joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006ac20
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r8d
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x48], rbx
or r13, 0xffffffffffffffff
cmp r8d, 0x3fe
jbe 0x18006accd
lea ecx, [rbp + 2]
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.180112448
mov r14, rax
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x18006acb9
cmp eax, ebp
ja 0x18006acb9
mov ecx, eax
mov word [rbx + rcx*2], r12w
lea ecx, [rax + 1]
mov word [rbx + rcx*2], r12w
mov ebp, eax
jmp 0x18006acfc
test r14, r14
je 0x18006acc6
mov rcx, r14
call fcn.18013a400
xor al, al
jmp 0x18006adca
mov rax, rbp
add rax, rax
cmp rax, 0x800
jae 0x18006adc4
mov word [rax + rdx], r12w
lea ecx, [rbp + 1]
add rcx, rcx
cmp rcx, 0x800
jae 0x18006adbe
mov word [rcx + rdx], r12w
mov eax, r12d
mov edi, r12d
test ebp, ebp
je 0x18006adad
mov rsi, r14
nop dword [rax]
cmp word [rsi], 0
jne 0x18006ad9f
cmp eax, edi
je 0x18006ad9f
lea rdx, [r14 + rax*2]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
cmp word [rdx], 0
jne 0x18006ad4f
mov r8, r12
jmp 0x18006ad5d
mov r8, r13
inc r8
cmp word [rdx + r8*2], 0
jne 0x18006ad52
lea rcx, [rsp + 0x20]
call fcn.180005920
nop
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.18000c8e0
nop
cmp qword [rsp + 0x38], 8
jb 0x18006ad88
mov rcx, qword [rsp + 0x20]
call fcn.180139b7c
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
lea eax, [rdi + 1]
inc edi
add rsi, 2
cmp edi, ebp
jb 0x18006ad10
test rbx, rbx
je 0x18006adba
mov rcx, rbx
call fcn.18013a400
mov al, 1
jmp 0x18006adca
call fcn.18013a820
int3
call fcn.18013a820
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006d240
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, r9
mov edi, r8d
test rax, rax
je 0x18006d292
mov rax, qword [rax]
test rax, rax
je 0x18006d292
test rdx, rdx
je 0x18006d292
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x18006d292
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18006d292
cmp edi, dword [rbx]
sete al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18006f690
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rdx]
test rcx, rcx
je 0x18006f87a
cmp qword [rcx], 0xffffffffffffffff
je 0x18006f87a
mov qword [r11 - 0x50], 0xffffffffffff8000
mov ebx, 2
mov r9d, ebx
lea r8, [r11 - 0x4c]
mov edx, 0xffff8000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
cmp eax, 0xffffffff
jne 0x18006f715
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18006f87a
mov ecx, 0x10000
call fcn.180112448
mov r15, rax
mov qword [rsp + 0x50], rax
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call fcn.180140c00
xor edx, edx
mov dword [rsp + 0x40], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x18006f858
test r15, r15
je 0x18006f858
cmp qword [rcx], 0xffffffffffffffff
je 0x18006f858
mov dword [rsp + 0x40], edx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x40]
mov r8d, 0x8000
mov rdx, r15
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18006f858
xor ecx, ecx
mov ebp, ecx
mov esi, ecx
mov r14d, 0x8000
lea r12, [r15 + 0x8000]
nop word [rax + rax]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x18006f869
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x30], ecx
mov edx, esi
add rdx, r12
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rcx, r13
call fcn.18007d8c0
test al, al
je 0x18006f84d
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x18006f80c
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x18006f7f9
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x18006f869
inc ebp
mov eax, dword [rsp + 0x30]
jmp 0x18006f816
add esi, eax
cmp esi, 0x8000
je 0x18006f827
cmp ebp, 0xf
ja 0x18006f846
sub r14d, eax
je 0x18006f827
xor ecx, ecx
jmp 0x18006f7a0
mov r8d, 0x8000
mov rdx, r12
mov rcx, r15
call fcn.1801465f0
xor edx, edx
mov ebx, edx
test eax, eax
setne bl
add ebx, 4
jmp 0x18006f869
mov ebx, 3
jmp 0x18006f869
mov eax, dword [rsp + 0x34]
mov ebx, 3
jmp 0x18006f863
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 1
mov dword [rdi + 0x100], eax
test r15, r15
je 0x18006f876
mov rcx, r15
call fcn.18013a400
mov eax, ebx
jmp 0x18006f87f
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800765b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x60
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rbx
xor esi, esi
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], r15
mov ebp, esi
mov r15, rcx
mov r14, r9
mov ebx, r8d
mov rdi, rdx
jne 0x1800765f2
xor al, al
jmp 0x18007664c
mov qword [rsp + 0x48], r12
mov r12d, 0x100000
nop dword [rax]
mov rcx, qword [r15 + 0x20]
mov r8d, ebx
cmp ebx, r12d
lea r9, [rsp + 0x30]
mov rdx, rdi
cmova r8d, r12d
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
test eax, eax
setne al
add ebp, ecx
test al, al
je 0x180076645
test ecx, ecx
je 0x180076641
add rdi, rcx
mov eax, ecx
sub ebx, ecx
jne 0x180076600
mov al, 1
jmp 0x180076647
xor al, al
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test r14, r14
je 0x180076663
mov dword [r14], ebp
test al, al
sete sil
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180139310
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
Function at 0x180079340
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x18], rdx
lea rdx, [r11 - 0x38]
call fcn.1800791a0
nop
xor edi, edi
cmp qword [rsp + 0x60], rdi
je 0x1800793fc
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800793fc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
lea r8d, [rdi + 8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x68], 8
jb 0x18007940e
mov rcx, qword [rsp + 0x50]
call fcn.180139b7c
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x180079440
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor edi, edi
mov qword [r11 - 0x40], rdi
lea rdx, [r11 - 0x30]
call fcn.1800791a0
nop
cmp qword [rsp + 0x68], rdi
je 0x18007950f
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18007950f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8d, [rdi + 8]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x48]
test eax, eax
cmove rcx, rdi
mov qword [rsp + 0x48], rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
cmp qword [rsp + 0x70], 8
jb 0x180079526
mov rcx, qword [rsp + 0x58]
call fcn.180139b7c
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x18007a940
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov esi, r8d
mov r15, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], 0
mov byte [rcx], 0
mov dword [rsp + 0x20], 1
xor ebx, ebx
test r8d, r8d
je 0x18007ab85
xor ecx, ecx
nop word [rax + rax]
dec esi
movzx eax, byte [r15]
mov byte [rsp + rcx + 0x80], al
inc ebx
inc rcx
lea r15, [r15 + 1]
movzx r12d, byte [rsp + 0x82]
movzx ebp, byte [rsp + 0x81]
movzx r14d, byte [rsp + 0x80]
cmp rcx, 3
jne 0x18007aa6e
movzx eax, r14b
shr al, 2
mov byte [rsp + 0x88], al
movzx ecx, r14b
and cl, 3
shl cl, 4
movzx eax, bpl
shr al, 4
add cl, al
mov byte [rsp + 0x89], cl
movzx ecx, bpl
and cl, 0xf
shl cl, 2
movzx eax, r12b
shr al, 6
add cl, al
mov byte [rsp + 0x8a], cl
movzx eax, r12b
and al, 0x3f
mov byte [rsp + 0x8b], al
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [0x180349d40]
cmp qword [0x180349d58], 0x10
cmovae rcx, qword [0x180349d40]
movzx eax, byte [rsp + rbx + 0x88]
movzx r8d, byte [rax + rcx]
mov edx, 1
mov rcx, rdi
call fcn.180038800
inc rbx
cmp rbx, 4
jl 0x18007aa30
xor ebx, ebx
xor ecx, ecx
test esi, esi
jne 0x18007a9a0
test ebx, ebx
je 0x18007ab85
movsxd rax, ebx
cmp rax, 3
jge 0x18007aabc
jae 0x18007aab6
mov byte [rsp + rax + 0x80], 0
inc rax
cmp rax, 3
jl 0x18007aa87
movzx r12d, byte [rsp + 0x82]
movzx ebp, byte [rsp + 0x81]
movzx r14d, byte [rsp + 0x80]
jmp 0x18007aabc
call fcn.18013a820
int3
movzx eax, r14b
shr al, 2
mov byte [rsp + 0x88], al
and r14b, 3
shl r14b, 4
movzx eax, bpl
shr al, 4
add r14b, al
mov byte [rsp + 0x89], r14b
and bpl, 0xf
shl bpl, 2
movzx eax, r12b
shr al, 6
add bpl, al
mov byte [rsp + 0x8a], bpl
and r12b, 0x3f
mov byte [rsp + 0x8b], r12b
lea eax, [rbx + 1]
test eax, eax
jle 0x18007ab55
lea rsi, [rsp + 0x88]
mov ebp, eax
nop dword [rax + rax]
lea rcx, [0x180349d40]
cmp qword [0x180349d58], 0x10
cmovae rcx, qword [0x180349d40]
movzx eax, byte [rsi]
movzx r8d, byte [rax + rcx]
mov edx, 1
mov rcx, rdi
call fcn.180038800
lea rsi, [rsi + 1]
dec rbp
jne 0x18007ab20
cmp ebx, 3
jge 0x18007ab85
mov eax, 3
sub eax, ebx
mov ebx, eax
nop dword [rax]
nop word [rax + rax]
mov r8b, 0x3d
mov edx, 1
mov rcx, rdi
call fcn.180038800
dec rbx
jne 0x18007ab70
mov rax, rdi
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18007e5c0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.180140c00
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18007e64b
cmp dword [rsp + 0x44], 6
jb 0x18007e64b
lea rax, [rsp + 0x34]
lea r8, str.Progid
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov r9, rbx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x34], 0x207
mov qword [rsp + 0x20], rax
call fcn.18007e2c0
test al, al
je 0x18007e64b
cmp word [rbx], 0
je 0x18007e64b
mov al, 1
jmp 0x18007e6b7
lea rax, [rsp + 0x30]
lea rdx, str.http_shellopencommand
mov r9, rbx
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x30], 0x207
mov qword [rsp + 0x20], rax
call fcn.18007e2c0
test al, al
je 0x18007e680
cmp word [rbx], 0
jne 0x18007e647
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareClasses.html
mov r9, rbx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x30], 0x207
mov qword [rsp + 0x20], rax
call fcn.18007e2c0
test al, al
je 0x18007e6b5
cmp word [rbx], 0
jne 0x18007e647
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180139310
add rsp, 0x170
pop rbx
ret
Function at 0x18007f4b0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov rbx, rcx
xor edx, edx
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x20], 0x114
call fcn.180140c00
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x18007f530
cmp dword [rsp + 0x24], 6
jb 0x18007f530
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180139310
add rsp, 0x150
pop rbx
ret
Function at 0x18007f560
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rcx
xor r14d, r14d
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r14
mov word [rbp - 0x48], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.wintrust.dll
lea rcx, [rbp - 0x48]
call fcn.180005920
nop
mov eax, dword [0x18034db90]
test al, 1
jne 0x18007f5e5
or eax, 1
mov dword [0x18034db90], eax
xor eax, eax
mov qword [0x18034db88], rax
call fcn.180064890
lea rcx, [0x180197b50]
call fcn.180139aec
nop
lea rdx, [rbp - 0x48]
lea rcx, [0x18034db88]
call fcn.180064a80
mov rbx, rax
cmp qword [rbp - 0x30], 8
jb 0x18007f608
mov rcx, qword [rbp - 0x48]
call fcn.180139b7c
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r14
mov word [rbp - 0x48], r14w
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
mov r8d, 0xb
lea rdx, str.crypt32.dll
lea rcx, [rbp - 0x28]
call fcn.180005920
nop
mov eax, dword [0x18034db90]
test al, 1
jne 0x18007f677
or eax, 1
mov dword [0x18034db90], eax
xor eax, eax
mov qword [0x18034db88], rax
call fcn.180064890
lea rcx, [0x180197b50]
call fcn.180139aec
nop
lea rdx, [rbp - 0x28]
lea rcx, [0x18034db88]
call fcn.180064a80
mov rdi, rax
cmp qword [rbp - 0x10], 8
jb 0x18007f69a
mov rcx, qword [rbp - 0x28]
call fcn.180139b7c
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
test rbx, rbx
je 0x18007f785
test rdi, rdi
je 0x18007f785
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180082700
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov rbx, rdx
mov r8, rdx
lea rdx, [rbp - 0x30]
call fcn.180082ec0
nop
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
xor r14d, r14d
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], ax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1800500b0
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x38], r14b
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x180082788
xor dil, dil
jmp 0x1800827a4
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x18008279d
xor dil, dil
jmp 0x1800827a4
mov byte [rbp - 0x48], 1
mov dil, 1
mov byte [rbp - 0x38], dil
mov byte [rbp - 0x60], 0
lea r9, [rbp - 0x60]
mov r8, rsi
mov rdx, rbx
call fcn.180082860
test al, al
jne 0x1800827d8
cmp byte [rbp - 0x60], al
je 0x1800827d8
cmp qword [rbx + 0x18], 8
jb 0x1800827ce
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test dil, dil
je 0x1800827f0
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1800827ec
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x40], r14
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180082807
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], 0
cmp qword [rbp - 0x18], 8
jb 0x18008281d
mov rcx, qword [rbp - 0x30]
call fcn.180139b7c
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r14
mov word [rbp - 0x30], r14w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180139310
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180084f80
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
jne 0x180084fb6
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180139310
add rsp, 0x30
pop rdi
ret
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x180084fe3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180084fe3
xor al, al
jmp 0x180084ff6
mov ecx, dword [rsp + 0x20]
mov rax, rbx
mov al, 1
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180139310
add rsp, 0x30
pop rdi
ret

Function at 0x180089d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180089e7a
mov dword [rbp - 0x30], 0x2d2d4352
mov dword [rbp - 0x2c], 0xf7babac9
mov dword [rbp - 0x28], 0x61726f43
mov dword [rbp - 0x24], 0x776f7242
mov dword [rbp - 0x20], 0x2d756e45
mov dword [rbp - 0x1c], 0x61746144
mov dword [rbp - 0x18], 0x37313630
mov dword [rbp - 0x14], 0x30313032
mov eax, 1
movd xmm2, eax
movdqu xmm1, xmmword [rbp - 0x30]
pslld xmm1, xmm2
xorps xmm0, xmm0
paddd xmm0, xmmword [0x1801b3460]
paddd xmm0, xmm1
movdqu xmmword [rbp - 0x30], xmm0
movdqu xmm1, xmmword [rbp - 0x20]
pslld xmm1, xmm2
movdqa xmm0, xmmword [0x1801b3470]
paddd xmm0, xmmword [0x1801b3460]
paddd xmm0, xmm1
movdqu xmmword [rbp - 0x20], xmm0
mov rax, qword [rdx]
mov qword [rdx + 8], rax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
test rdx, rdx
je 0x180089e59
lea r9, [rbp - 0x48]
mov r8d, eax
lea rcx, [rbp - 0x30]
call fcn.18009f8e0
test al, al
je 0x180089e59
mov rbx, qword [rbp - 0x48]
cmp rbx, qword [rbp - 0x40]
je 0x180089e5d
mov rdx, rdi
mov ecx, 0xa
call fcn.18009de00
mov ecx, dword [rbp - 0x40]
sub ecx, ebx
mov rdx, rdi
call fcn.18009de00
mov r9, qword [rbp - 0x40]
mov r8, rbx
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.18008a160
jmp 0x180089e5d
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x180089e7a
mov rcx, rbx
call fcn.180139b7c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], 0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180139310
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret