joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ec68
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 7
jbe 0x14006ec91
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14006ed7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14006ecd3
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov rcx, rsi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
jmp fcn.14006ed9c
mov ecx, 2
call fcn.140037700
test al, al
je 0x14006ed7d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x38]
mov r8d, 0x239
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x48]
lea rdx, str.CreateDirectory
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14006ed2f
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14006ed65
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006ed9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14006edc5
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006ee94
mov dil, 1
test al, 0x10
jne 0x14006ef40
mov ecx, 2
call fcn.140037700
test al, al
je 0x14006ef3e
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x48]
mov r8d, 0x227
mov r9d, 2
mov rcx, rdi
call fcn.1400377b0
lea rcx, [rsp + 0x50]
lea rdx, str.GetFileAttributes
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14006ee32
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14006ee68
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009de2
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140002c8d
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140037c30
jmp 0x14006ef3e
mov ecx, 2
call fcn.140037700
test al, al
je 0x14006ef3e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x48]
mov r8d, 0x223
mov r9d, 2
mov rcx, rdi
call fcn.140038c40
lea rcx, [rsp + 0x58]
lea rdx, str.GetFileAttributes
call fcn.140002c8d
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14006eef0
mov rax, qword [rsi]
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140047a30
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14006ef26
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009de2
mov rcx, rsi
call fcn.1400068c6
mov rcx, rdi
call fcn.140038d80
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400713c6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x70]
cmp eax, edx
jne 0x1400713de
cmp qword [rcx + 0x28], 7
jbe 0x1400713ee
mov rcx, qword [rcx + 0x10]
jmp 0x1400713f2
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
add eax, 1
jmp 0x14007140b
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret

Function at 0x140075350
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x60], rax
test r9d, r9d
js 0x1400753e7
lea rcx, [rsp + 0x50]
call fcn.1400481b0
call fcn.1400a0600
test al, al
je 0x1400753a3
movsxd r9, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x50]
mov r8, rbx
call fcn.1400a06a0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], eax
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400753ee
mov esi, dword [rsp + 0x2c]
jmp 0x1400753ff
mov esi, 0xffffffff
jmp 0x140075409
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x50]
call fcn.1400a0670
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140075430
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.1400481b0
call fcn.1400a0600
test al, al
je 0x14007547e
movsxd r9, esi
lea rdx, str.File::Write
lea rcx, [rsp + 0x50]
mov r8, rbx
call fcn.1400a06a0
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], eax
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.1400a0670
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400754f0
Capabilities:
Get file size

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
call fcn.1400481b0
call fcn.1400a0600
test al, al
je 0x140075531
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x28]
xor r9d, r9d
mov r8, rsi
call fcn.1400a06a0
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400a0670
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14011a890
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x140075570
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
call fcn.1400481b0
call fcn.1400a0600
test al, al
je 0x1400755b6
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x28]
mov r8, rsi
mov r9, rdi
call fcn.1400a06a0
mov rcx, qword [rsi]
xor ebx, ebx
lea r8, [rsp + 0x20]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140075614
mov rcx, qword [rsi]
xor ebx, ebx
xor r8d, r8d
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140075614
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140075612
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
jmp 0x140075614
xor ebx, ebx
lea rcx, [rsp + 0x28]
call fcn.1400a0670
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14011a890
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007c010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, r8
mov r12, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x14007c031
mov r15, qword [r15]
movabs rsi, 0xcbf29ce484222325
test r12, r12
mov qword [rsp + 0x20], rdx
je 0x14007c066
movabs rax, 0x100000001b3
lea rdx, [r12 - 1]
mov r8d, r12d
and r8d, 7
cmp rdx, 7
jae 0x14007c06e
mov rdi, r15
jmp 0x14007c0e1
mov rdx, rsi
jmp 0x14007c107
mov rdx, r8
sub rdx, r12
mov rdi, r15
nop word [rax + rax]
movzx ebp, byte [rdi]
xor rbp, rsi
imul rbp, rax
movzx ebx, byte [rdi + 1]
xor rbx, rbp
imul rbx, rax
movzx ebp, byte [rdi + 2]
xor rbp, rbx
imul rbp, rax
movzx ebx, byte [rdi + 3]
xor rbx, rbp
imul rbx, rax
movzx ebp, byte [rdi + 4]
xor rbp, rbx
imul rbp, rax
movzx ebx, byte [rdi + 5]
xor rbx, rbp
imul rbx, rax
movzx ebp, byte [rdi + 6]
xor rbp, rbx
imul rbp, rax
movzx esi, byte [rdi + 7]
xor rsi, rbp
imul rsi, rax
add rdi, 8
add rdx, 8
jne 0x14007c080
mov rdx, rsi
test r8, r8
je 0x14007c107
xor ebp, ebp
nop dword [rax + rax]
movzx edx, byte [rdi + rbp]
xor rdx, rsi
imul rdx, rax
add rbp, 1
mov rsi, rdx
cmp r8, rbp
jne 0x14007c0f0
and rdx, qword [rcx + 0x30]
mov rdi, qword [rcx + 8]
mov r13, qword [rcx + 0x18]
mov rax, rdx
shl rax, 4
mov rbp, qword [r13 + rax]
lea r14, [rdx + rdx]
add r14, 1
mov rbx, rbp
cmp rbp, rdi
jne 0x14007c148
jmp 0x14007c170
mov rbx, qword [rbx]
cmp rbp, rdi
je 0x14007c170
mov rax, qword [r13 + r14*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x14007c1a8
cmp qword [rbx + 0x20], r12
jne 0x14007c140
cmp qword [rbx + 0x28], 0xf
jbe 0x14007c180
mov rsi, qword [rbx + 0x10]
jmp 0x14007c184
mov rax, rdi
cmp rax, rbx
jne 0x14007c155
jmp 0x14007c1a8
lea rsi, [rbx + 0x10]
mov rcx, rsi
mov rdx, r15
mov r8, r12
call fcn.14011e990
test eax, eax
jne 0x14007c140
mov rcx, r15
mov rdx, rsi
mov r8, r12
call fcn.14011e990
test eax, eax
je 0x14007c1c1
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x20]
mov qword [rax], rbx
jmp 0x14007c1b0

Function at 0x140080250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x1400802d1
xor r11d, r11d
lea r10, [0x140155100]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x140080280
jmp 0x1400802d4
mov edx, r9d
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret
Function at 0x1400802e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x140080361
xor r11d, r11d
lea r10, [0x140155100]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x140080310
jmp 0x140080364
mov edx, r9d
mov dword [rcx + 0x18], edx
pop rsi
ret

Function at 0x14008b3e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x14017b828]
cmp ecx, 0xffffffff
je 0x14008b40d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14008b412
call fcn.14008b540
mov eax, dword [0x140181818]
mov ecx, dword [0x14017ea38]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008b4db
mov rbx, qword [0x140181810]
mov rcx, rbx
call fcn.1400481c0
mov rcx, qword [0x140180008]
add rcx, 1
xor edx, edx
lea rax, [0x140180010]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14008b491
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14008b491
add rdx, 2
add rcx, 2
cmp rdx, 0x100
jb 0x14008b460
jmp 0x14008b4b6
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x140180008], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x14008b523
cmp eax, 0x100
jge 0x14008b52a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x140181818]
call fcn.14011a6c0
mov eax, dword [0x140181818]
cmp eax, 0xffffffff
jne 0x14008b437
mov ecx, 8
call fcn.14011a524
mov rbx, rax
mov rcx, rax
call fcn.1400481b0
mov qword [0x140181810], rbx
lea rcx, [0x140181818]
call fcn.14011a728
jmp 0x14008b437
int3
int3
Function at 0x14008b540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.14011ba80
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x14017b750]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
mov ecx, dword [0x14017b828]
mov dword [rbp - 0x54], ecx
cmp ecx, 0xffffffff
jne 0x14008b5d8
lea rcx, [rbp - 0x54]
call fcn.1400b90c0
test al, al
je 0x14008b64f
mov ecx, dword [rbp - 0x54]
cmp ecx, 0xffffffff
jne 0x14008b5b8
lea rcx, [rbp - 0x54]
call fcn.1400b90c0
test al, al
je 0x14008b656
cmp dword [rbp - 0x54], 0xffffffff
je 0x14008b656
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rbp - 0x54]
mov eax, 0xffffffff
lock cmpxchg dword [0x14017b828], ecx
mov ecx, dword [rbp - 0x54]
je 0x14008b5d8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14017b828]
mov dword [rbp - 0x54], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14008b648
lea rsi, [rbp - 0x50]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.14011eed0
mov ecx, dword [rbp - 0x54]
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14011a570
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14011ea70
mov ecx, dword [rbp - 0x54]
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.14011a890
mov rax, rdi
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
int3
int3
int3

Function at 0x14008b660
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14017b828]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14008b68f
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14008b68f
mov rax, qword [rax + rcx]
jmp 0x14008b691
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14008b6a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14017b828]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14008b6c2
call fcn.14008b540
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14008e826
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x270
mov rsi, rdx
mov eax, ecx
mov rcx, qword [0x14017b750]
xor rcx, rsp
mov qword [rsp + 0x268], rcx
lea rbx, [rsp + 0x60]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov edx, eax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008e8b7
mov qword [rsp + 0x30], rbx
cmp word [rsp + 0x60], 0
je 0x14008e889
xor eax, eax
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x14008e87b
jmp 0x14008e88b
xor eax, eax
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14002ed80
mov rcx, rsi
mov rdx, rdi
call fcn.14002ef10
mov rcx, rdi
call fcn.14002ee30
mov dil, 1
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.14011a890
mov eax, edi
add rsp, 0x270
pop rbx
pop rdi
pop rsi
ret

Function at 0x140094dd8
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov rdi, rcx
lea rsi, [rcx + 0x48]
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x140094e06
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rbx, [rdi + 0x40]
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x140094e20
mov qword [rbx], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x20], rbx
lea rcx, [0x14015b140]
lea r9, [0x140155ee8]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbx]
test eax, eax
js 0x140094e89
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x90]
test eax, eax
js 0x140094e97
cmp rdi, r15
je 0x140094e76
mov r8, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 7
jbe 0x140094e6b
mov r15, qword [r15]
mov rcx, rdi
mov rdx, r15
call fcn.1400060c2
add rdi, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.14002eea0
mov al, 1
jmp 0x140094eae
test rcx, rcx
je 0x140094eac
mov qword [rbx], 0
jmp 0x140094ea6
mov rcx, qword [rsi]
test rcx, rcx
je 0x140094eac
mov qword [rsi], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400953c6
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r13, [rsp + 0x58]
mov qword [r13], 0
mov qword [rsp + 0x20], r13
lea rcx, [0x14015b130]
lea r9, [0x140155f08]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400955df
mov rdi, qword [rsp + 0x58]
mov ebp, 7
cmp qword [rsi + 0x18], rbp
jbe 0x140095440
mov rsi, qword [rsi]
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov rdx, rsi
call fcn.1400ba9a0
mov rdx, qword [rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
mov rcx, rbx
call fcn.1400ba9c0
mov rsi, qword [rsp + 0x58]
cmp qword [r12 + 0x18], rbp
jbe 0x140095474
mov r12, qword [r12]
movzx ebp, word [rsp + 0xf0]
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov rdx, r12
call fcn.1400ba9a0
mov rdx, qword [rdi]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
mov rcx, rdi
call fcn.1400ba9c0
mov rsi, qword [rsp + 0x58]
lea rdx, [r15 + 0x20]
cmp qword [r15 + 0x38], 8
jb 0x1400954b3
mov rdx, qword [rdx]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400ba9a0
mov rdx, qword [rdi]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x60]
mov rcx, rdi
call fcn.1400ba9c0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 0x11
call qword [rax + 0x80]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0xe0]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov dx, 0xffff
call qword [rax + 0x110]
mov rbx, qword [rsp + 0x58]
movzx r8d, bp
lea rdx, [0x140155f18]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140046b80
cmp qword [rsi + 0x18], 7
mov rdx, rsi
jbe 0x140095538
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400ba9a0
mov rdx, qword [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x90]
mov rcx, rdi
call fcn.1400ba9c0
mov rcx, rsi
call fcn.140006a9a
mov rsi, qword [rsp + 0x58]
cmp qword [r15 + 0x18], 8
jb 0x140095573
mov r15, qword [r15]
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, r15
call fcn.1400ba9a0
mov rdx, qword [rdi]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x120]
mov rcx, rdi
call fcn.1400ba9c0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 0x7fffffff
call qword [rax + 0x130]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x150]
mov qword [r14], 0
cmp r13, r14
je 0x1400955e6
mov rax, qword [rsp + 0x58]
mov qword [r14], rax
mov qword [rsp + 0x58], 0
jmp 0x1400955ff
mov qword [r14], 0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400955ff
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14011a890
mov rax, r14
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14009a962
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x60], rax
test dl, dl
je 0x14009a9bd
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x14009a9bd
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov dword [rax], 0x18
lea rcx, [0x140156ec4]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
jmp 0x14009a9bf
xor eax, eax
movzx edx, bl
shl edx, 0x13
or edx, 3
cmp qword [rsi + 0x18], 7
jbe 0x14009a9d2
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rax
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov r8d, 6
mov r9d, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011a890
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14009aa1c
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x140
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x138], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14009aaef
and eax, 0xfeff
cmp eax, 6
je 0x14009aaef
mov eax, dword [0x140181930]
mov ecx, dword [0x14017ea38]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009ab16
xor edx, edx
mov r8d, 0x10000000
mov rcx, rsi
call qword [0x140181928]
mov sil, 1
test eax, eax
jne 0x14009aafb
mov ecx, 2
call fcn.140037700
test al, al
je 0x14009aaeb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
lea rsi, [rsp + 0x28]
mov r8d, 0x21
mov r9d, 2
mov rcx, rsi
call fcn.140038c40
lea rcx, [rsp + 0x38]
lea rdx, str.InitializeCriticalSectionEx
call fcn.140002c8d
mov rcx, rsi
call fcn.140038d80
xor esi, esi
jmp 0x14009aafb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov sil, 1
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14011a890
mov eax, esi
add rsp, 0x140
pop rsi
ret
lea rcx, [0x140181930]
call fcn.14011a6c0
mov eax, dword [0x140181930]
cmp eax, 0xffffffff
jne 0x14009aa83
lea rcx, [0x140148686]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.14009b060
mov qword [0x140181928], rax
lea rcx, [0x140181930]
call fcn.14011a728
jmp 0x14009aa83