joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000df50
Capabilities:
Set registry value

Disassembly:
push rbp
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rbp - 8], r9
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], r9
lea rcx, [rbp + 0x10]
call fcn.14000d670
mov rcx, qword [rbp - 8]
add rcx, 0x18
call fcn.14000d860
mov byte [rbp + 7], al
jmp 0x14000df9b
mov rax, qword [rbp - 0x10]
mov cl, byte [rbp + 7]
mov byte [rbp + 0x2f], cl
movzx ecx, byte [rbp + 0x2f]
mov dword [rbp - 0x24], ecx
mov dword [rbp + 0x50], ecx
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x10]
call fcn.140001020
mov qword [rbp - 0x18], rax
jmp 0x14000dfc5
mov rcx, qword [rbp - 8]
call fcn.14001eb20
mov qword [rbp - 0x30], rax
jmp 0x14000dfd4
mov rcx, qword [rbp - 8]
call fcn.14001eb10
mov qword [rbp - 0x38], rax
jmp 0x14000dfe3
mov r9d, dword [rbp - 0x24]
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x30]
mov rax, qword [rbp - 0x38]
mov r10d, eax
mov rax, rsp
mov dword [rax + 0x28], r10d
mov qword [rax + 0x20], r8
mov rax, qword [sym.imp.advapi32.dll_RegSetValueExW]
xor r8d, r8d
call rax
mov dword [rbp - 0x3c], eax
jmp 0x14000e016
mov eax, dword [rbp - 0x3c]
mov dword [rbp + 0x54], eax
cmp eax, 0
jne 0x14000e02b
mov qword [rbp + 8], 0
jmp 0x14000e039
mov ecx, dword [rbp - 0x3c]
call fcn.14000e820
mov qword [rbp - 0x48], rax
jmp 0x14000e04f
lea rcx, [rbp + 0x10]
call fcn.14001d5f0
mov rax, qword [rbp + 8]
add rsp, 0xe0
pop rbp
ret
mov rax, qword [rbp - 0x48]
mov qword [rbp + 8], rax
jmp 0x14000e039

Function at 0x140014d40
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
movdqa xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x60]
call fcn.140016650
mov r8, qword [rsp + 0x28]
movdqa xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [r8]
movdqa xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x80]
call fcn.140016650
movaps xmm0, xmmword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movdqa xmm1, xmmword [rsp + 0x70]
sha256msg1 xmm0, xmm1
movdqa xmmword [rcx], xmm0
add rsp, 0x98
ret

Function at 0x140014dd0
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
movdqa xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x60]
call fcn.140016650
mov r8, qword [rsp + 0x28]
movdqa xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [r8]
movdqa xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x80]
call fcn.140016650
movaps xmm0, xmmword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movdqa xmm1, xmmword [rsp + 0x70]
sha256msg2 xmm0, xmm1
movdqa xmmword [rcx], xmm0
add rsp, 0x98
ret
Function at 0x140014e60
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
sub rsp, 0xc8
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
movdqa xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call fcn.140016650
mov r8, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [r8]
movdqa xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x90]
call fcn.140016650
mov r9, qword [rsp + 0x28]
movdqa xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [r9]
movdqa xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xb0]
call fcn.140016650
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
movdqa xmm0, xmmword [rsp + 0xa0]
sha256rnds2 xmm1, xmm2, xmm0
movaps xmm0, xmm1
movdqa xmmword [rcx], xmm0
add rsp, 0xc8
ret

Function at 0x140027220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
movdqa xmm0, xmmword [rdx]
aeskeygenassist xmm0, xmm0, 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14003b880
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14003b920
jmp 0x14003b90f
jae 0x14003b9df
cmp r8, 0x201
jae 0x14003b920
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14003b977
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14003b94f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14005ee60
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14003b9a0
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14003ba4b
mov r8d, r13d
cmp r12, r8
jne 0x14003b900
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003ba7f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14003b90f
jmp 0x14003b920
cmp r14, r8
jb 0x14003ba99
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14003e5b0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14003ba34
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14000fc30
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14003ba1f
jmp 0x14003ba34
lea rcx, [0x141076820]
lea r8, [0x1410790e8]
mov edx, 0x28
call fcn.14005fca0
jmp 0x14003baae
lea rax, [0x1410790d0]
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1400600b0
ud2
Function at 0x14003bb00
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14004ecf0
mov rax, qword [rbp - 0x60]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x14003bb56
lea rcx, [rbp - 0x58]
call fcn.140035d10
mov qword [rsi], rdi
jmp 0x14003bdaa
mov qword [rbp + 0x3f0], rsi
mov qword [rbp + 0x400], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x3f8], rax
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x410], 2
mov qword [rbp + 0x418], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x14003bbe0
jmp 0x14003bbcf
jae 0x14003bca6
cmp r8, 0x201
jae 0x14003bbe0
mov r15d, 0x200
lea r12, [rbp - 0x60]
mov r13, r8
jmp 0x14003bc38
sub r8, r14
sub rbx, r14
cmp rbx, r8
jae 0x14003bc0f
lea rcx, [rbp + 0x408]
mov rdx, r14
call fcn.14005ee60
mov rdi, qword [rbp + 0x408]
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rbp + 0x418], r14
mov rbx, rdi
mov r15, r14
mov r12, qword [rbp + 0x3e8]
mov r13, r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x3f8]
mov rdx, r12
mov r8d, r13d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14003bc67
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14003bd2c
mov r8d, esi
cmp r13, r8
jne 0x14003bbc0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003bdc1
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x14003bbcf
jmp 0x14003bbe0
cmp r15, r8
jb 0x14003bddb
lea rcx, [rbp + 0x3a0]
mov rdx, r12
call fcn.14003e5b0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
mov rdx, qword [rbp + 0x408]
test rdx, rdx
je 0x14003bcfb
mov rcx, qword [rbp + 0x410]
add rdx, rdx
mov r8d, 2
call fcn.14000fc30
movabs rdi, 0x8000000000000000
cmp qword [rbp + 0x3c0], rdi
mov rsi, qword [rbp + 0x3f0]
je 0x14003bd7a
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x14003bd89
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c8], rax
movabs rdi, 0x8000000000000000
mov qword [rbp + 0x3c0], rdi
mov rdx, qword [rbp + 0x408]
test rdx, rdx
je 0x14003bd73
mov rcx, qword [rbp + 0x410]
add rdx, rdx
mov r8d, 2
call fcn.14000fc30
mov rsi, qword [rbp + 0x3f0]
mov qword [rsi], rdi
lea rcx, [rbp + 0x3c8]
call fcn.140035d10
mov rdx, qword [rbp + 0x400]
test rdx, rdx
je 0x14003bdaa
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x3f8]
call fcn.14000fc30
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x141076820]
lea r8, [0x1410790e8]
mov edx, 0x28
call fcn.14005fca0
jmp 0x14003bdf0
lea rax, [0x1410790d0]
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400600b0
ud2
Function at 0x14003bed0
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x14003bee5
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14003bf00
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.140045a00

Function at 0x1400420f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14005e2b0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x140047fe0]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov rdi, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call case.0x140040a25.124
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x1400422e0
test r15, r15
je 0x1400422ac
cmp r15, 0x1000
ja 0x140042302
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x140042280
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x140042210
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x1400422a0
add r12, rax
cmp r12, r15
je 0x140042270
jbe 0x1400421c0
jmp 0x1400422ee
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14004216e
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.140035d10
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.140035d10
jmp 0x1400422ac
lea r8, [0x141078af0]
mov rcx, r12
mov rdx, r15
call fcn.1400600c0
jmp 0x140042316
lea r8, [0x141078af0]
mov edx, 0x1000
mov rcx, r15
call fcn.1400600b0
ud2
Function at 0x140045a00
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14004ecf0
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140045a60
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.1400506e0
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x140045a6c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x140045a98
test rdi, rdi
je 0x140045ac4
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.14000fc30
xor eax, eax
jmp 0x140045a63
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x140045a63
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.14000fc30
jmp 0x140045a60
xor eax, eax
jmp 0x140045a63

Function at 0x140046440
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x141078878]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140046478
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400464cf
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x1400464dc
xor edx, edx
xor eax, eax
jmp 0x140046506
cmp eax, 0x103
je 0x140046510
test eax, eax
js 0x1400464ef
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140046506
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1410788d8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14003e270
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400363a0
mov ecx, 7
int 0x29
ud2
Function at 0x140046560
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x141078878]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140046598
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400465f6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140046623
test eax, eax
js 0x140046602
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140046619
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1410788d8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14003e270
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1400363a0
mov ecx, 7
int 0x29
ud2

Function at 0x140047140
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x60], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x5c], ecx
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
lea r14, [rbp + 0x20]
mov r12, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor edi, edi
xor eax, eax
mov qword [rbp - 8], rax
nop word cs:[rax + rax]
Function at 0x1400484d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov rdi, rdx
cmp qword [rdx], 0
jne 0x140048640
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x14004850d
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x140048605
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x140048623
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rbp + 4], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rbp + 4]
mov r8d, eax
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x14004856c
mov eax, dword [rbp + 4]
mov ecx, 2
test rax, rax
je 0x1400485af
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x1400485b3
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x40], rax
movabs rcx, 0xffffffff00000000
and rcx, rax
movabs rdx, 0x6d00000000
cmp rcx, rdx
je 0x1400485b7
movabs rdx, 0x3e500000000
cmp rcx, rdx
jne 0x1400485e1
lea rax, [rbp - 8]
jmp 0x1400485c3
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400485e7
mov qword [rbp - 8], 1
lea rax, [rbp - 0x10]
mov qword [rax], 0
lea rcx, [rbp - 0x40]
call fcn.140035d10
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
cmp rcx, 2
jne 0x1400485f2
mov qword [rsi + 8], rax
mov al, 1
mov byte [rsi], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
test rcx, rcx
jne 0x140048555
mov ecx, 1
jmp 0x14004855f
mov r8d, 0x10
mov rcx, rbx
call fcn.14005efb0
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x14004851a
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.14005efb0
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x14004851a
mov qword [rbp - 0x40], 0
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14005edd0
int3
Function at 0x14004ca40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.14004ecf0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs r14, 0x8000000000000000
cmp rcx, r14
jne 0x14004ca7e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], r14
jmp 0x14004caa4
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
Function at 0x14004e540
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov dword [rbp - 8], 0xfffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14108a181]
mov ecx, 0x10
adc byte [rax], al
add byte [rax], al
mov edx, 8
call fcn.14000fc20
test rax, rax
ror byte [rdi], 0x84
invalid
add byte [rax], al
invalid
Function at 0x14005ce10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14005ce9a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14005ce90
cmp r11, r10
ja 0x14005cf16
cmp r10, rdx
ja 0x14005cf28
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14005ce92
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14005ce70
jmp 0x14005cef7
ja 0x14005ce9a
mov r11, r10
cmp rax, r8
jne 0x14005ce37
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14005cefb
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14005ced0
mov r8, r10
sub ecx, r9d
jns 0x14005ceee
jmp 0x14005cefd
cmp r10, rdx
je 0x14005cf0a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14005cefd
xor al, 1
cmp r8, rdx
jne 0x14005ceb0
jmp 0x14005cefd
xor eax, eax
jmp 0x14005cefd
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [0x14107c220]
call fcn.14005fba0
lea r8, [0x14107c238]
mov rcx, r11
mov rdx, r10
call fcn.1400600c0
lea r8, [0x14107c238]
mov rcx, r10
call fcn.1400600b0
int3

Function at 0x14005e7f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14005e842
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005e842
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005e842
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005e842
cmp dword [rcx + 0x84], 0xe
jbe 0x14005e842
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005e844
xor al, al
add rsp, 0x28
ret
Function at 0x140007f70
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x1400b5bc0]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x140007f8c
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x140007f9a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x140007fa5
bts eax, 5
shr ecx, 1
test cl, 1
je 0x140007fb0
bts eax, 4
shr ecx, 1
test cl, 1
je 0x140007fbb
bts eax, 3
shr ecx, 1
test cl, 1
je 0x140007fc6
bts eax, 2
shr ecx, 1
test cl, 1
je 0x140007fd1
bts eax, 1
test cl, 2
je 0x140007fda
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
mov edx, 0x1e
cmovns r8d, eax
xor ecx, ecx
test r8b, 1
je 0x140008073
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x14000807f
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x140008067
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x140007f80
mov dword [0x1400b5bb0], 1
ret