joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140259a94
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r9
movzx r14d, dl
mov r15, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
and qword [rbp - 0x30], 0
xor ebx, ebx
mov qword [rbp - 0x50], rbx
test r8b, r8b
je 0x140259b9f
lea rcx, [rbp - 0x48]
call fcn.140261b2c
mov rdi, rax
lea rax, [rbp - 0x50]
cmp rax, rdi
je 0x140259b00
mov rdx, qword [rdi]
lea rcx, [rbp - 0x50]
call fcn.14021f220
and qword [rdi], rbx
mov rbx, qword [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.14021e88c
test rbx, rbx
jne 0x140259b8c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x140259b55
lea rcx, str.Failed_to_create_sense_sid
mov qword [rbp - 0x48], rcx
mov dword [rbp + 0x30], ebx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044e636]
mov rcx, rax
call fcn.14000789c
test ebx, ebx
jle 0x140259b62
movzx ebx, bx
or ebx, 0x80070000
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rax, vtable.sense::Common::SafeCreateProcessException.0
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x10], ebx
and dword [rbp - 0xc], 0
lea rdx, [0x1404af008]
lea rcx, [rbp - 0x28]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov qword [rbp - 0x48], rbx
lea r8, [rbp - 0x48]
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.14014d958
mov edx, r14d
lea rcx, [rbp - 0x48]
test rsi, rsi
je 0x140259bbc
lea r9, [rbp - 0x40]
mov r8d, edx
mov rdx, r15
call fcn.1402619f4
jmp 0x140259bc5
lea r8, [rbp - 0x40]
call fcn.1400dbd40
mov rbx, qword [rbp + 0x40]
mov rdx, rax
mov rcx, rbx
call fcn.14011bd74
lea rcx, [rbp - 0x48]
call fcn.1400f0310
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
jne 0x140259c69
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.140091ae4
cmp dword [rax], 2
jbe 0x140259c32
lea rcx, [0x1403e6840]
mov qword [rbp - 0x48], rcx
mov dword [rbp + 0x30], ebx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044e636]
mov rcx, rax
call fcn.14000789c
test ebx, ebx
jle 0x140259c3f
movzx ebx, bx
or ebx, 0x80070000
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rax, vtable.sense::Common::SafeCreateProcessException.0
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x10], ebx
and dword [rbp - 0xc], 0
lea rdx, [0x1404af008]
lea rcx, [rbp - 0x28]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea rcx, [rbp - 0x50]
call fcn.14021e88c
nop
lea rcx, [rbp - 0x40]
call fcn.14006a168
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14025aefc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rax, vtable.sense::Common::MSAClient.0
mov qword [rcx], rax
xor esi, esi
mov dword [rcx + 8], esi
mov qword [rcx + 0x30], rsi
lea eax, [rsi + 7]
mov qword [rcx + 0x38], rax
mov word [rcx + 0x20], si
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rax
mov word [rcx + 0x40], si
mov qword [rcx + 0xa0], rsi
mov qword [rcx + 0xa8], rax
mov word [rcx + 0x90], si
or rax, 0xffffffffffffffff
mov dword [rcx + 0xb0], eax
mov qword [rcx + 0xb8], rax
mov dword [rsp + 0x60], esi
mov byte [rcx + 0x60], sil
add rcx, 0x68
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop dword [rax + rax]
mov byte [rbx + 0x60], 1
lea rdi, [rbx + 0x18]
mov dword [rdi], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x14025b2e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x14025aff5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14025afc1
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x58], eax
lea rdx, [0x1404af088]
lea rcx, [rsp + 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
or r9d, 0xffffffff
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
nop dword [rax + rax]
mov eax, dword [rdi]
test eax, eax
je 0x14025afd7
mov rax, rbx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14025d7fc
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14025d80f
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
nop dword [rax + rax]
test eax, eax
jne 0x14025d883
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14025d837
movzx eax, ax
or eax, 0x80070000
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14025d84a
cmp eax, 0x80070002
jne 0x14025d885
cmp qword [rbx + 0x18], 8
jb 0x14025d854
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14025d883
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14025d885
movzx eax, ax
or eax, 0x80070000
jmp 0x14025d885
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14025da28
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14025da41
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14025da71
test al, 0x10
je 0x14025da71
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14025da63
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
jmp 0x14025da8a
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14025da7e
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14025dad5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea edx, [rax - 2]
cmp edx, 1
jbe 0x14025dad5
cmp qword [rbx + 0x18], 8
jb 0x14025daae
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x14025dad5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x140261bb0
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400dc334
cmp qword [rdi + 0x18], 8
jb 0x140261bdc
mov rdi, qword [rdi]
lea rax, [rsp + 0x48]
mov r9d, 5
mov qword [rsp + 0x28], rax
lea r8, [0x1403a9f84]
and dword [rsp + 0x20], 0
lea rdx, str.NT_AUTHORITY
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_logon_l1_1_1.dll_LogonUserW]
nop dword [rax + rax]
lea rcx, [rsp + 0x48]
test eax, eax
jne 0x140261c1d
and qword [rbx], 0
jmp 0x140261c2b
mov rax, qword [rsp + 0x48]
and qword [rsp + 0x48], 0
mov qword [rbx], rax
call fcn.1400f0310
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140261c48
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp], rax
mov r12d, r9d
mov rsi, r8
mov rbx, rdx
mov r15, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], r8
mov r14, qword [rbp + 0x78]
mov qword [rsp + 0x68], r14
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x60], rax
mov al, byte [rbp + 0x70]
mov byte [rsp + 0x20], al
mov r9, r14
lea rdx, [rsp + 0x40]
call fcn.140261eb8
nop
mov rdi, qword [rsp + 0x40]
test rdi, rdi
jne 0x140261e83
mov r8, r14
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.1402620b0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14008f5f8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140261ce5
call fcn.14007e3e0
cmp qword [rsp + 0x40], 0
jne 0x140261d1d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
mov rcx, rbx
call fcn.1402611c8
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140261e8f
call fcn.14007e3e0
jmp 0x140261e8f
mov al, byte [r15 + 0x138]
mov rsi, qword [rsp + 0x50]
test al, al
je 0x140261dfa
test rsi, rsi
je 0x140261d57
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140261d57
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x140261dfa
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.1400f58ac
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.1400f58ac
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x140261ddd
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
mov qword [rsp + 0x70], rcx
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
mov qword [rsp + 0x78], rcx
lea rcx, str.Different_process_SID_than_the_expected_SID
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea rdx, [0x14044f7d0]
mov rcx, rax
call fcn.1400092bc
lea rcx, [rbp - 0x40]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x20]
call fcn.14007a7c0
mov rdi, qword [rsp + 0x40]
jmp 0x140261e83
mov r8d, r12d
lea rdx, [rbp - 0x80]
call fcn.140262ba4
nop
mov rdi, qword [rsp + 0x40]
mov r8, qword [rbp - 0x80]
test r8, r8
je 0x140261e75
mov rax, qword [r8]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140261e75
mov r8, qword [r8]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.14006a6bc
mov rdx, rax
mov rcx, r15
call fcn.140262a74
lea rcx, [rbp - 0x50]
call fcn.140298034
nop
lea rdx, [rdi + 0xe0]
lea r8, [rbp - 0x80]
mov rcx, qword [rax]
call fcn.140297c98
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140261e69
call fcn.14007e3e0
mov rdx, rsi
mov rcx, rdi
call fcn.140338820
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140261e83
call fcn.14007e3e0
mov qword [rbx], rdi
mov rax, qword [rsp + 0x48]
mov qword [rbx + 8], rax
mov rax, rbx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140112420
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14026508c
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0x20]
mov rdi, rcx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov al, byte [rdi + 0x18]
test al, al
je 0x1402650ec
mov rdx, qword [rdi + 0x28]
mov eax, 1
lock xadd qword [rdx + 0x38], rax
mov ecx, 0x323
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test rbx, rbx
je 0x1402650e7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
or eax, 0xffffffff
jmp 0x140265115
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov edi, eax
test rbx, rbx
je 0x140265113
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1402683d0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x218]
sub rsp, 0x310
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x200], rax
lea rsi, [0x1404e54b8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rsp + 0x50], rsi
cmp qword [0x1404fa428], 0
jne 0x140268578
and dword [rsp + 0x20], 0
lea rax, [0x1403a9f84]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call fcn.140266b58
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x20], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14026856d
mov dword [rbp - 0x40], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x3c]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [rax + rax]
jmp 0x140268565
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x140268552
mov ecx, dword [rbp - 0x20]
test ecx, ecx
jne 0x1402684d4
mov dword [reloc.OLEAUT32.dll_SysReAllocStringLen], eax
mov dword [rsp + 0x40], eax
lea rax, [rbp - 0x14]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140266b58
jmp 0x140268552
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocStringLen]
cmp ecx, eax
jne 0x140268552
test eax, eax
jne 0x1402684e7
call fcn.14007e73c
lea rdx, str..exe
lea rcx, [rbp - 0x68]
call fcn.14008c350
nop
lea rdx, [rbp - 0x14]
lea rcx, [rsp + 0x78]
call fcn.14008c350
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.1400b9ad0
test al, al
sete dil
lea rcx, [rsp + 0x78]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x68]
call fcn.14007a7c0
test dil, dil
je 0x140268552
mov eax, dword [rbp - 0x38]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x14]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x68]
call fcn.140266b58
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [rax + rax]
test eax, eax
jne 0x14026849e
lea rcx, [rsp + 0x20]
call fcn.1400f0310
nop
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14026c250
Capabilities:
Enumerate processes
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x40], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14026c3fa
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [rax + rax]
jmp 0x14026c3f2
or dword [rsp + 0x28], 0xffffffff
lea rax, str.Explorer.exe
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x7c]
lea edx, [r9 + 2]
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x14026c3de
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x38], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14026c3d4
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea r8, [rbp + 0x3a0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
nop dword [rax + rax]
mov edx, 0x104
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
lea r8, [0x1403e9d50]
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.14011a920
or dword [rsp + 0x28], 0xffffffff
lea rax, [rbp + 0x190]
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x3a0]
lea edx, [r9 + 2]
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x14026c42d
lea rcx, [rsp + 0x38]
call fcn.1400f0310
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [rax + rax]
test eax, eax
jne 0x14026c2d4
xor ebx, ebx
lea rcx, [rsp + 0x40]
call fcn.1400f0310
mov eax, ebx
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ebx, dword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.1400f0310
jmp 0x14026c3fc
Function at 0x14028e5f0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r8
mov rsi, rdx
mov r15, rcx
lea rdi, [rdx + 0x20]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14028e62f
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
nop dword [rax + rax]
xor r12d, r12d
test eax, eax
jne 0x14028e691
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rbp - 0x29]
call fcn.14008c350
nop
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.1400776e0
lea rdx, str._does_no_longer_exist
lea rcx, [rbp - 0x29]
call fcn.140077830
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x29]
mov r8, rdi
mov ebx, 0x80070002
mov edx, ebx
call fcn.14028f438
nop
lea rcx, [rbp - 0x29]
jmp 0x14028e81a
cmp byte [rbp + 0x7f], r12b
jne 0x14028e69e
xor eax, eax
jmp 0x14028e821
movdqa xmm0, xmmword [0x1403a9cf0]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r12w
lea r8, [rbp - 9]
mov rdx, rdi
call fcn.14029009c
mov ebx, eax
cmp eax, 5
je 0x14028e7e6
cmp eax, 0x80070005
je 0x14028e7e6
cmp eax, 0xd0000022
je 0x14028e7e6
test eax, eax
jns 0x14028e6f6
mov r9, r14
mov r8, rdi
mov edx, eax
mov rcx, r15
call fcn.14028f72c
jmp 0x14028e816
add rsi, 0x40
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.1400763d0
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.1400d7aa4
mov ebx, eax
lea rcx, [rbp - 0x29]
call fcn.14007a7c0
test ebx, ebx
je 0x14028e813
lea rdx, str.Remediation_has_not_occurred_since_the_file
lea rcx, [rbp - 0x29]
call fcn.14008c350
nop
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.1400776e0
lea rdx, str._sha1_has_been_changed
lea rcx, [rbp - 0x29]
call fcn.140077830
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x29]
mov r8, rdi
mov ebx, 0x80073bc5
mov edx, ebx
mov rcx, r15
call fcn.14028f568
call fcn.140091ae4
mov r8, rax
cmp dword [rax], 3
jbe 0x14028e7db
cmp qword [rsi + 0x18], 8
jb 0x14028e788
mov rsi, qword [rsi]
mov qword [rbp - 0x39], rsi
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov qword [rbp - 0x31], rcx
lea rax, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rax, qword [rbp - 0x29]
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea rdx, [0x1404508f5]
mov rcx, r8
call fcn.1400092bc
nop
lea rcx, [rbp - 0x29]
call fcn.14007a7c0
jmp 0x14028e816
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x14028e813
lea rcx, str.The_check_if_the_sha1_of_the_file_has_been_changed_was_skipped_since_there_was_access_denied_error_when_trying_to_read_the_file_hash
mov qword [rbp - 0x41], rcx
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1404508d3]
mov rcx, rax
call fcn.140005f40
mov ebx, r12d
lea rcx, [rbp - 9]
call fcn.14007a7c0
mov eax, ebx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140112420
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14029518c
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
movzx edx, word [rbp + 0x80]
cmp edx, 0x1c
ja 0x14029533c
mov ecx, 0x10000022
bt ecx, edx
jae 0x14029533c
and qword [rsp + 0x30], 0
mov rcx, r9
cmp qword [r9 + 0x18], 8
jb 0x1402951f2
mov rcx, qword [r9]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x8010
call qword [sym.imp.DNSAPI.dll_DnsQuery_W]
nop dword [rax + rax]
mov r12d, 1
add qword [rdi + 0x18], r12
test eax, eax
je 0x14029524e
xor edx, edx
lea r8d, [r12 + 0x3f]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov byte [rsi], 0
mov byte [rsi + 0x38], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140295351
jmp 0x1402952fb
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1402952de
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
cmp word [rdi + 0x10], r12w
jne 0x140295292
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x38], eax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlIpv4AddressToStringW]
nop dword [rax + rax]
jmp 0x1402952c1
cmp word [rdi + 0x10], 0x1c
jne 0x1402952ba
movups xmm0, xmmword [rdi + 0x20]
movdqu xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlIpv6AddressToStringW]
nop dword [rax + rax]
jmp 0x1402952c1
cmp word [rdi + 0x10], 5
je 0x1402952d1
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.140295378
test eax, eax
je 0x14029530c
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14029525c
mov rdi, qword [rsp + 0x30]
xor edx, edx
lea r8d, [rdx + 0x40]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov byte [rsi], 0
mov byte [rsi + 0x38], 0
test rdi, rdi
je 0x140295351
mov rcx, rdi
mov edx, r12d
call qword [sym.imp.DNSAPI.dll_DnsFree]
nop dword [rax + rax]
jmp 0x140295351
mov r8d, dword [rdi + 0x18]
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.1402950f8
nop
mov rdx, rax
mov rcx, rsi
call fcn.14029509c
mov byte [rsi + 0x38], r12b
lea rcx, [rsp + 0x50]
call fcn.1400f7dac
jmp 0x14029523b
xor edx, edx
lea r8d, [rdx + 0x40]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov byte [rsi], 0
mov byte [rsi + 0x38], 0
mov rax, rsi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140112420
add rsp, 0x128
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140296b8c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140296bfc
mov edx, 0x4c7
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
test eax, eax
jne 0x140296bfc
call fcn.140091ae4
mov rbx, rax
cmp dword [rax], 2
jbe 0x140296bfc
lea rax, str.Failed_to_terminate_SenseSampleUploader_process.
mov qword [rsp + 0x48], rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x40], eax
lea rdx, [0x14044e636]
lea rax, [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.14000789c
add rsp, 0x30
pop rbx
ret