joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021f00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rsi, r9
mov ebx, r8d
mov qword [r11 - 0x28], rax
mov rbp, rdx
mov qword [r11 - 0x20], rax
mov rdi, rcx
mov qword [r11 - 0x18], rax
lea edx, [rax + 1]
mov qword [r11 - 0x10], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14002200f
cmp dword [rsp + 0x88], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8d, ebx
mov rdx, rbp
mov rcx, rdi
je 0x140021f79
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140021f7f
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
jne 0x140022002
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140022002
mov edx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140021fec
cmp eax, 0x102
jne 0x140022002
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CancelIo]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebx, eax
test eax, eax
jne 0x140022002
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e3
jne 0x140022002
mov ecx, 0x102
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140022002
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140022610
Capabilities:
Get user security identifier

Disassembly:
push rbx
sub rsp, 0x860
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
mov dword [rsp + 0x44], 0x80
mov ecx, 0x80
mov dword [rsp + 0x40], 0x400
call fcn.140020af0
lea rcx, [rsp + 0x48]
mov qword [rbx], rax
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x44]
lea rcx, [rsp + 0x40]
mov r8, rax
mov qword [rsp + 0x28], rcx
lea rdx, str.__vmware__
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1400226a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.W32Util_GetVMwareGroupSid
lea rcx, str._s:_LookupAccountNameW:__d_n
call fcn.14001bf60
jmp 0x1400226c3
cmp dword [rsp + 0x48], 4
je 0x1400226d7
lea r8, str.VMware_User_Group
lea rdx, str.W32Util_GetVMwareGroupSid
lea rcx, str._s:_Bad_account_type_for__S_group_n
call fcn.14001bf60
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
mov qword [rbx], 0
jmp 0x1400226d9
mov al, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14006a480
add rsp, 0x860
pop rbx
ret
Function at 0x1400247e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
lea rcx, str.kernel32
call fcn.140021130
lea rdx, str.IsWow64Process
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNativeSystemInfo
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rdi, rdi
je 0x14002485b
test rax, rax
je 0x14002485b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rax, rdi
call qword [case.0x140007e54.0]
test eax, eax
je 0x14002485b
cmp dword [rsp + 0x60], 0
je 0x14002485b
lea rcx, [rsp + 0x20]
mov rax, rbx
call qword [case.0x140007e54.0]
jmp 0x140024866
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x20]
cmp cx, 9
jne 0x140024881
mov eax, 0x40
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
test cx, cx
mov eax, 0xffffffff
mov edx, 0x20
cmove eax, edx
add rsp, 0x50
pop rdi
ret

Function at 0x140024a50
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebp, edx
mov ebx, r9d
mov edx, 1
mov esi, r8d
call fcn.140042350
mov rcx, qword [rsp + 0x88]
mov r9d, ebx
mov qword [rsp + 0x38], rcx
mov r8d, esi
mov ecx, dword [rsp + 0x80]
mov edx, ebp
mov dword [rsp + 0x30], ecx
mov rdi, rax
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140024b70
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea r8, [rsp + 0x38]
xor edx, edx
mov dword [rsp + 0x38], ebx
mov edi, ebx
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140024ba7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140024be6
mov ecx, dword [rsp + 0x38]
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140024be6
lea r8, [rsp + 0x38]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140024be6
mov rdx, 0xffffffffffffffff
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.140042490
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140024c10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
xor edx, edx
xor ecx, ecx
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
je 0x140024c62
mov ecx, esi
add rcx, rcx
call fcn.140020af0
mov rdx, rax
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140024c62
lea rdx, [rdi - 1]
mov rcx, rbx
lea r8d, [rdi + 1]
call fcn.140042490
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140024c80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov r12d, ecx
mov edx, 0x208
xor ecx, ecx
xor edi, edi
mov r14d, 0x104
call fcn.140020b20
mov rdx, rax
mov ecx, r14d
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rbx, [rdi - 1]
mov esi, eax
test eax, eax
je 0x140024d0d
nop dword [rax]
mov eax, esi
mov rcx, rbp
cmp rax, r14
jb 0x140024cfc
lea rdx, [rax + rax]
mov r14d, eax
call fcn.140020b20
mov rdx, rax
mov ecx, esi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test eax, eax
jne 0x140024cd0
jmp 0x140024d0d
mov r8d, 1
mov rdx, rbx
call fcn.140042490
mov rdi, rax
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rdi, rdi
jne 0x140024d1f
xor eax, eax
jmp 0x140024d6e
test r15, r15
je 0x140024d50
test r12d, r12d
je 0x140024d50
mov r8, r12
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov rdx, rdi
mov rcx, r15
call fcn.1400420c0
test al, al
je 0x140024d85
jmp 0x140024d61
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140024d50
inc rbx
mov qword [rsp + 0x70], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r8d, 0x649
lea rdx, str.boralibmiscwin32u.c
lea rcx, str.VERIFY__s:_d_n
call fcn.14002b900
int3
Function at 0x140024da0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov dword [rsp + 0x70], 0x101
mov r15, rcx
mov edx, 0x202
xor ecx, ecx
xor edi, edi
call fcn.140020b20
lea rdx, [rsp + 0x70]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ebp, [rdi + 1]
lea rbx, [rdi - 1]
test eax, eax
jne 0x140024e17
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140024e28
mov edx, dword [rsp + 0x70]
mov rcx, rsi
add rdx, rdx
call fcn.140020b20
lea rdx, [rsp + 0x70]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140024de8
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call fcn.140042490
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rdi, rdi
jne 0x140024e49
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test r15, r15
je 0x140024e80
mov eax, dword [r14]
test eax, eax
je 0x140024e80
mov r8d, eax
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov rdx, rdi
mov rcx, r15
call fcn.1400420c0
test al, al
je 0x140024eb7
mov eax, dword [rsp + 0x78]
inc eax
mov dword [r14], eax
jmp 0x140024e9b
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140024e80
inc ebx
mov ecx, 0x7a
mov dword [r14], ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebp, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x60]
mov eax, ebp
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r8d, 0x7cc
lea rdx, str.boralibmiscwin32u.c
lea rcx, str.VERIFY__s:_d_n
call fcn.14002b900
int3

Function at 0x140024ff0
Capabilities:
Get common file path

Disassembly:
push rbx
push rdi
sub rsp, 0x258
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, qword [rsp + 0x290]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rdi], 0
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test eax, eax
js 0x14002504b
mov rdx, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 2]
call fcn.140042490
mov qword [rdi], rax
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006a480
add rsp, 0x258
pop rdi
pop rbx
ret
Function at 0x140025400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
xor ebx, ebx
mov edx, dword [rcx + 8]
mov rsi, rcx
test edx, edx
je 0x140025469
sub edx, 1
je 0x14002543d
cmp edx, 1
jne 0x1400254b9
mov rax, rdi
shr rax, 0x20
xor eax, edi
imul ebx, eax, 0xbc8f
jmp 0x140025480
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
test eax, eax
je 0x140025480
nop word [rax + rax]
movzx ecx, byte [rdi + 1]
lea rdi, [rdi + 1]
xor ebx, eax
rol ebx, 5
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
test eax, eax
jne 0x140025450
jmp 0x140025480
movzx eax, byte [rdi]
test eax, eax
je 0x140025480
xor ebx, eax
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
rol ebx, 5
test eax, eax
jne 0x140025470
mov r8d, dword [rsi + 4]
mov edx, 1
mov ecx, r8d
shl edx, cl
dec edx
cmp ebx, edx
jbe 0x1400254a7
mov eax, ebx
mov ecx, r8d
shr eax, cl
mov ecx, edx
and ecx, ebx
mov ebx, eax
xor ebx, ecx
cmp ebx, edx
ja 0x140025494
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, 0x8e
lea rdx, str.boralibmischashTable.c
lea rcx, str.NOT_REACHED__s:_d_n
call fcn.14002b900
int3

Function at 0x140025be0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, 1
call fcn.140042350
mov edx, 1
mov rcx, rbx
mov r14, rax
call fcn.140042350
mov r8d, 4
lea rdx, [0x140083fb0]
mov rcx, r14
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
mov rbp, 0xffffffffffffffff
test eax, eax
je 0x140025c6c
mov rax, rbp
nop
inc rax
cmp word [r14 + rax*2], 0
jne 0x140025c40
cmp rax, 0x104
jb 0x140025c6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0xce
mov dword [rax], 0x26
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140025cb0
mov r8d, 4
lea rdx, [0x140083fb0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140025ca2
mov rax, rbp
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140025c90
cmp rax, 0x104
jae 0x140025c53
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r14
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rsi
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov dword [rax], edi
mov eax, ebp
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140026390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov ebx, ecx
mov ecx, WSAGetLastError
movd xmm6, ebx
pshufd xmm6, xmm6, 0
call fcn.140020af0
mov r8, rax
mov dword [rbp - 0x39], 0x95f24dab
add rax, 0x60
mov dword [rbp - 0x35], 0xb685215
xor edx, edx
mov dword [rbp - 0x31], 0xe76ccae7
lea rcx, [rbp + 0x27]
mov dword [rbp - 0x2d], 0xaf3ec239
mov dword [rbp - 0x29], 0x715fad23
mov dword [rbp - 0x25], 0x24a590ad
mov dword [rbp - 0x21], 0x69e4b5ef
mov dword [rbp - 0x1d], 0xbf456141
mov dword [rbp - 0x19], 0x96bc1b7b
mov dword [rbp - 0x15], 0xa7bdf825
mov dword [rbp - 0x11], 0xc1de75b7
mov dword [rbp - 0xd], 0x8858a9c9
mov dword [rbp - 9], 0x2da87693
mov dword [rbp - 5], 0xb657f9dd
mov dword [rbp - 1], 0xffdc8a9f
mov dword [rbp + 3], 0x8121da71
mov dword [rbp + 7], 0x8b823ecb
mov dword [rbp + 0xb], 0x885d05f5
mov dword [rbp + 0xf], 0x4e20cd47
mov dword [rbp + 0x13], 0x5a9ad5d9
mov dword [rbp + 0x17], 0x512c0c03
mov dword [rbp + 0x1b], 0xea857ccd
mov dword [rbp + 0x1f], 0x4cc1d30f
mov dword [rbp + 0x23], 0x8891a8a1
mov dword [rbp + 0x27], 0xa6b7aadb
cmp r8, rcx
ja 0x140026497
lea rcx, [rbp - 0x39]
cmp rax, rcx
jae 0x1400264d3
movdqa xmm0, xmm6
movdqa xmm1, xmm6
pxor xmm0, xmmword [rbp - 0x39]
mov edx, reloc.WS2_32.dll_recv
pxor xmm1, xmmword [rbp - 0x29]
movdqu xmmword [r8], xmm0
movdqa xmm0, xmm6
pxor xmm6, xmmword [rbp - 9]
pxor xmm0, xmmword [rbp - 0x19]
movdqu xmmword [r8 + 0x10], xmm1
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmmword [r8 + 0x30], xmm6
mov eax, edx
lea r9, [rbp - 0x39]
sub r9, r8
mov ecx, 0x19
sub ecx, edx
mov edx, ecx
lea rax, [r8 + rax*4]
nop dword [rax]
mov ecx, dword [r9 + rax]
lea rax, [rax + 4]
xor ecx, ebx
mov dword [rax - 4], ecx
sub rdx, 1
jne 0x1400264f0
mov dword [r8 + 0x64], 0x18
mov rax, r8
mov dword [r8 + 0x68], 6
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14006a480
mov rbx, qword [rsp + 0xc0]
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbp
ret
Function at 0x140026540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov r11, rcx
mov qword [rsp + 0x10], rsi
lea rcx, [rdx + 2]
mov r10, rdx
mov rdi, r8
mov bl, 1
cmp rcx, rdx
jb 0x1400266a2
cmp r9, 1
jb 0x1400266a2
dec r9
movabs rsi, 0xaaaaaaaaaaaaaaab
mov rax, rsi
shr r9, 2
mul rcx
shr rdx, 1
cmp rdx, r9
ja 0x1400266a2
lea r9, [0x1400876f0]
cmp r10, 2
jbe 0x140026630
lea rcx, [r10 - 3]
mov rax, rsi
mul rcx
shr rdx, 1
inc rdx
imul rax, rdx, 0xfffffffffffffffd
add r10, rax
nop dword [rax + rax]
movzx eax, byte [r11]
shr rax, 2
movzx eax, byte [rax + r9]
mov byte [r8], al
movzx ecx, byte [r11]
movzx eax, byte [r11 + 1]
and ecx, 3
shr rax, 4
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + r9]
mov byte [r8 + 1], al
movzx ecx, byte [r11 + 1]
movzx eax, byte [r11 + 2]
and ecx, 0xf
shr rax, 6
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + r9]
mov byte [r8 + 2], al
movzx eax, byte [r11 + 2]
add r11, 3
and eax, 0x3f
movzx eax, byte [rax + r9]
mov byte [r8 + 3], al
add r8, 4
sub rdx, 1
jne 0x1400265c0
mov rax, r10
dec r10
test rax, rax
je 0x14002669c
test r10, r10
je 0x140026647
movzx ecx, byte [r11 + 1]
jmp 0x140026649
xor cl, cl
movzx eax, byte [r11]
shr rax, 2
movzx edx, cl
movzx eax, byte [rax + r9]
mov byte [r8], al
mov eax, edx
movzx ecx, byte [r11]
and ecx, 3
shr rax, 4
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + r9]
mov byte [r8 + 1], al
test r10, r10
je 0x14002668d
and edx, 0xf
shl edx, 2
mov eax, edx
movzx ecx, byte [rdx + r9]
jmp 0x14002668f
mov cl, 0x3d
mov byte [r8 + 2], cl
mov byte [r8 + 3], 0x3d
add r8, 4
mov byte [r8], 0
jmp 0x1400266a4
xor bl, bl
mov rcx, qword [rsp + 0x30]
movzx eax, bl
mov rsi, qword [rsp + 0x10]
test rcx, rcx
je 0x1400266bc
sub r8, rdi
mov qword [rcx], r8
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x1400266d0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140105278]
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
jne 0x140026778
lea ecx, [rbx + 4]
call fcn.140020af0
mov rbx, rax
call fcn.140028420
mov r8, rax
test rax, rax
jne 0x140026728
lea rdx, str.Hostinfo_MachineID
lea rcx, str._s_Hostinfo_HostName_failure__providing_default._n
call fcn.14001dba0
mov dword [rbx], 0
jmp 0x14002675b
movzx ecx, byte [r8]
mov rdx, r8
mov eax, 0x1505
test ecx, ecx
je 0x140026750
nop dword [rax + rax]
imul eax, eax, 0x21
lea rdx, [rdx + 1]
add eax, ecx
movzx ecx, byte [rdx]
test ecx, ecx
jne 0x140026740
mov rcx, r8
mov dword [rbx], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
lock cmpxchg qword [0x140105278], rbx
je 0x140026778
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x140105278]
mov eax, dword [rbx]
mov dword [rsi], eax
mov rcx, qword [0x140105270]
test rcx, rcx
jne 0x140026812
mov ecx, 8
call fcn.140020af0
mov rcx, rax
mov rbx, rax
call fcn.140026830
test eax, eax
je 0x1400267c9
mov ecx, eax
call fcn.140013400
mov r8, rax
lea rdx, str.Hostinfo_MachineID
lea rcx, str._s_ObtainHardwareID_failure___s___providing_default._n
call fcn.14001dba0
mov qword [rbx], 0
xor eax, eax
lock cmpxchg qword [0x140105270], rbx
je 0x1400267fc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140105270]
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx]
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov qword [rdi], rcx
add rsp, 0x20
pop rdi
ret
Function at 0x140026cf0
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x30
mov rcx, qword [0x140105268]
test rcx, rcx
je 0x140026d30
call fcn.140020e80
cmp eax, 0xffffffff
je 0x140026dec
test al, 0x10
je 0x140026e0f
mov rcx, qword [0x140105268]
call fcn.140020b50
mov rbp, rax
test rax, rax
jne 0x140026de3
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x801a
xor ecx, ecx
call fcn.140024ff0
test eax, eax
jns 0x140026d58
xor eax, eax
add rsp, 0x30
pop rbp
ret
mov rcx, qword [rsp + 0x40]
lea r8, str.VMware
mov qword [rsp + 0x48], rbx
lea rdx, [0x140083cd8]
mov qword [rsp + 0x50], rsi
xor r9d, r9d
mov qword [rsp + 0x58], rdi
call fcn.140042b80
mov rcx, qword [rsp + 0x40]
mov rbp, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov rcx, rbp
call fcn.140042350
xor edx, edx
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rsi
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov dword [rax], edi
mov rdi, qword [rsp + 0x58]
mov rax, rbp
add rsp, 0x30
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140105268]
lea rdx, str.W32Util_GetAppDataPath
mov r9d, eax
lea rcx, str._s:_GetFileAttributes___s___failed:__d_n
call fcn.14001bf60
lea rcx, str.Overridden_home_dir_does_not_specify_a_valid_directory._n
call fcn.14002b900
int3
Function at 0x1400271e0
Capabilities:
Check os version

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x108
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x48], rdx
mov r14, r9
mov dword [rsp + 0x40], ecx
mov r12, r8
mov r15, rdx
mov edi, ecx
test r8, r8
je 0x140027360
movzx eax, byte [reloc.WS2_32.dll_accept]
test al, al
jne 0x140027236
mov esi, dword [0x1401052a4]
jmp 0x1400272a2
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x98
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140027270
xor esi, esi
mov dword [0x1401052a4], esi
mov byte [reloc.WS2_32.dll_accept], sil
jmp 0x1400272a2
cmp dword [rsp + 0x54], 5
ja 0x140027290
jne 0x14002728c
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x140027290
cmp word [rsp + 0xe4], 4
jae 0x140027290
xor esi, esi
jmp 0x140027295
mov esi, 8
mov dword [0x1401052a4], esi
mov byte [reloc.WS2_32.dll_accept], 0
mov r13, qword [r14 + 8]
mov ebx, esi
shr ebx, 3
mov edx, 2
mov rcx, r14
and bl, 1
call fcn.1400213d0
test al, al
je 0x1400273ba
mov ebp, dword [rsp + 0x40]
nop word [rax + rax]
mov rcx, qword [r14 + 0x10]
mov r9d, r12d
mov rax, qword [r14]
sub rcx, r13
shr rcx, 1
add rax, r13
mov dword [rsp + 0x28], ecx
mov r8, r15
mov ecx, edi
mov qword [rsp + 0x20], rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
xor eax, eax
mov r15d, eax
test edi, edi
jne 0x140027310
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
xor eax, eax
test bl, bl
jne 0x14002733e
mov r8, qword [r14]
mov r9d, edi
mov ecx, dword [rsp + 0x40]
add r8, r13
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test edi, edi
jle 0x140027386
test bl, bl
jne 0x14002734e
movsxd rcx, ebp
cmp r12, rcx
jne 0x140027389
lea rcx, [rdi*2]
mov rax, rdi
add rcx, r13
mov qword [r14 + 8], rcx
mov al, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14006a480
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
movsxd rcx, ebp
test edi, edi
jle 0x140027396
test bl, bl
jne 0x140027396
cmp r12, rcx
jne 0x1400273ba
cmp r15d, 0x7a
jne 0x1400273ba
lea edx, [r15 - 0x78]
mov rcx, r14
call fcn.1400213d0
test al, al
je 0x1400273ba
mov edi, dword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
jmp 0x1400272d0
xor al, al
jmp 0x140027362