joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e690
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rcx, qword [rcx]
mov rax, qword [rcx]
mov qword [rcx], 0
test rax, rax
je 0x14002e7e1
mov rdi, qword [rax]
lea rsi, [rsp + 0x58]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.140092ff0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14002e723
cmp eax, 0x105
jae 0x14002e7e1
mov eax, eax
lea rax, [rsp + rax*2]
add rax, 0x58
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call fcn.14009103b
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14002e733
movups xmm0, xmmword [rsp + 0x30]
jmp 0x14002e7a5
mov qword [rsp + 0x28], 0
xor eax, eax
test rax, rax
jne 0x14002e719
lea rax, [0x1403dd743]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rbx, qword [rax + 0xcc0d]
movzx esi, word [rax + 0xcc15]
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x14002e772
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14002e7e5
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14002e7e5
xor esi, 0x6eb2
movabs rcx, 0x51c96ef9d7738600
xor rbx, rcx
mov qword [rax], rbx
mov word [rax + 8], si
movaps xmm0, xmmword [0x140098970]
mov r8, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rdi], rax
movups xmmword [rdi + 8], xmm0
test r8, r8
je 0x14002e7d5
test rcx, rcx
je 0x14002e7d5
mov rcx, qword [0x140443578]
xor edx, edx
add rsp, 0x260
pop rbx
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret
ud2
mov ecx, 0xa
mov edx, 1
call fcn.1400949bf
ud2
Function at 0x140034e70
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15b, 4
test r8, r8
je 0x140034efa
mov rsi, r8
mov rdi, rdx
mov rbx, qword [rcx]
mov r12, qword [sym.imp.ws2_32.dll_send]
mov r13, qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea r14, str.failed_to_write_whole_buffer
jmp 0x140034ec5
call r13
mov ebp, eax
mov ecx, eax
call fcn.140084604
cmp al, 0x23
jne 0x140034f10
test rsi, rsi
je 0x140034efa
cmp rsi, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, esi
mov rcx, rbx
mov rdx, rdi
xor r9d, r9d
call r12
cmp eax, 0xffffffff
je 0x140034eb0
test eax, eax
je 0x140034efc
cdqe
sub rsi, rax
jb 0x140034f3d
add rdi, rax
test rsi, rsi
jne 0x140034ec5
jmp 0x140034f1c
mov rdx, r14
shr rdx, 8
shl r14, 0x38
or r14, 0x17
mov r15b, 2
jmp 0x140034f1c
mov r14d, ebp
shl r14, 0x18
xor edx, edx
xor r15d, r15d
shld rdx, r14, 8
shl r14, 8
movzx eax, r15b
or rax, r14
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140036470
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r13, rcx
mov r15, qword [rcx + 0x18]
xor r12d, r12d
mov rbp, qword [sym.imp.kernel32.dll_WriteFile]
lea rax, str.failed_to_write_the_buffered_data
shr rax, 8
mov qword [rsp + 0x30], rax
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rdi, r15
sub rdi, r12
jbe 0x14003652c
mov byte [r13 + 0x20], 1
mov rbx, qword [r13 + 8]
lea rsi, [rbx + r12]
mov dword [rsp + 0x2c], 0
mov eax, 0xffffffff
cmp rdi, rax
mov r8d, 0xffffffff
cmovb r8d, edi
mov rcx, qword [r13]
mov qword [rsp + 0x20], 0
mov rdx, rsi
lea r9, [rsp + 0x2c]
call rbp
test eax, eax
jne 0x140036515
call qword [sym.imp.kernel32.dll_GetLastError]
mov r14d, eax
mov byte [r13 + 0x20], 0
mov ecx, eax
call fcn.140084604
cmp al, 0x23
je 0x1400364b0
jmp 0x14003655e
mov eax, dword [rsp + 0x2c]
mov byte [r13 + 0x20], 0
test rax, rax
je 0x1400365ba
add r12, rax
jmp 0x1400364b0
mov r14b, 4
test r12, r12
je 0x140036599
sub r15, r12
jb 0x1400365d8
mov qword [r13 + 0x18], 0
je 0x140036599
mov rcx, qword [r13 + 8]
add r12, rcx
mov rdx, r12
mov r8, r15
call fcn.1400931b0
mov r14b, 4
jmp 0x140036590
mov ebp, r14d
shl rbp, 0x18
xor edx, edx
xor r14d, r14d
test r12, r12
je 0x140036599
mov qword [r13 + 0x18], 0
test rdi, rdi
je 0x140036599
mov r12, rdx
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1400931b0
mov r15, rdi
mov qword [r13 + 0x18], r15
mov rdx, r12
jmp 0x140036599
shld rdx, rbp, 8
shl rbp, 8
movzx eax, r14b
or rax, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, str.failed_to_write_the_buffered_data
shl rbp, 0x38
or rbp, 0x17
mov r14b, 2
mov rdx, qword [rsp + 0x30]
test r12, r12
jne 0x14003656f
jmp 0x140036599
ud2

Function at 0x1400365e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14b, 4
test r8, r8
je 0x1400366ae
mov rsi, r8
mov rdi, rdx
mov rbx, qword [rcx]
mov rbp, qword [sym.imp.ws2_32.dll_recv]
mov r15, qword [sym.imp.ws2_32.dll_WSAGetLastError]
jmp 0x14003662c
add rdi, rax
test rsi, rsi
je 0x1400366ae
cmp rsi, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8d, esi
mov rcx, rbx
mov rdx, rdi
xor r9d, r9d
call rbp
cmp eax, 0xffffffff
je 0x140036660
cdqe
test rax, rax
je 0x1400366b9
sub rsi, rax
jae 0x140036620
jmp 0x1400366ef
call r15
cmp eax, 0x274a
je 0x1400366b0
mov rcx, rax
shl rcx, 0x20
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov ecx, eax
call fcn.140084604
cmp al, 0x23
je 0x140036623
movzx eax, byte [rsp + 0x37]
shl eax, 0x10
movzx ecx, word [rsp + 0x35]
or ecx, eax
shl rcx, 0x20
mov edx, dword [rsp + 0x31]
or rdx, rcx
mov rcx, qword [rsp + 0x29]
xor r14d, r14d
jmp 0x1400366d2
jmp 0x1400366d2
mov qword [rsp + 0x28], 0
lea rcx, str.failed_to_fill_whole_buffer
mov rdx, rcx
shr rdx, 8
shl rcx, 0x38
or rcx, 0x25
mov r14b, 2
shld rdx, rcx, 8
shl rcx, 8
movzx eax, r14b
or rax, rcx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
Function at 0x14003a960
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [rdx + 0x98]
cmp rax, qword [rdx + 0x90]
ja 0x14003abf3
mov rdi, rdx
mov r14, rcx
mov rcx, qword [rdx + 0x80]
test rcx, rcx
mov eax, eax
cmove rax, rcx
movabs rdx, 0x100000000
or rdx, rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x70], rax
movabs rax, 0x400000000
mov qword [rsp + 0x68], rax
lea rcx, [rdi + 8]
lea rdx, [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x14003aadb
cmp eax, 0x80090318
je 0x14003ab5c
test eax, eax
jne 0x14003ab74
mov rax, qword [rsp + 0x40]
mov rsi, qword [rdi + 0x80]
sub rax, rsi
mov r12d, dword [rsp + 0x38]
mov rcx, rax
mov qword [rdi + 0x70], 0
add rcx, r12
jb 0x14003abf3
cmp rcx, qword [rdi + 0x90]
ja 0x14003abf3
add rsi, rax
xor r15d, r15d
cmp qword [rdi + 0x68], r12
jb 0x14003abdc
xor ebx, ebx
mov rcx, qword [rdi + 0x60]
add rcx, rbx
mov rdx, rsi
mov r8, r12
call fcn.1400931b0
add rbx, r12
mov qword [rdi + 0x70], rbx
mov qword [rdi + 0x78], 0
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x98]
cmove r15d, dword [rsp + 0x58]
sub rdx, r15
jb 0x14003abf3
test r15, r15
je 0x14003abb1
mov rsi, qword [rdi + 0x90]
sub rsi, rdx
jb 0x14003abf3
mov qword [rdi + 0x90], 0
test rdx, rdx
je 0x14003aba5
test rsi, rsi
je 0x14003abb1
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rsi
call fcn.1400931b0
jmp 0x14003abaa
cmp eax, 0x90317
je 0x14003ab6d
cmp eax, 0x90321
jne 0x14003ab74
mov dword [rdi + 0xe0], 0x10000
mov byte [rdi + 0xe4], 0
xor ebx, ebx
cmp dword [rsp + 0x5c], 5
mov rdx, qword [rdi + 0x98]
cmove ebx, dword [rsp + 0x58]
sub rdx, rbx
jb 0x14003abf3
test rbx, rbx
je 0x14003ab94
mov rsi, qword [rdi + 0x90]
sub rsi, rdx
jb 0x14003abf3
mov qword [rdi + 0x90], 0
test rdx, rdx
je 0x14003ab88
test rsi, rsi
je 0x14003ab94
mov rcx, qword [rdi + 0x80]
add rdx, rcx
mov r8, rsi
call fcn.1400931b0
jmp 0x14003ab8d
cmp dword [rsp + 0x3c], 4
mov eax, 1
cmove eax, dword [rsp + 0x38]
jmp 0x14003abc0
mov byte [r14 + 1], 1
jmp 0x14003abc9
shl rax, 0x20
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0
mov al, 1
jmp 0x14003abcb
test rsi, rsi
je 0x14003ab94
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0x58], 0
jmp 0x14003abc4
test rsi, rsi
je 0x14003abb1
mov qword [rdi + 0x90], rsi
xor eax, eax
test r15d, r15d
sete al
mov qword [rdi + 0x98], r15
mov qword [rdi + 0x58], rax
mov byte [r14 + 1], 0
xor eax, eax
mov byte [r14], al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rdi + 0x60]
xor edx, edx
mov r8, r12
call fcn.1400945d0
mov rbx, qword [rdi + 0x70]
jmp 0x14003aa52
ud2
Function at 0x14003ac00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov rax, qword [rdx + 0x58]
test rax, rax
je 0x14003ad83
mov rdi, rdx
mov r15, qword [rdx + 0x90]
mov rbx, qword [rdx + 0x98]
mov r13d, 0x400
mov ebp, 0x7fffffff
mov r14, qword [sym.imp.ws2_32.dll_recv]
xor r12d, r12d
nop dword [rax + rax]
lea rsi, [rbx + rbx]
cmp rsi, 0x401
cmovb rsi, r13
cmp rsi, rax
cmovbe rsi, rax
sub rsi, r15
jbe 0x14003acfe
mov rax, qword [rdi + 0x88]
sub rax, r15
cmp rax, rsi
jb 0x14003acb4
mov r13, qword [rdi + 0x80]
lea rcx, [r15 + r13]
cmp rsi, 2
jb 0x14003ace0
lea r8, [rsi - 1]
xor edx, edx
call fcn.140092ff0
add r15, rsi
add r15, 0xffffffffffffffff
add r13, r15
mov rcx, r13
mov r13d, 0x400
mov ebp, 0x7fffffff
jmp 0x14003acf0
lea rcx, [rdi + 0x80]
mov rdx, r15
mov r8, rsi
call fcn.1400945d0
mov r15, qword [rdi + 0x90]
mov r13, qword [rdi + 0x80]
lea rcx, [r15 + r13]
cmp rsi, 2
jae 0x14003ac8f
nop
test rsi, rsi
mov r13d, 0x400
mov ebp, 0x7fffffff
je 0x14003acf7
mov byte [rcx], 0
add r15, 1
mov qword [rdi + 0x90], r15
mov r8, r15
sub r8, rbx
jb 0x14003adc1
mov rdx, qword [rdi + 0x80]
add rdx, rbx
cmp r8, 0x7fffffff
cmovae r8d, ebp
mov rcx, qword [rdi + 0x50]
xor r9d, r9d
call r14
cmp eax, 0xffffffff
je 0x14003ad40
movsxd rcx, eax
jmp 0x14003ad4f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x14003ada5
xor ecx, ecx
add rbx, rcx
mov qword [rdi + 0x98], rbx
mov rsi, qword [rdi + 0x58]
mov rdx, rsi
sub rdx, rcx
mov eax, 0
cmovae rax, rdx
mov qword [rdi + 0x58], rax
test rcx, rcx
je 0x14003ad86
add r12, rcx
cmp rsi, rcx
ja 0x14003ac50
jmp 0x14003ad86
xor r12d, r12d
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], r12
xor eax, eax
mov qword [rcx], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
shl rax, 0x20
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 0
mov eax, 1
jmp 0x14003ad91
ud2
Function at 0x14003c1f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2028
call fcn.140092730
sub rsp, rax
mov r14, r8
mov rbx, rdx
mov r15, rcx
lea rdi, [rsp + 0x28]
mov r13, qword [sym.imp.ws2_32.dll_recv]
mov rbp, qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
xor r12d, r12d
nop word [rax + rax]
cmp rcx, 0x1fff
ja 0x14003c250
mov r8d, 0x2000
sub r8, rcx
add rcx, rsp
add rcx, 0x28
xor edx, edx
call fcn.140092ff0
mov rcx, qword [rbx]
mov rdx, rdi
mov r8d, 0x2000
xor r9d, r9d
call r13
cmp eax, 0xffffffff
jne 0x14003c284
call rbp
cmp eax, 0x274a
je 0x14003c2ec
mov esi, eax
mov ecx, eax
call fcn.140084604
mov ecx, 0x2000
cmp al, 0x23
je 0x14003c230
jmp 0x14003c2f9
movsxd rsi, eax
cmp rsi, 0x2001
jae 0x14003c328
test rsi, rsi
je 0x14003c2ec
mov qword [rsp + 0x20], r12
mov rax, qword [r14 + 8]
mov r12, qword [r14 + 0x10]
sub rax, r12
cmp rax, rsi
jb 0x14003c2d8
mov rcx, qword [r14]
add rcx, r12
mov rdx, rdi
mov r8, rsi
call fcn.1400931b0
add r12, rsi
mov qword [r14 + 0x10], r12
mov r12, qword [rsp + 0x20]
add r12, rsi
mov ecx, 0x2000
jmp 0x14003c230
mov rcx, r14
mov rdx, r12
mov r8, rsi
call fcn.1400945d0
mov r12, qword [r14 + 0x10]
jmp 0x14003c2ae
mov qword [r15 + 8], r12
mov qword [r15], 0
jmp 0x14003c314
mov dword [r15 + 8], 0
mov dword [r15 + 0xc], esi
mov qword [r15 + 0x10], 0
mov qword [r15], 1
add rsp, 0x2028
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x14003efd0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, r9
mov rsi, rcx
movzx ebx, byte [rsp + 0xb8]
mov ebp, dword [rsp + 0xb0]
add r8, rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
mov word [rsp + 0x40], 0
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.14003f080
mov rcx, qword [rsi]
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov rdx, rsi
xor r8d, r8d
mov r9d, ebx
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
mov rax, qword [rsp + 0x58]
shl rax, 1
test rax, rax
je 0x14003f058
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rcx, rdi
shl rcx, 0x20
test edi, edi
mov eax, 4
cmovne rax, rcx
xor edx, edx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400417e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r8
mov rdi, rdx
mov r15, qword [rcx]
mov r12d, 0xffffffff
lea r14, [rsp + 0x34]
mov r13, qword [sym.imp.kernel32.dll_ReadFile]
mov rbp, qword [sym.imp.kernel32.dll_GetLastError]
jmp 0x14004182c
add rdi, rax
test rsi, rsi
je 0x1400418c2
mov dword [rsp + 0x34], 0
cmp rsi, r12
mov r8d, 0xffffffff
cmovb r8d, esi
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, rdi
mov r9, r14
call r13
test eax, eax
je 0x140041870
mov eax, dword [rsp + 0x34]
test rax, rax
je 0x1400418cf
sub rsi, rax
jae 0x140041820
jmp 0x140041907
call rbp
mov ebx, eax
mov ecx, eax
call fcn.140084604
cmp al, 0xb
je 0x1400418c6
mov rax, rbx
shl rax, 0x20
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov ecx, ebx
call fcn.140084604
cmp al, 0x23
je 0x140041823
movzx eax, byte [rsp + 0x47]
shl eax, 0x10
movzx ecx, word [rsp + 0x45]
or ecx, eax
shl rcx, 0x20
mov edx, dword [rsp + 0x41]
or rdx, rcx
mov rcx, qword [rsp + 0x39]
xor eax, eax
jmp 0x1400418e7
mov al, 4
jmp 0x1400418e7
mov qword [rsp + 0x38], 0
lea rcx, str.failed_to_fill_whole_buffer
mov rdx, rcx
shr rdx, 8
shl rcx, 0x38
or rcx, 0x25
mov al, 2
shld rdx, rcx, 8
shl rcx, 8
movzx eax, al
or rax, rcx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x140041bc0
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov sil, 4
cmp dword [rcx + 0xc0], 2
je 0x140041be7
mov rcx, qword [rcx + 0xb8]
mov edx, 1
call qword [sym.imp.kernel32.dll_TerminateProcess]
test eax, eax
je 0x140041be9
jmp 0x140041bf9
call qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
shl rcx, 0x18
xor edx, edx
xor esi, esi
shld rdx, rcx, 8
shl rcx, 8
movzx eax, sil
or rax, rcx
add rsp, 0x20
pop rsi
ret
Function at 0x140044e40
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, qword [rcx + 8]
test rax, rax
je 0x140044f1d
add rax, 0xffffffffffffffff
mov qword [rcx + 8], rax
mov rax, qword [rcx]
mov byte [rsp + 0x33], 0
mov rax, qword [rax]
mov rsi, qword [rax]
lea r14, [rsp + 0x33]
lea r15, [rsp + 0x34]
mov rbx, qword [sym.imp.kernel32.dll_ReadFile]
mov r12, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r14
mov r8d, 1
mov r9, r15
call rbx
test eax, eax
jne 0x140044f27
call r12
mov edi, eax
mov ecx, eax
call fcn.140084604
cmp al, 0xb
je 0x140044f57
mov rax, rdi
shl rax, 0x20
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov ecx, edi
call fcn.140084604
cmp al, 0x23
je 0x140044e90
movzx eax, byte [rsp + 0x47]
shl eax, 0x10
movzx ecx, word [rsp + 0x45]
or ecx, eax
shl rcx, 0x20
mov esi, dword [rsp + 0x41]
or rsi, rcx
mov rdi, qword [rsp + 0x39]
xor ebx, ebx
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x140044f9c
jmp 0x140044f84
mov sil, 2
xor ecx, ecx
jmp 0x140044fe9
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x140044f60
cmp eax, 1
jne 0x140045063
mov sil, byte [rsp + 0x33]
test sil, sil
je 0x140045011
cmp sil, 1
jne 0x140045017
xor ecx, ecx
jmp 0x140044fe9
mov qword [rsp + 0x38], 0
lea rdi, str.failed_to_fill_whole_buffer
mov rsi, rdi
shr rsi, 8
shl rdi, 0x38
or rdi, 0x25
mov bl, 2
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x140044f9c
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140045052
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140045052
movzx ecx, bl
shld rsi, rdi, 8
shl rdi, 8
or rdi, rcx
mov byte [rax], 0
mov ecx, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3b]
mov dword [rax + 1], ecx
mov dword [rax + 4], edx
mov qword [rax + 0x10], rsi
mov qword [rax + 8], rdi
mov rdx, rax
shr rdx, 0x10
shl rax, 0x30
mov cl, 1
xor esi, esi
shld rdx, rax, 0x10
shl rax, 0x10
movzx ebx, sil
shl rbx, 8
or rbx, rax
movzx eax, cl
or rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
xor ecx, ecx
jmp 0x140044fe9
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x140045037
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140045052
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140045052
mov byte [rax], 2
mov byte [rax + 1], sil
jmp 0x140044fda
mov ecx, 0x20
mov edx, 8
call fcn.1400949bf
ud2
ud2
Function at 0x1400462e5
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov eax, dword [0x1404435f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x18]
test rax, rax
je 0x140046319
cmp eax, 1
je 0x140046346
xor eax, eax
jmp 0x1400464b9
mov eax, dword [0x1404435f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rsi, [rax + 0x10]
lea rdx, [0x1400464d8]
mov rcx, rsi
call fcn.140084d93
mov byte [rsi + 8], 1
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.1400489a5
test rax, rax
jne 0x1400464c3
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rsi, [rsp + 0x50]
movaps xmmword [rsi + 0x10], xmm1
movaps xmmword [rsi], xmm0
lea rdi, [rsp + 0xa0]
lea r8, [0x1403eb028]
mov rcx, rdi
mov rdx, rsi
call fcn.14004654c
movaps xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmm2, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
movups xmmword [rdi - 8], xmm0
movups xmmword [rdi + 8], xmm1
movups xmmword [rdi + 0x18], xmm2
movups xmm0, xmmword [rdi - 0x10]
movaps xmmword [rsi], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [rdi + 0x10]
movaps xmmword [rsi + 0x20], xmm0
mov rax, qword [rdi + 0x20]
mov qword [rsi + 0x30], rax
mov ecx, 0x170
mov edx, 0x10
call fcn.14000bb90
test rax, rax
je 0x1400464c7
mov rsi, rax
mov qword [rax + 0x10], 0x40
mov rcx, rax
add rcx, 0x18
mov r8d, 0x100
xor edx, edx
call fcn.140092ff0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x118], xmm0
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x138], xmm2
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x148], rax
movaps xmm0, xmmword [0x140098b00]
movaps xmmword [rsi + 0x150], xmm0
mov qword [rsi + 0x160], 0
movaps xmm0, xmmword [0x140098750]
movaps xmmword [rsi], xmm0
mov eax, dword [0x1404435f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x90], rcx
test rcx, rcx
je 0x14004649f
lea rcx, [rsp + 0x90]
call fcn.1400462c8
mov eax, dword [0x1404435f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x10]
add rsp, 0xd8
pop rdi
pop rsi
ret
ud2
mov ecx, 0x170
mov edx, 0x10
call fcn.1400949bf
ud2
Function at 0x1400489a5
Capabilities:
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdx, rcx
mov ebx, 0x20
xor r14d, r14d
mov r15d, 0xffffffff
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test rbx, rbx
je 0x140048a20
cmp rbx, r15
mov r8d, 0xffffffff
cmovb r8, rbx
lea rsi, [rdx + r8]
sub rbx, r8
xor ecx, ecx
mov r9d, 2
call r12
mov rdx, rsi
cmp eax, 0xc0000000
jb 0x1400489ca
mov edi, eax
xor edi, 0x80000000
je 0x140048a1d
mov ecx, 4
mov edx, 4
call fcn.14000bb90
test rax, rax
je 0x140048a31
mov r14, rax
mov dword [rax], edi
jmp 0x140048a20
xor r14d, r14d
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.1400949bf
ud2
Function at 0x140053b22
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140053c39
mov r13, r8
mov r12, rdx
mov r15d, r13d
mov r14, r8
shr r14, 8
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov ebp, 0xff
mov rbx, r8
and rbx, rbp
xor rbx, rax
imul rbx, rdx
mov rax, r14
and rax, rbp
xor rax, rbx
imul rax, rdx
xor r8d, r8d
xor edx, edx
div rcx
mov rax, rdx
mov rdi, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x20]
mov rbx, qword [rdi + rax*8]
lea rbp, [rbx + rbx*2]
lea rbp, [rcx + rbp*8]
cmp rbx, rdx
cmovae rbp, r8
jae 0x140053bd4
cmp qword [rbp], r12
jne 0x140053bd4
cmp byte [rbp + 8], r15b
jne 0x140053bd4
cmp byte [rbp + 9], r14b
jne 0x140053bd4
mov rdx, qword [rbp + 0x10]
mov eax, 1
jmp 0x140053c28
shr r13, 0x10
mov qword [rdi + rax*8], rdx
cmp rdx, qword [rsi + 0x18]
jne 0x140053bf9
lea rcx, [rsi + 0x10]
mov rdi, r9
call fcn.14004affc
mov r9, rdi
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x20]
lea rax, [rdx + rdx*2]
mov qword [rcx + rax*8], r12
mov byte [rcx + rax*8 + 8], r15b
mov byte [rcx + rax*8 + 9], r14b
mov dword [rcx + rax*8 + 0xa], r13d
shr r13, 0x20
mov word [rcx + rax*8 + 0xe], r13w
mov qword [rcx + rax*8 + 0x10], r9
inc rdx
mov qword [rsi + 0x20], rdx
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2