joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400703d8
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 4
cmp dword [0x1400e4588], 0
jne 0x14007043c
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140087678
movzx eax, al
test eax, eax
je 0x140070432
mov dword [0x1400e4588], 2
jmp 0x14007043c
mov dword [0x1400e4588], 1
cmp dword [0x1400e4588], 2
jne 0x140070447
jmp 0x14007049f
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14007047c
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
jle 0x14007047c
jmp 0x14007049f
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x48
ret

Function at 0x1400704ac
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 1
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x1400704f6
xor eax, eax
test eax, eax
jne 0x1400704f0
add rsp, 0x48
ret

Function at 0x140070904
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1c8
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x24], 0x80
mov r8d, 0x80
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140028c20
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400709a6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, dword [rsp + 0x20]
call fcn.1400a399c
mov r9, rax
mov r8d, dword [rsp + 0x20]
lea rdx, [0x1400ddb78]
mov rcx, qword [rsp + 0x1d0]
call fcn.14006f3b4
jmp 0x140070a0e
mov r9, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x1e0]
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x30]
call fcn.140070b58
movzx eax, al
test eax, eax
jne 0x140070a0e
call fcn.140032640
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, dword [rax]
call fcn.1400a399c
mov qword [rsp + 0x28], rax
call fcn.140032640
mov rcx, qword [rsp + 0x28]
mov r9, rcx
mov r8d, dword [rax]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, qword [rsp + 0x1d0]
call fcn.14006f3b4
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x1c8
ret
Function at 0x140071548
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x90]
movzx eax, byte [rax + 0xa83]
test eax, eax
je 0x140071585
mov dword [rsp + 0x54], 1
jmp 0x14007158d
mov dword [rsp + 0x54], 0
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x50]
mov r8d, 8
mov edx, 0xffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x1400715ca
xor eax, eax
test eax, eax
jne 0x1400715bf
jmp 0x14007167d
mov dword [rsp + 0x60], 1
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax + 0xa08]
call fcn.14006f634
mov dword [rsp + 0x50], eax
imul eax, dword [rsp + 0x50], 0x3e8
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax + 0xa0c]
call fcn.14006f634
mov dword [rsp + 0x50], eax
imul eax, dword [rsp + 0x50], 0x3e8
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, listen
lea r8, [rsp + 0x60]
mov edx, 0x98000004
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x14007167d
xor eax, eax
test eax, eax
jne 0x140071677
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0x88
ret

Function at 0x140073578
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x50], rax
jae 0x140073600
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov al, byte [rax]
mov byte [rsp + 0x20], al
mov cl, byte [rsp + 0x20]
call fcn.14008401c
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x1400735a4
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x100
div rcx
mov rax, rdx
add rsp, 0x48
ret
Function at 0x140087a30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x8000
mov eax, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x30]
call qword [fcn.140033a98]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140087a7f
mov rcx, qword [rsp + 0x30]
call qword [fcn.1400337c0]
xor eax, eax
jmp 0x140087aea
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140087ac5
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
je 0x140087ac5
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jbe 0x140087ad4
mov rcx, qword [rsp + 0x30]
call qword [fcn.1400337c0]
xor eax, eax
jmp 0x140087aea
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jae 0x140087ae5
mov rax, qword [rsp + 0x30]
jmp 0x140087aea
jmp 0x140087a52
add rsp, 0x48
ret

Function at 0x140087b94
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 4
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x38], eax
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call fcn.140028c20
mov dword [rsp + 0x20], 0xf0000040
mov r9d, dword [rsp + 0x80]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140087c10
jmp 0x140087ce8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140087c3b
jmp 0x140087cc0
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140087c59
jmp 0x140087cc0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x140087c81
jmp 0x140087cc0
mov eax, dword [rsp + 0x30]
cmp qword [rsp + 0x78], rax
jae 0x140087c8e
jmp 0x140087cc0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140087cb6
jmp 0x140087cc0
xor eax, eax
test eax, eax
jne 0x140087c10
cmp qword [rsp + 0x40], 0
je 0x140087cd3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp qword [rsp + 0x48], 0
je 0x140087ce8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add rsp, 0x58
ret
Function at 0x140091c74
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140091cef
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x54]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x68
ret

Function at 0x140099eb0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x78], 0
je 0x140099eda
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
jne 0x140099f1c
cmp qword [rsp + 0x80], 0
je 0x140099ef2
mov rax, qword [rsp + 0x80]
cmp dword [rax], 0
jne 0x140099f1c
cmp qword [rsp + 0x88], 0
je 0x140099f0a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
jne 0x140099f1c
mov rcx, qword [rsp + 0x90]
call fcn.14009a278
jmp 0x140099fe1
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.1400b65b0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x88], 0
je 0x140099f5a
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
je 0x140099f5a
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
jmp 0x140099f63
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x80], 0
je 0x140099f8a
mov rax, qword [rsp + 0x80]
cmp dword [rax], 0
je 0x140099f8a
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
jmp 0x140099f93
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0
je 0x140099fb1
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
je 0x140099fb1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
jmp 0x140099fba
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x70]
inc eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x68
ret
Function at 0x14009abb8
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
add rax, 0xe8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x1278], ecx
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x1b8]
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x1280], eax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x10c9]
test eax, eax
je 0x14009ac2c
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x10c9]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x1b8]
cmp eax, ecx
jle 0x14009ac42
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov cl, byte [rcx + 0x1b8]
mov byte [rax + 0x10c9], cl
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10d8], 0
je 0x14009ac79
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x1140], 0
jne 0x14009ac79
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0x1a0
jne 0x14009ac79
mov rax, qword [rsp + 0x30]
mov byte [rax + 0xdc], 1
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x1b8]
cmp eax, 0xa
jne 0x14009aca1
xor eax, eax
test eax, eax
jne 0x14009ac8a
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.140071e80
jmp 0x14009ad0c
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x1b8]
cmp eax, 0x14
je 0x14009accb
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x8c], 1
jne 0x14009ace5
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0x65
jne 0x14009ace5
xor eax, eax
test eax, eax
jne 0x14009accb
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x700]
mov dword [rax], 2
jmp 0x14009ad0c
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x1b8]
cmp eax, 0xb
jl 0x14009ad0c
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x3ca]
test eax, eax
jne 0x14009ad0c
xor eax, eax
test eax, eax
jne 0x14009ad06
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0x64
jl 0x14009ad2f
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0xc8
jge 0x14009ad2f
mov dword [rsp + 0x20], 1
jmp 0x14009ad37
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x14009ad48
mov dword [rsp + 0x24], 0
jmp 0x14009ad50
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x30]
mov cl, byte [rsp + 0x24]
mov byte [rax + 0xdd], cl
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xcc
je 0x14009ad9b
cmp dword [rsp + 0x28], 0x130
je 0x14009ad81
jmp 0x14009adc0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x550], 0
je 0x14009ad9b
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x135c], 1
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x30]
mov byte [rax + 0xdd], 1
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400a44b8
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [rsp + 0x48], 0
je 0x1400a44d6
mov dword [rsp + 0x20], 1
jmp 0x1400a44de
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x1400a48c0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1400dc020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x30], 0x3e8
lea rcx, [rsp + 0x60]
call fcn.1400a3344
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x80], xmm0
mov rcx, qword [rsp + 0xb0]
call fcn.140046d70
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xb8]
call fcn.140046d70
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400a4986
cmp qword [rsp + 0x20], 0
je 0x1400a495a
mov rcx, qword [rsp + 0x20]
call fcn.1400337c0
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x1400a493f
cmp qword [rsp + 0x28], 0
je 0x1400a497b
mov rcx, qword [rsp + 0x28]
call fcn.1400337c0
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x1400a4960
jmp 0x1400a4a28
movups xmm0, xmmword [rsp + 0x80]
movdqu xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400a3344
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400a3410
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jl 0x1400a49cf
movsxd rax, dword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jle 0x1400a4a18
cmp qword [rsp + 0x20], 0
je 0x1400a49ea
mov rcx, qword [rsp + 0x20]
call fcn.1400337c0
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x1400a49cf
cmp qword [rsp + 0x28], 0
je 0x1400a4a0b
mov rcx, qword [rsp + 0x28]
call fcn.1400337c0
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x1400a49f0
mov eax, 1
jmp 0x1400a4a2a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400a4925
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140026bb0
add rsp, 0xa8
ret
Function at 0x1400ac624
Capabilities:
Parse pe header

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x18
movzx eax, byte [rsp + 0x20]
mov dword [rsp], eax
cmp dword [rsp], 0x56
jg 0x1400ac7bc
cmp dword [rsp], 0x56
je 0x1400ac8cd
cmp dword [rsp], 0x45
jg 0x1400ac70c
cmp dword [rsp], 0x45
je 0x1400ac8cd
cmp dword [rsp], 0x36
jg 0x1400ac6c1
cmp dword [rsp], 0x36
je 0x1400ac8cd
cmp dword [rsp], 0x2d
je 0x1400ac8cd
cmp dword [rsp], 0x2e
je 0x1400ac8cd
cmp dword [rsp], 0x30
je 0x1400ac8cd
cmp dword [rsp], 0x31
je 0x1400ac8cd
cmp dword [rsp], 0x32
je 0x1400ac8cd
cmp dword [rsp], 0x33
je 0x1400ac8cd
cmp dword [rsp], 0x34
je 0x1400ac8cd
cmp dword [rsp], 0x35
je 0x1400ac8cd
jmp 0x1400ac8d1
cmp dword [rsp], 0x37
je 0x1400ac8cd
cmp dword [rsp], 0x38
je 0x1400ac8cd
cmp dword [rsp], 0x39
je 0x1400ac8cd
cmp dword [rsp], 0x41
je 0x1400ac8cd
cmp dword [rsp], 0x42
je 0x1400ac8cd
cmp dword [rsp], 0x43
je 0x1400ac8cd
cmp dword [rsp], 0x44
je 0x1400ac8cd
jmp 0x1400ac8d1
cmp dword [rsp], 0x4e
jg 0x1400ac771
cmp dword [rsp], 0x4e
je 0x1400ac8cd
cmp dword [rsp], 0x46
je 0x1400ac8cd
cmp dword [rsp], 0x47
je 0x1400ac8cd
cmp dword [rsp], 0x48
je 0x1400ac8cd
cmp dword [rsp], 0x49
je 0x1400ac8cd
cmp dword [rsp], 0x4a
je 0x1400ac8cd
cmp dword [rsp], 0x4b
je 0x1400ac8cd
cmp dword [rsp], 0x4c
je 0x1400ac8cd
cmp dword [rsp], 0x4d
je 0x1400ac8cd
jmp 0x1400ac8d1
cmp dword [rsp], 0x4f
je 0x1400ac8cd
cmp dword [rsp], 0x50
je 0x1400ac8cd
cmp dword [rsp], 0x51
je 0x1400ac8cd
cmp dword [rsp], 0x52
je 0x1400ac8cd
cmp dword [rsp], 0x53
je 0x1400ac8cd
cmp dword [rsp], 0x54
je 0x1400ac8cd
cmp dword [rsp], 0x55
je 0x1400ac8cd
jmp 0x1400ac8d1
cmp dword [rsp], 0x6c
jg 0x1400ac869
cmp dword [rsp], 0x6c
je 0x1400ac8cd
cmp dword [rsp], 0x64
jg 0x1400ac835
cmp dword [rsp], 0x64
je 0x1400ac8cd
cmp dword [rsp], 0x57
je 0x1400ac8cd
cmp dword [rsp], 0x58
je 0x1400ac8cd
cmp dword [rsp], 0x59
je 0x1400ac8cd
cmp dword [rsp], 0x5a
je 0x1400ac8cd
cmp dword [rsp], 0x5f
je 0x1400ac8cd
cmp dword [rsp], 0x61
je 0x1400ac8cd
cmp dword [rsp], 0x62
je 0x1400ac8cd
cmp dword [rsp], 0x63
je 0x1400ac8cd
jmp 0x1400ac8d1
cmp dword [rsp], 0x65
je 0x1400ac8cd
cmp dword [rsp], 0x66
je 0x1400ac8cd
cmp dword [rsp], 0x67
je 0x1400ac8cd
cmp dword [rsp], 0x68
je 0x1400ac8cd
cmp dword [rsp], 0x69
je 0x1400ac8cd
cmp dword [rsp], 0x6a
je 0x1400ac8cd
cmp dword [rsp], 0x6b
je 0x1400ac8cd
jmp 0x1400ac8d1
cmp dword [rsp], 0x74
jg 0x1400ac8a1
cmp dword [rsp], 0x74
je 0x1400ac8cd
cmp dword [rsp], 0x6d
je 0x1400ac8cd
cmp dword [rsp], 0x6e
je 0x1400ac8cd
cmp dword [rsp], 0x6f
je 0x1400ac8cd
cmp dword [rsp], 0x70
je 0x1400ac8cd
cmp dword [rsp], 0x71
je 0x1400ac8cd
cmp dword [rsp], 0x72
je 0x1400ac8cd
cmp dword [rsp], 0x73
je 0x1400ac8cd
jmp 0x1400ac8d1
cmp dword [rsp], 0x75
je 0x1400ac8cd
cmp dword [rsp], 0x76
je 0x1400ac8cd
cmp dword [rsp], 0x77
je 0x1400ac8cd
cmp dword [rsp], 0x78
je 0x1400ac8cd
cmp dword [rsp], 0x79
je 0x1400ac8cd
cmp dword [rsp], 0x7a
je 0x1400ac8cd
cmp dword [rsp], 0x7e
je 0x1400ac8cd
jmp 0x1400ac8d1
mov al, 1
jmp 0x1400ac8d3
xor al, al
add rsp, 0x18
ret
Function at 0x1400ad51c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call fcn.14003efe8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400ad573
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x30], rax
jne 0x1400ad577
xor eax, eax
jmp 0x1400ad57c
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400b9b2c
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x28
ret

Function at 0x1400b9b68
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400b9bbd
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000b340
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14000b3d6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14000b3dd
mov r15, rsi
jmp 0x14000b39b
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.140012d00
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x14000b3ce
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b3b3
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x14000b370
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000b3ce
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x14000b39b
sub rsi, r15
jmp 0x14000b4ca
xor esi, esi
jmp 0x14000b4ca
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b430
mov rcx, qword [rbx + 0x50]
movsxd r15, dword [rcx]
test r15, r15
je 0x14000b430
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.140012d00
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x14000b441
jmp 0x14000b4c7
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x14000b4c7
mov rcx, qword [rbx + 0x18]
lea rdx, [rbx + 0x70]
cmp qword [rcx], rdx
jne 0x14000b470
mov edx, dword [rbx + 0x90]
mov r8, qword [rbx + 0x88]
mov qword [rcx], r8
mov qword [rax], r8
sub edx, r8d
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
nop word [rax + rax]
cmp r14, 0x1000
jb 0x14000b4a3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call sub.msvcrt.dll_fread
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x14000b470
jmp 0x14000b4c7
test r14, r14
je 0x14000b4c4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call sub.msvcrt.dll_fread
sub r14, rax
jmp 0x14000b4c7
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret