joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008a1c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp + 0x210], rax
lea rax, [0x140055ac8]
mov r14, rcx
mov r12, rdx
mov qword [rsp + 0x30], rax
lea rax, [0x140055ad0]
lea rcx, [rbp + 2]
mov qword [rsp + 0x38], rax
lea rax, [0x140055ad8]
xor r13d, r13d
mov qword [rsp + 0x40], rax
lea rax, [0x140055ae0]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [0x140055ae8]
mov r8d, 0x208
mov qword [rsp + 0x50], rax
lea rax, [0x140055af0]
mov word [rbp], r13w
mov qword [rsp + 0x58], rax
lea rax, [0x140055af8]
mov qword [rsp + 0x60], rax
lea rax, [0x140055b00]
mov qword [rsp + 0x68], rax
lea rax, [0x140055b08]
mov qword [rsp + 0x70], rax
lea rax, [0x140055b10]
mov qword [rsp + 0x78], rax
lea rax, [0x140055b18]
mov qword [rbp - 0x80], rax
lea rax, [0x140055b20]
mov qword [rbp - 0x78], rax
lea rax, [0x140055b28]
mov qword [rbp - 0x70], rax
lea rax, [0x140055b30]
mov qword [rbp - 0x68], rax
lea rax, [0x140055b38]
mov qword [rbp - 0x60], rax
lea rax, [0x140055b40]
mov qword [rbp - 0x58], rax
lea rax, [0x140055b48]
mov qword [rbp - 0x50], rax
lea rax, [0x140055b50]
mov qword [rbp - 0x48], rax
lea rax, [0x140055b58]
mov qword [rbp - 0x40], rax
lea rax, [0x140055b60]
mov qword [rbp - 0x38], rax
lea rax, [0x140055b68]
mov qword [rbp - 0x30], rax
lea rax, [0x140055b70]
mov qword [rbp - 0x28], rax
lea rax, [0x140055b78]
mov qword [rbp - 0x20], rax
lea rax, [0x140055b80]
mov qword [rbp - 0x18], rax
lea rax, [0x140055b88]
mov qword [rbp - 0x10], rax
lea rax, [0x140055b90]
mov qword [rbp - 8], rax
call fcn.140018a40
test r14, r14
je 0x140008c6e
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [r14 + rax*2], r13w
jne 0x140008ba3
test rax, rax
je 0x140008c6e
test r12, r12
je 0x140008c6e
mov rdi, r13
mov rcx, qword [rsp + rdi*8 + 0x30]
lea rdx, [rbp]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x140008c33
mov r15d, r13d
lea rcx, [rbp]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140008be5
test rax, rax
je 0x140008c22
mov rsi, r13
movzx ecx, word [rbp + rsi*2]
call fcn.1400145d8
inc r15d
lea rcx, [rbp]
mov word [rbp + rsi*2], ax
mov esi, r15d
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140008c13
cmp rsi, rax
jb 0x140008bf7
lea rdx, [rbp]
mov rcx, r14
call fcn.1400145e0
cmp r14, rax
je 0x140008c3e
inc rdi
cmp rdi, 0x1a
jae 0x140008c6e
jmp 0x140008bc2
lea rax, [rbp]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x140008c42
mov r9, qword [rsp + rdi*8 + 0x30]
lea rax, [r14 + rbx*2]
lea r8, [0x140055b98]
mov edx, 0x105
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.1400147dc
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140012b40
mov rbx, qword [rsp + 0x370]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009894
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov edi, 0x104
lea rcx, [rsp + 0x21]
xor ebx, ebx
mov r8d, edi
xor edx, edx
mov byte [rsp + 0x20], bl
call fcn.140018a40
lea rcx, [rbp + 0x31]
mov r8d, edi
xor edx, edx
mov byte [rbp + 0x30], bl
call fcn.140018a40
lea rsi, [0x1400a1b40]
test rsi, rsi
jne 0x140009901
xor eax, eax
jmp 0x1400099b8
mov edi, 0x105
lea rdx, [rbp + 0x30]
lea rcx, str.f_ceYI9
mov r8d, edi
mov byte [0x1400a1b40], bl
call fcn.14000fe00
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x30]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000999d
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.140012f94
test rax, rax
je 0x14000999d
lea rdx, [rbp + 0x30]
lea rcx, str.i_W_c_nj
mov r8d, edi
mov byte [rax + 1], bl
call fcn.14000fe00
lea r8, [rbp + 0x30]
lea rcx, [rsp + 0x20]
mov edx, edi
call fcn.14001486c
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x140009978
inc rax
cmp rax, rdi
ja 0x14000999d
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
call fcn.1400130d8
mov ebx, 1
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140010a84
lea rcx, [rbp + 0x30]
mov rdx, rdi
call fcn.140010a84
mov eax, ebx
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000a514
Capabilities:
Read file via mapping
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov esi, r8d
mov r14, rdx
mov rbp, rcx
or rax, 0xffffffffffffffff
mov dword [rsp + 0x44], ebx
inc rax
cmp byte [rax + rcx], bl
jne 0x14000a541
test rax, rax
je 0x14000a66c
test rdx, rdx
je 0x14000a66c
cmp r8d, 2
jbe 0x14000a66c
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call fcn.140007508
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a66c
mov r9d, 2
lea rcx, [rsp + 0x40]
mov r8, r14
mov edx, r9d
call fcn.140013390
xor eax, eax
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, r14
mov rcx, rdi
mov word [r14], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000a65f
cmp esi, dword [rsp + 0x44]
jne 0x14000a65f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call fcn.140007508
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a668
xor r9d, r9d
xor edx, edx
mov rcx, rax
lea r8d, [r9 + 4]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x14000a65f
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
test rax, rax
je 0x14000a656
movzx eax, word [rsp + 0x40]
mov ebx, 1
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x14000a66e
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140012b40
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000c01c
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rdx
mov rbx, rcx
call fcn.14000c2d4
test eax, eax
je 0x14000c0ab
cmp dword [rbx + 0x108], 0
jne 0x14000c064
cmp byte [rbx + 0x1e0], 0
jne 0x14000c064
cmp dword [rbx + 0x110], 0
je 0x14000c064
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rdi
mov rcx, rbx
call fcn.14000a7f8
mov ecx, 0xa8
call fcn.140014800
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000c09f
xor edx, edx
mov r8d, 0xa8
mov rcx, rax
call fcn.140018a40
mov rcx, rdi
call fcn.14000ddbc
nop
mov qword [rbx + 0x118], rax
test rax, rax
jne 0x14000c0b0
or eax, 0xffffffff
jmp 0x14000c0e0
cmp dword [rbx + 0x108], 0
jne 0x14000c0d1
test dword [rax + 0xa0], 0x4000
je 0x14000c0d1
mov dword [rbx + 0x10c], 1
jmp 0x14000c0d8
and dword [rbx + 0x10c], 0
mov rcx, rbx
call fcn.14000b48c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000c2d4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7c0
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
mov rsi, rcx
xor ebx, ebx
lea rcx, [rbp + 0x5a1]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x20], rbx
mov byte [rbp + 0x5a0], bl
call fcn.140018a40
mov r14d, 0x105
lea rcx, [rbp + 0x5a0]
mov edx, r14d
mov r8, rsi
call fcn.1400130d8
lea r8, str..mul
lea rcx, [rbp + 0x5a0]
mov edx, r14d
call fcn.14001486c
lea rcx, [rbp + 0x5a0]
xor edx, edx
call fcn.14001331c
mov edi, 0x778
test eax, eax
jne 0x14000c3b9
lea r8, [0x140055d70]
lea rdx, [rbp + 0x5a0]
lea rcx, [rsp + 0x20]
call fcn.140014d3c
mov r9, qword [rsp + 0x20]
test r9, r9
je 0x14000c3ad
lea edx, [rbx + 1]
lea rcx, [0x14009e900]
mov r8d, edi
call fcn.140014fb0
mov rcx, qword [rsp + 0x20]
call fcn.1400150f4
lea rcx, [rbp + 0x5a0]
call fcn.140010be4
lea rcx, [rbp + 0x5a0]
mov rdx, r14
call fcn.140010a84
mov r14d, 0x670
lea rcx, [rsp + 0x30]
mov r8d, r14d
xor edx, edx
call fcn.140018a40
lea r8, [0x14009e900]
lea rdx, [rsp + 0x30]
mov r9d, edi
call fcn.14000c1e0
xor eax, eax
mov ecx, r14d
lea rdi, [rsi + 0x120]
lea r15, [rsp + 0x30]
lea r12, [rbp - 0x70]
rep stosb byte [rdi], al
sub r15, rsi
lea rdi, [rsi + 0x180]
sub r12, rsi
lea r14d, [rax + 3]
lea r8, [r15 - 0x180]
lea rdx, [rdi - 0x60]
add r8, rdi
call fcn.14000c0ec
lea r8, [r12 - 0x180]
mov rdx, rdi
add r8, rdi
call fcn.14000c0ec
add rdi, 0x20
dec r14
jne 0x14000c419
mov cl, byte [rbp - 0x10]
mov edx, 0x5a8
lea r8, [rbp - 8]
mov byte [rsi + 0x1e0], cl
lea rcx, [rsi + 0x1e8]
mov r9d, edx
call fcn.140013390
test eax, eax
sete bl
mov eax, ebx
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0x7c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000dffc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov edi, 0x104
lea rcx, [rsp + 0x21]
xor ebx, ebx
xor edx, edx
mov r8d, edi
mov byte [rsp + 0x20], bl
call fcn.140018a40
lea rcx, [rsp + 0x131]
mov r8d, edi
xor edx, edx
mov byte [rsp + 0x130], bl
call fcn.140018a40
lea rdi, [rsi + 0x18]
cmp qword [rdi + 0x18], 0x10
mov qword [rdi + 0x10], rbx
jb 0x14000e06f
mov rax, qword [rdi]
jmp 0x14000e072
mov rax, rdi
mov ebp, 0x105
lea rdx, [rsp + 0x130]
lea rcx, str.7HK:DE_IC_
mov r8d, ebp
mov byte [rax], bl
call fcn.14000fe00
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000e0b7
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000d100
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.140010a84
lea rcx, [rsp + 0x130]
mov rdx, rbp
call fcn.140010a84
cmp qword [rsi + 0x28], rbx
seta bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140010950
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
xor esi, esi
mov r14, r8
mov rdi, rdx
test rcx, rcx
je 0x140010a2a
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x140010986
test rax, rax
je 0x140010a2a
test rdx, rdx
je 0x140010a2a
test r8, r8
je 0x140010a2a
and dword [rsp + 0x28], esi
mov edx, 0x80000000
mov r8d, 7
mov dword [rsp + 0x20], 3
call fcn.140007508
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140010a2a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r14], eax
cmp eax, 0xffffffff
je 0x140010a1d
mov ecx, eax
call fcn.1400128dc
mov qword [rdi], rax
test rax, rax
je 0x140010a1d
mov r8d, dword [r14]
and qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140010a1d
mov eax, dword [r14]
mov ecx, 1
cmp dword [rsp + 0x40], eax
cmove esi, ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140010a61
mov rcx, qword [rdi]
test rcx, rcx
je 0x140010a5d
call fcn.140012edc
mov rcx, qword [rdi]
mov rdx, rax
call fcn.140010a84
mov rbx, qword [rdi]
mov rcx, rbx
call fcn.140012eb0
test rbx, rbx
je 0x140010a59
mov qword [rdi], 0x8123
and qword [rdi], 0
and dword [r14], 0
mov eax, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140012b40
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140011044
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp - 0x10], rax
and dword [rbp - 0x40], 0
xor edi, edi
mov rbx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x140011078
test rax, rax
je 0x140011277
mov rax, qword [0x1400a0830]
mov r12d, 1
test rax, rax
jne 0x1400110b7
lea edx, [rax + 0x1c]
mov ecx, r12d
call fcn.140007338
mov qword [0x1400a0830], rax
test rax, rax
jne 0x1400110b7
xor esi, esi
jmp 0x1400110c6
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call rax
mov rsi, rax
test rsi, rsi
je 0x140011275
mov rax, qword [0x1400a0828]
test rax, rax
jne 0x1400110f6
lea edx, [rax + 0x1d]
mov ecx, r12d
call fcn.140007338
mov qword [0x1400a0828], rax
test rax, rax
jne 0x1400110f6
xor ebx, ebx
jmp 0x140011107
mov r8d, 0x14
mov rdx, rbx
mov rcx, rsi
call rax
mov rbx, rax
test rbx, rbx
je 0x14001124b
mov rax, qword [0x1400a0820]
test rax, rax
jne 0x140011133
lea edx, [rax + 0x1e]
mov ecx, r12d
call fcn.140007338
mov qword [0x1400a0820], rax
test rax, rax
je 0x14001113d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
jne 0x140011156
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x140011156
mov edi, r12d
jmp 0x140011223
lea rax, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140007918
test eax, eax
je 0x140011223
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, dword [rbp - 0x24]
mov r14d, eax
mov eax, dword [rbp - 0x34]
cmp eax, 2
jne 0x14001121c
mov ecx, 0x2710
mov eax, 0xcccccccd
mul dword [rbp - 0x20]
shr edx, 3
cmp edx, 0x3e8
jae 0x1400111ab
mov edx, 0x3e8
jmp 0x1400111b0
cmp edx, ecx
cmova edx, ecx
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140007918
test eax, eax
je 0x140011219
cmp dword [rbp - 0x24], r15d
jbe 0x1400111e6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, dword [rbp - 0x24]
mov r14d, eax
jmp 0x140011206
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
cmp rcx, r14
jae 0x1400111fb
mov eax, 0xffffffff
add rcx, rax
mov eax, dword [rbp - 0x20]
sub rcx, r14
cmp rcx, rax
ja 0x140011219
mov eax, dword [rbp - 0x34]
mov ecx, 0x2710
cmp eax, 2
je 0x140011191
jmp 0x14001121c
mov eax, dword [rbp - 0x34]
cmp eax, 4
cmove edi, r12d
mov rax, qword [0x1400a0810]
test rax, rax
jne 0x140011246
lea edx, [rax + 0x20]
mov ecx, r12d
call fcn.140007338
mov qword [0x1400a0810], rax
test rax, rax
je 0x140011257
mov rcx, rbx
call rax
mov rax, qword [0x1400a0810]
test rax, rax
jne 0x140011270
mov edx, 0x20
mov ecx, r12d
call fcn.140007338
mov qword [0x1400a0810], rax
test rax, rax
je 0x140011275
mov rcx, rsi
call rax
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140011430
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
lea rbp, [rsp - 0x12f0]
mov eax, 0x13f0
call fcn.14001fef0
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1400], rbx
mov qword [rsp + 0x1408], rsi
mov qword [rsp + 0x1410], rdi
mov qword [rsp + 0x1418], r14
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp + 0x12e0], rax
mov esi, edx
mov ebx, ecx
mov qword [rsp + 0x38], 0xf
and qword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [0x140033df4]
lea rcx, [rsp + 0x20]
call fcn.14000d370
nop
call fcn.140012afc
nop
cmp qword [rsp + 0x38], 0x10
jb 0x1400114c6
mov rcx, qword [rsp + 0x20]
call fcn.140013388
call fcn.140012afc
or dword [rbp + 0x12d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov edi, 1
mov r8d, edi
mov edx, edi
mov r14d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rsp + rdx*4 + 0x54], eax
add r8d, edi
add rdx, rdi
cmp rdx, r14
jl 0x1400114e6
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001154b
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x54], eax
mov r8d, edi
mov rdx, rdi
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, r8d
mov dword [rsp + rdx*4 + 0x54], ecx
mov eax, ecx
add r8d, edi
add rdx, rdi
cmp rdx, r14
jl 0x140011528
jmp 0x14001157a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x54], eax
mov r8d, edi
mov rdx, rdi
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rsp + rdx*4 + 0x54], eax
add r8d, edi
add rdx, rdi
cmp rdx, r14
jl 0x14001155b
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x20
or dword [rsp + 0x30], 0xffffffff
mov r14d, 0x80000000
lea edi, [rbx + r14]
lea eax, [rsi + r14]
sub eax, edi
cmp eax, 0xffffffff
jne 0x1400115ba
lea rcx, [rsp + 0x20]
call fcn.140011c74
mov edx, eax
jmp 0x1400115fd
lea esi, [rax + 1]
lea ebx, [rsi - 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x1400115dd
lea rcx, [rsp + 0x20]
call fcn.140011c74
mov r8d, eax
or eax, 0xffffffff
cmp eax, ebx
jb 0x1400115c9
xor edx, edx
div esi
mov r9d, edx
mov ecx, eax
xor edx, edx
mov eax, r8d
div esi
cmp eax, ecx
jb 0x1400115f6
cmp r9d, ebx
jne 0x1400115c0
xor edx, edx
mov eax, r8d
div esi
lea eax, [rdx + rdi]
add eax, r14d
mov rcx, qword [rbp + 0x12e0]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140011790
Capabilities:
Create new key via cryptacquirecontext
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x18], 0
and qword [rbp - 0x28], 0
and dword [rbp - 0x30], 0
and dword [rbp - 0x20], 0
xor ebx, ebx
mov rdi, r9
mov r15, r8
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140011904
test r9, r9
je 0x140011904
cmp qword [r9], 0x14
jb 0x140011904
lea r13, [0x140033df4]
lea r9d, [rbx + 1]
lea rcx, [rbp - 0x18]
mov r8, r13
mov rdx, r13
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
and dword [rsp + 0x20], ebx
lea r9d, [rbx + 1]
lea rcx, [rbp - 0x18]
mov r8, r13
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14001185c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14001185c
lea r9d, [rbx + 1]
lea rcx, [rbp - 0x18]
mov r8, r13
mov rdx, r13
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140011904
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x28]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400118e0
mov rcx, qword [rbp - 0x28]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400118e0
mov rcx, qword [rbp - 0x28]
and dword [rsp + 0x20], ebx
mov edx, 4
lea r9, [rbp - 0x20]
lea r8, [rbp - 0x30]
mov dword [rbp - 0x20], edx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400118e0
cmp dword [rbp - 0x30], 0x14
jne 0x1400118e0
mov rcx, qword [rbp - 0x28]
and dword [rsp + 0x20], ebx
mov r9, rdi
mov r8, r15
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
mov eax, 1
cmovne ebx, eax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400118ef
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140011900
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x140011906
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140012b40
add rsp, 0x60
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140011c74
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rbx, rcx
mov esi, 0x7fffffff
mov ebp, 0x9908b0df
mov r9, qword [rbx]
cmp dword [r9], 0x270
jne 0x140011cdd
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, esi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
dec r10
jne 0x140011ca6
jmp 0x140011d99
cmp dword [r9], 0x4e0
jb 0x140011d99
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r10 + 4]
xor edx, dword [r10]
and edx, esi
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
dec r11
jne 0x140011cf7
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov edx, dword [r10 + 4]
xor edx, dword [r10]
and edx, esi
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
dec r11
jne 0x140011d35
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, esi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], r11d
mov eax, dword [r9]
mov edx, dword [r9 + rax*4 + 4]
inc eax
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
mov ecx, edx
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [rbx + 0x10]
ja 0x140011c90
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret

Function at 0x140013c90
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140013af8
Function at 0x1400263e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140026450
mov eax, 0xffffffff
cmp rbx, rax
ja 0x140026418
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14002641e
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14001c808
int3
call fcn.14001c808
int3