joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400310c0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [rcx + 0x40]
mov rsi, rdx
lea rdx, [rsp + 0x38]
mov ebp, r9d
mov edi, r8d
mov rbx, rcx
mov r10, qword [rax + 0x440]
mov r14, qword [r10 + 0x28]
call fcn.14002d9d0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14002d800
mov dword [r14], 0
mov r8d, edi
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x1400311d5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400311d1
mov eax, dword [r14]
or eax, 6
mov dword [r14], eax
test ebp, ebp
js 0x14003114e
or eax, 8
mov dword [r14], eax
jmp 0x140031150
xor ebp, ebp
mov dword [r14 + 0x10], ebp
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x140031165
mov rdx, qword [r14 + 0x28]
mov cl, 1
call rax
lea rcx, [r14 + 0x38]
call fcn.14002ebb0
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x14003117f
mov rdx, qword [r14 + 0x28]
xor ecx, ecx
call rax
test byte [r14 + 4], 8
jne 0x1400311ca
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x30], 4
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400311ca
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400311d5
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov ecx, dword [rsp + 0x60]
mov dword [rax], ecx
mov eax, 0xffffffff
jmp 0x1400311d5
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
mov ebp, r8d
mov r14, rdx
mov rdi, rcx
mov r9, qword [rax + 0x440]
mov rax, qword [r9 + 0x28]
mov qword [rax + 0x18], rcx
mov rbx, qword [rcx]
test rbx, rbx
je 0x140034c15
movzx eax, byte [rbx + 8]
not al
test al, 1
je 0x140034c15
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rsi
mov edx, 0x8004667e
mov esi, dword [rbx + 8]
or esi, 1
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140034c0d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x140034c10
mov dword [rbx + 8], esi
mov rsi, qword [rsp + 0x48]
mov r9d, dword [rdi + 0x24]
mov r8d, ebp
mov rdx, r14
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
jmp 0x1400310c0
Function at 0x140033eb0
Capabilities:
Get socket status

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r10d, r10d
movzx r9d, dl
mov qword [rsp + 0x38], r10
test rcx, rcx
je 0x14003405a
mov rbx, qword [rcx]
test rbx, rbx
je 0x14003405a
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax + 0x440]
test rcx, rcx
je 0x140033f12
mov rax, qword [rcx + 0x140]
test rax, rax
je 0x140033f12
mov rcx, qword [rbx]
call rax
jmp 0x14003405c
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
mov rax, qword [rbx]
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x4a8], rdi
mov dword [rsp + 0x260], 1
test r8d, r8d
js 0x140033f69
mov eax, 0x10624dd3
mov ecx, r8d
mul r8d
shr edx, 6
imul eax, edx, 0x3e8
mov dword [rsp + 0x38], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x3c], eax
test r8d, r8d
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x50]
cmovs rax, r10
lea rdx, [rsp + 0x50]
test r9b, r9b
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x260]
cmovne r8, r10
cmove rdx, r10
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140033fc5
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx], eax
mov eax, edi
mov rdi, qword [rsp + 0x4a8]
jmp 0x14003405c
test eax, eax
jne 0x140033ff0
mov ecx, 0x274c
mov edi, 0xffffffff
call qword [sym.imp.WS2_32.dll_WSASetLastError]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], 0x8a
mov eax, edi
mov rdi, qword [rsp + 0x4a8]
jmp 0x14003405c
mov rcx, qword [rbx]
lea rdx, [rsp + 0x260]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14003404e
mov rcx, qword [rbx]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x40], 4
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x140034049
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSASetLastError]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
mov edi, 0xffffffff
mov eax, edi
mov rdi, qword [rsp + 0x4a8]
jmp 0x14003405c
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14008e500
add rsp, 0x480
pop rbx
ret
Function at 0x140034ba0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [rcx + 0x40]
mov rsi, rdx
lea rdx, [rsp + 0x38]
mov ebp, r9d
mov edi, r8d
mov rbx, rcx
mov r10, qword [rax + 0x440]
mov r14, qword [r10 + 0x28]
call fcn.14002d9d0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14002d800
mov dword [r14], 0
mov r8d, edi
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x1400311d5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400311d1
mov eax, dword [r14]
or eax, 6
mov dword [r14], eax
test ebp, ebp
js 0x14003114e
or eax, 8
mov dword [r14], eax
jmp 0x140031150
xor ebp, ebp
mov dword [r14 + 0x10], ebp
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x140031165
mov rdx, qword [r14 + 0x28]
mov cl, 1
call rax
lea rcx, [r14 + 0x38]
call fcn.14002ebb0
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x14003117f
mov rdx, qword [r14 + 0x28]
xor ecx, ecx
call rax
test byte [r14 + 4], 8
jne 0x1400311ca
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x30], 4
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400311ca
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400311d5
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov ecx, dword [rsp + 0x60]
mov dword [rax], ecx
mov eax, 0xffffffff
jmp 0x1400311d5
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
mov ebp, r8d
mov r14, rdx
mov rdi, rcx
mov r9, qword [rax + 0x440]
mov rax, qword [r9 + 0x28]
mov qword [rax + 0x18], rcx
mov rbx, qword [rcx]
test rbx, rbx
je 0x140034c15
movzx eax, byte [rbx + 8]
not al
test al, 1
je 0x140034c15
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rsi
mov edx, 0x8004667e
mov esi, dword [rbx + 8]
or esi, 1
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140034c0d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x140034c10
mov dword [rbx + 8], esi
mov rsi, qword [rsp + 0x48]
mov r9d, dword [rdi + 0x24]
mov r8d, ebp
mov rdx, r14
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
jmp 0x1400310c0

Function at 0x140035c40
Capabilities:
Hash data via bcrypt

Disassembly:
push rbx
sub rsp, 0x30
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
mov ebx, eax
test eax, eax
jne 0x140035c5a
add rsp, 0x30
pop rbx
ret
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov dword [rsp + 0x28], __WSAFDIsSet
lea rax, str.D:winx64_packages_build_srclibmariadblibmariadb_securewin_crypt.c
mov r8d, ebx
lea r9, str.ma_hash_input
mov qword [rsp + 0x20], rax
lea rdx, str.invalid_return__d_from_bcrypt__function__s_with_file__s__line__d_n
call fcn.140018470
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140036740
Capabilities:
Get remote cert context via schannel

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r13, qword [rcx + 8]
xor eax, eax
mov r12, qword [rcx + 0x10]
mov esi, edx
mov ebp, 0x80
mov rbx, qword [r13 + 0x40]
mov r15, qword [rbx + 0x440]
mov rcx, qword [rbx + 0x3d8]
mov rdx, qword [rbx + 0x3e0]
test r15, r15
je 0x1400367a2
mov r14, qword [r15 + 0x10]
mov r15, qword [r15 + 0x18]
jmp 0x1400367a8
mov r14, rax
mov r15, rax
mov qword [rsp + 0x40], rax
mov r9, r15
mov qword [rsp + 0x48], rax
mov r8, r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140037ac0
mov edi, eax
test eax, eax
jne 0x140036826
test r14, r14
jne 0x1400367ed
test r15, r15
jne 0x1400367ed
and esi, 0xffffffef
lea rcx, [r12 + 0x30]
mov edx, 0x53
lea r8, [rsp + 0x40]
call sub.Secur32.dll_QueryContextAttributesA
mov edi, eax
test eax, eax
je 0x140036854
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.QueryContextAttributes_SECPKG_ATTR_REMOTE_CERT_CONTEXT__failed.
mov edx, 0x100
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140038a60
cmp edi, 0x80092010
je 0x1400368a2
cmp edi, 0x800b0101
je 0x14003689c
cmp edi, 0x800b0109
je 0x140036890
cmp edi, 0x800b010f
je 0x14003688a
cmp edi, 0x800b0114
je 0x14003688a
or byte [rbx + 0x6b], 0x20
jmp 0x1400368a6
mov r8, qword [rbx + 0x298]
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r9d, esi
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call fcn.140037e30
mov edi, eax
test eax, eax
jne 0x140036826
xor ebp, ebp
jmp 0x1400368c6
or byte [rbx + 0x6b], 2
jmp 0x1400368a6
test sil, 1
je 0x1400368a6
or byte [rbx + 0x6b], 1
jmp 0x1400368a6
or byte [rbx + 0x6b], 8
jmp 0x1400368a6
or byte [rbx + 0x6b], 0x10
mov r8, qword [str.pg_n_]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x7ea
mov rcx, rbx
call qword [r13 + 0x50]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400368d6
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400368e5
call fcn.140037e20
mov eax, ebp
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14008e500
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140036920
Capabilities:
Encrypt data via sspi

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x38]
mov rsi, rcx
mov rdi, qword [rax + 0x10]
mov ebp, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
cmp r8, rbp
cmovb rbp, r8
add rcx, qword [rdi + 0x10]
mov r8, rbp
call fcn.140092830
mov rax, qword [rdi + 0x10]
lea rcx, [rdi + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x20]
mov eax, dword [rdi + 0x1c]
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor edx, edx
mov dword [rsp + 0x34], 7
mov eax, dword [rdi + 0x1c]
add rax, qword [rdi + 0x10]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x44], 1
mov eax, dword [rdi + 0x1c]
add rax, rbp
add rax, qword [rdi + 0x10]
mov qword [rsp + 0x58], rax
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x50], eax
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x54], 6
mov dword [rsp + 0x24], 4
call sub.Secur32.dll_EncryptMessage
test eax, eax
je 0x1400369ee
mov rax, 0xffffffffffffffff
jmp 0x140036a2f
mov r8d, dword [rsp + 0x50]
mov rcx, rsi
add r8d, dword [rsp + 0x40]
add r8d, dword [rsp + 0x30]
mov rax, qword [rsi + 0x48]
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0xb8], rbx
mov ebx, r8d
call qword [rax + 0x20]
cmp rax, rbx
mov rcx, 0xffffffffffffffff
mov rbx, qword [rsp + 0xb8]
cmove rcx, rbp
mov rax, rcx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008e500
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140037080
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x3b0
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov r14, rcx
mov rsi, r9
mov rcx, rdx
mov r15d, r8d
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400370fc
mov ecx, 0x8009035d
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.directory__s_does_not_exist
test eax, eax
mov qword [rsp + 0x20], rdi
mov ebx, 0x54f
cmovne ebx, eax
mov rdx, qword [rsp + 0x400]
mov r8d, ebx
mov rcx, rsi
call fcn.140038a60
mov eax, ebx
jmp 0x1400371fd
test al, 0x10
jne 0x14003711a
mov ecx, 0x8009035d
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._s_is_not_a_directory
jmp 0x1400370d3
mov r9, rdi
lea r8, str._s
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140037f90
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14003717b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x54f
lea r9, str.FindFirstFile__s__failed
test eax, eax
cmovne ebx, eax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
jmp 0x1400370e2
mov qword [rsp + 0x3a8], rbp
mov rbp, qword [rsp + 0x400]
nop dword [rax + rax]
test byte [rsp + 0x30], 0x10
jne 0x1400371d8
lea rax, [rsp + 0x5c]
mov r9, rdi
lea r8, [0x1400a8064]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.140037f90
mov r9, rsi
mov qword [rsp + 0x20], rbp
mov r8d, r15d
lea rdx, [rsp + 0x280]
mov rcx, r14
call fcn.140036d80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140037190
mov rbp, qword [rsp + 0x3a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.14008e500
add rsp, 0x3b0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140037710
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r8
mov r15, rdx
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov dword [rsp + 0x20], 3
mov r12, rcx
xor r14d, r14d
xor esi, esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400377aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x54f
mov qword [rsp + 0x20], r12
test eax, eax
lea r9, str.failed_to_open_file__s
mov rdx, r13
mov rcx, r15
cmovne r8d, eax
call fcn.140038a60
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400377eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x54f
mov qword [rsp + 0x20], r12
test eax, eax
lea r9, str.GetFileSizeEx_failed_on__s
mov rdx, r13
mov rcx, r15
cmovne esi, eax
mov r8d, esi
call fcn.140038a60
jmp 0x1400378db
mov qword [rsp + 0x90], rdi
mov eax, 0xfffffffe
mov rdi, qword [rsp + 0x40]
cmp rdi, rax
jle 0x14003783c
mov ecx, 0x8009035d
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x54f
mov qword [rsp + 0x20], r12
test eax, eax
lea r9, str.file__s_too_large
mov rdx, r13
mov rcx, r15
cmovne esi, eax
mov r8d, esi
call fcn.140038a60
jmp 0x1400378d3
lea r15, [rdi + 1]
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x140037884
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x98]
lea r9, str.LocalAlloc_0__zu__failed
test eax, eax
mov qword [rsp + 0x20], r15
mov esi, 0x54f
mov rdx, r13
cmovne esi, eax
mov r8d, esi
call fcn.140038a60
jmp 0x1400378d3
test rdi, rdi
je 0x1400378cf
xor r15d, r15d
nop dword [rax]
mov r8d, edi
mov dword [rsp + 0xa8], r15d
sub r8d, ebx
mov qword [rsp + 0x20], r15
lea rdx, [r14 + rbx]
mov rcx, rbp
lea r9, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037908
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x140037903
add rbx, rax
cmp rbx, rdi
jb 0x140037890
mov byte [r14 + rdi], sil
mov rdi, qword [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140037939
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
mov rdi, rbx
jmp 0x1400378cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x98]
lea r9, str.ReadFile___failed_to_read__file__s
test eax, eax
mov qword [rsp + 0x20], r12
mov esi, 0x54f
mov rdx, r13
cmovne esi, eax
mov r8d, esi
call fcn.140038a60
jmp 0x1400378d3
mov rax, r14
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x140037950
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, qword [rsp + 0x80]
xorps xmm0, xmm0
movups xmmword [r8], xmm0
xor eax, eax
mov rbx, r8
movups xmmword [r8 + 0x10], xmm0
mov r14, rdx
mov rdx, r9
movups xmmword [r8 + 0x20], xmm0
mov r12, r9
mov r15, rcx
movups xmmword [r8 + 0x30], xmm0
xor esi, esi
mov edi, 0x80090304
movups xmmword [r8 + 0x40], xmm0
movups xmmword [r8 + 0x50], xmm0
movups xmmword [r8 + 0x60], xmm0
movups xmmword [r8 + 0x70], xmm0
movups xmmword [r8 + 0x80], xmm0
mov qword [r8 + 0x90], rax
mov r8, r13
call fcn.140037710
mov rbp, rax
test rax, rax
je 0x140037a0d
cmp r15, r14
jne 0x1400379df
mov rsi, rax
jmp 0x1400379f5
mov r8, r13
mov rdx, r12
mov rcx, r14
call fcn.140037710
mov rsi, rax
test rax, rax
je 0x140037a0d
mov r9, r12
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140037220
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r15, r14
je 0x140037a24
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x140037a94
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140037a3f
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor ebp, ebp
mov qword [rbx + 8], rbp
jmp 0x140037a41
xor ebp, ebp
mov rcx, qword [rbx]
test rcx, rcx
je 0x140037a54
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], rbp
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140037a67
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov qword [rbx + 0x10], rbp
cmp word [rbx + 0x18], 0
je 0x140037a94
mov r9d, 1
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rcx, rbx
lea rdx, [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov word [rbx + 0x18], bp
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140037d90
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
xor esi, esi
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140037db7
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140037dca
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140037ddd
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov qword [rbx + 0x10], rsi
cmp word [rbx + 0x18], si
je 0x140037e09
mov r9d, 1
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rcx, rbx
lea rdx, [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov word [rbx + 0x18], si
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140038630
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, r8
mov r14, rdx
mov rbx, rcx
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp byte [rsi + r8], 0
jne 0x140038660
mov ecx, 2
call fcn.140035ca0
mov r8, rsi
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.140035c40
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140035dd0
mov rcx, rdi
call fcn.140035be0
mov ecx, 2
call fcn.140035ca0
mov r8d, shutdown
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call fcn.140035c40
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140035dd0
mov rcx, rdi
call fcn.140035be0
mov ecx, 2
call fcn.140035ca0
mov r8d, shutdown
mov rdx, r14
mov rcx, rax
mov rdi, rax
call fcn.140035c40
mov r8d, shutdown
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140035c40
mov rdx, rbx
mov rcx, rdi
call fcn.140035dd0
mov rcx, rdi
call fcn.140035be0
lea rdx, [rbx + 0x14]
cmp rbx, rdx
jae 0x14003873e
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rbx]
xor byte [rbx], al
inc rbx
cmp rbx, rdx
jb 0x140038730
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008e500
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003a310
Capabilities:
Encode data using base64

Disassembly:
push rbx
xor eax, eax
xor r11d, r11d
mov r9, rdx
mov rbx, rcx
test rdx, rdx
je 0x14003a3f1
mov qword [rsp + 0x10], rsi
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [rsp + 0x18], rdi
lea rdi, [rdx + 1]
nop dword [rax + rax]
cmp r11, 0x4c
jne 0x14003a350
xor r11d, r11d
mov byte [r8], 0xa
inc r8
movzx edx, byte [rax + rbx]
inc rax
shl edx, 8
cmp rax, r9
jae 0x14003a365
movzx ecx, byte [rax + rbx]
add edx, ecx
shl edx, 8
inc rax
cmp rax, r9
jae 0x14003a376
movzx ecx, byte [rax + rbx]
add edx, ecx
mov ecx, edx
inc rax
shr rcx, 0x12
mov r10d, edx
movzx ecx, byte [rcx + rsi]
mov byte [r8], cl
mov ecx, edx
lea rdx, [r8 + 3]
shr rcx, 0xc
and ecx, 0x3f
movzx ecx, byte [rcx + rsi]
mov byte [r8 + 1], cl
cmp rax, rdi
jbe 0x14003a3a7
mov cl, 0x3d
jmp 0x14003a3b5
mov rcx, r10
shr rcx, 6
and ecx, 0x3f
movzx ecx, byte [rcx + rsi]
mov byte [r8 + 2], cl
lea r8, [rdx + 1]
cmp rax, r9
ja 0x14003a3dc
and r10d, 0x3f
add r11, 4
movzx ecx, byte [r10 + rsi]
mov byte [rdx], cl
cmp rax, r9
jb 0x14003a340
jmp 0x14003a3df
mov byte [rdx], 0x3d
mov rdi, qword [rsp + 0x18]
xor eax, eax
mov rsi, qword [rsp + 0x10]
mov byte [r8], 0
pop rbx
ret
mov byte [r8], al
pop rbx
ret

Function at 0x14003a840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
mov ecx, dword [0x1402ced28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x1402cf2d8]
mov rbx, rax
call qword [rcx + 0x138]
mov ecx, dword [0x1402ced28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rbx, rbx
je 0x14003a966
cmp byte [rbx + 0xa8], 0
je 0x14003a966
mov rcx, rbx
mov qword [rsp + 0x78], rdi
call fcn.14003a600
mov rdx, qword [0x140524448]
test rdx, rdx
je 0x14003a8ec
mov rax, qword [0x1402cf2d8]
lea r9, str.D:winx64_packages_build_srcmysysmy_thr_init.c
xor r8d, r8d
mov dword [rsp + 0x20], 0x177
lea rcx, [rsp + 0x30]
call qword [rax + 0x190]
lea rcx, [0x140524420]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rdi, rdi
je 0x14003a8f9
mov rax, qword [0x1402cf2d8]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x198]
jmp 0x14003a8f9
lea rcx, [0x140524420]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x1404acc88], 0xffffffff
mov rdi, qword [rsp + 0x78]
jne 0x14003a92c
mov rcx, qword [0x1405243d8]
test rcx, rcx
je 0x14003a920
mov rax, qword [0x1402cf2d8]
call qword [rax + 0x170]
lea rcx, [0x1405243d0]
call fcn.1400468f0
mov rcx, qword [0x140524448]
test rcx, rcx
je 0x14003a945
mov rax, qword [0x1402cf2d8]
call qword [rax + 0x160]
lea rcx, [0x140524420]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
mov byte [rbx + 0xa8], 2
add rsp, 0x60
pop rbx
jmp sub.api_ms_win_crt_heap_l1_1_0.dll_free
add rsp, 0x60
pop rbx
ret