joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140143340
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call fcn.14035c350
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x18
mov eax, dword [rcx + rdi]
mov esi, 0x10
test al, 1
jne 0x1401433ab
or eax, 1
mov dword [rcx + rdi], eax
xor eax, eax
mov qword [rdi + rsi], rax
call fcn.140149b80
mov qword [rdi + rsi], rax
mov rax, qword [rdi + rsi]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x70]
call fcn.1400b8060
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
cmp dword [rsp + 0x68], eax
setl byte [rsp + 0x168]
jl 0x140143400
lea rdx, str.Service_starting...
lea rcx, [rsp + 0x60]
call fcn.140142b20
mov byte [rsp + 0x168], 1
lea rcx, [rsp + 0x60]
call fcn.14010a560
cmp qword [0x14068a9a8], 0
je 0x14014341b
or dword [rbx + 0x18], 0xc0
mov dword [rbx + 0x14], 2
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140143435
lea rdx, [rbx + 0x10]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp qword [0x14068a9a8], 0
je 0x14014348e
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x44], 5
xor eax, eax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], eax
lea r8d, [rax + 5]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov rdi, rax
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140143485
call qword [sym.imp.USER32.dll_UnregisterDeviceNotification]
mov qword [rbx + 0x30], rdi
test rdi, rdi
je 0x1401434b3
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, str.Failed_to_register_for_device_notifications
lea rcx, [rsp + 0x20]
call fcn.140073260
nop
lea rcx, [rsp + 0x20]
call fcn.140124ec0
int3
Function at 0x140144770
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1401cd220.0]
cmp byte [0x14068a6d8], 0
je 0x140144968
cmp qword [0x140677330], 0
je 0x140144968
lea rcx, [rsp + 0x40]
call fcn.140143b80
mov rsi, rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call fcn.14035c350
call fcn.140147360
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 4
lea rcx, [rsp + 0x70]
call fcn.1400b8060
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
cmp dword [rsp + 0x68], eax
setl byte [rsp + 0x168]
jl 0x14014491e
mov rbx, qword [0x140677330]
lea rdi, [0x140677320]
cmp qword [0x140677338], 0x10
cmovae rdi, qword [0x140677320]
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x170]
call fcn.14035c350
lea rcx, [rsp + 0x170]
call fcn.1400b8060
nop
lea rdx, [0x1405f565c]
lea rcx, [rsp + 0x180]
call fcn.1400b6970
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.1400b6680
mov rcx, rax
lea rdx, [0x1405fc4b4]
call fcn.1400b6970
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x188]
call fcn.1400b65b0
nop
lea rcx, [rsp + 0x170]
call fcn.1400b6c60
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140124b50
lea rdx, str.Shutdown_version
mov rcx, rax
call fcn.140142a00
mov rdx, rsi
mov rcx, rax
call fcn.140124b50
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140144916
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140144911
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140144911
call fcn.140368068
int3
call fcn.140359090
mov byte [rsp + 0x168], 1
lea rcx, [rsp + 0x60]
call fcn.14010a560
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140144968
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140144963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140144963
call fcn.140368068
int3
call fcn.140359090
call fcn.140147360
mov rcx, rax
call fcn.14014c600
call fcn.140149b80
mov rcx, rax
call fcn.14014c600
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140147f40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x14068beb4], 0xffffffff
lea rax, [0x14068ab30]
mov dword [0x14068ab34], edx
mov ecx, 1
nop dword [rax]
mov r8d, edx
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, ecx
mov dword [rax + rcx*4 + 4], edx
inc rcx
cmp rcx, 0x270
jb 0x140147f60
mov dword [0x14068ab30], 0x270
ret
Function at 0x140148370
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140148392
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14014841e
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.14006fc20
test rax, rax
jle 0x1401483ee
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov r8, rsi
mov rdx, qword [rdx]
call fcn.14035bc80
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14014840e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1401cd220.0]
cmp eax, 0xffffffff
je 0x140148416
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x1401483b0
sub rbp, rdi
jmp 0x140148508
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140148435
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140148437
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14014846c
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14035bc80
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140148502
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1401484a7
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x1401484e0
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.140376560
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x140148502
cmp rsi, rax
ja 0x1401484b0
test rdi, rdi
je 0x140148502
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140376560
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x14014c2a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14014c402
cmp byte [rdx + 4], 0
je 0x14014c2de
mov eax, dword [rcx]
cmp dword [rdx], eax
jl 0x14014c402
mov r9, r8
mov r8, rdx
lea rdx, str._H:_M:_S
lea rcx, [rbp + 0xf]
call fcn.14014b230
nop
mov dword [rbp + 7], 0
cmp byte [rbx + 0x10], 0
je 0x14014c3a1
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x1f]
mov qword [rbp - 1], rax
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x2f]
call fcn.14014e810
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x3f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14014c3cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014c39a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014c425
call fcn.140359090
jmp 0x14014c3cb
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x1f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14014c402
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014c3fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014c41f
call fcn.140359090
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
nop
int3
Function at 0x14014d740
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, qword [r8]
mov r14, r9
mov rbp, qword [rsp + 0xe0]
mov rsi, rdx
mov r15, qword [rsp + 0xe8]
mov rbx, rcx
mov r12, qword [rsp + 0xf0]
test rdi, rdi
je 0x14014d846
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x14014d846
cmp byte [rcx + 4], 0
je 0x14014d7a9
mov eax, dword [rdi]
cmp dword [rcx], eax
jl 0x14014d846
mov r9, rsi
lea rdx, str._FT_T
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.14014b230
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x68], 0xffffffffffffffff
cmp qword [rsp + 0x50], 0x10
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14014d846
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014d841
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014d88e
call fcn.140359090
mov rcx, qword [r14]
test rcx, rcx
je 0x14014d859
mov r8, rsi
mov rdx, rbx
call fcn.14014b4f0
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.14014e470
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140359070
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140368068
int3
Function at 0x140155500
Capabilities:
Get system information on windows
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x90], rax
movsxd rsi, r8d
mov qword [rsp + 0x38], rdx
mov r13, rcx
xor edi, edi
mov dword [rsp + 0x50], edi
mov r14d, edi
mov r15d, edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140155705
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x140155576
mov ebx, 0xffffffff
cmp eax, 0x26
cmovne edi, ebx
mov dword [rsp + 0x50], edi
jmp 0x140155705
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov qword [rsp + 0x40], rax
mov ebx, 0xffffffff
mov dword [rsp + 0x50], ebx
test rax, rax
jne 0x1401555bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
jne 0x1401555bd
mov dword [rsp + 0x50], edi
jmp 0x140155705
test r14, r14
je 0x140155705
mov qword [rsp + 0x58], rdi
mov r9d, 1
lea r8, [rsp + 0x5c]
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58], eax
cmp eax, ebx
jne 0x140155608
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x58]
mov rcx, 0xffffffffffffffff
test eax, eax
cmovne rbx, rcx
mov qword [rsp + 0x58], rbx
jmp 0x14015560d
mov rbx, qword [rsp + 0x58]
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, r13
call fcn.140155ad0
mov r12, rax
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call fcn.140155ad0
test esi, esi
jle 0x1401556f7
cmp rbx, r12
jge 0x1401556f7
lfence
mov rcx, r12
mov rbx, qword [rsp + 0x58]
sub rcx, rbx
cmp rcx, rsi
jge 0x140155655
mov esi, r12d
sub esi, ebx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x88]
mov rax, rbx
cqo
idiv rcx
mov qword [rsp + 0x30], rdx
mov r8, rbx
sub r8, rdx
movsxd rax, esi
add rax, rdx
mov rcx, r8
sar rcx, 0x20
mov qword [rsp + 0x20], rax
mov r9d, r8d
mov r8d, ecx
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1401556f7
lfence
mov rdx, qword [rsp + 0x30]
add rdx, rax
movsxd rbx, esi
mov r8, rbx
mov rcx, qword [rsp + 0x38]
call fcn.14035bc80
lfence
mov r8d, 1
mov rdx, rbx
mov rcx, r13
call fcn.140155ad0
mov rbx, qword [rsp + 0x58]
jmp 0x1401556fb
mov esi, dword [rsp + 0x50]
cmp rbx, r12
cmove esi, edi
mov dword [rsp + 0x50], esi
test r15, r15
je 0x140155713
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r14, r14
je 0x140155721
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140359070
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140155750
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140155789
mov dword [rsp + 0x30], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140359070
add rsp, 0x48
ret
Function at 0x140155a60
Capabilities:
Get file size

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x140155ab3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x20]
test ecx, ecx
cmovne rax, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140359070
add rsp, 0x38
ret
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140359070
add rsp, 0x38
ret

Function at 0x140156930
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x140156a50
test rdx, rdx
je 0x140156a50
mov rcx, 0xffffffffffffffff
mov rbx, rcx
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140156961
add rbx, 0x2e
cmp rbx, 0x7fff
ja 0x140156a50
mov qword [rsp + 0x40], rsi
lfence
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140368330
mov rsi, rax
test rax, rax
jne 0x1401569b8
lea eax, [rsi + 6]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lfence
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, str._s_S
mov rdx, rbx
mov rcx, rsi
call fcn.140156470
movsxd rcx, eax
lea rax, [rbx - 1]
cmp rcx, rax
je 0x1401569f2
mov rcx, rsi
mov ebx, 3
call fcn.1403683a0
mov eax, ebx
jmp 0x1401569a3
lfence
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140156a3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
sub edx, 2
je 0x140156a3f
cmp edx, 1
je 0x140156a3f
lfence
mov ebx, 3
lea rdx, str.Unable_to_remove_file:___s___winError:__d_
mov ecx, ebx
mov r9d, eax
mov r8, rsi
call fcn.140157a90
mov rcx, rsi
call fcn.1403683a0
mov eax, ebx
jmp 0x1401569a3
xor ebx, ebx
mov rcx, rsi
call fcn.1403683a0
mov eax, ebx
jmp 0x1401569a3
mov rbx, qword [rsp + 0x48]
mov eax, 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140157fe0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x14068a710], ebx
jne 0x14015800d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x14068a700], rax
jmp 0x140158014
mov rax, qword [0x14068a700]
test rax, rax
je 0x14015806d
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [0x14068a708], 0
jne 0x140158045
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x14068a708], rax
xor edx, edx
lea ecx, [rdx + 0xc]
call fcn.14039d3f0
call fcn.140315020
mov ebx, eax
test eax, eax
jne 0x140158060
inc dword [0x14068a6f8]
mov rcx, qword [0x14068a700]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14015b110
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
test edx, 0xc0000
mov r12, r9
mov r13d, r8d
lea r9, [rsp + 0x78]
setne r10b
mov esi, edx
bt edx, 0x18
mov rdi, rcx
mov r15d, 7
setb al
test al, r10b
mov eax, 1
cmove r15d, eax
xor r8d, r8d
mov edx, r15d
mov ecx, r15d
call fcn.14015ada0
test eax, eax
je 0x14015b172
mov rax, 0xffffffffffffffff
jmp 0x14015b261
mov qword [rsp + 0x70], rbp
mov r9, r12
mov ebp, dword [rsp + 0x98]
mov r8d, r13d
mov qword [rsp + 0x30], 0
mov edx, esi
mov qword [rsp + 0x80], r14
mov rcx, rdi
mov r14d, dword [rsp + 0x90]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14015b224
mov edx, esi
mov qword [rsp + 0x30], 0
btr edx, 0x18
mov dword [rsp + 0x28], ebp
mov r9, r12
mov dword [rsp + 0x20], r14d
mov r8d, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14015b210
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14015b224
mov r9d, esi
mov dword [rsp + 0x20], eax
mov r8, rdi
lea rdx, str.Unable_to_open_file:___s___dwDesiredAccess:__u__winError:__d_
lea ecx, [rbx + 4]
call fcn.140157a90
jmp 0x14015b224
mov r8, rdi
lea rdx, str.Unable_to_open_file_with_the_ACCESS_SYSTEM_SECURITY_flag:___s_
mov ecx, 2
call fcn.140157a90
mov ecx, dword [rsp + 0x78]
xor r9d, r9d
mov edx, r15d
lea r8d, [r9 + 1]
call fcn.14015ada0
mov r14, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
test eax, eax
je 0x14015b25e
cmp rbx, 0xffffffffffffffff
je 0x14015b25e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, 0xffffffffffffffff
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140162460
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x20], 8
xor r8d, r8d
lea edx, [r8 + 0x40]
call fcn.1401831c0
nop
lea rax, vtable.Botan::MD5.0
mov qword [rbx], rax
xor edi, edi
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], rdi
lea edx, [rdi + 4]
lea ecx, [rdi + 0x10]
call fcn.140371340
test rax, rax
je 0x1401625b0
mov qword [rbx + 0x38], rax
add rax, 0x40
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x38]
lea rdx, [rax + 0x40]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov qword [rbx + 0x40], rdx
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov edx, 4
mov ecx, edx
call fcn.140371340
test rax, rax
je 0x140162594
mov qword [rbx + 0x50], rax
add rax, 0x10
mov qword [rbx + 0x60], rax
mov rax, qword [rbx + 0x50]
lea rcx, [rax + 0x10]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rbx + 0x58], rcx
mov rcx, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x14016252d
xor edx, edx
call fcn.14035c350
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x10], rdi
mov rcx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x40]
sub rax, rcx
sar rax, 2
lea r8, [rax*4]
test r8, r8
je 0x140162558
xor edx, edx
call fcn.14035c350
mov rax, qword [rbx + 0x50]
mov dword [rax], 0x67452301
mov rcx, qword [rbx + 0x50]
mov dword [rcx + 4], 0xefcdab89
mov rcx, qword [rbx + 0x50]
mov dword [rcx + 8], 0x98badcfe
mov rcx, qword [rbx + 0x50]
mov dword [rcx + 0xc], 0x10325476
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
lea rcx, [rsp + 0x50]
call fcn.140160250
lea rdx, [0x140669ad8]
lea rcx, [rsp + 0x50]
call fcn.14035c4f0
nop
lea rcx, [rsp + 0x38]
call fcn.140160250
lea rdx, [0x140669ad8]
lea rcx, [rsp + 0x38]
call fcn.14035c4f0
int3
Function at 0x140162890
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x20], 8
mov r8b, 1
mov edx, 0x40
call fcn.1401831c0
nop
lea rax, vtable.Botan::SHA_160.0
mov qword [rbx], rax
xor edi, edi
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], rdi
lea edx, [rdi + 4]
lea ecx, [rdi + 5]
call fcn.140371340
test rax, rax
je 0x140162991
mov qword [rbx + 0x38], rax
add rax, 0x14
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x38]
lea rcx, [rax + 0x14]
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov rcx, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x140162922
call fcn.14035c350
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x10], rdi
mov rcx, qword [rbx + 0x50]
mov rax, qword [rbx + 0x58]
sub rax, rcx
sar rax, 2
lea r8, [rax*4]
test r8, r8
je 0x14016294d
xor edx, edx
call fcn.14035c350
mov rax, qword [rbx + 0x38]
mov dword [rax], 0x67452301
mov rax, qword [rbx + 0x38]
mov dword [rax + 4], 0xefcdab89
mov rcx, qword [rbx + 0x38]
mov dword [rcx + 8], 0x98badcfe
mov rcx, qword [rbx + 0x38]
mov dword [rcx + 0xc], 0x10325476
mov rcx, qword [rbx + 0x38]
mov dword [rcx + 0x10], 0xc3d2e1f0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
lea rcx, [rsp + 0x38]
call fcn.140160250
lea rdx, [0x140669ad8]
lea rcx, [rsp + 0x38]
call fcn.14035c4f0
int3

Function at 0x140162a40
Capabilities:
Hash data using sha224

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x20], 8
mov r8b, 1
mov edx, 0x40
call fcn.1401831c0
nop
lea rax, vtable.Botan::SHA_224.0
mov qword [rbx], rax
xor edi, edi
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], rdi
lea edx, [rdi + 4]
lea ecx, [rdi + 8]
call fcn.140371340
test rax, rax
je 0x140162b34
mov qword [rbx + 0x38], rax
add rax, 0x20
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x38]
lea rcx, [rax + 0x20]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rbx + 0x40], rcx
mov rcx, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x140162ac7
xor edx, edx
call fcn.14035c350
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx + 0x38]
mov dword [rax], 0xc1059ed8
mov rax, qword [rbx + 0x38]
mov dword [rax + 4], 0x367cd507
mov rax, qword [rbx + 0x38]
mov dword [rax + 8], 0x3070dd17
mov rax, qword [rbx + 0x38]
mov dword [rax + 0xc], 0xf70e5939
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x10], 0xffc00b31
mov rcx, qword [rbx + 0x38]
mov dword [rcx + 0x14], 0x68581511
mov rcx, qword [rbx + 0x38]
mov dword [rcx + 0x18], 0x64f98fa7
mov rcx, qword [rbx + 0x38]
mov dword [rcx + 0x1c], 0xbefa4fa4
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
lea rcx, [rsp + 0x38]
call fcn.140160250
lea rdx, [0x140669ad8]
lea rcx, [rsp + 0x38]
call fcn.14035c4f0
int3