
call fcn.140001158
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402db258
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov r8d, 0x104
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
test eax, eax
jne 0x1402db366
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1402db357
cmp qword [rbx + 0x18], 8
lea rax, [rbp - 0x29]
mov qword [rbp + 7], rax
lea rax, str.ComputeSenseModuleFullPath_failed
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x25]
mov qword [rbp + 0x27], rax
mov dword [rbp - 0x29], SafeArrayGetDim
mov qword [rbp + 0xf], 4
mov qword [rbp + 0x1f], CloseCompressor
mov dword [rbp - 0x25], edi
mov qword [rbp + 0x2f], 4
jb 0x1402db301
mov rbx, qword [rbx]
lea rcx, [0x140344690]
mov rax, rsi
test rbx, rbx
je 0x1402db320
mov rcx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], si
jne 0x1402db317
lea eax, [rax*2 + 2]
mov qword [rbp + 0x37], rcx
mov dword [rbp + 0x3f], eax
mov dword [rbp + 0x43], esi
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403e7133]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001158
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
jmp 0x1402db391
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
mov word [rax], si
cmp qword [rbx + 0x18], 8
jb 0x1402db381
mov rbx, qword [rbx]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call fcn.1400460e8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402db538
Capabilities:
Check if file exists
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rdx]
add rcx, 0x60
cmp qword [rcx + 0x18], 8
jb 0x1402db571
mov rcx, qword [rcx]
mov rdx, qword [rbx]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
test eax, eax
jne 0x1402db58a
mov al, 1
jmp 0x1402db598
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
sete al
mov byte [rbp - 0x29], al
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1402db638
lea rax, str.irrelevantRulesPredicate_returned_with
mov qword [rbp + 0xf], MsiGetActiveDatabase
mov qword [rbp + 7], rax
mov rax, qword [rdi]
add rax, 0x60
cmp qword [rax + 0x18], 8
jb 0x1402db5d2
mov rax, qword [rax]
lea rdx, [0x140344690]
mov rcx, rsi
test rax, rax
je 0x1402db5f1
mov rdx, rax
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x1402db5e8
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x17], rdx
mov dword [rbp + 0x1f], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x23], esi
mov qword [rbp + 0x2f], 1
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403e7099]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001158
mov al, byte [rbp - 0x29]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret