joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004370
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x170
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0x160], rax
test r9d, r9d
mov r12d, 2
mov eax, 4
cmovne eax, r12d
mov ebp, r8d
mov rdi, rcx
mov esi, edx
mov qword [rsp + 0x30], 0
lea r8d, [r12 - 1]
lea rcx, str.C:AEService.log
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x140004518
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x70]
lea r9, str.ddMMMyy
lea r8, [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea rax, [rsp + 0x58]
lea r9, str.HH:mm:ss
lea r8, [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
cmp esi, 0xffffffff
movzx eax, word [rsp + 0x56]
lea r9, [rsp + 0x70]
mov edx, 0xc8
lea rcx, [rsp + 0x90]
jne 0x140004484
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x58]
lea r8, str._s__s._i:__s__r_n
mov qword [rsp + 0x20], rax
call fcn.1400046b0
jmp 0x1400044a7
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x58]
lea r8, str._s__s._i:__s___i__r_n
mov qword [rsp + 0x20], rax
call fcn.1400046b0
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebp, ebp
je 0x1400044dd
lea r9, [rsp + 0x40]
lea rdx, [0x140012124]
mov r8d, r12d
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x90]
not rcx
mov qword [rsp + 0x20], rax
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400046f0
add rsp, 0x170
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400059c4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x140005a70
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x140008cbd
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jl 0x14000c445
jmp 0x140009324
jmp 0x140007ae7
Function at 0x14000a17f
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x14000ba1e
jmp 0x14000a989
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x140007761
test eax, eax
je 0x140005d2b
jmp 0x14000a3cc
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.1400080de
jmp 0x1400070f9
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x14000ba1e
jmp 0x14000a989
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x140005cd8
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x14000c428
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x14000c255
jmp 0x140007761
mov rcx, qword [rsp + 0x70]
call fcn.14000bd36
jmp 0x1400079a0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x140007f9f
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x14000951c
jmp 0x14000c334
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000a3cc
jmp 0x14000b4c3
jmp 0x140005cd8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x14000c255
Function at 0x1400012d0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.1400138d0
test rax, rax
je 0x1400014ff
mov rbx, rax
movzx eax, word [rbp + rax*2 - 2]
cmp eax, 0x5c
je 0x1400014f7
cmp eax, 0x2f
je 0x1400014f7
lea rax, [rbx + 2]
add rax, rax
mov rcx, 0xffffffffffffffff
cmovae rcx, rax
call fcn.1400137e4
mov rdi, rax
lea r8, [rbx + rbx]
add r8, 4
xor r14d, r14d
mov rcx, rax
xor edx, edx
call fcn.140015da0
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, rbp
call fcn.140013a90
mov rcx, rdi
call fcn.140013ae8
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x38]
mov qword [rcx], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001504
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001537
add ebx, ebx
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001537
lea r9, [rsp + 0x2c]
mov dword [r9], 4
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001537
lea r14, [rsp + 0x28]
mov ebp, dword [r14]
mov rcx, rbp
call fcn.1400137e4
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.140015da0
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, r15
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001537
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001462
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001474
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.140013a88
lea rdx, [0x1400409c8]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013a90
mov r14d, 1
cmp dword [rsp + 0x28], 0
je 0x1400014cf
add rsi, 0x48
xor ebp, ebp
lea rdi, str._.2x
mov rbx, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [r15 + rbp]
mov rcx, rsi
mov rdx, rdi
call rbx
add rsi, 4
inc rbp
mov eax, dword [rsp + 0x28]
cmp rbp, rax
jb 0x1400014b2
mov rdi, r15
mov rcx, rdi
call fcn.140013a88
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140024a50
mov eax, r14d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec rbx
jmp 0x140001319
xor r14d, r14d
jmp 0x1400014da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140001537
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140001395
xor r14d, r14d
jmp 0x1400014d2
Function at 0x140001bb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 2
mov edx, 0x4000000
call fcn.14000f4c0
test rax, rax
je 0x140001cdd
mov r12, rax
mov rax, qword [rbx + 8]
lea r15, [rsp + 0x28]
mov qword [r15], rax
xorps xmm0, xmm0
movups xmmword [r15 + 8], xmm0
mov rax, qword [rbx + 0x10]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], 0
mov rax, qword [rbx + 0x20]
mov qword [r15 + 0x28], rax
xor esi, esi
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x140001ce4
cmp esi, eax
jge 0x140001c6d
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x38]
jne 0x140001c6d
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbx]
mov r9, qword [rbx + 8]
mov dword [rsp + 0x20], eax
mov rdx, rdi
mov r8d, esi
call fcn.14000d540
test eax, eax
jle 0x140001cf2
add esi, eax
mov eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rcx, r12
mov rdx, r15
call fcn.14000e4f0
mov ebp, eax
mov r8, qword [rsp + 0x48]
cmp r8, qword [rbx + 0x20]
jne 0x140001ca9
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, r14
call fcn.140021a1c
cmp rax, qword [rsp + 0x48]
jne 0x140001ceb
mov qword [rsp + 0x48], 0
xor r8d, r8d
test ebp, ebp
je 0x140001c1f
mov esi, 0x27
cmp ebp, 1
jne 0x140001cf7
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, r14
call fcn.140021a1c
xor ecx, ecx
cmp rax, qword [rsp + 0x48]
mov esi, 0x46
cmove esi, ecx
jmp 0x140001cf7
mov esi, 0x27
jmp 0x140001cff
mov esi, 0x28
jmp 0x140001cf7
mov esi, 0x46
jmp 0x140001cf7
mov esi, 6
mov rcx, r12
call fcn.14000f5c0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024a50
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140004020
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov dx, 0x2f
call fcn.140016108
test rax, rax
je 0x140004055
mov rsi, rax
mov word [rax], 0
mov rcx, rdi
call fcn.140004020
mov ebx, eax
test eax, eax
je 0x140004061
mov word [rsi], 0x2f
jmp 0x140004057
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
cmp word [rdi], 0
je 0x14000404e
mov rcx, rdi
call fcn.14001fd10
test eax, eax
jns 0x14000404e
call fcn.14001b5f4
cmp dword [rax], 0x11
je 0x14000404e
mov eax, dword [0x14004b098]
mov ecx, dword [0x140048e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400040c5
call fcn.14001b5f4
mov r9d, dword [rax]
lea rcx, [0x14004ae88]
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
mov r8, rdi
call fcn.140011840
mov ebx, 7
jmp 0x14000404e
lea rcx, [0x14004b098]
call fcn.140013d00
cmp dword [0x14004b098], 0xffffffff
jne 0x1400040a0
mov qword [0x14004ae88], 0
lea rcx, [0x14000add0]
call fcn.140013eb8
lea rcx, [0x14004b098]
call fcn.140013d68
jmp 0x1400040a0
Function at 0x140005bd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rsi, r8
mov ebp, edx
mov rdi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.MOZ_LAUNCHED_CHILD1
call fcn.14001eb14
mov rcx, rdi
call fcn.14001f384
test eax, eax
je 0x140005c4a
mov eax, dword [0x14004b098]
mov ecx, dword [0x140048e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005d00
lea rcx, [0x14004ae88]
lea rdx, str.Warning:_chdir_failed
call fcn.140011840
test bl, bl
je 0x140005c6d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140024a50
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea r9, [rsp + 0x28]
mov edx, ebp
mov r8, rsi
call fcn.1400357e0
test eax, eax
je 0x140005c4e
mov rsi, qword [rsp + 0x28]
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbp
mov edi, eax
call rbp
sub eax, edi
cmp eax, 0x270f
ja 0x140005cf0
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [sym.imp.USER32.dll_WaitForInputIdle]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0x2710
sub ebx, eax
xor ecx, ecx
call r14
mov rcx, rsi
mov edx, ebx
call r15
cmp eax, 0xffffffff
jne 0x140005cf0
call r12
cmp eax, 0x5bf
jne 0x140005cf0
mov ecx, 0xa
call r13
call rbp
sub eax, edi
cmp eax, 0x2710
jb 0x140005cba
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005c4e
lea rcx, [0x14004b098]
call fcn.140013d00
cmp dword [0x14004b098], 0xffffffff
jne 0x140005c37
mov qword [0x14004ae88], 0
lea rcx, [0x14000add0]
call fcn.140013eb8
lea rcx, [0x14004b098]
call fcn.140013d68
jmp 0x140005c37
Function at 0x1400085a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x248
mov rsi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
xor edx, edx
call fcn.140015da0
cmp byte [0x14004ac78], 0
je 0x1400085fa
lea rcx, [0x14004a230]
lea rdx, [0x1400401bc]
lea r8, [rsp + 0x30]
call fcn.1400122b0
test eax, eax
jne 0x140008623
jmp 0x14000867c
lea rax, [0x1400401b0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea r9, [0x14004a230]
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.140004870
lea rdx, [0x140040aee]
lea rcx, [rsp + 0x30]
call fcn.14001fbe4
test rax, rax
je 0x14000867c
mov rdi, rax
mov rcx, rsi
call fcn.1400224c0
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov r9, rdi
call fcn.140021a1c
cmp rax, 1
jne 0x140008680
cmp byte [0x14004ac78], 0
je 0x140008677
lea rcx, [0x14004a230]
call fcn.140012340
test eax, eax
je 0x140008680
mov sil, 1
jmp 0x140008682
xor esi, esi
jmp 0x14000868a
xor esi, esi
mov rcx, rdi
call fcn.140021088
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140024a50
mov eax, esi
add rsp, 0x248
pop rdi
pop rsi
ret

Function at 0x1400086b0
Capabilities:
Copy file

Disassembly:
push rsi
sub rsp, 0x660
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov eax, dword [0x14004b098]
mov ecx, dword [0x140048e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008821
mov rcx, qword [0x14004ae88]
test rcx, rcx
je 0x14000870b
call fcn.140021088
mov qword [0x14004ae88], 0
cmp byte [0x14004aa69], 1
jne 0x140008807
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015da0
lea rcx, [0x14004a230]
lea rdx, [0x1400401bc]
mov r8, rsi
call fcn.1400122b0
test eax, eax
je 0x140008791
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015da0
lea r8, str._supdate.status
lea r9, [0x14004a230]
mov edx, 0x105
mov rcx, rsi
call fcn.140004870
lea rcx, [rsp + 0x440]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015da0
lea rcx, [0x14004a230]
lea rdx, [0x140040734]
mov r8, rsi
call fcn.1400122b0
test eax, eax
je 0x140008807
lea rsi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015da0
lea r8, str._supdate.log
lea r9, [0x14004a230]
mov edx, 0x105
mov rcx, rsi
call fcn.140004870
lea rcx, [rsp + 0x230]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.140024a50
nop
add rsp, 0x660
pop rsi
ret
lea rcx, [0x14004b098]
call fcn.140013d00
cmp dword [0x14004b098], 0xffffffff
jne 0x1400086ef
mov qword [0x14004ae88], 0
lea rcx, [0x14000add0]
call fcn.140013eb8
lea rcx, [0x14004b098]
call fcn.140013d68
jmp 0x1400086ef
Function at 0x14000b1f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
lea rsi, [rsp + 0x50]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015da0
lea rcx, [0x14004a230]
lea rdx, [0x1400401bc]
mov r8, rsi
call fcn.1400122b0
test eax, eax
je 0x14000b388
lea rdx, [0x1400409ba]
lea rcx, [rsp + 0x50]
call fcn.14001fbe4
test rax, rax
je 0x14000b32c
mov rsi, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 1
mov r8d, 0x1f
mov r9, rax
call fcn.140021758
mov rdi, rax
mov rcx, rsi
call fcn.140021170
test eax, eax
sete bl
jne 0x14000b380
mov byte [rsp + rdi + 0x30], 0
test r15, r15
je 0x14000b2be
cmp byte [r15 + 4], 0
je 0x14000b2be
mov byte [r15 + 4], 0
lea r13, [rsp + 0x30]
mov rcx, r13
mov edx, 0x3a
call fcn.140015f30
mov rdi, rax
test rax, rax
jne 0x14000b301
lea rcx, [rsp + 0x30]
mov edx, 0xa
call fcn.140015f30
mov rdi, rax
test rax, rax
jne 0x14000b301
lea rcx, [rsp + 0x30]
call fcn.1400224c0
lea rdi, [rsp + rax]
add rdi, 0x30
mov rbp, rdi
sub rbp, r13
mov rcx, r12
call fcn.1400224c0
cmp rbp, rax
jne 0x14000b330
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r8, rbp
call fcn.140022580
test eax, eax
sete bpl
jmp 0x14000b332
xor ebx, ebx
jmp 0x14000b388
xor ebp, ebp
test r15, r15
je 0x14000b37d
cmp byte [rdi], 0x3a
jne 0x14000b37d
inc rdi
lea r12, [rsp + 0x28]
mov qword [r12], 0
mov rcx, rdi
mov rdx, r12
mov r8d, 0xa
call fcn.140022c5c
cmp qword [r12], rdi
je 0x14000b37d
lea ecx, [rax - 0x7fffffff]
cmp ecx, 2
jb 0x14000b37d
cmp byte [r15 + 4], 0
jne 0x14000b3ae
mov dword [r15], eax
mov byte [r15 + 4], 1
mov byte [r14], bpl
mov rcx, rsi
call fcn.140021088
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140024a50
mov eax, ebx
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
Function at 0x14000bd00
Capabilities:
Hash data via wincrypt
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14000bd5e
mov rbx, r8
test r8, r8
je 0x14000bd5e
mov r12, qword [rsp + 0x80]
test r12, r12
je 0x14000bd5e
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x14000bd5e
mov edi, r9d
mov r8, rdx
mov r9d, r9d
mov rdx, rbx
call fcn.14000ce10
test eax, eax
je 0x14000bd84
mov ecx, 2
call fcn.140016598
lea rdx, str.ERROR:_Could_not_read__s_n
jmp 0x14000bdc6
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140021a1c
jmp 0x14000bdd1
mov r15d, dword [rsp + 0x88]
xor esi, esi
mov r13, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [r12 + rsi*8]
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call r13
test eax, eax
je 0x14000bdb5
inc rsi
cmp r15, rsi
jne 0x14000bd95
xor eax, eax
jmp 0x14000bdd6
mov ecx, 2
call fcn.140016598
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
mov r8, r14
call fcn.140001260
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c830
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 1
mov r8d, 0x20
mov rcx, rsi
mov r9, rdi
call fcn.140021758
mov ebx, 6
cmp rax, 0x20
jne 0x14000c90d
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
mov rcx, rdi
call fcn.14001b9d0
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.14001bc34
mov ebx, 6
test eax, eax
jne 0x14000c90d
movabs rax, 0x303146464944424d
mov ebx, 0x29
cmp qword [rsi], rax
jne 0x14000c90d
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14000c90d
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14000c90d
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14000c90d
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14000c90d
xor edx, edx
cmp rax, rcx
mov ebx, 0x29
cmove ebx, edx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024a50
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c930
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
mov rbx, rdx
mov r13, rcx
mov r14d, dword [rcx + 8]
mov esi, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
add ebp, esi
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.140021ee0
test rax, rax
je 0x14000c9c7
mov r15, rax
test rbp, rbp
je 0x14000c9ad
mov r12d, 0x7fffffff
mov rsi, r15
cmp rbp, r12
mov edi, 0x7fffffff
cmovb rdi, rbp
mov edx, 1
mov rcx, rsi
mov r8, rdi
mov r9, rbx
call fcn.140021758
cmp rax, rdi
jne 0x14000c9d1
add rsi, rdi
sub rbp, rdi
jne 0x14000c97d
mov esi, dword [r13 + 0x14]
imul eax, esi, 0xaaaaaaab
ror eax, 2
cmp eax, 0x15555555
jbe 0x14000c9db
mov ebp, 0x29
jmp 0x14000cb1d
mov ebp, ntohl
jmp 0x14000cb25
mov ebp, 6
jmp 0x14000cb1d
test esi, esi
je 0x14000cb1b
mov rcx, qword [rsp + 0x20]
add r14, rcx
mov eax, esi
mov rdi, r15
add rdi, rax
mov ebx, dword [r13 + 0x18]
mov eax, dword [r13 + 0x1c]
add rbx, rdi
add rax, rbx
mov qword [rsp + 0x38], rax
mov r13, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov r12, r15
mov ecx, dword [r12]
mov rsi, qword [sym.imp.WS2_32.dll_ntohl]
call rsi
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r14
sub rcx, r13
cmp rcx, rax
jb 0x14000c9bd
mov rcx, qword [rsp + 0x40]
sub rcx, rdi
cmp rcx, rax
jb 0x14000c9bd
test eax, eax
je 0x14000ca7f
xor ecx, ecx
mov al, byte [r13 + rcx]
add byte [rdi + rcx], al
inc rcx
mov eax, dword [r12]
cmp rcx, rax
jb 0x14000ca69
jmp 0x14000ca81
xor eax, eax
mov r8d, eax
mov edx, 1
mov rcx, rdi
mov r9, qword [rsp + 0x28]
call fcn.140021a1c
mov rsi, rax
mov ebp, 0x40
cmp dword [r12], esi
jne 0x14000cb1d
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, r8
jb 0x14000c9bd
mov edx, 1
mov rcx, rbx
mov r9, qword [rsp + 0x28]
call fcn.140021a1c
cmp dword [r12 + 4], eax
jne 0x14000cb1d
mov edx, esi
add r13, rdx
movsxd rcx, dword [r12 + 8]
mov rbp, qword [rsp + 0x20]
sub rbp, r13
cmp rbp, rcx
jg 0x14000c9bd
mov rbp, r14
sub rbp, r13
cmp rbp, rcx
jl 0x14000c9bd
add rdi, rdx
mov eax, eax
add rbx, rax
add r13, rcx
add r12, 0xc
xor ebp, ebp
cmp r12, qword [rsp + 0x30]
jb 0x14000ca16
jmp 0x14000cb1d
xor ebp, ebp
mov rcx, r15
call fcn.140021a08
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret