joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a59c0
Capabilities:
Copy file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x1800a59f8
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1800a5a02
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1800a5a16
mov al, 1
jmp 0x1800a5b61
xor sil, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x58], xmm1
xor ebp, ebp
mov word [rsp + 0x48], bp
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1800a6650
movzx ebx, sil
mov ecx, 1
test al, al
cmovne ebx, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x38], xmm1
mov word [rsp + 0x28], bp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1800a6650
test al, al
jne 0x1800a5a83
test bl, bl
je 0x1800a5ab6
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1800a5ab6
mov bl, 1
jmp 0x1800a5ab8
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1800a5afa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a5af5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a5b84
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1800a5b4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a5b46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a5b7e
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18011e4c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.180146ad4
nop
call fcn.180146ad4
nop
int3
Function at 0x1800a5ee0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [rsp + 0x20]
call fcn.18013d3d0
cmp qword [rdi + 0x18], 8
jb 0x1800a5f22
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x1800a5f2c
mov rbx, qword [rbx]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1800a5f7c
xor eax, eax
mov r8, 0xffffffffffffffff
mov word [rsp + 0x22a], ax
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800a5f60
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180003960
mov al, 1
jmp 0x1800a5f7e
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18011e4c0
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800a69d0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x1800a6a0e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1800abd90
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x1800a6a34
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x1800a6a47
cmp qword [rsi + 0x18], 8
jb 0x1800a6a4a
mov rsi, qword [rsi]
jmp 0x1800a6a4a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x1800a6a6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800a6a6e
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800a6a95
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800a6aa8
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.18011e904
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18011e4c0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a6ae0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x1800a6b25
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov word [rdi + 8], r14w
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.1800abeb0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rbp, [rbx + 0x10]
jne 0x1800a6b4c
mov rbp, r14
cmp qword [rsi + 0x10], 0
je 0x1800a6b62
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1800a6b65
mov r8, qword [rsi]
jmp 0x1800a6b65
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
jne 0x1800a6bb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1800a6bb3
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsi + 0x10], 0
je 0x1800a6b9f
cmp qword [rsi + 0x18], 8
jb 0x1800a6ba2
mov rsi, qword [rsi]
jmp 0x1800a6ba2
mov rsi, r14
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
mov rax, qword [rdi]
test rax, rax
je 0x1800a6bda
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800a6bcc
mov byte [rdi + 9], 1
mov rcx, qword [rdi]
call fcn.1800857c0
mov rax, qword [rdi]
test rax, rax
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800a6bfd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800a6c10
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.18011e904
mov qword [rsp + 0x28], r14
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18011e4c0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800a9000
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov rbx, rdx
mov r8, rdx
lea rdx, [rbp - 0x30]
call fcn.1800a9bc0
nop
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
xor r14d, r14d
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], ax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1800a69d0
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x38], r14b
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x1800a9088
xor dil, dil
jmp 0x1800a90a6
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x1800a909f
xor dil, dil
jmp 0x1800a90a6
mov byte [rbp - 0x48], 1
mov dil, 1
mov byte [rbp - 0x38], dil
mov byte [rbp - 0x60], 0
lea r9, [rbp - 0x60]
mov r8, rsi
mov rdx, rbx
call fcn.1800a9190
test al, al
jne 0x1800a90da
cmp byte [rbp - 0x60], al
je 0x1800a90da
cmp qword [rbx + 0x18], 8
jb 0x1800a90d0
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test dil, dil
je 0x1800a90f2
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1800a90ee
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x40], r14
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1800a9109
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1800a914b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a9146
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a9181
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18011e4c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180146ad4
int3
Function at 0x1800ab050
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], 0x114
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, 0x110
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
call fcn.18013d3d0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x1800ab0d0
cmp dword [rsp + 0x24], 6
jb 0x1800ab0d0
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18011e4c0
add rsp, 0x150
pop rbx
ret
Function at 0x1800ab0f0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rcx
xorps xmm0, xmm0
movdqu xmmword [rax - 0x48], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rax - 0x48], xmm1
xor ebp, ebp
mov word [rax - 0x58], bp
lea r8d, [rbp + 0xc]
lea rdx, str.wintrust.dll
lea rcx, [rax - 0x58]
call fcn.180003960
nop
call fcn.18009c460
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.18009c500
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1800ab196
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ab191
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ab33d
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x40], bp
mov r8d, 0xb
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x40]
call fcn.180003960
nop
call fcn.18009c460
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18009c500
mov rdi, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1800ab234
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ab22f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ab337
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bp
test rbx, rbx
je 0x1800ab321
test rdi, rdi
je 0x1800ab321
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180146ad4
int3
call fcn.180146ad4
int3
Function at 0x1800b3540
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
je 0x1800b359e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1800b3589
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800b359e
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x1800b35a0
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18011e4c0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800b6f40
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rcx]
test rdx, rdx
je 0x1800b7057
cmp byte [rdx + 0x78], 0
je 0x1800b7057
add rdx, 0x28
lea rcx, [r11 - 0x48]
call fcn.180087de0
nop
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.180093ad0
nop
mov rsi, qword [rsp + 0x70]
lea rdi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdi, qword [rsp + 0x60]
mov rcx, qword [rbx]
cmp qword [rcx + 0x18], 8
jb 0x1800b6fcb
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800b7042
mov dword [rsp + 0x40], 0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.18003edc0
nop
lea rcx, [rsp + 0x50]
call fcn.180087e40
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18011e4c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800c9120
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx], 0
jne 0x1800c9278
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea r8d, [rsi + 0xc]
lea rdx, str.wintrust.dll
lea rcx, [rsp + 0x28]
call fcn.180003960
nop
call fcn.18009c460
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.18009c500
mov rdi, rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1800c91e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c91db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c9295
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
test rdi, rdi
jne 0x1800c9201
mov dword [rbx + 0x30], 3
jmp 0x1800c9278
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 8], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18011e4c0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.180146ad4
int3
Function at 0x1800ca360
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp + 0x1f], rax
movzx ebx, r8b
mov r15, rdx
mov rdi, rcx
mov qword [rbp - 0x29], rcx
xor r12d, r12d
mov r14d, r12d
mov dword [rbp - 0x35], r12d
test rdx, rdx
jne 0x1800ca3d1
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 7
mov word [rcx], r12w
mov dword [rbp - 0x35], 1
jmp 0x1800ca5a1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm6, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x11], xmm6
mov word [rbp - 0x21], r12w
mov word [rbp - 0x39], r12w
mov r9, r15
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rbp - 0x39]
call fcn.18014d28c
cmp rax, 1
jne 0x1800ca572
movzx ecx, word [rbp - 0x39]
inc rcx
test bl, bl
je 0x1800ca484
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.18011e958
mov rsi, rax
movzx ecx, word [rbp - 0x39]
mov word [rax + rcx*2], r12w
movzx r8d, word [rbp - 0x39]
mov r9, r15
lea edx, [rbx + 3]
mov rcx, rax
call fcn.18014d28c
movzx ecx, word [rbp - 0x39]
cmp rax, rcx
jne 0x1800ca565
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1800ca461
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp - 0x21]
call fcn.180003960
movdqu xmm6, xmmword [rbp - 0x11]
jmp 0x1800ca565
call fcn.18011e958
mov rsi, rax
movzx ecx, word [rbp - 0x39]
mov byte [rcx + rax], 0
movzx r8d, word [rbp - 0x39]
mov r9, r15
mov edx, 1
mov rcx, rax
call fcn.18014d28c
movzx ecx, word [rbp - 0x39]
cmp rax, rcx
jne 0x1800ca565
xor r9d, r9d
lea r8, [r9 - 1]
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.1800934e0
mov rbx, rax
mov dword [rbp - 0x35], 2
lea rax, [rbp - 0x21]
cmp rax, rbx
je 0x1800ca505
lea rcx, [rbp - 0x21]
call fcn.1800038e0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x21], xmm0
movups xmm6, xmmword [rbx + 0x10]
movdqu xmmword [rbp - 0x11], xmm6
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov r14d, 2
and r14d, 0xfffffffd
mov dword [rbp - 0x35], r14d
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x1800ca553
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ca54e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ca5d1
call fcn.18011e904
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp + 0xf], xmm0
mov word [rbp - 1], r12w
test rsi, rsi
je 0x1800ca572
mov rcx, rsi
call fcn.18011e904
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm6
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 0x21], r12w
or r14d, 1
mov dword [rbp - 0x35], r14d
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 0x21], r12w
mov rax, rdi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18011e4c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.180146ad4
int3
Function at 0x1800cac50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, r9
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800cacad
test rdx, rdx
je 0x1800cacad
test rbx, rbx
je 0x1800cacad
mov dword [r9], 0
test r8d, r8d
je 0x1800caca9
call fcn.180170928
mov r8d, edi
mov r9, rbp
mov edx, 1
mov rcx, rsi
call fcn.18014d28c
cmp eax, edi
jne 0x1800cacad
mov dword [rbx], eax
xor eax, eax
jmp 0x1800cacb2
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d40d0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x10], eax
xor ecx, ecx
call fcn.18014b2d4
mov qword [rbx + 8], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800d427b
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x38]
call fcn.1800d1a70
nop
cmp qword [rbp - 0x28], 0
jne 0x1800d417b
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x1800d4174
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d416f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d42a8
call fcn.18011e904
xor ebx, ebx
jmp 0x1800d426b
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800d422f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x18], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x18]
lea r8d, [rbx + 8]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x1800d426b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4266
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d42a2
jmp 0x1800d4266
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x1800d426b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4266
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d429c
call fcn.18011e904
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], bx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18011e4c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.180146ad4
int3
call fcn.180146ad4
int3
call fcn.180146ad4
int3