joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a54
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [rcx + 8]
mov rsi, rcx
mov ecx, dword [rcx + 0x18]
add rax, r8
mov r15, r8
mov qword [rsp + 0x70], rax
mov r13, rdx
add ecx, dword [rsi + 0x1c]
add ecx, dword [rsi + 0x14]
call fcn.140013358
xor edi, edi
mov r12, rax
test rax, rax
jne 0x140001aa1
lea eax, [rdi + 0xc]
jmp 0x140001bf0
mov ebp, dword [rsi + 0x18]
mov r14, rax
add ebp, dword [rsi + 0x1c]
add ebp, dword [rsi + 0x14]
je 0x140001ae7
mov eax, 0x7fffffff
cmp rbp, rax
mov rbx, rbp
mov r9, r13
mov edx, 1
cmova rbx, rax
mov rcx, r14
mov r8, rbx
call fcn.1400135f0
cmp rax, rbx
jne 0x140001bd3
add r14, rax
sub rbp, rax
mov eax, 0x7fffffff
jne 0x140001ab4
mov ebp, dword [rsi + 0x14]
mov rbx, r12
mov r14d, dword [rsi + 0x18]
add rbp, r12
mov r13d, dword [rsi + 0x1c]
add r14, rbp
mov qword [rsp + 0x80], r14
add r13, r14
mov qword [rsp + 0x20], rbp
mov ecx, dword [rbx]
call qword [sym.imp.WSOCK32.dll_ntohl]
mov ecx, dword [rbx + 4]
mov dword [rbx], eax
call qword [sym.imp.WSOCK32.dll_ntohl]
mov ecx, dword [rbx + 8]
mov dword [rbx + 4], eax
call qword [sym.imp.WSOCK32.dll_ntohl]
mov ecx, dword [rbx]
mov dword [rbx + 8], eax
lea rax, [rcx + r15]
cmp rax, qword [rsp + 0x70]
ja 0x140001be1
lea rax, [rcx + rbp]
cmp rax, qword [rsp + 0x80]
ja 0x140001be1
mov edx, edi
test ecx, ecx
je 0x140001b65
mov ecx, edx
inc edx
mov al, byte [rcx + r15]
add byte [rcx + rbp], al
cmp edx, dword [rbx]
jb 0x140001b56
mov r8d, dword [rbx]
mov edx, 1
mov r9, qword [rsp + 0x88]
mov rcx, rbp
mov esi, dword [rbx]
call fcn.140013158
cmp eax, esi
jne 0x140001bda
mov r8d, dword [rbx + 4]
add r15, rsi
add rbp, rsi
lea rax, [r8 + r14]
cmp rax, r13
ja 0x140001be1
mov r9, qword [rsp + 0x88]
mov edx, 1
mov esi, dword [rbx + 4]
mov rcx, r14
call fcn.140013158
cmp eax, esi
jne 0x140001bda
movsxd rax, dword [rbx + 8]
add r14, rsi
add r15, rax
cmp r15, qword [rsp + 0x70]
ja 0x140001be1
add rbx, 0xc
cmp rbx, qword [rsp + 0x20]
jae 0x140001be6
jmp 0x140001b0b
mov edi, 6
jmp 0x140001be6
mov edi, 0x40
jmp 0x140001be6
mov edi, 0x29
mov rcx, r12
call fcn.140013324
mov eax, edi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002b5c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rdi, rcx
mov ebx, ebp
lea edx, [rbp + 0x2f]
call fcn.14001050c
mov rsi, rax
test rax, rax
je 0x140002c0c
mov rcx, rdi
mov word [rax], bp
call fcn.140002b5c
mov ebx, eax
test eax, eax
jne 0x140002c04
cmp word [rdi], bp
je 0x140002c04
mov rcx, rdi
call fcn.1400140c0
test eax, eax
jns 0x140002c02
call fcn.140018ec4
cmp dword [rax], 0x11
je 0x140002c02
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002bdd
or eax, 1
mov qword [0x14003f0c0], rbp
lea rcx, [0x14002aae0]
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call fcn.140018ec4
mov r8, rdi
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
lea rcx, [0x14003f0c0]
mov r9d, dword [rax]
call fcn.14000b1bc
mov ebx, 7
jmp 0x140002c04
mov ebx, ebp
mov eax, 0x2f
mov word [rsi], ax
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140002c24
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
mov sil, r8b
mov rcx, rdx
mov rbx, rdx
call fcn.140002b5c
test eax, eax
jne 0x140002e2f
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140013fb0
test eax, eax
je 0x140002cbb
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002c93
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call fcn.140018ec4
mov r8, rdi
lea rdx, str.rename_file:_failed_to_read_file_status_info:__S__err:__d
lea rcx, [0x14003f0c0]
mov r9d, dword [rax]
call fcn.14000b1bc
mov eax, 6
jmp 0x140002e2f
movzx eax, word [rsp + 0x36]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x8000
cmp ax, cx
je 0x140002d6e
test sil, sil
je 0x140002d34
mov ecx, 0x4000
cmp ax, cx
je 0x140002d34
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002d0c
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call fcn.140018ec4
mov r8, rdi
lea rdx, str.rename_file:_path_present__but_not_a_file:__S__err:__d
lea rcx, [0x14003f0c0]
mov r9d, dword [rax]
call fcn.14000b1bc
mov eax, 0x30
jmp 0x140002e2f
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002d5b
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.rename_file:_proceeding_to_rename_the_directory
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
xor edx, edx
mov rcx, rbx
call fcn.140014000
test eax, eax
jne 0x140002dcc
mov rcx, rbx
call fcn.140002810
test eax, eax
je 0x140002dcc
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002daf
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r8, rbx
lea rdx, str.rename_file:_destination_file_exists_and_could_not_be_removed:__S
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov eax, 0x3e
jmp 0x140002e2f
mov rdx, rbx
mov rcx, rdi
call fcn.140018ee4
test eax, eax
je 0x140002e2d
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002e02
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call fcn.140018ec4
mov r9, rbx
lea rdx, str.rename_file:_failed_to_rename_file___src:__S__dst:_S__err:__d
mov r8, rdi
mov ecx, dword [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov eax, 7
jmp 0x140002e2f
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000f700
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140003208
Capabilities:
Get common file path
Move file

Disassembly:
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r9, rcx
lea r8, str._s.moz_backup
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.1400024cc
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140014000
test eax, eax
jne 0x1400033ca
lea rcx, [rsp + 0x20]
call fcn.140002810
test eax, eax
je 0x1400033ca
cmp byte [0x14003e198], 0
jne 0x1400033ca
cmp byte [0x14003e199], 0
jne 0x1400033ca
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x1400032aa
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea r8, [rsp + 0x20]
lea rdx, str.backup_discard:_unable_to_remove:__S
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
lea r9, [rbp + 0x130]
xor r8d, r8d
lea rdx, [0x140035368]
lea rcx, str.tobedeleted
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r8d, r8d
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call fcn.140002c24
test eax, eax
je 0x140003348
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x14000331f
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea r9, [rbp + 0x130]
lea r8, [rsp + 0x20]
lea rdx, str.backup_discard:_failed_to_rename_file:_S__dst:_S
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov eax, 0x45
jmp 0x1400033cc
xor edx, edx
lea rcx, [rbp + 0x130]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [0x14003f0a8]
je 0x14000338f
test al, 1
jne 0x140003386
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.backup_discard:_file_renamed_and_will_be_removed_on_OS_reboot:__S
jmp 0x1400033b7
test al, 1
jne 0x1400033b0
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.backup_discard:_failed_to_schedule_OS_reboot_removal_of_file:__S
lea r8, [rbp + 0x130]
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
xor eax, eax
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.14000f700
add rsp, 0x450
pop rbp
ret
Function at 0x140003df8
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov r14, rdx
mov rcx, rdx
call fcn.14001c448
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.140013ebc
xor r15d, r15d
test eax, eax
je 0x140003e87
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140003e5e
or eax, 1
mov qword [0x14003f0c0], r15
lea rcx, [0x14002aae0]
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call fcn.140018ec4
mov r8, qword [rdi + 0x20]
lea rdx, str.LoadSourceFile:_unable_to_stat_destination_file:__S__err:__d
lea rcx, [0x14003f0c0]
mov r9d, dword [rax]
call fcn.14000b1bc
mov eax, 6
jmp 0x140004016
mov r8d, dword [rsp + 0x34]
cmp r8d, dword [rdi + 0x34]
je 0x140003ede
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140003ebd
or eax, 1
mov qword [0x14003f0c0], r15
lea rcx, [0x14002aae0]
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r8d, dword [rsp + 0x34]
mov r9d, dword [rdi + 0x34]
lea rdx, str.LoadSourceFile:_destination_file_size__d_does_not_match_expected_size__d
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov eax, 2
jmp 0x140004016
mov ecx, dword [rdi + 0x34]
call fcn.140013358
mov qword [rdi + 0x50], rax
mov rbp, rax
test rax, rax
jne 0x140003efa
lea eax, [rbp + 0xd]
jmp 0x140004016
mov esi, dword [rdi + 0x34]
test rsi, rsi
je 0x140003f32
mov ebx, 0x7fffffff
mov r9, r14
cmp rsi, rbx
mov edx, 1
mov rcx, rbp
cmovb rbx, rsi
mov r8, rbx
call fcn.1400135f0
cmp rax, rbx
jne 0x140003fd2
add rbp, rax
sub rsi, rax
jne 0x140003f02
mov rdx, qword [rdi + 0x50]
or ebx, 0xffffffff
mov eax, dword [rdi + 0x34]
add rax, rdx
mov r9, rax
sub r9, rdx
cmp rdx, rax
cmova r9, r15
test r9, r9
je 0x140003f80
mov r8, rdx
sub r8, rdx
movzx eax, byte [rdx]
lea r10, [0x140034020]
mov ecx, ebx
inc rdx
shr rcx, 0x18
inc r8
xor rcx, rax
mov eax, ebx
shl eax, 8
mov ebx, dword [r10 + rcx*4]
xor ebx, eax
cmp r8, r9
jne 0x140003f57
not ebx
cmp ebx, dword [rdi + 0x38]
je 0x140004014
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140003fb1
or eax, 1
mov qword [0x14003f0c0], r15
lea rcx, [0x14002aae0]
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r9d, dword [rdi + 0x38]
lea rdx, str.LoadSourceFile:_destination_file_crc__d_does_not_match_expected_crc__d
mov r8d, ebx
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov eax, 4
jmp 0x140004016
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140003ff8
or eax, 1
mov qword [0x14003f0c0], r15
lea rcx, [0x14002aae0]
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r8, qword [rdi + 0x20]
lea rdx, str.LoadSourceFile:_error_reading_destination_file:__S
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
jmp 0x140003e7d
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000f700
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004b44
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x20], r9
push rbp
lea rbp, [rax - 0x57]
sub rsp, 0xe0
mov eax, edx
mov rdi, rcx
mov ecx, eax
mov rdx, r8
call fcn.1400048f4
mov rbx, rax
test rax, rax
je 0x140004c6c
xor edx, edx
lea rcx, [rbp - 0x19]
lea r8d, [rdx + 0x60]
call fcn.140010e20
and qword [rbp - 0x41], 0
lea rax, str.winsta0Default
mov qword [rbp - 0x11], rax
xor r9d, r9d
xor eax, eax
mov dword [rbp - 0x21], 0x68
mov qword [rbp - 0x39], rax
xor r8d, r8d
mov qword [rbp - 0x31], rax
mov rdx, rbx
lea rax, [rbp - 0x41]
mov rcx, rdi
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test eax, eax
je 0x140004c00
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004c62
and qword [rbp + 0x77], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
xor edx, edx
and dword [rsp + 0x28], 0
mov r8d, eax
lea rax, [rbp + 0x77]
mov ecx, 0x1300
mov r9d, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rax, qword [rbp + 0x77]
lea rdx, str._null_
test rax, rax
lea rcx, str.Error_restarting:__s_n
cmovne rdx, rax
call fcn.1400023dc
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140004c62
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call fcn.140013324
mov eax, edi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140005134
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140010e20
mov rcx, qword [0x14003ec88]
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [0x140035ab0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x20]
call fcn.140002b5c
test eax, eax
jne 0x1400051d7
lea rdx, [0x140033a50]
lea rcx, [rsp + 0x20]
call fcn.1400132c0
mov rbx, rax
test rax, rax
je 0x1400051d7
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400051af
mov r9, rax
mov r8d, 1
mov rcx, rdi
call fcn.140013158
mov rcx, rbx
cmp rax, 1
je 0x1400051fa
call fcn.140012d04
xor al, al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14000f700
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
call fcn.140012d04
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.140010e20
mov r9, qword [0x14003ec88]
lea r8, str._supdate.status
mov edx, 0x104
lea rcx, [rsp + 0x230]
call fcn.1400024cc
mov r8d, 1
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x1400051d9

Function at 0x1400052bc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r9, qword [0x14003ec88]
lea r8, str._s_update.status
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400024cc
lea rdx, [0x140035884]
lea rcx, [rsp + 0x60]
call fcn.1400132c0
xor edi, edi
mov rbx, rax
test rax, rax
je 0x1400053ad
xor eax, eax
mov byte [rsp + 0x20], dil
mov r9, rbx
mov qword [rsp + 0x21], rax
lea edx, [rdi + 0x20]
mov qword [rsp + 0x29], rax
lea r8d, [rdi + 1]
mov qword [rsp + 0x31], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
call fcn.1400135f0
movups xmm0, xmmword [str.pending_service]
lea r8d, [rdi + 0xf]
movups xmm1, xmmword [str.applied_service]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
call fcn.140018cf0
test eax, eax
je 0x1400053a2
lea r8d, [rdi + 0xf]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140018cf0
test eax, eax
jne 0x1400053a5
mov dil, 1
mov rcx, rbx
call fcn.140012d04
mov al, dil
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14000f700
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400053d4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r9, qword [0x14003ec88]
lea r8, str._s_update.status
mov rsi, rcx
xor edi, edi
mov byte [rcx], dil
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400024cc
lea rdx, [0x140035884]
lea rcx, [rsp + 0x50]
call fcn.1400132c0
mov rbx, rax
test rax, rax
je 0x1400054b7
xor eax, eax
mov byte [rsp + 0x30], dil
mov r9, rbx
mov qword [rsp + 0x31], rax
lea edx, [rdi + 0x20]
mov qword [rsp + 0x39], rax
lea r8d, [rdi + 1]
mov qword [rsp + 0x41], rax
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
call fcn.1400135f0
movsd xmm0, qword [str.succeeded]
lea r8d, [rdi + 9]
movzx eax, word [0x140035b60]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x28], ax
call fcn.140018cf0
test eax, eax
mov rcx, rbx
mov dil, 1
sete al
mov byte [rsi], al
call fcn.140012d04
mov al, dil
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14000f700
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140007a70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, [0x140035884]
mov r14, rcx
call fcn.1400132c0
mov rbx, rax
test rax, rax
jne 0x140007add
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140007ad4
and qword [0x14003f0c0], rbx
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.GetManifestContents:_error_opening_manifest_file:__S
jmp 0x140007b23
mov rcx, rax
call fcn.14001c448
lea rdx, [rsp + 0x30]
mov ecx, eax
call fcn.140013ebc
test eax, eax
je 0x140007b6b
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140007b1c
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.GetManifestContents:_error_stating_manifest_file:__S
mov r8, r14
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
xor edi, edi
test rbx, rbx
je 0x140007b41
mov rcx, rbx
call fcn.140012d04
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000f700
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov eax, dword [rsp + 0x44]
inc eax
movsxd rcx, eax
call fcn.140013358
mov rsi, rax
test rax, rax
je 0x140007b32
movsxd rax, dword [rsp + 0x44]
mov r15, rsi
mov rbp, rax
test eax, eax
je 0x140007bc0
mov edi, 0x7fffffff
mov r9, rbx
cmp rbp, rdi
mov edx, 1
mov rcx, r15
cmovb rdi, rbp
mov r8, rdi
call fcn.1400135f0
cmp rax, rdi
jne 0x140007bec
add r15, rax
sub rbp, rax
jne 0x140007b90
mov eax, dword [rsp + 0x44]
cdqe
mov byte [rax + rsi], 0
mov eax, dword [rsp + 0x44]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.140013358
mov rdi, rax
test rax, rax
jne 0x140007c2b
mov rcx, rsi
call fcn.140013324
jmp 0x140007b32
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140007c13
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
mov r8, r14
lea rdx, str.GetManifestContents:_error_reading_manifest_file:__S
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
jmp 0x140007bdf
mov eax, dword [rsp + 0x44]
or r9d, 0xffffffff
inc eax
mov r8, rsi
mov dword [rsp + 0x28], eax
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 9]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140007ca7
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140007c7b
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetManifestContents:_error_converting_utf8_to_utf16le:__d
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov rcx, rsi
call fcn.140013324
mov rcx, rdi
jmp 0x140007be2
mov rcx, rsi
call fcn.140013324
jmp 0x140007b34
Function at 0x140008834
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140008884
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400088af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140008880
call fcn.140018ec4
mov dword [rax], 2
xor eax, eax
jmp 0x1400088dc
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x1400088af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140008875
call fcn.140018ec4
mov dword [rax], 9
jmp 0x140008880
lea rbx, [0x14003e1b0]
xor edx, edx
mov rcx, rbx
mov r8d, 0x208
call fcn.140010e20
mov r8d, 0x104
lea rdx, [rsp + 0x4c]
mov rcx, rbx
call fcn.140013fb8
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000f700
add rsp, 0x280
pop rbx
ret

Function at 0x1400089b4
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r14
push r15
sub rsp, 0x20
mov r15d, r8d
mov rbx, r9
mov r14, rdx
test rcx, rcx
je 0x140008aa3
test rdx, rdx
je 0x140008aa3
test rbx, rbx
je 0x140008aa3
cmp dword [rsp + 0x50], 0
je 0x140008aa3
cmp qword [rsp + 0x58], 0
je 0x140008aa3
mov r9, rcx
mov edx, r15d
mov rcx, r14
mov r8d, 1
call fcn.1400135f0
cmp rax, 1
je 0x140008a3e
mov ecx, 2
call fcn.140014718
mov r8, qword [rsp + 0x58]
lea rdx, str.ERROR:_Could_not_read__s_n
mov rcx, rax
call fcn.140002430
jmp 0x140008abc
xor ebp, ebp
cmp dword [rsp + 0x50], ebp
jbe 0x140008a7a
test rbx, rbx
je 0x140008a67
mov rcx, qword [rbx]
xor r9d, r9d
mov r8d, r15d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
neg eax
sbb ecx, ecx
neg ecx
dec ecx
jmp 0x140008a6a
or ecx, 0xffffffff
test ecx, ecx
jne 0x140008a7e
inc ebp
add rbx, 8
cmp ebp, dword [rsp + 0x50]
jb 0x140008a46
xor eax, eax
jmp 0x140008abf
mov ecx, 2
call fcn.140014718
mov r8, qword [rsp + 0x58]
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
call fcn.140002430
mov eax, 0xfffffffe
jmp 0x140008abf
mov ecx, 2
call fcn.140014718
mov rcx, rax
lea rdx, str.ERROR:_Invalid_parameter_specified._n
call fcn.140002430
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
add rsp, 0x20
pop r15
ret
Function at 0x140009b74
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x10], 0
mov rdi, r9
and qword [rbp - 0x18], 0
mov r14, r8
mov ebx, edx
mov dword [rax - 0x38], 0xf0000000
mov rsi, rcx
mov r9d, 1
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140009bf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x140009bd8
xor eax, eax
jmp 0x140009cb9
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140009bd1
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140009bd1
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140009bd1
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
and dword [rsp + 0x20], 0
mov edx, 4
mov r8, rdi
mov dword [rbp - 0x20], edx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140009bd1
mov ecx, dword [rdi]
call fcn.14000f9c0
mov r8d, dword [rdi]
xor edx, edx
mov rcx, rax
mov qword [r14], rax
mov rbx, rax
call fcn.140010e20
mov rcx, qword [rbp - 0x18]
mov r9, rdi
and dword [rsp + 0x20], 0
mov r8, rbx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140009bd1
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140009ca3
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140009cb4
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret