joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x140
lea rbx, [rcx + 0x10]
mov rdi, rcx
mov dword [rcx], 0xa
mov qword [rcx + 8], rbx
lea rcx, [rsp + 0x20]
mov r8d, 0x80
call fcn.00010da0
test eax, eax
jne 0x11185
mov eax, dword [rsp + 0x20]
mov esi, 4
shl eax, 2
movsxd rcx, eax
mov rax, qword [rsp + 0x28]
lea r9, [rax + rcx*4]
mov eax, dword [r9]
add r9, rsi
mov dword [rbx], eax
mov eax, dword [r9]
add rbx, rsi
mov dword [rbx], eax
add r9, rsi
add rbx, rsi
mov eax, dword [r9]
add r9, rsi
mov dword [rbx], eax
mov eax, dword [r9]
add rbx, rsi
mov dword [rbx], eax
mov r10d, dword [rdi]
add rbx, rsi
dec r10d
sub r9, 0x1c
test r10d, r10d
jle 0x11163
lea rdi, [0x00010000]
mov r11, rsi
movzx eax, byte [r9]
movzx edx, byte [rax + rdi + 0x2770]
movzx eax, byte [r9 + 3]
movzx ecx, byte [rax + rdi + 0x2770]
movzx eax, byte [r9 + 2]
mov r8d, dword [rdi + rdx*4 + 0x34a0]
xor r8d, dword [rdi + rcx*4 + 0x2870]
movzx ecx, byte [rax + rdi + 0x2770]
movzx eax, byte [r9 + 1]
xor r8d, dword [rdi + rcx*4 + 0x2c70]
movzx ecx, byte [rax + rdi + 0x2770]
add r9, rsi
xor r8d, dword [rdi + rcx*4 + 0x30a0]
mov dword [rbx], r8d
add rbx, rsi
sub r11, 1
jne 0x110f5
dec r10d
sub r9, 0x20
test r10d, r10d
jg 0x110f2
mov eax, dword [r9]
add r9, rsi
mov dword [rbx], eax
mov eax, dword [r9]
add rbx, rsi
mov dword [rbx], eax
mov eax, dword [r9 + rsi]
mov dword [rbx + rsi], eax
mov eax, dword [r9 + rsi + 4]
mov dword [rbx + rsi + 4], eax
xor eax, eax
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x15794
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r13, r8
mov r8d, dword [0x00014a04]
mov r12d, edx
mov rsi, rcx
cmp r8d, 0x10
jae 0x159c9
xor r14d, r14d
lea rax, [0x00012720]
lea ebp, [r14 + 1]
mov ecx, r14d
cmp r8d, r14d
jbe 0x15803
mov edx, dword [rsi + 8]
cmp edx, dword [rax]
je 0x159c9
add ecx, ebp
add rax, 4
cmp ecx, r8d
jb 0x157f0
mov r15d, 0x4d525356
mov edx, 0x1530
xor ecx, ecx
mov r8d, r15d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, r14
jne 0x1582b
mov eax, 0xc000009a
jmp 0x159ce
lea rcx, [rsp + 0x48]
mov rdx, rsi
mov r8d, 0x34
call fcn.00011990
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.0001a368
cmp eax, r14d
mov ebx, eax
jl 0x15933
mov edx, dword [0x00014a04]
mov eax, dword [rsi + 4]
lea r8, [0x000126e0]
mov dword [r8 + rdx*4], eax
mov eax, dword [rsi + 8]
add r12, 0xffffffffffffffcc
shr r12, 1
lea r8, [0x00012720]
mov dword [r8 + rdx*4], eax
add edx, ebp
lea eax, [r12 - 1]
mov dword [0x00014a04], edx
cmp r14w, word [rsi + rax*2 + 0x34]
jne 0x159bd
lea eax, [r12 - 2]
cmp r14w, word [rsi + rax*2 + 0x34]
jne 0x159bd
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [r13 + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea r11, [r13 + 0x30]
mov rax, qword [r11]
cmp rax, r11
je 0x158da
mov ecx, dword [rsi + 4]
cmp ecx, dword [rax - 8]
je 0x158d7
mov rax, qword [rax]
cmp rax, r11
jne 0x158c8
jmp 0x158da
mov bpl, r14b
lea rcx, [r13 + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
cmp bpl, r14b
jne 0x158f6
mov ebx, 0xc000000d
jmp 0x15933
mov rcx, qword [r13]
lea rax, [rsp + 0x40]
mov r9d, 0x2a
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x1580
mov byte [rsp + 0x28], r14b
add r12d, r12d
mov dword [rsp + 0x20], 0x180
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r14d
mov ebx, eax
jge 0x15946
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x159ce
mov rax, qword [rsp + 0x40]
mov r8d, r15d
mov rdx, r12
mov rbp, qword [rax + 0x40]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbp + 0x28], rax
cmp rax, r14
jne 0x15982
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x15821
lea rdx, [rsi + 0x34]
mov r8, r12
mov rcx, rax
call fcn.00011990
mov r11d, dword [rsi + 4]
mov rdx, r13
mov dword [rbp + 0x30], r11d
mov rcx, qword [rsp + 0x40]
call fcn.000156e0
lea rcx, [rbp + 0x50]
mov r8d, 0x1530
mov rdx, rdi
call fcn.00011990
jmp 0x15933
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.00011e70
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x16478
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x1b0
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, r9
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
mov rax, cr8
xor ebx, ebx
cmp al, bl
je 0x164b6
lea eax, [rbx + 1]
jmp 0x165af
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x100
call fcn.00011ce0
lea r11, [rdi + 0x14f8]
lea rax, str.RegistryMACHINESystemCurrentControlSetMkbus
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [0x0001b510]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x40]
mov edx, 0x20006
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 0x30
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x60], 0x40
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov edi, eax
jl 0x165a8
lea rcx, [rsp + 0x78]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, ebx
setl bl
mov eax, ebx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.00011e70
add rsp, 0x1b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1a9e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9b, byte [rcx + 1]
mov dil, byte [rcx + 2]
mov r11b, byte [rcx]
shr dil, 7
mov al, r9b
mov rbx, rcx
shr al, 5
not dil
and al, 1
and dil, 1
mov byte [rcx + 0xa], al
jne 0x1aa25
not r11b
and dword [rsp + 0x50], 0
mov esi, 0x1f
mov r10b, byte [rsp + 0x50]
lea edx, [rsi - 0x1b]
and r9b, sil
mov al, r10b
mov cl, r9b
shl al, 2
add cl, cl
not cl
and cl, 2
mov r10b, cl
or r10b, al
mov al, r9b
shr r9b, 1
and al, 1
or r10b, al
sub rdx, 1
jne 0x1aa3a
mov bpl, r10b
xor r12d, r12d
mov byte [rsp + 0x50], r10b
not bpl
or r13d, 0xffffffff
lea r14d, [rdx + 0x18]
mov byte [rsp + 0x52], bpl
mov r15d, 0xfe
lea rax, [r14 - 0x10]
mov r8d, r13d
dec r13d
sar rax, 2
and r8d, 7
and rax, r15
mov cl, r8b
mov dl, byte [rax + rbx + 2]
mov rax, r14
inc r14
shr dl, cl
mov ecx, r12d
sar rax, 2
and dl, 1
and rax, r15
xor dl, r9b
shl dl, cl
mov cl, r8b
xor r10b, dl
mov dl, byte [rax + rbx + 2]
shr dl, cl
mov ecx, r12d
inc r12d
and dl, 1
xor dl, r9b
shl dl, cl
xor bpl, dl
cmp r13d, 0xfffffff7
jg 0x1aa82
and dword [rbx + 0xb], 0
movzx r12d, r11b
xor r13d, r13d
mov r14d, r12d
mov byte [rsp + 0x51], r10b
mov byte [rsp + 0x53], bpl
shl r14d, 3
mov r15, rsi
mov dword [rbx + 0xf], r14d
mov ebp, 0xc
mov rdx, rbx
mov ecx, esi
call fcn.0001a924
sub rbp, 1
mov r11d, eax
jne 0x1ab03
mov eax, dword [rsp + 0x50]
mov rcx, r15
dec r15
sar rcx, 2
and ecx, 0xfe
movzx edx, byte [rcx + rbx + 2]
mov ecx, 0xff
sub cl, sil
and ecx, 7
shr edx, cl
mov ecx, esi
shr eax, cl
xor edx, eax
movzx eax, r11b
xor edx, esi
and edx, 1
xor edx, eax
lea eax, [r13 + r13]
mov r13d, edx
or r13d, eax
sub esi, 1
jns 0x1aafa
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
lea ecx, [r12 + r12]
mov dword [rbx + 0xb], r13d
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
mov dword [rbx + 0xf], ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1ac28
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov eax, dword [rcx + 0x43c]
movzx ebx, dx
mov edx, 0x1f0000
and eax, edx
movzx r11d, r8w
cmp eax, edx
jne 0x1adc0
movzx r9d, word [rcx + 0x99]
movzx edi, word [rcx + 0x95]
movzx esi, word [rcx + 0x97]
mov r12d, 0xf
movzx eax, r9w
lea r10, [rsp + 8]
shr ax, 0xc
lea ebp, [r12 - 0xe]
and al, r12b
mov byte [rsp], al
movzx eax, r9w
shr r9b, 4
shr ax, 8
and r9b, r12b
and al, r12b
mov byte [rsp + 2], r9b
mov byte [rsp + 1], al
mov al, byte [rcx + 0x99]
and al, r12b
xor r8d, r8d
movzx r9d, r8w
mov byte [rsp + 3], al
movzx ecx, r9w
movzx edx, di
movzx eax, si
shr dx, cl
shr ax, cl
add r9w, bp
and dl, bpl
and al, bpl
add dl, dl
or dl, al
mov byte [r10], dl
add r10, rbp
cmp r9w, 0x10
jb 0x1accf
movzx eax, r11w
movzx r9d, r12w
lea rcx, [rsp + 0x17]
shr ax, 8
mov r10d, 8
rol al, 4
movzx edx, al
shl edx, 8
rol r11b, 4
movzx eax, r11b
or edx, eax
movzx eax, bx
shr ax, 8
shl edx, 8
rol al, 4
movzx eax, al
or edx, eax
shl edx, 8
rol bl, 4
movzx eax, bl
or edx, eax
movzx eax, byte [rcx]
add r8b, r8b
movzx ecx, byte [rsp + rax]
movzx eax, dx
shr edx, 4
and ax, r12w
xor cx, ax
xor r9w, cx
movzx eax, r9w
lea rcx, [rsp + rax + 8]
mov al, byte [rcx]
and al, bpl
or r8b, al
sub r10, rbp
jne 0x1ad41
mov dl, r8b
mov al, r8b
mov cl, r8b
shr al, 2
and dl, 0x40
and cl, 2
or dl, al
mov al, r8b
and al, 0x20
shr dl, 2
or dl, al
mov al, r8b
and al, 0x10
shr dl, 2
or dl, al
mov al, r8b
shl al, 2
shr dl, 1
or cl, al
mov al, r8b
and r8b, 8
shl cl, 2
and al, 4
or cl, al
shl cl, 2
or cl, r8b
add cl, cl
or dl, cl
not dl
jmp 0x1adc2
mov dl, 0xff
mov al, dl
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.00011e70
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1adf4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
lea rdx, [rsp + 0x20]
mov rbp, rcx
call fcn.0001aef8
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x38]
call fcn.00011ce0
mov r11, qword [rbp + 0x9b]
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x68], r11
mov esi, 6
sub rdi, 4
mov eax, dword [rsp + 0x6c]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x6c]
mov r9, rbp
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.00011880
add rdi, 4
movzx r11d, al
mov eax, dword [rsp + 0x68]
dec esi
xor dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
add word [rsp + 0x5c], r11w
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x64]
mov dword [rdi], eax
test esi, esi
jg 0x1ae4f
mov eax, dword [rsp + 0x44]
mov dword [rbx], eax
mov eax, dword [rsp + 0x40]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x4c]
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x48]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x54]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x50]
mov dword [rbx + 0x14], eax
movzx eax, word [rsp + 0x5c]
mov word [rbx + 0x18], ax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.00011e70
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1b028
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
lea rdx, [rsp + 0x28]
mov rbp, rcx
call fcn.0001aef8
movzx r12d, word [rbx]
movzx r13d, word [rbx + 2]
movzx esi, word [rbx + 4]
movzx edi, word [rbx + 6]
mov r14d, 5
lea r15d, [r14 - 4]
mov eax, 0xf
lea r8, [rsp + 0x28]
xor edx, edx
mov word [rsp + 0x28], ax
xor eax, eax
mov r9, rbp
movzx ecx, si
mov word [rsp + 0x2a], ax
call fcn.0001af78
lea r8, [rsp + 0x28]
mov r9, rbp
movzx edx, ax
movzx ecx, di
call fcn.0001af78
xor ax, di
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
mov word [rsp + 0x20], cx
shr cx, 8
add byte [rsp + 0x20], cl
movzx r8d, word [rsp + 0x20]
xor r8w, di
xor r8w, si
movzx eax, r8w
shr ax, 8
add al, r8b
mov cl, al
add al, al
shr cl, 7
add cl, al
add cl, r15b
mov dl, cl
add cl, cl
shr dl, 7
add dl, cl
add r8b, dl
mov cl, r8b
add r8b, r8b
shr cl, 7
add cl, r8b
mov al, cl
add cl, cl
shr al, 7
add al, cl
mov ecx, 0x100
movzx r8d, al
movzx eax, dl
imul ax, cx
mov ecx, 0xff
add r8w, ax
lea edx, [rdi + r8]
xor r8w, r12w
mov r12w, si
lea eax, [r15 + rdx]
xor si, r8w
xor ax, dx
and ax, cx
xor dx, ax
movzx ecx, dx
add dx, dx
shr cx, 0xf
add cx, dx
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
xor ax, r13w
mov r13w, di
xor di, ax
sub r14, r15
jne 0x1b076
mov word [rbx], si
mov word [rbx + 2], di
mov word [rbx + 4], r12w
mov word [rbx + 6], r13w
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00011e70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013210
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14008f010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [0x14009a7b9]
call fcn.140069c34
xor eax, eax
mov dword [rsp + 0x20], 0x114
xor edx, edx
mov qword [rbx + 8], rax
mov r8d, 0x110
mov qword [rbx + 0x10], rax
lea rcx, [rsp + 0x24]
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
mov byte [rbx], al
call fcn.140024ac0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x14001329c
cmp dword [rsp + 0x24], 6
jb 0x14001329c
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140020d90
add rsp, 0x150
pop rbx
ret

Function at 0x1400132e0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rcx
lea rcx, [0x14009a7b9]
call fcn.140069c34
lea rdx, str.wintrust.dll
lea rcx, [rsp + 0x28]
call fcn.140003220
nop
call fcn.140016130
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.140016210
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.1400031f0
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x48]
call fcn.140003220
nop
call fcn.140016130
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.140016210
mov rdi, rax
lea rcx, [rsp + 0x48]
call fcn.1400031f0
test rbx, rbx
je 0x140013443
test rdi, rdi
je 0x140013443
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140013f60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14008f010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rcx, [0x14009a7b9]
call fcn.140069c34
mov rcx, rbx
call fcn.140003830
cmp qword [rax + 0x10], 0
jne 0x140013fb1
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140020d90
add rsp, 0x70
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006520
nop
mov edx, 4
lea rcx, [rsp + 0x28]
call fcn.14000b250
lea rcx, [rsp + 0x28]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14001410a
lea rcx, [rsp + 0x48]
call fcn.140003280
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140015820
test al, al
je 0x14001401f
lea rcx, [rsp + 0x48]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1400031f0
cmp ebx, 0xffffffff
jne 0x14001410a
lea rcx, [rsp + 0x28]
call fcn.140003830
cmp qword [rax + 0x10], 2
jbe 0x140014106
lea rcx, [rsp + 0x28]
call fcn.140003830
mov rbx, qword [rax + 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004200
cmp qword [rax + 0x18], 8
jb 0x140014069
mov rax, qword [rax]
cmp word [rax + rbx*2 - 2], 0x5c
je 0x14001409b
lea rcx, [rsp + 0x28]
call fcn.140003830
mov rbx, qword [rax + 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004200
cmp qword [rax + 0x18], 8
jb 0x140014093
mov rax, qword [rax]
cmp word [rax + rbx*2 - 2], 0x2f
jne 0x140014106
mov edx, 0x20
lea rcx, [rsp + 0x28]
call fcn.14000b250
lea rcx, [rsp + 0x28]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14001410a
lea rcx, [rsp + 0x48]
call fcn.140003280
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140015820
test al, al
je 0x1400140f7
lea rcx, [rsp + 0x48]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1400031f0
cmp ebx, 0xffffffff
jne 0x14001410a
xor bl, bl
jmp 0x14001410c
mov bl, 1
lea rcx, [rsp + 0x28]
call fcn.1400031f0
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140020d90
add rsp, 0x70
pop rbx
ret
Function at 0x140014130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14008f010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rcx, [0x14009a7b9]
call fcn.140069c34
mov rcx, rbx
call fcn.140003830
cmp qword [rax + 0x10], 0
jne 0x140014181
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140020d90
add rsp, 0x70
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006520
nop
mov edx, 4
lea rcx, [rsp + 0x28]
call fcn.14000b250
lea rcx, [rsp + 0x28]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400141fa
lea rcx, [rsp + 0x48]
call fcn.140003280
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140015820
test al, al
je 0x1400141eb
lea rcx, [rsp + 0x48]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1400031f0
cmp ebx, 0xffffffff
je 0x140014203
test bl, 0x10
je 0x1400142e0
lea rcx, [rsp + 0x28]
call fcn.140003830
cmp qword [rax + 0x10], 2
jbe 0x1400142dc
lea rcx, [rsp + 0x28]
call fcn.140003830
mov rbx, qword [rax + 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004200
cmp qword [rax + 0x18], 8
jb 0x14001423a
mov rax, qword [rax]
cmp word [rax + rbx*2 - 2], 0x5c
je 0x14001426c
lea rcx, [rsp + 0x28]
call fcn.140003830
mov rbx, qword [rax + 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004200
cmp qword [rax + 0x18], 8
jb 0x140014264
mov rax, qword [rax]
cmp word [rax + rbx*2 - 2], 0x2f
jne 0x1400142dc
mov edx, 0x20
lea rcx, [rsp + 0x28]
call fcn.14000b250
lea rcx, [rsp + 0x28]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400142d7
lea rcx, [rsp + 0x48]
call fcn.140003280
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140015820
test al, al
je 0x1400142c8
lea rcx, [rsp + 0x48]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1400031f0
cmp ebx, 0xffffffff
je 0x1400142dc
test bl, 0x10
je 0x1400142e0
xor bl, bl
jmp 0x1400142e2
mov bl, 1
lea rcx, [rsp + 0x28]
call fcn.1400031f0
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140020d90
add rsp, 0x70
pop rbx
ret
Function at 0x140014310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14008f010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rcx, [0x14009a7b9]
call fcn.140069c34
mov rcx, rbx
call fcn.140003830
cmp qword [rax + 0x10], 0
jne 0x140014361
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140020d90
add rsp, 0x70
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006520
nop
mov edx, 4
lea rcx, [rsp + 0x28]
call fcn.14000b250
lea rcx, [rsp + 0x28]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400143da
lea rcx, [rsp + 0x48]
call fcn.140003280
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140015820
test al, al
je 0x1400143cb
lea rcx, [rsp + 0x48]
call fcn.140003080
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1400031f0
cmp ebx, 0xffffffff
je 0x1400143e3
test bl, 0x10
je 0x1400143e3
mov bl, 1
jmp 0x1400143e5
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.1400031f0
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140020d90
add rsp, 0x70
pop rbx
ret