joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400022a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400022fe
cmp dword [0x140015678], 2
je 0x1400022e0
call fcn.140004e10
mov ecx, 0x12
call fcn.140004bd0
mov ecx, 0xff
call fcn.1400047d0
mov eax, 0xff
jmp 0x140002505
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14000232f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x140002505
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x140002361
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x140015c24], r13d
mov dword [0x140015c2c], eax
mov dword [0x140015c30], esi
mov dword [0x140015c34], r12d
mov dword [0x140015c28], edi
cmp word [0x140000000], 0x5a4d
jne 0x1400023e7
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x1400023b5
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x1400023ed
cmp word [rax + 0x18], 0x20b
je 0x1400023c5
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x1400023ed
cmp dword [rax + 0x84], 0xe
ja 0x1400023d6
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x1400023ed
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x50], ebx
jmp 0x1400023ed
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov ecx, 1
call fcn.140006570
test eax, eax
jne 0x14000241d
cmp dword [0x140015678], 2
je 0x140002409
call fcn.140004e10
mov ecx, 0x1c
call fcn.140004bd0
mov ecx, 0xff
call fcn.1400047d0
call fcn.140006450
test eax, eax
jne 0x140002448
cmp dword [0x140015678], 2
je 0x140002434
call fcn.140004e10
mov ecx, 0x10
call fcn.140004bd0
mov ecx, 0xff
call fcn.1400047d0
call fcn.140005d10
nop
call fcn.1400059e0
test eax, eax
jns 0x140002461
mov ecx, 0x1b
call fcn.1400047a0
call fcn.1400058c0
mov qword [0x140017888], rax
call fcn.1400056c0
mov qword [0x140015670], rax
call fcn.140005450
test eax, eax
jns 0x14000248c
mov ecx, 8
call fcn.1400047a0
call fcn.140005120
test eax, eax
jns 0x14000249f
mov ecx, 9
call fcn.1400047a0
mov ecx, 1
call fcn.140004910
test eax, eax
je 0x1400024b4
mov ecx, eax
call fcn.1400047a0
mov r8, qword [0x140015c60]
mov qword [0x140015c68], r8
mov rdx, qword [0x140015c48]
mov ecx, dword [0x140015c38]
call fcn.140001250
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400024e5
mov ecx, eax
call fcn.140004b20
call fcn.140004b40
jmp 0x140002503
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.1400065d0
add rsp, 0x28
jmp 0x1400022a0
Function at 0x140003fa0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140015690]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140005f50
test rax, rax
je 0x140003ff4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x140004089
mov ecx, 2
call fcn.1400087e0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140002760
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140004075
test ebx, ebx
jne 0x140004075
lea ecx, [rax + 2]
call fcn.1400087e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140004297
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140014060]
jne 0x1400020ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1400020c6
repz ret
ror rcx, 0x10
jmp 0x1400041f0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140015740]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140015838]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140004275
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140015740]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140004297
mov rax, qword [rsp + 0x88]
mov qword [0x140015838], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400157d8], rax
mov rax, qword [0x140015838]
mov qword [0x1400156b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400157c0], rax
mov dword [0x1400156a0], 0xc0000409
mov dword [0x1400156a4], 1
mov rax, qword [0x140014060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140014068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140015738], eax
mov ecx, 1
call fcn.1400087e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000f428]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140015738], 0
jne 0x14000431e
mov ecx, 1
call fcn.1400087e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140004bd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x1400145c0]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x140004c0e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140004bf0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140004df5
mov ecx, 3
call fcn.1400091b0
cmp eax, 1
je 0x140004dac
mov ecx, 3
call fcn.1400091b0
test eax, eax
jne 0x140004c45
cmp dword [0x140014058], 1
je 0x140004dac
cmp edi, 0xfc
je 0x140004df5
mov qword [rsp + 0x50], rbp
lea rbp, [0x140015c90]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.1400087f0
test eax, eax
je 0x140004c89
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140003f00
lea rdx, [0x140015ca9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x140015dad], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140004cd9
lea r8, str._program_name_unknown_
lea rcx, [0x140015ca9]
mov edx, 0x2fb
call fcn.1400087f0
test eax, eax
je 0x140004cd9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140003f00
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140015ca9]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x140004d28
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x140015fa4]
lea r9d, [rax + 3]
lea r8, [0x14000fa04]
sub rdx, rcx
call fcn.140009090
test eax, eax
je 0x140004d28
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140003f00
lea r8, [0x14000fa00]
mov edx, 0x314
mov rcx, rbp
call fcn.140008fd0
test eax, eax
je 0x140004d54
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140003f00
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.140008fd0
test eax, eax
je 0x140004d84
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140003f00
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.140008d70
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140004df5
cmp rax, 0xffffffffffffffff
je 0x140004df5
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140004e10
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.1400091b0
cmp eax, 1
je 0x140004e42
mov ecx, 3
call fcn.1400a6000
test eax, eax
jne 0x140004ef6
cmp dword [0x140014058], 1
jne 0x140004ef6
mov qword [rsp + 0x48], rbx
lea rbx, [0x1400145c0]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x140004e6e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140004e58
jmp 0x140004ee2
cmp edi, 0x17
jae 0x140004ee2
mov ecx, 3
call fcn.1400091b0
cmp eax, 1
je 0x140004e99
mov ecx, 3
call fcn.1400091b0
test eax, eax
jne 0x140004ee2
cmp dword [0x140014058], 1
jne 0x140004ee2
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140004ee2
cmp rax, 0xffffffffffffffff
je 0x140004ee2
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140004bd0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x1400056c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x1400161bc]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x14000571c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x1400056fc
mov dword [0x1400161bc], 1
jmp 0x14000572f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x140005716
mov dword [0x1400161bc], 2
jmp 0x140005799
mov eax, dword [0x1400161bc]
cmp eax, 1
jne 0x140005790
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14000576a
cmp word [rdi], bp
mov rax, rdi
je 0x140005749
add rax, 2
cmp word [rax], bp
jne 0x140005737
add rax, 2
cmp word [rax], bp
jne 0x140005737
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.140006690
test rax, rax
mov rbx, rax
jne 0x140005771
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x14000588b
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.1400043f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x14000588b
cmp eax, 2
je 0x140005799
test eax, eax
jne 0x14000576a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x14000576a
cmp byte [rax], bpl
mov rbx, rax
je 0x1400057e8
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000576a
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x1400057b0
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.140006700
test rax, rax
mov r12, rax
jne 0x14000580d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x14000588b
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x140005875
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000589e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x140005820
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.140002700
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x140005886
Function at 0x140008d70
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140005e60
xor ebx, ebx
cmp qword [0x140016530], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140008e9c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140008faf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008faf
mov rcx, rax
call fcn.140005d90
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140016530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005d90
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140016538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005d90
lea rcx, [rsp + 0x98]
mov qword [0x140016540], rax
call fcn.140004870
test eax, eax
je 0x140008e4f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140003f00
cmp dword [rsp + 0x98], 2
jne 0x140008e9c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005d90
test rax, rax
mov qword [0x140016550], rax
je 0x140008e9c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005d90
mov qword [0x140016548], rax
mov rcx, qword [0x140016548]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140008f48
cmp qword [0x140016550], rbp
je 0x140008f48
call fcn.140005f50
mov rcx, qword [0x140016550]
mov rsi, rax
call fcn.140005f50
test rsi, rsi
mov r12, rax
je 0x140008f48
test rax, rax
je 0x140008f48
call rsi
test rax, rax
je 0x140008f13
lea rcx, [rsp + 0x34]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140008f13
test byte [rsp + 0x40], 1
jne 0x140008f48
lea rcx, [rsp + 0x30]
call fcn.1400048c0
test eax, eax
je 0x140008f35
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140003f00
cmp dword [rsp + 0x30], 4
jb 0x140008f42
bts edi, 0x15
jmp 0x140008f86
bts edi, 0x12
jmp 0x140008f86
mov rcx, qword [0x140016538]
cmp rcx, rbp
je 0x140008f86
call fcn.140005f50
test rax, rax
je 0x140008f86
call rax
test rax, rax
mov rbx, rax
je 0x140008f86
mov rcx, qword [0x140016540]
cmp rcx, rbp
je 0x140008f86
call fcn.140005f50
test rax, rax
je 0x140008f86
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140016530]
call fcn.140005f50
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140008faf
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140008fb1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000bcf0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140014060]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14000bd37
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400020b0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.14000b440
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400020b0
add rsp, 0x38
ret
Function at 0x1400014a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r12d, r12d
lea r8, [0x140050080]
mov rdi, 0xffffffffffffffff
mov dword [rsp + 0x28], r12d
mov r9d, edi
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140002330
mov r9d, edi
mov dword [rsp + 0x28], ebx
lea r8, [0x140050080]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rsi, qword [rdx + 0x20]
test rsi, rsi
je 0x14000162d
cmp word [rsi + 0x48], r12w
je 0x14000162d
mov rbp, qword [rsi + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r14
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
cmp edi, 0x104
jge 0x140001621
cmp r15d, 0x104
jge 0x140001621
mov rbx, r12
test rdi, rdi
jle 0x1400015bb
nop word [rax + rax]
movzx ecx, word [rbp + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rbx*2 + 0x240], ax
inc rbx
cmp rbx, rdi
jl 0x1400015a0
add rbx, rbx
cmp rbx, 0x208
jae 0x140001667
mov word [rsp + rbx + 0x240], r12w
mov rbx, r12
test r15d, r15d
jle 0x1400015f8
nop dword [rax]
movzx ecx, word [r14 + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rbx*2 + 0x30], ax
inc rbx
cmp rbx, r15
jl 0x1400015e0
add rbx, rbx
cmp rbx, 0x208
jae 0x140001667
lea rdx, [rsp + 0x30]
mov word [rsp + rbx + 0x30], r12w
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140001661
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140001552
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140002030
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rax, qword [rsi + 0x20]
jmp 0x14000162f
call fcn.140002158
int3
Function at 0x140001670
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xf0
mov edi, edx
mov r8, rcx
test rcx, rcx
je 0x1400017b4
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400017b4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400017b4
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp]
xor r9d, r9d
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, r8
mov r10d, dword [rax + 0x20]
mov ebp, dword [rax + 0x1c]
add r10, r8
mov r11d, dword [rax + 0x24]
add rbp, r8
mov esi, dword [rax + 0x14]
add r11, r8
test esi, esi
je 0x1400017b4
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r11]
mov ecx, dword [r10]
add rcx, r8
mov ebx, dword [rbp + rax*4]
mov eax, 0x92
add rbx, r8
movsx edx, byte [rcx]
test edx, edx
je 0x1400017a0
nop dword [rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140001790
cmp edi, eax
je 0x1400017cf
inc r9d
add r11, 2
add r10, 4
cmp r9d, esi
jb 0x140001770
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, rbx
jmp 0x1400017b6
Function at 0x140001c40
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9d, 0x18
mov dword [rsp + 0x30], 0x4b010
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001d54
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001d54
mov rcx, qword [rsp + 0x48]
lea rdx, [0x140005060]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001d54
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001d54
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [0x140005070]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001d54
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002030
add rsp, 0x68
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002030
add rsp, 0x68
ret
Function at 0x140002aec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b36
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b38
xor al, al
add rsp, 0x28
ret