joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047e10
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [rsi], ecx
jne 0x140047fc2
mov dword [0x14023c260], ebx
lea rbp, [0x14023c260]
movabs rax, 0x100000000
mov qword [0x14023c380], rax
movaps xmm6, xmmword [0x1401fa990]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov r14, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, rdi
call r14
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [0x14023c388], rcx
mov r15d, 0x20
mov qword [0x14023c390], r15
mov r12d, 0x40
mov qword [0x14023c398], r12
mov dword [0x14023c3a0], ebx
mov qword [0x14023c268], rbx
lea rax, [0x14023c268]
mov r13, 0xffffffffb37cc16a
xor rax, r13
mov qword [0x14023c270], rax
mov qword [0x14023c278], rbp
mov dword [0x14023c288], ebx
lea rcx, [0x14023c290]
mov r8d, 0xf0
xor edx, edx
call fcn.14016a6d0
mov dword [0x14023c3a8], ebx
lea rbp, [0x14023c3a8]
mov qword [0x14023c4c8], rbx
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdi, [rsp + 0x20]
mov rcx, rdi
call r14
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [0x14023c4d0], rcx
mov qword [0x14023c4d8], r15
mov qword [0x14023c4e0], r12
mov dword [0x14023c4e8], ebx
mov qword [0x14023c3b0], rbx
lea rax, [0x14023c3b0]
xor rax, r13
mov qword [0x14023c3b8], rax
mov qword [0x14023c3c0], rbp
mov dword [0x14023c3d0], ebx
lea rcx, [0x14023c3d8]
mov r8d, 0xf0
xor edx, edx
call fcn.14016a6d0
mov eax, 0xdd
xchg dword [rsi], eax
cmp eax, 0x5a308d2
je 0x140047fe2
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x140047fac
call fcn.1401363f0
int3
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r9d, edx
lea r8, [0x1401ffff0]
mov rcx, rsi
mov edx, 3
call fcn.140062c70
test eax, eax
jne 0x140047f95
jmp 0x140047e4a
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401363f0
mov rcx, rsi
mov dl, 1
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14016d7f0
Function at 0x140049580
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14016a6d0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14004961f
cmp word [rsp + 0x70], 0
je 0x14004961f
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1401341e0
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400f4790
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x140049611
call fcn.1401363f0
int3
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.140053a70
test al, al
jne 0x14004966d
lea rax, [0x14020a8d0]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1400f4790
cmp byte [rsp + 0x57], 0
jns 0x1400495f7
mov rcx, qword [rsp + 0x40]
call fcn.140133b2c
jmp 0x1400495f7
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x1400495f7

Function at 0x140049e90
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x140049eb6
call fcn.1400a7ad0
cmp qword [rsi], rbx
je 0x140049ee5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140049ef2
cmp r14, 2
jb 0x140049edd
mov qword [rsi], rbx
call fcn.1400a7ad0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400a7ad0
mov rcx, qword [rsi]
call fcn.140110390
mov qword [rsi], 0
jmp 0x140049ecf
Function at 0x14004abe0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x14004ad75
mov rbx, r9
mov edi, r8d
mov ebp, edx
mov rsi, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov r14, qword [rsi]
cmp r14, rax
je 0x14004ac68
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004ad54
lea rax, [r15 + 1]
cmp rax, 2
jb 0x14004ac5c
mov qword [rsi], r15
call fcn.1400a7ad0
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
lea rax, [r14 + 1]
cmp rax, 1
jbe 0x14004ad7c
xor r15d, r15d
lea rcx, [rsp + 0x30]
mov r8d, 0x90
xor edx, edx
call fcn.14016a6d0
test ebp, ebp
jne 0x14004ad2f
mov ecx, 0xff
mov r15d, 0x408
mov dword [rsp + 0x58], 1
mov eax, r15d
mov dword [rsp + 0x2c], ecx
mov r15d, ecx
test rbx, rbx
je 0x14004acc2
or eax, 0x100
mov qword [rsp + 0xa0], rbx
or eax, 0x2000
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x30]
mov rcx, r14
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14004ad6d
not edi
and r15d, edi
lea r8, [rsp + 0x2c]
mov dword [r8], r15d
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x14004ad6d
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x14004ad44
call fcn.1401363f0
int3
cmp ebp, 1
jne 0x14004ada3
mov ecx, 0xd8
mov r15d, 8
jmp 0x14004ac9e
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400a7ad0
mov rcx, qword [rsi]
call fcn.140110390
mov qword [rsi], 0
jmp 0x14004ac4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004ad15
mov eax, 0x4df
jmp 0x14004ad15
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401363f0
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xc8
cmp ebp, 2
je 0x14004aca6
mov eax, 0
cmp ebp, 3
je 0x14004acb0
jmp 0x14004accb
Function at 0x14004cfa0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, r8d
mov rsi, rdx
mov rdx, qword [0x14022c040]
xor rdx, rsp
mov qword [rsp + 0x40], rdx
mov rcx, qword [rcx]
movabs rdx, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x38]
mov qword [r8], rdx
or r9d, 8
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 2
mov edx, r9d
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14004d080
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14004d080
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004d07c
call fcn.1400a7ad0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], 0
mov bpl, 1
test rbx, rbx
je 0x14004d055
cmp rbx, 0xffffffffffffffff
je 0x14004d087
call fcn.1400a7ad0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsi], rbx
call fcn.1400a7ad0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x14004d070
call fcn.1401363f0
int3
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x14004d01b
mov byte [rsi], 0
xor ebp, ebp
jmp 0x14004d055
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14004d04d
Function at 0x14004dbb0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rdx]
test rbx, rbx
je 0x14004dc62
lea r14, [rsp + 0x38]
mov qword [r14], 0
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov r15, rax
call r12
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rbx
mov r8, r15
mov r9, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14004dd56
mov r14, qword [rsp + 0x38]
cmp qword [rsi], r14
je 0x14004dc62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004dd25
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14004dc5a
mov qword [rsi], r14
call fcn.1400a7ad0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14004dcf2
lea r14, [rsp + 0x38]
mov qword [r14], 0
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r12
mov r15, rax
call r12
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rbx
mov r8, r15
mov r9, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14004dd56
mov r14, qword [rsp + 0x38]
cmp qword [rsi + 8], r14
je 0x14004dcf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14004dd3e
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14004dcea
mov qword [rsi + 8], r14
call fcn.1400a7ad0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x14004dd17
call fcn.1401363f0
int3
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400a7ad0
mov rcx, qword [rsi]
call fcn.140110390
mov qword [rsi], 0
jmp 0x14004dc48
call fcn.1400a7ad0
mov rcx, qword [rsi + 8]
call fcn.140110390
mov qword [rsi + 8], 0
jmp 0x14004dcd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14004dd00
Function at 0x140052d60
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
je 0x140052ea3
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], 0
test rdi, rdi
je 0x140052db0
mov rcx, rdi
call fcn.140052ee0
mov rcx, rdi
call fcn.140133b2c
mov rcx, qword [rsi + 0x48]
mov qword [rsi + 0x48], 0
test rcx, rcx
je 0x140052dc8
xor edx, edx
call fcn.1400021e0
mov rcx, qword [rsi + 0x38]
movabs rax, 0xfffffffc00000000
and rax, rcx
cmp rax, qword [0x14022e648]
je 0x140052e99
mov rdi, qword [rsi + 0x30]
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
test rdi, rdi
jne 0x140052ec6
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x140052e38
call fcn.1400a7ad0
mov rdi, qword [rsi + 0x28]
cmp qword [0x14023e3e8], 0
je 0x140052e58
mov rcx, qword [0x14023e3e8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x14021e390]
mov qword [rsi + 0x28], 0
lea rcx, [rsi + 0x20]
call fcn.14004ce90
lea rcx, [rsi + 0x18]
call fcn.14004ce90
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14004a0e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140211538]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140052edb
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140052e93
call qword [0x14021e390]
mov rcx, rax
xor edx, edx
call fcn.14001e8b0
jmp 0x140052e1a
xor ecx, ecx
mov dl, 1
jmp 0x140052e8c
call fcn.140003910
jmp 0x140052de6
test rcx, rcx
jne 0x140052d76
cmp dword [rsi + 0x14], 0
jne 0x140052d76
cmp qword [rsi + 8], 0
jne 0x140052d76
jmp 0x140052d8f
mov rcx, rdi
call fcn.140052ee0
mov rcx, rdi
call fcn.140133b2c
jmp 0x140052dfa
xor ecx, ecx
jmp 0x140052e8a

Function at 0x140053a70
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.14016a6d0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x140053b2d
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1401341e0
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400f4790
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140053b60
cmp byte [rsi + 0x17], 0
jns 0x140053aff
mov rcx, qword [rsi]
call fcn.140133b2c
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x140053b2d
mov rcx, qword [rsp + 0x30]
call fcn.140133b2c
cmp edi, 0x103
setb al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x140053b50
call fcn.1401363f0
int3
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140056910
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov sil, 1
test r8, r8
je 0x140056996
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12d, 0xffffffff
lea r15, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, r12
mov r8d, 0xffffffff
cmovb r8, rdi
mov dword [rsp + 0x30], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rbx
mov r9, r15
call r13
test eax, eax
je 0x1400569c8
mov eax, dword [rsp + 0x30]
cmp rax, r12
je 0x1400569c5
add rbx, rax
sub rdi, rax
jne 0x140056957
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x1400569b0
call fcn.1401363f0
int3
mov eax, esi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
cmp dword [0x14023e2a0], 2
jg 0x140056a19
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x8c
mov r9d, 2
call fcn.14018c510
lea rcx, [rsp + 0x40]
lea rdx, [0x140218918]
mov r8d, 9
call fcn.140122650
mov rcx, rsi
call fcn.14018c580
xor esi, esi
jmp 0x140056996

Function at 0x140057990
Capabilities:
Clear file content

Disassembly:
push rsi
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x168], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x160]
mov qword [r8], rax
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140057a14
cmp qword [rsp + 0x160], 0
jne 0x140057aaf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, eax
mov al, 1
test ecx, ecx
je 0x140057a5e
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x140057a0b
call fcn.1401363f0
int3
add rsp, 0x170
pop rsi
ret
cmp dword [0x14023e2a0], 2
jg 0x140057aaf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xf1
mov r9d, 2
call fcn.14018c510
lea rcx, [rsp + 0x38]
lea rdx, [0x14021888e]
mov r8d, 0x10
jmp 0x140057aa2
cmp dword [0x14023e2a0], 2
jg 0x140057aaf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.14018c510
lea rcx, [rsp + 0x38]
lea rdx, [0x14021889f]
mov r8d, 0xc
call fcn.140122650
mov rcx, rsi
call fcn.14018c580
xor eax, eax
jmp 0x1400579f1
Function at 0x140059380
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140059d30
mov rax, qword [rsi]
test rax, rax
je 0x140059401
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140059408
lea rcx, [rsp + 0x28]
call fcn.140059470
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x1400593f1
call fcn.1401363f0
int3
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x1400593d0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x14005942c
cmp byte [rbx + 0x27], 0
js 0x140059421
lea rcx, [rbx + 0x10]
jmp 0x140059425
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x140059437
add rbx, 0x70
cmp rbx, r15
je 0x1400593d0
jmp 0x14005940f
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x140059456
mov rcx, r14
mov rdx, rbx
call fcn.1401a4240
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14005942c
mov rcx, rdi
mov rdx, rbx
call fcn.1401a40e0
mov r14, rax
jmp 0x140059450
Function at 0x140062470
Capabilities:
Get token privileges

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx]
lea r15, [rsp + 0x2c]
mov dword [r15], 0
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov edx, 3
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14006269e
mov r14d, dword [rsp + 0x2c]
test r14d, r14d
je 0x14006269e
mov rcx, r14
call fcn.140133b54
mov rdi, rax
xor eax, eax
mov rcx, rdi
add rcx, rax
je 0x1400625bb
mov byte [rcx], 0
inc rax
cmp r14, rax
jne 0x1400624dd
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov edx, 3
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140062699
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov eax, dword [rdi]
test rax, rax
je 0x140062583
shl rax, 2
lea r14, [rax + rax*2]
mov rcx, r14
call fcn.140133b54
mov rbx, rax
add r14, rax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r14
lea r15, [rdi + 0xc]
xor r12d, r12d
mov r13, qword [r15 - 8]
mov rcx, qword [rsi + 0x10]
cmp rbx, rcx
jae 0x1400625cb
test rbx, rbx
je 0x1400625bb
mov eax, dword [r15]
mov qword [rbx], r13
mov dword [rbx + 8], eax
add rbx, 0xc
mov qword [rsi + 8], rbx
inc r12
mov eax, dword [rdi]
add r15, 0xc
cmp r12, rax
jb 0x140062552
test rdi, rdi
je 0x140062590
mov rcx, rdi
call fcn.140133b2c
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x1400625a7
call fcn.1401363f0
int3
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
call fcn.14016f450
call fcn.14016eb90
xor eax, eax
jmp 0x140062639
movabs rax, 0x1555555555555555
mov r8, qword [rsi]
sub rbx, r8
sar rbx, 2
movabs r9, 0xaaaaaaaaaaaaaaab
imul rbx, r9
lea rdx, [rbx + 1]
cmp rdx, rax
ja 0x1400625bd
sub rcx, r8
sar rcx, 2
imul rcx, r9
lea rbp, [rcx + rcx]
cmp rbp, rdx
ja 0x14006260d
mov rbp, rdx
movabs rdx, 0xaaaaaaaaaaaaaaa
cmp rcx, rdx
cmovae rbp, rax
test rbp, rbp
je 0x1400625c7
cmp rbp, rax
ja 0x1400625c2
lea rax, [rbp*4]
lea rcx, [rax + rax*2]
call fcn.140133b54
lea r14, [rbx + rbx*2]
shl r14, 2
add r14, rax
je 0x1400625bb
lea rcx, [rbp*2]
add rcx, rbp
lea rbp, [rax + rcx*4]
mov eax, dword [r15]
mov qword [r14], r13
mov dword [r14 + 8], eax
lea rbx, [r14 + 0xc]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
sub r14, r8
mov rcx, r14
call fcn.14016a030
mov rcx, qword [rsi]
mov qword [rsi], r14
mov qword [rsi + 0x10], rbp
test rcx, rcx
je 0x140062571
call fcn.140133b2c
jmp 0x140062571
test rdi, rdi
jne 0x1400626b1
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x140062590
mov rcx, rdi
call fcn.140133b2c
jmp 0x14006269e
Function at 0x1400629e0
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x140062b66
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x140062b66
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rbx, rax
mov r15, qword [rdi + 8]
cmp r15, rax
je 0x140062a74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x140062b8b
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140062a65
mov qword [rdi + 8], rbx
call fcn.1400a7ad0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 8]
mov rbx, r15
inc rbx
cmp rbx, 2
jb 0x140062c27
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.140133b54
mov r14, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.140133b54
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov rax, r14
and rax, r12
cmp rax, qword [0x14022e648]
je 0x140062c32
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x14022e648]
je 0x140062bc1
mov qword [rdi + 0x18], r14
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140052600]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp qword [rdi + 0x10], rax
je 0x140062b5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x140062ba6
mov rax, r15
inc rax
cmp rax, 2
jb 0x140062b51
mov qword [rdi + 0x10], r15
call fcn.1400a7ad0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x10]
inc r15
cmp r15, 1
jbe 0x140062bcb
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x140062c3f
mov eax, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400a7ad0
mov rcx, qword [rdi + 8]
call fcn.140110390
mov qword [rdi + 8], 0
jmp 0x140062a50
call fcn.1400a7ad0
mov rcx, qword [rdi + 0x10]
call fcn.140110390
mov qword [rdi + 0x10], 0
jmp 0x140062b3c
call fcn.140003910
jmp 0x140062af2
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x14022e648]
jne 0x140062be0
call fcn.140003910
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x140062c27
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x140062c0e
mov rcx, rdi
call fcn.1400a0fc0
mov rcx, rdi
call fcn.140133b2c
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x140062c56
mov rcx, rbx
call fcn.140133b2c
mov r14d, 0x3b
jmp 0x140062b66
mov rcx, r14
call fcn.1400037d0
jmp 0x140062adb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x14021e390]
jmp 0x140062b79
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x14021e390]
jmp 0x140062c1f