joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x98], ebx
mov eax, dword [0x1401c73d4]
test eax, eax
jns 0x14005e4cb
mov dword [0x1401c73d4], ebx
call fcn.14002cc20
test al, al
je 0x14005e4c3
mov dword [0x1401c73d4], 1
jmp 0x14005e4d1
mov eax, dword [0x1401c73d4]
test eax, eax
jle 0x14005e590
xor ecx, ecx
call fcn.140027930
test rax, rax
je 0x14005e500
mov dword [rsp + 0x20], 1
lea r9, str.Logger
xor r8d, r8d
lea rdx, [0x14001ccd0]
mov rcx, rax
call fcn.140027c40
jmp 0x14005e503
mov rax, rbx
cmp dword [rax + 0x40], 2
jl 0x14005e57a
xor ecx, ecx
call fcn.140027930
test rax, rax
je 0x14005e53b
mov dword [rsp + 0x20], 1
lea r9, str.Logger
xor r8d, r8d
lea rdx, [0x14001ccd0]
mov rcx, rax
call fcn.140027c40
mov rsi, rax
jmp 0x14005e53e
mov rsi, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400220b0
nop
mov ebx, 1
mov dword [rsp + 0x98], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x14005e562
mov rax, qword [rax]
mov r9, rax
lea r8, str.Process_running_as_system_attempted_to_delete_file:__s._Operation_denied.
mov edx, 2
mov rcx, rsi
call fcn.14001ef20
nop
test bl, 1
je 0x14005e589
lea rcx, [rsp + 0x30]
call fcn.140009880
xor al, al
jmp 0x14005e6eb
mov rcx, rdi
call fcn.140026750
movzx r14d, al
test al, al
jne 0x14005e6e7
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005e5b1
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x14005e5c3
mov al, 1
jmp 0x14005e6eb
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14005e5d0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005e5ec
test al, 0x10
je 0x14005e5ec
mov rcx, rdi
call fcn.140025e20
jmp 0x14005e6eb
xor ecx, ecx
call fcn.140027930
test rax, rax
je 0x14005e61b
mov dword [rsp + 0x20], 1
lea r9, str.Logger
xor r8d, r8d
lea rdx, [0x14001ccd0]
mov rcx, rax
call fcn.140027c40
jmp 0x14005e61e
mov rax, rbx
cmp dword [rax + 0x40], 2
jl 0x14005e6c5
xor ecx, ecx
call fcn.140027930
test rax, rax
je 0x14005e65a
mov dword [rsp + 0x20], 1
lea r9, str.Logger
xor r8d, r8d
lea rdx, [0x14001ccd0]
mov rcx, rax
call fcn.140027c40
mov rbp, rax
jmp 0x14005e65d
mov rbp, rbx
mov edx, 0xffffffff
lea rcx, [rsp + 0x50]
call fcn.14002c970
mov rsi, rax
mov dword [rsp + 0x98], 2
cmp qword [rax + 0x18], 0xf
jbe 0x14005e684
mov rsi, qword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400220b0
nop
mov ebx, 6
mov dword [rsp + 0x98], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x14005e6a8
mov rax, qword [rax]
mov qword [rsp + 0x20], rsi
mov r9, rax
lea r8, str.Failed_to_delete_file:__s_r_n_s
mov edx, 2
mov rcx, rbp
call fcn.14001ef20
nop
test bl, 4
je 0x14005e6d8
and ebx, 0xfffffffb
lea rcx, [rsp + 0x30]
call fcn.140009880
nop
test bl, 2
je 0x14005e6e7
lea rcx, [rsp + 0x50]
call fcn.140009880
movzx eax, r14b
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400831f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov r14, rcx
mov rcx, rdx
call fcn.140083f70
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lfence
mov ecx, 0x40
call fcn.1401219f8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x40], rax
lea rdi, [r14 + 0x50]
mov qword [rsp + 0x20], rdi
mov edx, 0xffffffff
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test eax, eax
sete r15b
test eax, eax
jne 0x140083280
cmp dword [rdi + 0x10], eax
jne 0x14008327d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov qword [rdi + 8], rcx
inc dword [rdi + 0x10]
mov byte [rsp + 0x28], r15b
lea rdx, [r14 + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140083e40
nop
test esi, esi
jne 0x1400832b7
xor eax, eax
sub dword [rdi + 0x10], 1
jns 0x1400832a5
mov dword [rdi + 0x10], eax
jmp 0x1400832aa
cmp dword [rdi + 0x10], eax
jne 0x1400832ae
mov qword [rdi + 8], rax
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x40]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140083379
nop dword [rax]
lea rcx, [rbx + 0x20]
cmp qword [rbx + 0x38], 7
jbe 0x1400832df
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140083319
lea rcx, [rbx + 0x20]
cmp qword [rbx + 0x38], 7
jbe 0x1400832f9
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140083319
test al, 0x10
je 0x140083319
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400841a0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140083348
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140083343
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140083343
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140083330
mov rbx, rax
jmp 0x14008336f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14008336f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140083360
cmp byte [rbx + 0x19], 0
je 0x1400832d0
mov ebx, dword [rbp + 8]
lea rcx, [rsp + 0x40]
call fcn.14002ec40
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401219d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140094650
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r14, rcx
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140094688
cmp eax, 0x80010106
je 0x14009468f
xor al, al
jmp 0x14009483f
mov dword [r14], 1
lea rsi, [r14 + 8]
mov qword [rsp + 0x20], rsi
lea r9, [0x1401857b8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1401857c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400946c8
call qword [sym.imp.ole32.dll_CoUninitialize]
xor ebx, ebx
mov dword [r14], ebx
xor al, al
jmp 0x14009483f
lfence
mov rbp, qword [rsi]
mov rax, qword [rbp]
mov r12, qword [rax + 0x18]
lea r15, [r14 + 0x10]
mov ecx, 0x18
call fcn.1401219f8
mov rdi, rax
mov qword [rsp + 0x88], rax
xor ebx, ebx
test rax, rax
je 0x14009471e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], 1
lea rcx, str.ROOTCIMV2
call fcn.1401216a0
mov qword [rdi], rax
jmp 0x140094721
mov rdi, rbx
mov qword [rsp + 0x88], rdi
test rdi, rdi
je 0x140094858
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbp
mov rax, r12
call qword [case.0x14000aed8.0]
mov ebp, eax
mov ecx, 0xffffffff
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x1400947a0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140094781
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140094793
call fcn.1401219f0
mov qword [rdi + 8], rbx
mov edx, 0x18
mov rcx, rdi
call fcn.1401219f0
test ebp, ebp
jns 0x1400947b9
cmp qword [rsi], 0
je 0x140094830
lfence
mov rcx, qword [rsi]
mov qword [rsi], rbx
jmp 0x14009481d
lfence
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [r15]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14009483d
cmp qword [rsi], 0
je 0x14009480e
lfence
mov rcx, qword [rsi]
mov qword [rsi], rbx
test rcx, rcx
je 0x14009480e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14000aed8.0]
nop
cmp qword [r15], 0
je 0x140094830
lfence
mov rcx, qword [r15]
mov qword [r15], rbx
test rcx, rcx
je 0x140094830
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14000aed8.0]
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [r14], ebx
xor al, al
jmp 0x14009483f
mov al, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x8007000e
call fcn.140121690
int3
Function at 0x14009a5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, r9
mov r14, r8
cmp qword [rdx + 0x10], 0
je 0x14009a752
cmp qword [rdx + 0x18], 7
jbe 0x14009a625
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009a752
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14009a653
mov rdx, qword [r14]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14009a747
cmp dword [rsp + 0x3c], 1
jne 0x14009a747
xorps xmm0, xmm0
mov edi, dword [rsp + 0x38]
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
test rdi, rdi
je 0x14009a6d2
lfence
add rdi, rdi
mov rcx, rdi
call fcn.14000d5f0
mov rsi, rax
mov qword [rsp + 0x40], rax
lea rbx, [rdi + rax]
mov qword [rsp + 0x50], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140152f80
mov qword [rsp + 0x48], rbx
cmp qword [r14 + 0x18], 7
jbe 0x14009a6dc
mov r14, qword [r14]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14009a716
xor bl, bl
jmp 0x14009a738
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x14009a720
mov rdx, rsi
mov rcx, rbp
call fcn.14000a690
mov bl, 1
lea rcx, [rsp + 0x40]
call fcn.140009780
movzx eax, bl
jmp 0x14009a754
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401219d0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a2810
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x1400a2847
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400a29c0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140024d40
xor ebp, ebp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], ebp
lea edx, [rbp + 1]
lea rcx, [rsp + 0x38]
call fcn.140132000
xor ecx, ecx
call fcn.140027930
test rax, rax
je 0x1400a28c6
mov dword [rsp + 0x20], 0x1e
lea r9, str.ConfigurationManger
xor r8d, r8d
lea rdx, [0x140045110]
mov rcx, rax
call fcn.140027c40
mov rdi, rax
jmp 0x1400a28c9
mov rdi, rbp
lea rbx, str.userPrefUpdateIntervalHour
mov ecx, 0x40
call fcn.1401219f8
mov r14, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rsi, [rax + 0x20]
movups xmmword [rsi], xmm0
lea r15, [rsi + 0x10]
mov qword [r15], rbp
mov qword [rsi + 0x18], 7
mov word [rsi], bp
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400a2920
mov rdx, rbx
mov rcx, r14
call fcn.14000a7d0
cmp qword [rsi + 0x18], 7
jbe 0x1400a293f
mov rsi, qword [rsi]
mov qword [r15], rbp
mov word [rsi], bp
mov qword [rsp + 0x30], r14
mov edx, 1
mov rcx, rdi
call fcn.140064e70
test al, al
je 0x1400a2968
mov edx, 1
mov rcx, rdi
call fcn.140061770
lea rcx, [rdi + 0x38]
lea rdx, [rsp + 0x30]
call fcn.1400b1e90
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400a2985
mov ecx, 0x18
jmp 0x1400a299a
cvttsd2si rax, qword [rcx + 8]
mov ecx, 0x18
test rax, rax
cmovle rax, rcx
mov rcx, rax
imul rbx, rcx, 0xe10
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b0970
nop
mov rax, qword [rsp + 0x38]
sub rax, qword [rsp + 0x58]
cmp rax, rbx
setg al
jmp 0x1400a29c2
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401219d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400a4680
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rdx, str.ui.json
lea rcx, [rsp + 0x30]
xor esi, esi
call fcn.140058920
cmp qword [rsp + 0x48], 7
lea rcx, [rsp + 0x30]
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.140009810
cmp ebx, 1
je 0x1400a4709
lea ecx, [rsi + 1]
call fcn.140027930
test rax, rax
je 0x1400a4709
lea r9, str.UserInfoManager
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r8d, [rsi + 1]
mov rcx, rax
lea rdx, [0x140049f70]
call fcn.140027c40
test rax, rax
je 0x1400a4709
mov rcx, rax
call fcn.1400ae200
xor ecx, ecx
call fcn.140027930
test rax, rax
je 0x1400a4739
lea r9, str.UserInfoManager
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
xor r8d, r8d
lea rdx, [0x140049f70]
mov rcx, rax
call fcn.140027c40
mov rsi, rax
mov rcx, rsi
call fcn.1400adc00
lea rdx, [rsi + 0x38]
cmp rdi, rdx
je 0x1400a4760
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x1400a4758
mov rdx, qword [rdx]
mov rcx, rdi
call fcn.14000a7d0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
setne bl
test rcx, rcx
jne 0x1400a4782
lea r8d, [rcx + 7]
mov rcx, rdi
lea rdx, str.UnNamed
call fcn.14000a7d0
mov rsi, qword [rsp + 0x70]
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a8780
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rbp + 8], rax
mov rax, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14019b870]
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x70], r14b
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400a8520
nop
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rbp - 8], rax
lea rax, [0x140199368]
mov qword [rbp], rax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov dword [rsp + 0x20], 1
lea rdi, [rbp - 0x10]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
lea rdx, [0x14018f4cd]
test rax, rax
cmovne rdx, rax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400a8880
lea rcx, [rbp - 0x50]
call fcn.14000c1a0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x50]
call fcn.14001b670
nop
lea rcx, [rbp - 0x50]
call fcn.140009880
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140024af0
nop
lea r8, str..json
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140025030
nop
cmp rbx, rax
je 0x1400a88f4
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1400a88e8
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.14000a690
nop
lea rcx, [rsp + 0x50]
call fcn.140009810
nop
lea rcx, [rsp + 0x70]
call fcn.140009810
nop
lea rcx, [rsp + 0x28]
call fcn.140009810
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400a8921
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x1400a893d
add rdi, 8
lea rax, [rbp + 8]
cmp rdi, rax
jne 0x1400a8840
lea rcx, [rbp - 0x30]
call fcn.140009880
nop
lea rcx, [rbp - 0x70]
call fcn.140009880
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1401219d0
add rsp, 0x110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400bd2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, rcx
lea rax, vtable.CUnzipper.0
mov qword [rcx], rax
xor r14d, r14d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rcx + 0x18], r14d
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x28], r14
lea rax, [fcn.140002600]
mov qword [rcx + 0x30], rax
lea rsi, [rcx + 0x38]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
lea rax, [0x140190230]
test rdx, rdx
cmovne rax, rdx
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400bd370
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c0c0
nop
mov rcx, rdi
call fcn.1400bd590
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400bd4e9
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400bd3d5
test al, 0x10
jne 0x1400bd4e9
lea rax, [0x1400c0470]
mov qword [rbp - 0x71], rax
lea rax, [0x1400c0490]
mov qword [rbp - 0x69], rax
lea rax, [0x1400c0520]
mov qword [rbp - 0x51], rax
lea rax, [0x1400c0530]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], r14
lea rax, [0x1400bd6e0]
mov qword [rbp - 0x79], rax
lea rax, [0x1400bd770]
mov qword [rbp - 0x61], rax
lea rax, [0x1400bd780]
mov qword [rbp - 0x59], rax
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
movaps xmm0, xmmword [rbp - 0x79]
movaps xmmword [rbp - 0x19], xmm0
movaps xmm1, xmmword [rbp - 0x69]
movaps xmmword [rbp - 9], xmm1
movaps xmm0, xmmword [rbp - 0x59]
movaps xmmword [rbp + 7], xmm0
movaps xmm1, xmmword [rbp - 0x49]
movaps xmmword [rbp + 0x17], xmm1
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x37], r14
lea rdx, [rbp - 0x19]
call fcn.1400be980
mov qword [rdi + 8], rax
test rax, rax
je 0x1400bd4e9
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400bd491
mov r8, rbx
lea rcx, [rbp - 0x39]
call fcn.14000c0c0
nop
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1400248f0
nop
cmp rsi, rax
je 0x1400bd4d5
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1400bd4c9
mov rax, qword [rax]
mov rdx, rax
mov rcx, rsi
call fcn.14000a690
nop
lea rcx, [rbp - 0x79]
call fcn.140009810
nop
lea rcx, [rbp - 0x39]
call fcn.140009810
nop
lea rcx, [rsp + 0x20]
call fcn.140009810
nop
mov rax, rdi
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c7310
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400c73f2
call fcn.1400ded00
test al, al
jne 0x1400c73f2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400c7342
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1400e0070
test rax, rax
je 0x1400c7387
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1400e0070
mov rsi, rax
test rax, rax
je 0x1400c7387
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400c73bb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1400c4ef0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400c73a0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400d1320
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1401403a0
cdqe
add rsp, 0x28
ret
Function at 0x1400dced0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x140176de0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400dcefa
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140176e00]
mov rcx, rbx
mov r14, rax
call fcn.140139940
test rax, rax
je 0x1400dcf5d
mov rcx, rbx
test r14, r14
je 0x1400dcf47
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1400dcf95
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400dcf95
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1400dd058
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1400dcfc0
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x1400dd04a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400dd04a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1400dcff0
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x1400dd004
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400dd020
mov rcx, rdi
test r14, r14
je 0x1400dd041
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1400dd047
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.14012d4d0]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret