joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020b6d0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp word [rdx], 0
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
jne 0x14020b70f
mov r8d, 0x66
lea rdx, str.ImpersonateLoggedInUser.cpp
lea rcx, str.wszAppName_0____L0
call fcn.1402aa4f4
xor edx, edx
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [rdx + 1]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
jne 0x14020b754
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
call fcn.1400e1650
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
mov byte [rdi + 0x10], 0
movups xmmword [rdi], xmm0
jmp 0x14020b808
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xa0], rbx
lea rcx, [rsp + 0x30]
call fcn.14020b4f0
mov r8d, dword [rsp + 0x58]
xor ebx, ebx
test r8d, r8d
je 0x14020b7b0
nop word [rax + rax]
mov rax, qword [rsp + 0x50]
lea rcx, [rbx + rbx*2]
cmp ebp, dword [rax + rcx*8]
jne 0x14020b7a9
mov rdx, qword [rax + rcx*8 + 8]
test rdx, rdx
je 0x14020b7a9
mov rcx, rsi
call fcn.14029df98
test eax, eax
je 0x14020b820
mov r8d, dword [rsp + 0x58]
inc ebx
cmp ebx, r8d
jb 0x14020b780
mov rax, qword gs:[0x58]
lea rbx, str._k0_
mov ecx, dword [0x1403f0e4c]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1403f078c], eax
jg 0x14020b835
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [rsp + 0x40]
mov byte [rdi + 0x10], 0
movups xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rbx, qword [rsp + 0xa0]
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rsp + 0x50]
lea rcx, [rbx + rbx*2]
mov ecx, dword [rax + rcx*8 + 4]
mov dword [rdi], ecx
mov byte [rdi + 0x10], 1
jmp 0x14020b7f3
lea rcx, [0x1403f078c]
call fcn.14026dad4
cmp dword [0x1403f078c], 0xffffffff
jne 0x14020b7da
lea rax, vtable.._AVimpersonation_error_category__1__make_error_code__A0x1c445d5e__YA_AVerror_code_std__W4impersonation_error_2__Z_.0
mov qword [str._k0_], rbx
lea rcx, [0x1402e0d80]
mov qword [str._k0_], rax
call fcn.14026dec0
lea rcx, [0x1403f078c]
call fcn.14026da74
jmp 0x14020b7da
Function at 0x140211350
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
add rcx, 0x10
call fcn.1402114e0
nop
mov dword [rsp + 0x60], 0x208
xor ebp, ebp
mov dword [rsp + 0x64], 0x6610
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
mov dword [rsp + 0x68], eax
je 0x1402113c4
mov r8, rax
lea rcx, [rsp + 0x6c]
call fcn.14028db80
mov eax, dword [rsp + 0x68]
mov r8d, eax
add r8, 0xc
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x140211447
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
lea r8d, [rax + 0xe]
lea rdx, [0x140307de0]
lea rcx, [rsp + 0x40]
call fcn.14002c3d0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1402116a0
lea rdx, [0x1403d6698]
lea rcx, [rsp + 0x90]
call fcn.14028e980
nop
xor r9d, r9d
mov r8, qword [r14]
lea edx, [r9 + 1]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x1402114b7
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
lea r8d, [rax + 0x10]
lea rdx, [0x140307e00]
lea rcx, [rsp + 0x40]
call fcn.14002c3d0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1402116a0
lea rdx, [0x1403d6698]
lea rcx, [rsp + 0x90]
call fcn.14028e980
nop
mov rax, rdi
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14026d870
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402114e0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov qword [rcx], rdi
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [rdi + 0x18]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14021160a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1402115b5
mov dword [rsp + 0x20], 0xf0000008
lea r9d, [rdi + 0x18]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14021160a
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
lea r8d, [rdi + 0x13]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.14002c3d0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1402116a0
lea rdx, [0x1403d6698]
lea rcx, [rsp + 0x58]
call fcn.14028e980
nop
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.14002c3d0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1402116a0
lea rdx, [0x1403d6698]
lea rcx, [rsp + 0x58]
call fcn.14028e980
nop
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret

Function at 0x140211a30
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov qword [r11 - 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [r11 - 0x70], rcx
xor esi, esi
mov qword [rcx], rsi
add rcx, 8
call fcn.1402114e0
nop
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140211ae4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
lea r8d, [rsi + 0xf]
lea rdx, [0x140307e48]
lea rcx, [rsp + 0x40]
call fcn.14002c3d0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1402116a0
lea rdx, [0x1403d6698]
lea rcx, [rsp + 0x60]
call fcn.14028e980
nop
mov rax, rdi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14026d870
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140211bc0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x58], rdx
xor ebp, ebp
mov dword [rsp + 0x44], ebp
mov rdi, qword [r8 + 8]
sub rdi, qword [r8]
shr edi, 4
inc edi
shl edi, 4
mov byte [rsp + 0x40], bpl
mov qword [rdx], rbp
mov qword [rdx + 8], rbp
mov qword [rdx + 0x10], rbp
mov edx, edi
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.140132e20
mov dword [rsp + 0x44], 1
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
je 0x140211c47
mov rcx, qword [rbx]
call fcn.14028db80
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
mov dword [rsp + 0x48], eax
mov rdx, qword [rbx]
mov rax, qword [r14]
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x140211cdb
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
lea r8d, [rax + 0xc]
lea rdx, [0x140307e28]
lea rcx, [rsp + 0x60]
call fcn.14002c3d0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.1402116a0
lea rdx, [0x1403d6698]
lea rcx, [rsp + 0x80]
call fcn.14028e980
nop
mov rax, rbx
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14026d870
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402126f0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rdx
cmp qword [r8 + 0x18], 8
mov dword [rsp + 0x20], ebx
jb 0x14021270d
mov r8, qword [r8]
mov rcx, r8
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rdx, qword [str.FALSE]
test eax, eax
mov qword [rdi + 0x18], 7
cmovne rdx, qword [str.TRUE]
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rdx], bx
je 0x14021274a
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140212740
mov r8, rbx
mov rcx, rdi
call fcn.14002c3d0
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140215120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r12, qword [r8 + 0x18]
mov rdi, r9
mov r10, qword [r8 + 0x10]
mov r11, r8
mov r14, rdx
mov rsi, rcx
cmp r12, 8
jb 0x14021515d
mov r9, qword [r8]
jmp 0x140215160
mov r9, r11
lea r8, [r10 + r10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r8, r8
je 0x140215194
movabs rbx, 0x100000001b3
nop
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r8
jb 0x140215180
mov r15, qword [rsi + 0x30]
mov rax, qword [rsi + 0x18]
and r15, rdx
mov rbx, qword [rsi + 8]
shl r15, 4
mov rbp, qword [r15 + rax]
cmp rbp, rbx
je 0x1402151b8
mov rbx, qword [r15 + rax + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x88], r13
cmp rbx, rbp
je 0x14021521e
or r13d, 0xffffffff
nop dword [rax]
mov rbx, qword [rbx + 8]
cmp qword [rbx + 0x28], 8
jb 0x1402151e1
mov rdx, qword [rbx + 0x10]
jmp 0x1402151e5
lea rdx, [rbx + 0x10]
cmp r12, 8
jb 0x1402151f0
mov rcx, qword [r11]
jmp 0x1402151f3
mov rcx, r11
mov r9, qword [rbx + 0x20]
cmp r10, r9
mov r8, r9
cmovb r8, r10
test r8, r8
jne 0x140215271
xor r8d, r8d
test r8d, r8d
jne 0x140215219
cmp r10, r9
jb 0x140215219
jbe 0x14021529c
cmp rbx, rbp
jne 0x1402151d0
mov rax, qword [rdi]
cmp rbx, rax
je 0x140215253
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, qword [rsi + 8]
jne 0x1402152b1
mov qword [rdx], rdi
mov rax, qword [rsi + 0x18]
mov qword [r15 + rax + 8], rdi
jmp 0x1402152dd
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14021528a
add rcx, 2
add rdx, 2
sub r8, 1
jmp 0x140215204
cmp word [rcx], ax
mov r8d, 1
cmovb r8d, r13d
jmp 0x140215209
mov rdx, rdi
mov rcx, rsi
call fcn.1402172d0
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x1402152ed
cmp rax, rbx
jne 0x1402152bb
mov qword [rdx], rdi
jmp 0x1402152dd
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1402152dd
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, rsi
call fcn.140217210
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov r13, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140215320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r12, qword [r8 + 0x18]
mov rdi, r9
mov r10, qword [r8 + 0x10]
mov r11, r8
mov r14, rdx
mov rsi, rcx
cmp r12, 8
jb 0x14021535d
mov r9, qword [r8]
jmp 0x140215360
mov r9, r11
lea r8, [r10 + r10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r8, r8
je 0x140215394
movabs rbx, 0x100000001b3
nop
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r8
jb 0x140215380
mov rbp, qword [rsi + 0x30]
mov rax, qword [rsi + 0x18]
and rbp, rdx
mov rbx, qword [rsi + 8]
shl rbp, 4
mov r15, qword [rax + rbp]
cmp r15, rbx
je 0x1402153b8
mov rbx, qword [rax + rbp + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x88], r13
cmp rbx, r15
je 0x14021541e
or r13d, 0xffffffff
nop dword [rax]
mov rbx, qword [rbx + 8]
cmp qword [rbx + 0x28], 8
jb 0x1402153e1
mov rdx, qword [rbx + 0x10]
jmp 0x1402153e5
lea rdx, [rbx + 0x10]
cmp r12, 8
jb 0x1402153f0
mov rcx, qword [r11]
jmp 0x1402153f3
mov rcx, r11
mov r9, qword [rbx + 0x20]
cmp r10, r9
mov r8, r9
cmovb r8, r10
test r8, r8
jne 0x140215471
xor r8d, r8d
test r8d, r8d
jne 0x140215419
cmp r10, r9
jb 0x140215419
jbe 0x14021549c
cmp rbx, r15
jne 0x1402153d0
mov rax, qword [rdi]
cmp rbx, rax
je 0x140215453
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
add rdx, rbp
mov rax, qword [rdx]
cmp rax, qword [rsi + 8]
jne 0x1402154b1
mov qword [rdx], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + rbp + 8], rdi
jmp 0x1402154dd
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14021548a
add rcx, 2
add rdx, 2
sub r8, 1
jmp 0x140215404
cmp word [rcx], ax
mov r8d, 1
cmovb r8d, r13d
jmp 0x140215409
mov rdx, rdi
mov rcx, rsi
call fcn.1402172d0
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x1402154ed
cmp rax, rbx
jne 0x1402154bb
mov qword [rdx], rdi
jmp 0x1402154dd
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1402154dd
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rbp + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rbp + 8], rcx
mov rcx, rsi
call fcn.140217210
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov r13, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140217800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp], rax
mov rbp, qword [r8 + 0x18]
mov r9, r8
mov rbx, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
cmp rbp, 8
jb 0x140217844
mov r8, qword [r8]
xor edi, edi
lea r10, [rbx + rbx]
movabs rdx, 0xcbf29ce484222325
mov ecx, edi
test r10, r10
je 0x140217884
movabs rsi, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, rsi
cmp rcx, r10
jb 0x140217870
mov rcx, qword [r11 + 0x30]
mov r13d, 1
mov rsi, qword [r11 + 8]
and rcx, rdx
mov rdx, qword [r11 + 0x18]
mov rax, rcx
add rax, rax
mov r10, qword [rdx + rax*8]
lea rax, [rcx + rcx]
mov r14, qword [rdx + rax*8]
lea r12, [rdx + rax*8]
nop
cmp r14, rsi
jne 0x1402178ba
mov rax, rsi
jmp 0x1402178c2
mov rax, qword [r12 + 8]
mov rax, qword [rax]
cmp r10, rax
je 0x14021799b
cmp rbp, 8
jb 0x1402178d6
mov rdx, qword [r9]
jmp 0x1402178d9
mov rdx, r9
cmp qword [r10 + 0x28], 8
jb 0x1402178e6
mov rcx, qword [r10 + 0x10]
jmp 0x1402178ea
lea rcx, [r10 + 0x10]
mov r11, qword [r10 + 0x20]
mov r8, rbx
cmp r11, rbx
cmovb r8, r11
test r8, r8
jne 0x140217911
mov r8d, edi
test r8d, r8d
jne 0x14021790c
cmp r11, rbx
jb 0x14021790c
jbe 0x140217937
mov r10, qword [r10]
jmp 0x1402178b0
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140217926
add rcx, 2
add rdx, 2
sub r8, r13
jmp 0x1402178fb
cmp word [rcx], ax
mov r8d, r13d
mov eax, 0xffffffff
cmovb r8d, eax
jmp 0x140217900
cmp qword [r10 + 0x28], 8
jb 0x140217944
mov rcx, qword [r10 + 0x10]
jmp 0x140217948
lea rcx, [r10 + 0x10]
cmp rbp, 8
jb 0x140217951
mov r9, qword [r9]
mov r8, qword [r10 + 0x20]
cmp rbx, r8
mov rdx, r8
cmovb rdx, rbx
test rdx, rdx
je 0x140217988
movzx eax, word [rcx]
cmp word [r9], ax
jne 0x14021797c
add r9, 2
add rcx, 2
sub rdx, r13
jne 0x140217964
jmp 0x140217988
mov eax, 0xffffffff
cmovb r13d, eax
mov edi, r13d
test edi, edi
jne 0x140217993
cmp rbx, r8
jb 0x140217993
jbe 0x140217996
mov r10, rsi
mov qword [r15], r10
jmp 0x14021799e
mov qword [r15], rsi
mov rax, r15
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140220560
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rdx + 0x18], 8
movzx esi, r9b
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
jb 0x140220594
mov rcx, qword [rdx]
jmp 0x140220597
mov rcx, rbx
call fcn.14021ee40
test al, al
jne 0x1402205e0
cmp qword [rbx + 0x18], 8
jb 0x1402205aa
mov rbx, qword [rbx]
lea rax, str.Unable_to_verify_signature_for_file:__s
mov r9d, 0x5c
mov qword [rsp + 0x28], rbx
lea r8, str.XMLUpdater::v2::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand
mov qword [rsp + 0x20], rax
lea rdx, str.ExtractCabLocalCommand.cpp
mov ecx, 1
call fcn.1401fc9c0
xor al, al
jmp 0x1402206b1
cmp qword [rdi + 0x18], 8
mov dword [rsp + 0x30], 0
jb 0x1402205f4
mov rcx, qword [rdi]
jmp 0x1402205f7
mov rcx, rdi
mov dl, 1
call fcn.140205a40
cmp qword [rdi + 0x18], 8
jb 0x14022060a
mov rcx, qword [rdi]
jmp 0x14022060d
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.1400fa5e0
test al, al
jne 0x140220632
mov eax, dword [rsp + 0x30]
mov r9d, 0x64
mov dword [rsp + 0x28], eax
lea rax, str.Unable_to_create_destination_directory___d_
jmp 0x1402205bc
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call fcn.1402206d0
test al, al
jne 0x140220660
cmp qword [rbx + 0x18], 8
jb 0x14022064e
mov rbx, qword [rbx]
lea rax, str.Failed_to_extract_cab___s_
mov r9d, WSAGetLastError
jmp 0x1402205b7
test sil, sil
je 0x1402206af
cmp qword [rbx + 0x18], 8
jb 0x14022066f
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1402206af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9d, reloc.WS2_32.dll_WSACleanup
lea r8, str.XMLUpdater::v2::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand
lea rax, str.Failed_to_delete_src_cab___d_
lea rdx, str.ExtractCabLocalCommand.cpp
mov qword [rsp + 0x20], rax
lea ecx, [r9 - 0x73]
call fcn.1401fc9c0
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140220cf0
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, dword [rsp + 0x90]
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x34]
mov rcx, rdi
mov r14, r9
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0x28], 0
mov r8d, ebx
mov dword [rsp + 0x30], eax
mov rcx, rdi
mov rax, qword [rsp + 0x30]
cmp rax, rbp
cmovb rax, rbp
mov qword [rsp + 0x30], rax
mov edx, dword [rsp + 0x30]
shr rax, 0x20
mov dword [rsp + 0x20], edx
mov r9d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsi + 0x10], rax
mov rcx, rax
test rax, rax
jne 0x140220d79
call fcn.140220000
jmp 0x140220de4
test rbp, rbp
jne 0x140220d8c
mov rax, qword [rsp + 0x30]
sub rax, r14
mov qword [rsi + 8], rax
jmp 0x140220d90
mov qword [rsi + 8], rbp
mov rax, qword [rsi + 8]
mov r9d, r14d
mov edx, dword [rsp + 0x98]
mov qword [rsi + 0x18], r14
mov r8d, dword [rsi + 0x1c]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov dword [rsi + 0x20], edx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov qword [rsi], rax
test rax, rax
jne 0x140220de2
call fcn.140220000
mov rcx, qword [rsi + 0x10]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov qword [rsi + 0x10], 0
jmp 0x140220de4
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140220ed0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 0x60]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140220f46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9d, 0x5d
lea r8, str.XMLUpdater::v2::CCabParser::Write
lea rax, str.WriteFile_failed:__d
lea rdx, str.e:_b_t481c8603_f840_49c1_9844_b21ef6aac888webadvisor_xmlupdater_srcxmlupdaterCabParser.h
mov qword [rsp + 0x20], rax
lea ecx, [r9 - 0x5c]
call fcn.1401fc9c0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x48
ret
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x48
ret
Function at 0x1402244d0
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable.XMLUpdater::v2::CMD5Checksum.0
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov rax, rcx
mov dword [rcx + 0x50], 0x67452301
mov dword [rcx + 0x54], 0xefcdab89
mov dword [rcx + 0x58], 0x98badcfe
mov dword [rcx + 0x5c], 0x10325476
ret

Function at 0x140225320
Capabilities:
Set http header

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x140225334
xor al, al
add rsp, 0x28
ret
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x140225490
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx], 0
mov rax, rdx
mov rbx, rcx
je 0x1402254aa
xor al, al
add rsp, 0x30
pop rbx
ret
cmp byte [rsp + 0x60], 0
je 0x1402254b8
mov edx, 1
jmp 0x1402254d2
test r8, r8
je 0x1402254d0
mov dword [rsp + 0x20], r9d
mov edx, 3
mov r9, qword [r8 + 8]
mov r8, qword [r8]
jmp 0x1402254dd
xor edx, edx
mov dword [rsp + 0x20], r9d
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
mov qword [rbx], rax
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x140225500
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x14022551a
xor al, al
add rsp, 0x40
pop rbx
ret
cmp qword [rbx + 0x10], 0
jne 0x140225512
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
test rax, rax
mov qword [rbx + 0x10], rax
setne al
add rsp, 0x40
pop rbx
ret

Function at 0x140225560
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, qword [rcx + 0x10]
mov rbx, rdx
test rdi, rdi
je 0x1402255e6
test rdx, rdx
je 0x1402255e6
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x80
call fcn.14028e7e0
xor r8d, r8d
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x7f
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r8 + 5]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1402255e6
lea rcx, [rsp + 0x40]
call fcn.14029f8e4
mov dword [rbx], eax
mov al, 1
jmp 0x1402255e8
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret