joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e7d44
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov r14, rcx
mov byte [rbp - 0x39], 0
lea rax, [rbp - 0x39]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x11], rax
and qword [rbp + 0x17], 0
and qword [rbp + 0x1f], 0
lea rax, [rbp + 0x17]
mov qword [rbp + 0x27], rax
lea rax, [rbp - 0x11]
mov qword [rbp + 0x2f], rax
xor r9d, r9d
lea r8, [rbp + 0x27]
lea rdx, [0x1400e82d0]
lea rcx, [0x1403c7528]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400e7f0c
mov rbx, qword [rbp + 0x1f]
test rbx, rbx
je 0x1400e7e0c
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400e7e0c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x1400e7e0c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
mov rax, qword [0x1403c7530]
and qword [rbp + 0xf], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xf]
mov rcx, qword [rax]
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e7f2f
mov rax, qword [rdi + 8]
mov rdx, qword [rax]
mov rax, qword [rdi]
mov rcx, qword [rax]
lea rax, [0x140174ab8]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rdx
mov rsi, qword [rbp + 0xf]
lea rcx, [rbp - 0x31]
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
mov rbx, rax
lea rcx, [rbp - 0x31]
call fcn.1400e84d0
mov rdi, rax
sub edi, ebx
mov rdx, qword [rbp - 0x31]
lea rcx, [rbp - 0x31]
mov rax, qword [rdx + 8]
call qword [case.0x1400b5e20.0]
mov rdx, rax
xor r9d, r9d
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e7f59
xor r9d, r9d
lea r8d, [r9 + 0x20]
mov rdx, r14
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e7f44
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x1400e7ee5
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov rax, r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp qword [rbp + 0x17], 0
je 0x1400e7f29
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140028f78
mov rcx, rax
call fcn.1400282c0
int3
call fcn.14002acc0
nop
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x1b
call fcn.14003adb0
int3
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x27
call fcn.14003adb0
nop
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x22
call fcn.14003adb0
int3
Function at 0x1400e7f74
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov r14, rcx
mov byte [rbp - 0x39], 0
lea rax, [rbp - 0x39]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x11], rax
and qword [rbp + 0x17], 0
and qword [rbp + 0x1f], 0
lea rax, [rbp + 0x17]
mov qword [rbp + 0x27], rax
lea rax, [rbp - 0x11]
mov qword [rbp + 0x2f], rax
xor r9d, r9d
lea r8, [rbp + 0x27]
lea rdx, [0x1400e83b0]
lea rcx, [0x1403c7558]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400e813c
mov rbx, qword [rbp + 0x1f]
test rbx, rbx
je 0x1400e803c
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400e803c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x1400e803c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
mov rax, qword [0x1403c7560]
and qword [rbp + 0xf], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xf]
mov rcx, qword [rax]
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e815f
mov rax, qword [rdi + 8]
mov rdx, qword [rax]
mov rax, qword [rdi]
mov rcx, qword [rax]
lea rax, [0x140174ab8]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rdx
mov rsi, qword [rbp + 0xf]
lea rcx, [rbp - 0x31]
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
mov rbx, rax
lea rcx, [rbp - 0x31]
call fcn.1400e84d0
mov rdi, rax
sub edi, ebx
mov rdx, qword [rbp - 0x31]
lea rcx, [rbp - 0x31]
mov rax, qword [rdx + 8]
call qword [case.0x1400b5e20.0]
mov rdx, rax
xor r9d, r9d
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e8189
xor r9d, r9d
lea r8d, [r9 + 0x10]
mov rdx, r14
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e8174
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x1400e8115
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov rax, r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp qword [rbp + 0x17], 0
je 0x1400e8159
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140028f78
mov rcx, rax
call fcn.1400282c0
int3
call fcn.14002acc0
nop
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x1b
call fcn.14003adb0
int3
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x27
call fcn.14003adb0
nop
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x22
call fcn.14003adb0
int3
Function at 0x1400e8ca4
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
movsxd rsi, edx
mov rdi, rcx
mov eax, esi
mov r11d, r8d
cdq
mov ebx, r8d
and edx, 0xf
movabs rbp, 0x87c37b91114253d5
add eax, edx
movabs r14, 0x4cf5ad432745937f
sar eax, 4
xor edx, edx
movsxd r10, eax
mov r8, r10
test eax, eax
jle 0x1400e8d42
mov rax, qword [rcx]
lea rcx, [rcx + 0x10]
imul rax, rbp
rol rax, 0x1f
imul rax, r14
xor rax, r11
rol rax, 0x1b
add rax, rbx
lea r11, [rax*4 + 0x52dce729]
add r11, rax
mov rax, qword [rcx - 8]
imul rax, r14
rol rax, 0x21
imul rax, rbp
xor rax, rbx
rol rax, 0x1f
add rax, 0xb41def1
add rax, r11
lea rbx, [rax + rax*4]
sub r8, 1
jne 0x1400e8cf0
shl r10d, 4
mov ecx, esi
movsxd r8, r10d
and ecx, 0xf
add r8, rdi
cmp ecx, 8
ja 0x1400e8da0
je 0x1400e8e23
sub ecx, 1
je 0x1400e8e74
sub ecx, 1
je 0x1400e8e68
sub ecx, 1
je 0x1400e8e5c
sub ecx, 1
je 0x1400e8e50
sub ecx, 1
je 0x1400e8e44
sub ecx, 1
je 0x1400e8e38
cmp ecx, 1
je 0x1400e8e2c
jmp 0x1400e8e8a
sub ecx, 9
je 0x1400e8e0c
sub ecx, 1
je 0x1400e8e00
sub ecx, 1
je 0x1400e8df4
sub ecx, 1
je 0x1400e8de8
sub ecx, 1
je 0x1400e8ddc
sub ecx, 1
je 0x1400e8dd0
cmp ecx, 1
jne 0x1400e8e8a
movzx edx, byte [r8 + 0xe]
shl rdx, 0x30
movzx eax, byte [r8 + 0xd]
shl rax, 0x28
xor rdx, rax
movzx eax, byte [r8 + 0xc]
shl rax, 0x20
xor rdx, rax
movzx eax, byte [r8 + 0xb]
shl rax, 0x18
xor rdx, rax
movzx eax, byte [r8 + 0xa]
shl rax, 0x10
xor rdx, rax
movzx eax, byte [r8 + 9]
shl rax, 8
xor rdx, rax
movzx eax, byte [r8 + 8]
xor rax, rdx
imul rax, r14
rol rax, 0x21
imul rax, rbp
xor rbx, rax
movzx edx, byte [r8 + 7]
shl rdx, 0x38
movzx eax, byte [r8 + 6]
shl rax, 0x30
xor rdx, rax
movzx eax, byte [r8 + 5]
shl rax, 0x28
xor rdx, rax
movzx eax, byte [r8 + 4]
shl rax, 0x20
xor rdx, rax
movzx eax, byte [r8 + 3]
shl rax, 0x18
xor rdx, rax
movzx eax, byte [r8 + 2]
shl rax, 0x10
xor rdx, rax
movzx eax, byte [r8 + 1]
shl rax, 8
xor rdx, rax
movzx eax, byte [r8]
xor rax, rdx
imul rax, rbp
rol rax, 0x1f
imul rax, r14
xor r11, rax
mov rbp, qword [rsp + 0x18]
xor rbx, rsi
mov rdi, qword [rsp + 0x28]
mov rcx, rsi
mov rsi, qword [rsp + 0x20]
xor rcx, r11
add rcx, rbx
movabs r10, 0xff51afd7ed558ccd
mov rax, rcx
movabs r8, 0xc4ceb9fe1a85ec53
shr rax, 0x21
xor rax, rcx
imul rax, r10
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
lea rax, [rbx + rcx]
mov rbx, qword [rsp + 0x10]
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
imul rcx, r10
imul rdx, r8
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, r8
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
mov rax, rdx
shr rax, 0x21
xor rax, rdx
add rax, rcx
mov qword [r9], rax
add rax, rcx
mov qword [r9 + 8], rax
pop r14
ret
Function at 0x1400e8f24
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x59], rcx
lea rcx, [rbp + 0x17]
call fcn.14000da98
nop
lea rax, [rbp + 0x17]
mov qword [rbp - 0x51], rax
mov rdx, qword [rbp + 0x27]
lea rcx, [rbp + 0x17]
call fcn.140021b90
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
mov rdx, qword [rbp + 0x27]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
lea rcx, [rbp - 0x51]
call fcn.1400219e8
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbp + 0x27]
movups xmmword [rbp + 7], xmm1
xor esi, esi
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], si
xor r8d, r8d
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x39]
call fcn.1400e7644
nop
lea rcx, [rbp + 0x17]
call fcn.140006970
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rcx, [rbp - 0x39]
call fcn.140006970
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400e9004
mov rcx, qword [rbx]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x59], rax
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.1400c7cfc
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400e904a
mov rdx, qword [rbx]
mov rax, qword [rbp - 0x49]
test rax, rax
je 0x1400e9058
mov r9, qword [rax]
jmp 0x1400e905b
mov r9, rsi
mov rcx, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rdx
lea rax, [0x14017a218]
mov qword [rsp + 0x20], rax
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
mov edx, 0x1b6
call fcn.1400ea984
mov ecx, 0x68
call fcn.14011006c
mov qword [rbp - 0x11], rax
lea r8, [rbp - 0x49]
mov rdx, rbx
mov rcx, rax
call fcn.1400ea1d8
mov rcx, rax
add rax, 0x10
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov rbx, qword [rbp - 0x41]
test rbx, rbx
je 0x1400e90ed
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400e90ed
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
mov edx, esi
lock xadd dword [rbx + 0xc], edx
add edx, esi
jne 0x1400e90ed
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 8]
call qword [case.0x1400b5e20.0]
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e9118
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400e9150
mov rcx, qword [rdx]
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebp, eax
test eax, eax
jne 0x1400e916c
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
jmp 0x1400e9226
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.140033b84
nop
cmp qword [rsi + 0x18], 8
jb 0x1400e9184
mov rsi, qword [rsi]
mov rbx, qword [rsp + 0x40]
mov r9, rbx
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x1400e9258
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [0x14017c5bc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x1400e9246
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x20], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
mov byte [rdi + 8], 1
test rbx, rbx
je 0x1400e9226
mov rdx, qword [rsp + 0x50]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400e921e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e921e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140110004
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
mov edx, 0x1e3
call fcn.1400290d4
int3
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
mov edx, 0x1df
call fcn.1400290d4
int3
Function at 0x1400ea1d8
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rcx
mov eax, 1
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], eax
lea rax, [0x140174af0]
mov qword [rcx], rax
lea rdi, [rcx + 0x10]
mov qword [rbp - 0x48], rdi
mov rax, qword [r8]
mov qword [rbp - 0x60], rax
mov rax, qword [r8 + 8]
mov qword [rbp - 0x58], rax
and qword [r8], 0
and qword [r8 + 8], 0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x40], rax
lea rax, [0x140174b10]
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov rcx, rbx
call fcn.14000da98
nop
mov rax, qword [rbp - 0x60]
mov qword [rdi + 0x28], rax
mov rax, qword [rbp - 0x58]
mov qword [rdi + 0x30], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
lea r15, [rdi + 0x38]
mov qword [rbp - 0x10], r15
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1400ea289
mov rcx, qword [rcx]
mov rsi, qword [rbp + 0x28]
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400ea346
cmp qword [rbx + 0x18], 8
jb 0x1400ea2a9
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140006594
mov r8, qword [rbp - 0x10]
mov rdx, rax
mov rcx, r15
call fcn.1400ea690
nop
and qword [rdi + 0x48], 0
and qword [rdi + 0x50], 0
mov rax, qword [rdi + 0x40]
mov rdx, qword [rax]
mov rcx, rdi
call fcn.1400e9c84
nop
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x1400ea320
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x1400ea320
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
mov edx, edi
lock xadd dword [rbx + 0xc], edx
add edx, edi
jne 0x1400ea320
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 8]
call qword [case.0x1400b5e20.0]
mov rax, r14
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
mov edx, 0x24
mov rcx, rsi
call fcn.1400290d4
int3
Function at 0x1400ea4e8
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r8
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], r8
lea rax, [0x140174b60]
mov qword [rcx], rax
lea rbx, [rcx + 8]
mov rcx, rbx
call fcn.14000da98
nop
and qword [rdi + 0x28], 0
and qword [rdi + 0x30], 0
mov rax, qword [r14]
mov qword [rdi + 0x28], rax
mov rax, qword [r14 + 8]
mov qword [rdi + 0x30], rax
and qword [r14], 0
and qword [r14 + 8], 0
lea rbp, [rdi + 0x38]
mov qword [rsp + 0x60], rbp
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1400ea569
mov rcx, qword [rcx]
mov rsi, qword [rsp + 0x98]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400ea622
cmp qword [rbx + 0x18], 8
jb 0x1400ea58e
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140006594
mov r8, qword [rsp + 0x60]
mov rdx, rax
mov rcx, rbp
call fcn.1400ea690
nop
and qword [rdi + 0x48], 0
and qword [rdi + 0x50], 0
mov rax, qword [rdi + 0x40]
mov rdx, qword [rax]
mov rcx, rdi
call fcn.1400e9f8c
nop
mov rbx, qword [r14 + 8]
test rbx, rbx
je 0x1400ea607
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400ea607
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
mov edx, esi
lock xadd dword [rbx + 0xc], edx
add edx, esi
jne 0x1400ea607
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 8]
call qword [case.0x1400b5e20.0]
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14010fb20
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea r8, str.onecore_amcore_smartscreencommonwindows_src_file.cpp
mov edx, 0x24
mov rcx, rsi
call fcn.1400290d4
int3
Function at 0x1400ea690
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rdx
xor ebx, ebx
mov qword [rcx], rbx
mov rcx, rdx
mov rdx, qword [rdx + 0x18]
cmp rdx, 8
jb 0x1400ea6df
mov rcx, qword [rcx]
mov rax, qword [rdi + 0x10]
lea rax, [rcx + rax*2]
mov rcx, rdi
jb 0x1400ea6ef
mov rcx, qword [rdi]
mov r9, rbx
mov r8, rax
sub r8, rcx
mov r14d, 1
add r8, r14
shr r8, 1
cmp rcx, rax
cmova r8, rbx
test r8, r8
je 0x1400ea72e
cmp word [rcx], 0x5c
jne 0x1400ea71e
mov eax, 0x7c
mov word [rcx], ax
add rcx, 2
add r9, r14
cmp r9, r8
jne 0x1400ea710
mov rdx, qword [rdi + 0x18]
mov qword [rbp - 0x40], rsi
lea rax, [rbp + 0x50]
mov qword [rbp - 0x38], rax
movups xmm0, xmmword [rbp - 0x40]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x30], r14b
mov r8, rdi
cmp rdx, 8
jb 0x1400ea753
mov r8, qword [rdi]
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov r15, rax
mov r13, qword [rsi]
lea rax, [r13 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400ea789
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov qword [rsi], r15
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400ea7fb
mov r14b, bl
mov byte [rbp - 0x30], bl
mov qword [rsp + 0x20], 8
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rcx, qword [rbp + 0x38]
test rax, rax
je 0x1400ea869
test r14b, r14b
je 0x1400ea7d5
mov rdx, qword [rbp + 0x50]
mov qword [rax], rdx
mov rcx, rdi
call fcn.140006970
mov rax, rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14010fb20
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400ea808
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 8
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
mov r13, qword [rsi]
lea rax, [r13 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400ea851
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi], r15
mov rcx, qword [rbp + 0x38]
lea rax, [r15 + 1]
test rax, 0xfffffffffffffffe
je 0x1400ea87b
jmp 0x1400ea79c
lea r8, str.onecore_amcore_smartscreencommoncore_src_shared_value.h
mov edx, 0x21
call fcn.1400290d4
int3
lea r8, str.onecore_amcore_smartscreencommoncore_src_shared_value.h
mov edx, 0x1d
call fcn.1400290d4
int3
Function at 0x1400eac44
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], r9
mov r9d, 0x10
and qword [r11 - 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010fb20
add rsp, 0x58
ret
Function at 0x1400eb8bc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r12d, r12d
lea rax, [r11 - 0x48]
mov r15, r8
mov qword [r11 - 0x50], rax
mov rbp, rdx
mov qword [r11 - 0x58], r12
mov r14, rcx
mov dword [r11 - 0x48], r12d
mov rdx, r15
lea r9, [r11 - 0x44]
mov rcx, rbp
xor r8d, r8d
mov edi, r12d
mov esi, r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400eba80
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
dec eax
cmp eax, 1
ja 0x1400eb944
test ecx, ecx
je 0x1400eb944
test cl, 1
je 0x1400eb949
mov ebx, 0x8007000d
test ebx, ebx
js 0x1400eba80
call qword [sym.imp.OLE32.dll_CoTaskMemAlloc]
mov rdi, rax
mov r13d, 0x8007000e
neg rax
sbb ebx, ebx
not ebx
and ebx, r13d
test rdi, rdi
je 0x1400eba2f
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rdx, r15
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400eba80
mov esi, dword [rsp + 0x30]
shr esi, 1
dec esi
cmp dword [rsp + 0x34], 2
jne 0x1400eba2f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r15d, eax
test eax, eax
je 0x1400eba2f
mov ecx, r15d
add rcx, rcx
call qword [sym.imp.OLE32.dll_CoTaskMemAlloc]
mov rcx, rax
mov rbp, rax
neg rcx
sbb ebx, ebx
not ebx
and ebx, r13d
test rax, rax
je 0x1400eba2f
mov r8d, r15d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r13d, eax
test eax, eax
je 0x1400eba21
cmp eax, r15d
ja 0x1400eba21
mov rcx, rdi
mov ebx, r12d
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
mov rdi, rbp
lea esi, [r13 - 1]
jmp 0x1400eba33
mov rcx, rbp
mov ebx, 0x8007007a
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
test ebx, ebx
js 0x1400eba80
mov eax, esi
cmp word [rdi + rax*2], r12w
jne 0x1400eba7b
mov rcx, qword [r14]
inc esi
test rcx, rcx
je 0x1400eba4f
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
mov qword [r14], r12
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
test rdi, rdi
je 0x1400eba76
test rsi, rsi
je 0x1400eba76
lea rax, [rsi - 1]
mov qword [r14], rdi
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rsi
mov word [rdi + rsi*2 - 2], r12w
mov rdi, r12
jmp 0x1400eba80
mov ebx, 0x8007000d
mov rcx, rdi
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret