joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4cea60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cfb40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4cf462
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4cf4fa
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4cf4de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cf4d2
cmp qword [rbp - 0x10], 0
je 0x2fc4cf4d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cf498
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cf4fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cf600
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cf628
mov eax, 0
jmp 0x2fc4cf676
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cf651
mov eax, 0
jmp 0x2fc4cf676
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cf671
mov eax, 0
jmp 0x2fc4cf676
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cf67c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cf6fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cf6f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cf6f1
mov rax, qword [rbp - 8]
jmp 0x2fc4cf70f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cf6c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x401ed0
Capabilities:
Manipulate console buffer

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
test edx, edx
mov rbx, rcx
mov esi, edx
mov edi, r8d
jle 0x402090
test r8d, r8d
jle 0x402090
movzx r12d, byte [rbx + 0x48]
lea rbp, [rbx + 0x40]
mov rcx, rbp
mov edx, r12d
call fcn.00411b70
cmp edi, 0x7d0
mov eax, 0x7d0
mov qword [rsp + 0x60], 0
cmovg edi, eax
cmp esi, 0x9c4
mov eax, 0x9c4
cmovg esi, eax
xor edx, edx
cmp byte [rbx + 0x38], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x30]
mov word [rsp + 0x74], dx
jne 0x402075
call fcn.00411c20
lea r14, [rsp + 0x60]
lea r13, [rsp + 0x40]
mov rcx, qword [rbx + 0x68]
mov rdx, qword [rsp + 0x30]
mov word [rsp + 0x40], si
mov r9, r14
mov r8, r13
mov word [rsp + 0x42], di
call fcn.00410700
movzx edx, word [rsp + 0x6a]
mov rax, qword [rbx + 0xa8]
mov rcx, qword [rbx + 0x70]
mov word [rax + 0xec], dx
movzx edx, word [rsp + 0x6c]
test rcx, rcx
mov word [rax + 0xee], dx
movzx edx, word [rsp + 0x6e]
mov word [rax + 0xf0], dx
movzx edx, word [rsp + 0x70]
mov word [rax + 0xf2], dx
je 0x401fdd
mov rdx, qword [rbx + 0x78]
mov r9, r14
mov r8, r13
mov word [rsp + 0x40], si
mov word [rsp + 0x42], di
call fcn.00410700
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov eax, 4
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov word [rsp + 0x40], ax
call fcn.00411e60
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], 0
mov ecx, 0xfffffff6
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x2c]
mov r8d, 1
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x40205a
cmp byte [rbx + 8], 0
jne 0x402080
mov rcx, rbx
call fcn.004aaf10
mov edx, r12d
mov rcx, rbp
call fcn.00411b70
nop
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.00411be0
jmp 0x401f5c
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402052
lea r8, str.cols___1__rows___1
lea rcx, str.src_agent_Agent.cc
mov edx, 0x20d
call fcn.00418fa0
jmp 0x401ef7
Function at 0x407150
Capabilities:
Log keystrokes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, 1
mov ebx, dword [rsp + 0x80]
mov rsi, rcx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x24], edx
mov edx, 1
mov qword [rsp + 0x28], 0
mov edi, r9d
mov word [rsp + 0x28], dx
mov dword [rsp + 0x30], 0
xor edx, edx
mov word [rsp + 0x20], ax
mov word [rsp + 0x2a], r8w
movzx ecx, r8w
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rsp + 0x2c], ax
mov rax, qword [rsi + 8]
movzx ebx, bx
cmp rax, qword [rsi + 0x10]
mov word [rsp + 0x2e], di
mov dword [rsp + 0x30], ebx
je 0x4071f0
test rax, rax
je 0x4071e0
mov rdx, qword [rsp + 0x20]
mov qword [rax], rdx
mov rdx, qword [rsp + 0x28]
mov qword [rax + 8], rdx
mov edx, dword [rsp + 0x30]
mov dword [rax + 0x10], edx
add rax, 0x14
mov qword [rsi + 8], rax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.00496640
jmp 0x4071e8

Function at 0x407200
Capabilities:
Log keystrokes
Read pipe
Write pipe

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x80]
cmp r9d, 0xffff
mov rbp, rcx
mov r12d, edx
ja 0x407250
lea edx, [r9 - 0xd800]
cmp edx, 0x7ff
ja 0x4072b3
lea rcx, str.INTERNAL_ERROR:_appendInputRecordCP:_invalid_codePoint:_U_04X
mov edx, r9d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.00413ac0
cmp r9d, 0x10ffff
ja 0x407233
lea ebx, [r9 - 0x10000]
movzx esi, ax
movzx edi, r8w
mov r8d, edi
mov dword [rsp + 0x20], esi
mov r9d, ebx
and ebx, 0x3ff
shr r9d, 0xa
or r9w, 0xd800
movzx r9d, r9w
call fcn.00407150
mov r9d, ebx
mov dword [rsp + 0x80], esi
mov r8d, edi
or r9d, 0xdc00
mov edx, r12d
mov rcx, rbp
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.00407150
movzx eax, ax
movzx r8d, r8w
mov dword [rsp + 0x80], eax
jmp 0x40729e
Function at 0x4080f0
Capabilities:
Manipulate console buffer

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov r9, qword [rcx + 0x30]
mov rbp, qword [rcx + 0x28]
mov rsi, rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
test r9, r9
je 0x40816b
movzx edi, dl
xor ebx, ebx
lea r12, [rsp + 0x40]
jmp 0x408143
mov r9, qword [rsi + 0x30]
cdqe
add rbx, rax
cmp rbx, r9
jae 0x4081c0
lea r8, [rbp + rbx]
mov dword [rsp + 0x20], edi
sub r9d, ebx
mov rdx, r12
mov rcx, rsi
call fcn.00407c00
cmp eax, 0xffffffff
jne 0x408131
cmp qword [rsi + 0x30], rbx
cmovbe rbx, qword [rsi + 0x30]
mov r9, rbx
lea rcx, [rsi + 0x28]
mov r8, r9
xor edx, edx
call fcn.00499ca0
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
movabs rax, 0xcccccccccccccccd
mov dword [rsp + 0x3c], 0
sub r8, rcx
sar r8, 2
imul r8, rax
test r8, r8
jne 0x4081d0
test rcx, rcx
je 0x4081b0
call fcn.004aaf10
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r9, rbx
cmova r9, rbx
jmp 0x40816b
mov rax, qword [rsi + 8]
mov rdx, rcx
lea r9, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x4081f0
mov rcx, qword [rsp + 0x40]
jmp 0x4081a5
lea rcx, str.WriteConsoleInputW_failed
call fcn.00413ac0
jmp 0x4081e9
Function at 0x40c0f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rsi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
call r15
mov dword [rsp + 0x24], eax
mov rdx, qword [rsp + 0x30]
lea rax, [0x00430d10]
lea r12, [rsp + 0x30]
lea r14, [0x00430d20]
mov qword [rsp + 0x28], rax
nop dword [rax]
movzx r13d, byte [rsi + 8]
test r13b, r13b
jne 0x40c223
mov qword [rsp + 0x38], rdx
mov rax, qword [rsi + 0x18]
xor ebx, ebx
mov rdx, qword [rsi + 0x10]
sub rax, rdx
sar rax, 3
test rax, rax
jne 0x40c198
jmp 0x40c242
mov rdx, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
add rbx, 1
sub rax, rdx
sar rax, 3
cmp rbx, rax
jae 0x40c1d0
mov rcx, qword [rdx + rbx*8]
mov rdx, r12
lea rbp, [rbx*8]
call fcn.0040eea0
test al, al
mov edi, eax
je 0x40c180
mov rax, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov r13d, edi
mov rax, qword [rax + 0x18]
cmp rax, r14
je 0x40c184
mov rdx, qword [rdx + rbp]
mov rcx, rsi
call rax
jmp 0x40c180
mov eax, dword [rsi + 0x28]
test eax, eax
jg 0x40c250
test r13b, r13b
jne 0x40c210
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov r9d, 0xffffffff
sub rax, rdx
sar rax, 3
test rax, rax
je 0x40c2ce
xor r8d, r8d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x40c301
movzx r13d, byte [rsi + 8]
mov rdx, qword [rsp + 0x30]
test r13b, r13b
je 0x40c15e
test rdx, rdx
je 0x40c231
mov rcx, rdx
call fcn.004aaf10
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [rsi + 0x28]
test edx, edx
jle 0x40c1dc
nop dword [rax]
call r15
sub eax, dword [rsp + 0x24]
mov ebx, dword [rsi + 0x28]
cmp eax, ebx
jge 0x40c2af
test r13b, r13b
jne 0x40c210
test ebx, ebx
jle 0x40c1dc
add ebx, dword [rsp + 0x24]
call r15
sub ebx, eax
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov r9d, 0
cmovns r9d, ebx
sub rax, rdx
sar rax, 3
test rax, rax
jne 0x40c1fc
test r9d, r9d
je 0x40c150
mov ecx, r9d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40c210
mov rax, qword [rsi]
mov rax, qword [rax + 0x10]
cmp rax, qword [rsp + 0x28]
jne 0x40c2fa
call r15
mov dword [rsp + 0x24], eax
mov rdx, qword [rsp + 0x30]
jmp 0x40c150
lea r8, str.timeout___INFINITE
lea rcx, str.src_agent_EventLoop.cc
mov edx, 0x47
call fcn.00418fa0
mov r9d, 0xffffffff
mov ecx, r9d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40c210
mov rcx, rsi
call rax
jmp 0x40c2bd
lea r8, str.result___WAIT_FAILED
lea rcx, str.src_agent_EventLoop.cc
mov edx, 0x4f
call fcn.00418fa0
jmp 0x40c210
Function at 0x40df40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor esi, esi
cmp byte [rcx + 0x10], 0
mov r15, rcx
jne 0x40e062
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x37], 0
lea rbp, [rsp + 0x37]
lea rdi, [rsp + 0x38]
lea rbx, [r15 + 0x20]
lea r13, [rsp + 0x3c]
lea r12, [r15 + 0x40]
mov r14, qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x40dfbf
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e039
mov rcx, qword [r15 + 0x18]
mov esi, 2
call r14
mov rax, qword [r15]
mov edx, dword [rsp + 0x3c]
mov rcx, r15
call qword [rax + 0x10]
mov dword [r15 + 0x14], 0
mov rax, qword [r15]
mov r8, rbp
mov rdx, rdi
mov rcx, r15
call qword [rax + 0x18]
test al, al
je 0x40e04f
mov r8d, dword [rsp + 0x38]
cmp byte [rsp + 0x37], 0
mov r9, r13
mov dword [rsp + 0x3c], 0
mov rdx, r12
mov dword [r15 + 0x14], r8d
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rax, qword [r15 + 0x18]
mov qword [r15 + 0x38], rax
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x98]
mov qword [rsp + 0x20], rbx
jne 0x40df90
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40df9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40e0d0
mov esi, 1
mov eax, esi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rcx + 8]
lea rdx, [rcx + 0x20]
xor r9d, r9d
mov dword [rsp + 0x3c], 0
lea r8, [rsp + 0x3c]
mov rcx, qword [rax + 0x98]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40e0a0
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
setne sil
jmp 0x40e04f
mov rcx, qword [r15 + 0x18]
mov esi, 2
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [r15]
mov byte [r15 + 0x10], 0
mov rcx, r15
mov edx, dword [rsp + 0x3c]
call qword [rax + 0x10]
mov dword [r15 + 0x14], 0
jmp 0x40df5f
mov byte [r15 + 0x10], 1
jmp 0x40e04f
Function at 0x411b40
Capabilities:
Read pipe
Set console window title
Write pipe

Disassembly:
sub rsp, 0x28
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
test eax, eax
je 0x411b60
add rsp, 0x28
ret
lea rcx, str.SetConsoleTitleW_failed
add rsp, 0x28
jmp fcn.00413ac0

Function at 0x411fc0
Capabilities:
Read pipe
Write pipe

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx]
mov rbx, rdx
mov edx, dword [rdx]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
test eax, eax
je 0x411fe0
add rsp, 0x20
pop rbx
ret
movsx edx, word [rbx]
movsx r8d, word [rbx + 2]
lea rcx, str.SetConsoleScreenBufferSize_failed:_size__d__d_
add rsp, 0x20
pop rbx
jmp fcn.00413ac0

Function at 0x412000
Capabilities:
Read pipe
Write pipe

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov r8, rdx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
test eax, eax
je 0x412020
add rsp, 0x28
ret
lea rcx, str.SetConsoleWindowInfo_failed
add rsp, 0x28
jmp fcn.00413ac0

Function at 0x412060
Capabilities:
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
sub rsp, 0x28
mov edx, dword [rdx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x412080
add rsp, 0x28
ret
lea rcx, str.SetConsoleCursorPosition_failed
add rsp, 0x28
jmp fcn.00413ac0

Function at 0x412d60
Capabilities:
Manipulate console buffer

Disassembly:
sub rsp, 0x68
mov rax, qword [rdx]
movzx r11d, word [rdx + 4]
mov r10, r8
xor r8d, r8d
mov word [rsp + 0x42], r8w
mov qword [rsp + 0x50], rax
xor eax, eax
mov word [rsp + 0x40], ax
movzx eax, word [rdx + 6]
lea r8d, [r11 + 1]
sub r8w, word [rdx]
mov r9d, dword [rsp + 0x40]
add eax, 1
sub ax, word [rdx + 2]
mov rdx, r10
mov word [rsp + 0x30], r8w
mov word [rsp + 0x32], ax
lea rax, [rsp + 0x50]
mov r8d, dword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
test eax, eax
jne 0x412dd3
lea rcx, str.WriteConsoleOutput_failed
call fcn.00413ac0
nop
add rsp, 0x68
ret

Function at 0x412de0
Capabilities:
Read pipe
Write pipe

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx edx, dx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
je 0x412e00
add rsp, 0x28
ret
lea rcx, str.SetConsoleTextAttribute_failed
add rsp, 0x28
jmp fcn.00413ac0
Function at 0x414500
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rcx, [0x004b4040]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx], rax
je 0x4145c0
mov qword [rbx + 8], 0
mov byte [rbx + 0x10], 0
lea rdx, str.SystemFunction036
mov qword [rbx + 0x18], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x414560
mov qword [rbx + 8], rax
add rsp, 0x38
pop rbx
pop rsi
ret
lea rdx, str.SystemFunction036
lea rcx, [0x004b4093]
call fcn.00413ac0
mov qword [rbx + 8], 0
lea rcx, [rbx + 0x18]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
setne byte [rbx + 0x10]
jne 0x41454f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GenRandom:_CryptAcquireContext_failed:__u
mov edx, eax
call fcn.00413ac0
jmp 0x41454f
lea r8, [0x004b405a]
lea rcx, [0x004b406b]
mov edx, 0x28
call fcn.00418fa0
mov rax, qword [rbx]
jmp 0x414522

Function at 0x414630
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov rcx, rsi
mov rbx, r8
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 8]
test rax, rax
je 0x414691
mov edx, ebx
mov rcx, rsi
mov edi, 1
call rax
test al, al
je 0x414670
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GenRandom:_RtlGenRandom_SystemFunction036_failed:__u
mov edx, eax
xor edi, edi
call fcn.00413ac0
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx edi, byte [rbp + 0x10]
test dil, dil
je 0x414664
mov rcx, qword [rbp + 0x18]
mov r8, rsi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x414664
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GenRandom:_CryptGenRandom_failed__size_d__lasterror_u
mov r8d, eax
mov edx, ebx
xor edi, edi
call fcn.00413ac0
jmp 0x414664
Function at 0x4193a0
Capabilities:
Read pipe
Write pipe

Disassembly:
lea r8, str.none
lea rdx, str.0.4.3
lea rcx, str.winpty_version__s__commit__s_
jmp fcn.00413ac0

Function at 0x423370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x004de6a4]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x423487
mov rax, qword [0x004de6a8]
xor edx, edx
add rax, 8
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x4233bd
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rcx, r8
cmp rbx, rcx
jb 0x42346d
add edx, 1
add rax, 0x18
cmp edx, ebp
jne 0x4233a1
mov rcx, rbx
call fcn.00423fc0
test rax, rax
mov r12, rax
je 0x4234bf
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x004de6a8]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00424130
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004de6a8]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4234a2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x423466
sub eax, 4
and eax, 0xfffffffb
je 0x423466
mov r9, rbp
add r9, qword [0x004de6a8]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x42348e
add dword [0x004de6a4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x4233c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00423300
mov rax, qword [0x004de6a8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.00423300
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00423300
nop
nop

Function at 0x423c20
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004de980]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004de960]
test rbx, rbx
je 0x423c74
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x423c6b
test rsi, rsi
je 0x423c6b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x423c50
lea rcx, [0x004de980]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x423fc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004ba3e0]
xor r9d, r9d
mov rdx, rcx
cmp word [r8], 0x5a4d
je 0x423fe1
mov rax, r9
add rsp, 0x28
ret
mov rcx, r8
call fcn.00423e90
test eax, eax
je 0x423fd9
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x423fd9
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x424034
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x424050
add rax, 0x28
cmp rax, r9
jne 0x424020
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
mov r9, rax
mov rax, r9
add rsp, 0x28
ret

Function at 0x424390
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x004de968]
mov edi, ecx
mov rsi, rdx
test eax, eax
jne 0x423cb0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov rbx, rax
je 0x423d03
mov dword [rax], edi
mov qword [rax + 8], rsi
lea rcx, [0x004de980]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x004de960]
lea rcx, [0x004de980]
mov qword [0x004de960], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 0xffffffff
jmp 0x423ca6
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4243c0
mov rdx, rbx
mov ecx, eax
mov dword [rsi], eax
add rsp, 0x28
pop rbx
pop rsi
jmp 0x42f730
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
je 0x42f740
jmp 0x423c90
xor eax, eax
ret

Function at 0x4243f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x424420
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x424435
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]