joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004ad9
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x14012fdf0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
xor edx, edx
mov ecx, reloc.WS2_32.dll_ntohs
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x130
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_301
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14012fe9d
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14012fe8a
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14012fe8a
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14012fe9d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14012fe3a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x160
pop rdi
ret

Function at 0x140004b33
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x14022d8e0
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14022d922
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14022d969
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14022d9c2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14022d980
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14022da03
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1402b25e7]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1402b25e8]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14022d9d0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400051be
Capabilities:
Terminate process

Disassembly:
jmp 0x140237edc
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140005650
Capabilities:
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
jmp 0x1401eecc0
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14039ae00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edx, 1
mov dword [rsp + 0x34], reloc.WS2_32.dll_recv
mov ebp, 2
mov dword [rsp + 0x30], 1
mov ecx, ebp
mov rsi, r9
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401eed15
jmp 0x1401eeec4
mov qword [rsp + 0x80], rbx
mov ecx, 0x7f000001
xor ebx, ebx
mov word [rsp + 0x38], bp
mov qword [rsp + 0x40], rbx
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rsp + 0x30]
mov word [rsp + 0x3a], bx
mov edx, 0xffff
mov dword [rsp + 0x3c], eax
lea r8d, [rbx + 4]
mov qword [rsi + 8], 0xffffffffffffffff
mov rcx, rdi
mov qword [rsi], 0xffffffffffffffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1401eee9b
lea r8d, [rbx + 0x10]
mov rcx, rdi
lea rdx, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1401eee9b
lea r8, [rsp + 0x34]
mov rcx, rdi
lea rdx, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1401eee9b
lea edx, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1401eee9b
xor r8d, r8d
lea edx, [rbx + 1]
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1401eee9b
lea r8d, [rbx + 0x10]
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1401eee9b
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1401eee9b
mov r9, rsi
lea r8, [0x1402a941c]
lea edx, [rbx + 0xc]
lea rcx, [rsp + 0x48]
call fcn.140003035
lea rax, [rsp + 0x48]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1401eee35
mov rcx, qword [rsi]
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
cmp rcx, rbx
jne 0x1401eee9b
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x54]
xor r9d, r9d
lea r8d, [r9 + 0xc]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, rbx
jne 0x1401eee9b
mov r8, rbx
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1401eee9b
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1401eeebc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400048e5
lea r11, [rsp + 0x70]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000576d
Capabilities:
Resolve dns

Disassembly:
jmp 0x1401f3db0
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r12, r9
mov qword [r9], r13
mov ebx, r13d
lea r9, [rsp + 0x68]
mov r15d, r13d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x1401f3f74
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
test rsi, rsi
je 0x1401f3f54
mov qword [rsp + 0x50], rbp
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x1401f3e0d
lea ebp, [rax + 0xe]
jmp 0x1401f3e19
cmp eax, 0x17
jne 0x1401f3ec1
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], r13
je 0x1401f3ec1
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1401f3ec1
cmp rax, rbp
jb 0x1401f3ec1
mov ecx, Ordinal_50
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1401f3efc
mov ecx, dword [rsi]
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
mov rcx, rbp
mov dword [rax + 0x10], ebp
mov qword [rax + 0x20], r13
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x1401f3eeb
mov rdx, qword [rsi + 0x20]
mov r8, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1401f3eae
call qword [case.0x1401c99c9.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1401f3ed0
test rbx, rbx
cmove rbx, rdi
test r15, r15
je 0x1401f3ebe
mov qword [r15 + 0x28], rdi
mov r15, rdi
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1401f3e00
jmp 0x1401f3f02
mov rcx, qword [rdi + 0x20]
mov r14d, 8
call qword [fcn.14023972b]
mov rcx, rdi
call qword [fcn.14023972b]
jmp 0x1401f3f02
mov rcx, rdi
mov r14d, 8
call qword [fcn.14023972b]
jmp 0x1401f3f02
mov r14d, 8
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x50]
test rcx, rcx
je 0x1401f3f17
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x1401f3f4f
test rbx, rbx
je 0x1401f3f4a
mov rcx, qword [rbx + 0x20]
call qword [fcn.14023972b]
mov rcx, qword [rbx + 0x18]
call qword [fcn.14023972b]
mov rdi, qword [rbx + 0x28]
mov rcx, rbx
call qword [fcn.14023972b]
mov rbx, rdi
test rdi, rdi
jne 0x1401f3f21
mov rbx, r13
jmp 0x1401f3f63
test rbx, rbx
jne 0x1401f3f63
mov r14d, 0x2af9
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r14d
mov rsi, qword [rsp + 0x58]
mov qword [r12], rbx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbx
ret

Function at 0x140005781
Capabilities:
Check for process debug object

Disassembly:
jmp 0x140127d60
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x38]
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rax
call sub.ntdll.dll_NtQueryInformationProcess
cmp qword [rsp + 0x38], 0
je 0x140127d9d
mov dword [rsp + 0x30], 1
jmp 0x140127da5
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400057d1
Capabilities:
Hide thread from debugger

Disassembly:
jmp 0x140128630
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recvfrom
mov rcx, rax
call sub.ntdll.dll_NtSetInformationThread
add rsp, 0x28
ret
Function at 0x140005ad8
Capabilities:
Write file on windows

Disassembly:
jmp 0x140040130
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x28
ret

Function at 0x140005b64
Capabilities:
Get geographical location

Disassembly:
jmp 0x14022dcf0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14022dd2a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14022dd2f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14022dd78
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14022dd78
dec r8
sub rdx, 1
jne 0x14022dd5e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140005ba0
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x1401bedb0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x14039ae00]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
lea rax, [rsp + 0xd0]
mov rdi, rax
mov eax, gethostname
mov ecx, 0x40
rep stosb byte [rdi], al
lea rax, [rsp + 0x110]
mov rdi, rax
mov eax, 0x5c
mov ecx, 0x40
rep stosb byte [rdi], al
cmp qword [rsp + 0x188], 0x40
jbe 0x1401bee4b
mov r9d, 0x40
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
call fcn.1401bf020
jmp 0x1401bee65
lea rax, [rsp + 0x50]
mov rdi, rax
mov rsi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x188]
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x30], 0
jmp 0x1401bee79
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x40
jge 0x1401beecc
movsxd rax, dword [rsp + 0x30]
movsxd rcx, dword [rsp + 0x30]
movzx ecx, byte [rsp + rcx + 0x50]
movzx eax, byte [rsp + rax + 0xd0]
xor eax, ecx
movsxd rcx, dword [rsp + 0x30]
mov byte [rsp + rcx + 0xd0], al
movsxd rax, dword [rsp + 0x30]
movsxd rcx, dword [rsp + 0x30]
movzx ecx, byte [rsp + rcx + 0x50]
movzx eax, byte [rsp + rax + 0x110]
xor eax, ecx
movsxd rcx, dword [rsp + 0x30]
mov byte [rsp + rcx + 0x110], al
jmp 0x1401bee6f
mov qword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x198]
mov r8, qword [rsp + 0x190]
mov edx, 0x40
lea rcx, [rsp + 0xd0]
call fcn.1401becd0
mov qword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, reloc.WLDAP32.dll_Ordinal_32
lea r8, [rsp + 0x90]
mov edx, 0x40
lea rcx, [rsp + 0x110]
call fcn.1401becd0
cmp qword [rsp + 0x1a8], 0x20
jbe 0x1401bef50
mov qword [rsp + 0x38], reloc.WLDAP32.dll_Ordinal_32
jmp 0x1401bef5d
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xb0]
mov rdi, qword [rsp + 0x1a0]
mov rsi, rax
mov rcx, qword [rsp + 0x40]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400048e5
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x140005baa
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x140117940
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x3285501
lea rcx, [rsp + 0x40]
call fcn.14000545c
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x1401179a4
lea rcx, [rsp + 0x50]
call fcn.140002086
cmp eax, dword [rsp + 0x24]
jne 0x140117a6f
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000882d
lea rcx, [rsp + 0x60]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x140117a6f
lea rcx, [rsp + 0x60]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140117a6f
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, dword [rsp + 0x28]
jne 0x140117a6a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140007167
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000346d
movzx eax, al
test eax, eax
je 0x140117a63
mov rcx, qword [rsp + 0x30]
call fcn.140008cfb
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140001a00
jmp 0x140117a6f
mov rax, qword [rsp + 0x30]
jmp 0x140117a86
jmp 0x1401179da
lea rcx, [rsp + 0x40]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x140117964
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140005bff
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
jmp 0x1401181b0
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x820621f3
lea rcx, [rsp + 0x40]
call fcn.14000545c
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140118214
lea rcx, [rsp + 0x50]
call fcn.140002086
cmp eax, dword [rsp + 0x24]
jne 0x1401182df
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000882d
lea rcx, [rsp + 0x60]
call fcn.14000798c
movzx eax, al
test eax, eax
je 0x1401182df
lea rcx, [rsp + 0x60]
call fcn.14000385a
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x1401182df
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140008404
mov rcx, rax
call fcn.140006c49
cmp eax, dword [rsp + 0x28]
jne 0x1401182da
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140007167
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000346d
movzx eax, al
test eax, eax
je 0x1401182d3
mov rcx, qword [rsp + 0x30]
call fcn.140008cfb
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140001a00
jmp 0x1401182df
mov rax, qword [rsp + 0x30]
jmp 0x1401182f6
jmp 0x14011824a
lea rcx, [rsp + 0x40]
call fcn.1400071da
movzx eax, al
test eax, eax
jne 0x1401181d4
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret

Function at 0x140005e70
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x140127e60
push rdi
sub rsp, 0x30
xor edx, edx
lea rcx, [0x14000120d]
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.140003544
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x20]
call fcn.14011e4d0
mov rcx, rax
call fcn.1400089db
xor edx, edx
mov rcx, rax
call fcn.14000459d
movzx eax, al
test eax, eax
je 0x140127eb7
xor ecx, ecx
int 0x29
add rsp, 0x30
pop rdi
ret
Function at 0x140005e75
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x14011b710
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140008792
mov rcx, rax
call fcn.1400089db
xor edx, edx
mov rcx, rax
call fcn.14000459d
movzx eax, al
test eax, eax
je 0x14011b75a
xor ecx, ecx
int 0x29
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x3e]
lea rcx, [rsp + 0x21]
call fcn.140005399
mov rcx, rax
call fcn.1400089db
xor edx, edx
mov rcx, rax
call fcn.14000459d
movzx eax, al
test eax, eax
je 0x14011b797
xor ecx, ecx
int 0x29
call fcn.140003544
xor edx, edx
lea rcx, [0x14000120d]
call qword [sym.imp.USER32.dll_EnumWindows]
xor r8d, r8d
lea rdx, [0x14028c268]
lea rcx, [rsp + 0x50]
call fcn.140002fd1
nop
lea rcx, [rsp + 0x50]
call fcn.140004557
mov byte [rsp + 0x22], al
lea rcx, [rsp + 0x50]
call fcn.140007a86
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x14011b857
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x23]
call fcn.1400034db
mov rcx, rax
call fcn.140007301
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x24]
call fcn.140005d8a
mov rcx, rax
call fcn.140007329
mov qword [rsp + 0x30], rax
mov r9d, 0x40
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
int 0x29
call fcn.1400071d0
test eax, eax
je 0x14011b86b
mov dword [0], 0xdead
mov rax, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret

Function at 0x140005e7a
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400400e0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rsp, 0x28
ret
Function at 0x140005ea7
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140041bb0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14025d980]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140041cb4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140041caf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140041c84
cmp qword [rsp + 0x38], 2
jb 0x140041c84
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041c84
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041c84
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140041bf7
jmp 0x140041d46
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140041d46
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140041d1c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041d1c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140041d1c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140041cb4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140005fdd
Capabilities:
Terminate process

Disassembly:
jmp 0x140237ca0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.1400089d1
test al, al
je 0x140237b9c
xor dil, dil
mov byte [rsp + 0x20], dil
call fcn.14000730b
mov bl, al
mov ecx, dword [0x1403a37a0]
cmp ecx, 1
je 0x140237ba7
test ecx, ecx
jne 0x140237ad8
mov dword [0x1403a37a0], 1
lea rdx, [0x140251d90]
lea rcx, [0x140251a60]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x140237ab9
mov eax, 0xff
jmp 0x140237b91
lea rdx, [0x140251950]
lea rcx, [section..rdata]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x1403a37a0], 2
jmp 0x140237ae0
mov dil, 1
mov byte [rsp + 0x20], dil
mov cl, bl
call fcn.14000700e
call fcn.1400063de
mov rbx, rax
cmp qword [rax], 0
je 0x140237b13
mov rcx, rax
call fcn.140003ce7
test al, al
je 0x140237b13
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x1403cb020]
call fcn.140006929
mov rbx, rax
cmp qword [rax], 0
je 0x140237b35
mov rcx, rax
call fcn.140003ce7
test al, al
je 0x140237b35
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call fcn.140008d1e
movzx ebx, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
mov r9d, ebx
mov r8, rax
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000645b
mov ebx, eax
call fcn.14000614a
test al, al
je 0x140237bb1
test dil, dil
jne 0x140237b6b
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140003a94
mov eax, ebx
jmp 0x140237b91
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140007130
nop
mov ecx, 7
call fcn.140007130
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.140006244
add rsp, 0x28
jmp 0x140237a50
Function at 0x14000614a
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402388e8
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140238932
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140238932
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140238932
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140238932
cmp dword [rcx + 0x84], 0xe
jbe 0x140238932
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140238934
xor al, al
add rsp, 0x28
ret