joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079360
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14007938f
call fcn.140125100
cmp qword [rsi], r14
je 0x1400793be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400793fa
cmp r15, 2
jb 0x1400793b6
mov qword [rsi], r14
call fcn.140125100
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.140125d60
lea rcx, [rsi + 0x20]
call fcn.140135450
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140079410
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140125100
mov rcx, qword [rsi]
call fcn.140113440
mov qword [rsi], 0
jmp 0x1400793a8
call fcn.140125100
mov rcx, qword [rdi]
call fcn.140113440
mov qword [rdi], 0
jmp 0x1400793ea

Function at 0x140079cc0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140392508]
test rdi, rdi
jne 0x140079d73
mov ecx, 0x50
call fcn.14016b6ec
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.14016b6ec
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x140079d95
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x140392508], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140079d95
mov rcx, rax
call fcn.14018deb4
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140079da0
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14016cc60
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1400841a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x1400841ba
test r8d, r8d
jne 0x1400841b3
call fcn.140142500
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.14012bb40

Function at 0x140085410
Capabilities:
Get session user name

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rdi, [rsp + 0x50]
mov r8d, 0x200
mov rcx, rdi
mov dl, 0xaa
call fcn.1401a5660
lea rbx, [rsp + 0x4c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
setne al
mov ecx, dword [rbx]
test rcx, rcx
setne bl
and bl, al
je 0x140085634
movabs r14, 0x7fffffffffffffff
movsx r8, byte [rsi + 0x17]
test r8, r8
js 0x140085611
mov rdx, rsi
cmp ecx, 0xa
jbe 0x140085510
mov eax, r8d
mov rdx, r8
cmp rdx, rcx
cmova rcx, rdx
mov r9d, 0xa
mov edx, 0xa
cmp rcx, 0xb
jb 0x1400854ce
mov rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, 4
or rcx, 3
cmp rcx, 0xb
cmove rcx, rdx
mov rdx, rcx
test r8b, r8b
js 0x140085649
cmp rdx, r9
je 0x1400854e7
mov rcx, rsi
call fcn.140040270
mov al, byte [rsi + 0x17]
mov rdx, rsi
test al, al
jns 0x140085510
mov rax, qword [rsi + 0x10]
mov rcx, rax
and rcx, r14
cmp rcx, 1
je 0x14008565f
shr rax, 0x38
mov rdx, rsi
test al, al
jns 0x140085510
mov rdx, qword [rsi]
mov word [rdx], 0x2e
cmp byte [rsi + 0x17], 0
jns 0x14008563e
mov qword [rsi + 8], 1
mov word [rdx + 2], 0
mov r12d, dword [rsp + 0x4c]
dec r12d
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x1400855c8
and r14, qword [rsi + 0x10]
dec r14
mov r15, qword [rsi + 8]
mov rcx, r14
sub rcx, r15
cmp rcx, r12
jb 0x1400855d6
test r12, r12
je 0x1400855a5
mov r14, rsi
test al, al
jns 0x140085568
mov r14, qword [rsi]
lea rcx, [r14 + r15*2]
lea rax, [rcx + r12*2]
cmp rax, rdi
seta al
cmp rcx, rdi
ja 0x140085583
test al, al
jne 0x140085647
lea r8, [r12 + r12]
lea rdx, [rsp + 0x50]
call fcn.1401a4fc0
add r15, r12
cmp byte [rsi + 0x17], 0
jns 0x140085607
mov qword [rsi + 8], r15
mov word [r14 + r15*2], 0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14016cc60
mov eax, ebx
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14d, 0xa
mov r15, rax
jmp 0x14008554e
mov r8, r12
sub r8, r14
add r8, r15
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], 0
mov rcx, rsi
mov rdx, r14
mov r9, r15
call fcn.140044840
jmp 0x1400855a5
mov eax, r15d
and al, 0x7f
mov byte [rsi + 0x17], al
jmp 0x14008559e
mov rax, qword [rsi + 0x10]
mov rdx, rax
and rdx, r14
dec rdx
shr rax, 0x38
cmp rdx, rcx
jae 0x1400854e7
mov rdx, qword [rsi + 8]
jmp 0x14008549c
call fcn.1401dff40
jmp 0x1400855a5
mov byte [rsi + 0x17], 1
jmp 0x140085527
ud2
mov rax, qword [rsi + 0x10]
mov r9, rax
and r9, r14
dec r9
shr rax, 0x38
jmp 0x1400854d7
mov r9, qword [rsi + 8]
mov r8d, 2
sub r8, rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r15
mov rcx, rsi
xor edx, edx
call fcn.140100c70
mov qword [rsi + 8], r15
mov al, byte [rsi + 0x17]
jmp 0x140085506
Function at 0x14008d9a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rcx], 0
mov qword [rcx + 8], 0
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14008daa1
mov r15, qword [rsp + 0x40]
cmp qword [rsi + 8], r15
je 0x14008da3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14008dae2
lea rax, [r15 + 1]
cmp rax, 2
jb 0x14008da33
mov qword [rsi + 8], r15
call fcn.140125100
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x38]
mov qword [r8], r14
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14008dabd
lea r8, [rsp + 0x48]
mov dword [r8], 1
mov rax, qword [rsp + 0x38]
mov qword [r8 + 4], rax
mov dword [r8 + 0xc], 2
lea rax, [rsp + 0x34]
mov dword [rax], 0xaaaaaaaa
lea rdx, [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14008dabd
mov byte [rsi], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016cc60
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jb 0x14008daa1
call fcn.140125100
mov rcx, qword [rsi + 8]
call fcn.140113440
mov qword [rsi + 8], 0
jmp 0x14008daa1
call fcn.140125100
mov rcx, qword [rsi + 8]
call fcn.140113440
mov qword [rsi + 8], 0
jmp 0x14008da20
Function at 0x140093da0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1403947c8]
mov ecx, dword [0x14038f0a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140093e00
lea rsi, [0x1403947c0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14016cc60
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1403947c8]
call fcn.14016b76c
cmp dword [0x1403947c8], 0xffffffff
jne 0x140093ddc
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1401a5660
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.14016b6ec
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140394830]
mov ecx, dword [0x14038f0a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140093ec0
lea r8, [0x140394800]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140093fc0
mov qword [0x1403947c0], rsi
lea rcx, [0x1403947c8]
call fcn.14016b820
jmp 0x140093ddc
lea rcx, [0x140394830]
call fcn.14016b76c
cmp dword [0x140394830], 0xffffffff
jne 0x140093e91
xorps xmm0, xmm0
movups xmmword [0x140394820], xmm0
movups xmmword [0x140394810], xmm0
movups xmmword [0x140394800], xmm0
lea rcx, [0x140394800]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140394830]
call fcn.14016b820
jmp 0x140093e91

Function at 0x140093f10
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140394830]
mov ecx, dword [0x14038f0a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140093f4b
movzx eax, word [0x140394800]
cmp eax, 9
jne 0x140093f93
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140394830]
call fcn.14016b76c
cmp dword [0x140394830], 0xffffffff
jne 0x140093f35
xorps xmm0, xmm0
movups xmmword [0x140394820], xmm0
movups xmmword [0x140394810], xmm0
movups xmmword [0x140394800], xmm0
lea rcx, [0x140394800]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140394830]
call fcn.14016b820
jmp 0x140093f35
test eax, eax
je 0x140093f46
cmp eax, 6
jne 0x140093fa3
mov eax, 2
jmp 0x140093f46
cmp eax, 0xc
jne 0x140093faf
mov eax, 3
jmp 0x140093f46
mov eax, 4
jmp 0x140093f46
Function at 0x140095130
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov qword [r9], 0
lea rcx, [0x1402ef0a0]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400952d9
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1400952c8
movabs r15, 0x7ffffffffffffff7
mov rcx, rdi
call fcn.14018deb4
cmp rax, r15
ja 0x1400952cf
mov rbx, rax
lea r14, [rsp + 0x28]
cmp rax, 0xa
jbe 0x1400952bc
lea rax, [r15 + 5]
and rax, rbx
add rax, 4
mov r12, rbx
or r12, 3
cmp r12, 0xb
cmove r12, rax
inc r12
js 0x1400952ca
lea rcx, [r12 + r12]
call fcn.14016b6ec
mov rcx, rax
mov qword [rsp + 0x28], rax
lea rax, [r15 + r12]
add rax, 9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r15, [rcx + rbx*2]
cmp rcx, rdi
seta al
cmp r15, rdi
setbe dl
or dl, al
je 0x1400952c8
test rbx, rbx
je 0x140095220
add rbx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.1401a4fc0
mov word [r15], 0
movsx rax, byte [rsp + 0x3f]
test rax, rax
cmovs rax, qword [rsp + 0x30]
cmovs r14, qword [rsp + 0x28]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rax
test rax, rax
js 0x1400952c8
sete al
test r14, r14
setne cl
or cl, al
je 0x1400952c8
lea rdi, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140125dc0
mov rcx, rsi
mov rdx, rdi
call fcn.140077280
mov rcx, rdi
call fcn.140125f00
cmp byte [rsp + 0x3f], 0
jns 0x14009528d
mov rcx, qword [rsp + 0x28]
call fcn.14016b728
mov bl, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14009529f
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14016cc60
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov byte [rsp + 0x3f], bl
mov rcx, r14
jmp 0x1400951f5
ud2
call fcn.1401a65f0
lea rcx, [rsp + 0x28]
call fcn.1401a65b0
mov rcx, rsi
call fcn.14023bce0
mov ebx, eax
jmp 0x14009528f
Function at 0x1400953a0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400953c7
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140095401
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140095420
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14016cc60
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140095500
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14016cc60
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140124de0
test al, al
je 0x1400954eb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.1401dd1d0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400fd720
mov rdi, rax
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x140095483
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
test rax, rax
js 0x1400954f2
sete al
test rsi, rsi
setne cl
or cl, al
je 0x1400954f2
lea rsi, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14011b680
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x1400954c5
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400fd720
cmp byte [rsp + 0x57], 0
jns 0x1400954e1
mov rcx, qword [rsp + 0x40]
call fcn.14016b728
lea rcx, [rsp + 0x58]
call fcn.1401dd240
xor esi, esi
jmp 0x140095404
ud2

Function at 0x140095500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x140095527
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400955cd
mov dil, 1
test al, 0x10
je 0x140095559
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14016cc60
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140124de0
test al, al
je 0x1400955c6
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.1400740b0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400fd720
mov rcx, rax
mov rdx, rsi
call fcn.1401de440
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400fd720
mov rcx, rdi
call fcn.140074680
xor edi, edi
jmp 0x14009553d
mov ecx, 2
call fcn.140124de0
test al, al
je 0x1400955c6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.1401dd1d0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400fd720
mov rcx, rax
mov rdx, rsi
call fcn.1401de440
mov rcx, rdi
call fcn.1401dd240
jmp 0x1400955c6
Function at 0x140096920
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400956c0
mov rax, qword [rsi]
test rax, rax
je 0x140096997
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14009699e
lea rcx, [rsp + 0x28]
call fcn.140096110
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14016cc60
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140096970
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x1400969c2
cmp byte [rbx + 0x27], 0
js 0x1400969b7
lea rcx, [rbx + 0x10]
jmp 0x1400969bb
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x1400969cd
add rbx, 0x70
cmp rbx, r15
je 0x140096970
jmp 0x1400969a5
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x1400969ec
mov rcx, r14
mov rdx, rbx
call fcn.14023d510
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x1400969c2
mov rcx, rdi
mov rdx, rbx
call fcn.14023d3b0
mov r14, rax
jmp 0x1400969e6

Function at 0x140096a00
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400956c0
mov rax, qword [rsi]
test rax, rax
je 0x140096a77
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140096a7e
lea rcx, [rsp + 0x28]
call fcn.140096110
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14016cc60
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140096a50
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x140096aa2
cmp byte [rbx + 0x27], 0
js 0x140096a97
lea rcx, [rbx + 0x10]
jmp 0x140096a9b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x140096aad
add rbx, 0x70
cmp rbx, r15
je 0x140096a50
jmp 0x140096a85
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x140096acc
mov rcx, r14
mov rdx, rbx
call fcn.14023d510
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140096aa2
mov rcx, rdi
mov rdx, rbx
call fcn.14023d3b0
mov r14, rax
jmp 0x140096ac6
Function at 0x140097680
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1402ef0c0]
lea r9, [0x14031f4c0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140097834
mov qword [rsp + 0x60], 0
movsx rax, byte [r14 + 0x17]
test rax, rax
jns 0x1400976f5
mov rax, qword [r14 + 8]
mov r14, qword [r14]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rax
test rax, rax
js 0x140097820
sete al
test r14, r14
setne cl
or cl, al
je 0x140097820
lea r14, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.1400c2320
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [0x14036e598]
mov ebp, eax
mov rcx, r14
call fcn.1400c2370
test ebp, ebp
js 0x140097822
test bl, bl
je 0x1400977ba
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x14009782a
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x140097840
mov byte [rsi], 0
xor eax, eax
mov byte [rsi + 4], al
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14009784f
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140097805
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14036e598]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14016cc60
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
mov dword [rsi], 1
jmp 0x140097830
mov dword [rsi], 2
mov al, 1
jmp 0x1400977d8
mov dword [rsi], 0
mov byte [rsi + 4], 1
jmp 0x1400977e5
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14036e598]
jmp 0x1400977d3
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14036e598]
jmp 0x1400977e5
Function at 0x14009c710
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov r13, qword [rsp + 0xb0]
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xor r14d, r14d
test r13, r13
je 0x14009c780
mov ecx, dword [r13 + 0x2c]
call fcn.140137ff0
test rax, rax
je 0x14009c851
mov r12, rax
xor ecx, ecx
call fcn.140138050
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r14, r12
mov rax, qword [r13 + 0x10]
lea rcx, [0x140256280]
cmp rax, rcx
jne 0x14009c855
xorps xmm0, xmm0
movups xmmword [r14 + 0x5c], xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movaps xmm0, xmmword [0x140323290]
movups xmmword [r14], xmm0
movaps xmm0, xmmword [0x1403232a0]
movups xmmword [r14 + 0x10], xmm0
mov dword [r14 + 0x6c], 0x20
lea r14, [rsp + 0x20]
mov rax, qword [r14]
mov rax, qword [rax + 0x18]
mov rcx, r14
mov rdx, r15
mov r8, rbx
call qword [0x14036e598]
mov rax, qword [r14]
mov rax, qword [rax + 0x20]
mov rcx, r14
mov rdx, rdi
call qword [0x14036e598]
mov rax, qword [r14]
test rsi, rsi
je 0x14009c80a
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x28]
call fcn.140138090
mov r14d, 1
mov rcx, qword [rsp + 0x28]
call fcn.140138050
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x14009c865
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14016cc60
mov eax, r14d
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x14009c822
lea rcx, [rsp + 0x20]
call qword [0x14036e598]
jmp 0x14009c7cf
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
call qword [0x14036e598]
jmp 0x14009c831

Function at 0x14009ca20
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
cmp rax, rdx
je 0x14009ca58
mov rdi, rdx
mov ecx, dword [rdx + 0x2c]
call fcn.140137ff0
test rax, rax
je 0x14009caac
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.140138050
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, rdi
mov rax, qword [rax + 0x10]
lea rcx, [0x140256280]
cmp rax, rcx
jne 0x14009cab0
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140323290]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1403232a0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14009caa4
mov rcx, rsi
call qword [0x14036e598]
jmp 0x14009ca9f