joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038530
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x30
call fcn.14005d7e0
sub rsp, rax
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
call sub.libcrypto_3_x64.dll_BIO_s_connect
mov rcx, rax
call sub.libcrypto_3_x64.dll_BIO_new
mov rsi, rax
test rax, rax
je 0x1400385b6
xor r8d, r8d
mov r9, rbp
mov rcx, rax
lea edx, [r8 + 0x64]
call sub.libcrypto_3_x64.dll_BIO_ctrl
test eax, eax
jle 0x1400385ae
xor r9d, r9d
mov edx, 0x9b
mov rcx, rsi
lea r8d, [r9 + 0x10]
call sub.libcrypto_3_x64.dll_BIO_ctrl
test eax, eax
jle 0x1400385ae
test rdi, rdi
jne 0x1400385cd
mov rcx, rbx
call sub.libssl_3_x64.dll_SSL_new
mov rbx, rax
test rax, rax
jne 0x1400385d8
mov rcx, rsi
call sub.libcrypto_3_x64.dll_BIO_free
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
mov rbx, rdi
call sub.libssl_3_x64.dll_SSL_set_connect_state
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call sub.libssl_3_x64.dll_SSL_set_bio
mov rcx, rbx
call sub.libssl_3_x64.dll_SSL_connect
test eax, eax
jg 0x14003864e
mov rcx, qword [0x1400ac6a8]
lea rdx, str.ERROR_n
call sub.libcrypto_3_x64.dll_BIO_printf
mov ecx, dword [0x1400ab848]
test ecx, ecx
je 0x14003862c
call sub.libcrypto_3_x64.dll_X509_verify_cert_error_string
mov rcx, qword [0x1400ac6a8]
lea rdx, str.verify_error:_s_n
mov r8, rax
call sub.libcrypto_3_x64.dll_BIO_printf
jmp 0x140038638
mov rcx, qword [0x1400ac6a8]
call sub.libcrypto_3_x64.dll_ERR_print_errors
test rdi, rdi
jne 0x1400385b6
mov rcx, rbx
call sub.libssl_3_x64.dll_SSL_free
jmp 0x1400385b6
mov rcx, rbx
mov dword [rsp + 0x58], 1
call sub.libssl_3_x64.dll_SSL_get_fd
test eax, eax
js 0x140038683
movsxd rcx, eax
lea r9, [rsp + 0x58]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rbx
jmp 0x1400385b8
Function at 0x14003bb50
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
mov eax, 0x48
call fcn.14005d7e0
sub rsp, rax
movaps xmmword [rsp + 0x30], xmm6
test ecx, ecx
jne 0x14003bc00
xor eax, eax
lea r8, [0x14003cd60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x1000
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov dword [0x1400ac8e0], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400ac8e8], rax
test rax, rax
jne 0x14003bbce
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400ac6a8]
lea rdx, str.unable_to_CreateThread___lu_
mov r8d, eax
mov ebx, eax
call sub.libcrypto_3_x64.dll_BIO_printf
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1400ac8e0]
test eax, eax
jne 0x14003bbea
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400ac8e0]
test eax, eax
je 0x14003bbd8
mov edx, dword [0x1400aaf0c]
xor ecx, ecx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.14004f170
mov edx, dword [0x1400aaf0c]
call fcn.14004f170
mov eax, dword [0x1400ac8d0]
movaps xmm6, xmm0
test eax, eax
je 0x14003bc27
mov rcx, qword [0x1400ac8e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1400ac8e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14004c370
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x250
call fcn.14005d7e0
sub rsp, rax
mov rax, qword [0x1400ac2c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov rbx, 0xffffffffffffffff
cmp byte [rcx + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x14004c3a4
lea rsi, [rbx + 1]
cmp rsi, 0x104
ja 0x14004c509
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x104
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14004c4f1
xor eax, eax
test rsi, rsi
je 0x14004c4cd
cmp rsi, 4
jb 0x14004c4e0
lea rcx, [rbx + rdi]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rbx*2]
cmp r8, rcx
ja 0x14004c41f
cmp rdx, rdi
jae 0x14004c4e0
cmp rsi, 0x20
jb 0x14004c4a7
mov rcx, rsi
mov rdx, rsi
and ecx, 0x1f
sub rdx, rcx
lea r8, [rdi + 0x10]
nop dword [rax]
movq xmm0, qword [r8 - 0x10]
movq xmm1, qword [r8 - 8]
lea r8, [r8 + 0x20]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rsp + rax*2 + 0x30], xmm0
movq xmm0, qword [r8 - 0x20]
psraw xmm1, 8
movdqu xmmword [rsp + rax*2 + 0x40], xmm1
movq xmm1, qword [r8 - 0x18]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rsp + rax*2 + 0x50], xmm0
psraw xmm1, 8
movdqu xmmword [rsp + rax*2 + 0x60], xmm1
add rax, 0x20
cmp rax, rdx
jb 0x14004c440
cmp rcx, 4
jb 0x14004c4cd
mov rcx, rsi
and rcx, 0xfffffffffffffffc
nop
movd xmm0, dword [rdi + rax]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movq qword [rsp + rax*2 + 0x30], xmm0
add rax, 4
cmp rax, rcx
jb 0x14004c4b0
cmp rax, rsi
jae 0x14004c4f1
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rdi + rax]
mov word [rsp + rax*2 + 0x30], cx
inc rax
cmp rax, rsi
jb 0x14004c4e0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c509
shr eax, 4
and eax, 1
jmp 0x14004c50e
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14005d840
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, 0x28
call fcn.14005d7e0
sub rsp, rax
add rsp, 0x28
jmp 0x14004c370
Function at 0x14004e060
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x28
call fcn.14005d7e0
sub rsp, rax
mov rdx, rcx
lea r8, [rsp + 0x38]
mov rcx, qword [0x1400ac6a8]
call sub.libcrypto_3_x64.dll_BIO_vprintf
mov rcx, qword [0x1400ac6a8]
call sub.libcrypto_3_x64.dll_ERR_print_errors
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14004e6f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x250
call fcn.14005d7e0
sub rsp, rax
mov rax, qword [0x1400ac2c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov rbx, 0xffffffffffffffff
cmp byte [rcx + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x14004c3a4
lea rsi, [rbx + 1]
cmp rsi, 0x104
ja 0x14004c509
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x104
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14004c4f1
xor eax, eax
test rsi, rsi
je 0x14004c4cd
cmp rsi, 4
jb 0x14004c4e0
lea rcx, [rbx + rdi]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rbx*2]
cmp r8, rcx
ja 0x14004c41f
cmp rdx, rdi
jae 0x14004c4e0
cmp rsi, 0x20
jb 0x14004c4a7
mov rcx, rsi
mov rdx, rsi
and ecx, 0x1f
sub rdx, rcx
lea r8, [rdi + 0x10]
nop dword [rax]
movq xmm0, qword [r8 - 0x10]
movq xmm1, qword [r8 - 8]
lea r8, [r8 + 0x20]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rsp + rax*2 + 0x30], xmm0
movq xmm0, qword [r8 - 0x20]
psraw xmm1, 8
movdqu xmmword [rsp + rax*2 + 0x40], xmm1
movq xmm1, qword [r8 - 0x18]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rsp + rax*2 + 0x50], xmm0
psraw xmm1, 8
movdqu xmmword [rsp + rax*2 + 0x60], xmm1
add rax, 0x20
cmp rax, rdx
jb 0x14004c440
cmp rcx, 4
jb 0x14004c4cd
mov rcx, rsi
and rcx, 0xfffffffffffffffc
nop
movd xmm0, dword [rdi + rax]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movq qword [rsp + rax*2 + 0x30], xmm0
add rax, 4
cmp rax, rcx
jb 0x14004c4b0
cmp rax, rsi
jae 0x14004c4f1
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rdi + rax]
mov word [rsp + rax*2 + 0x30], cx
inc rax
cmp rax, rsi
jb 0x14004c4e0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c509
shr eax, 4
and eax, 1
jmp 0x14004c50e
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14005d840
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, 0x28
call fcn.14005d7e0
sub rsp, rax
add rsp, 0x28
jmp 0x14004c370
Function at 0x14004f2a0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.14005d7e0
sub rsp, rax
xor r9d, r9d
add rsp, 0x28
jmp 0x14004f2c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x30
call fcn.14005d7e0
sub rsp, rax
mov r14d, r9d
mov ebp, r8d
movzx edi, dl
mov rsi, rcx
test rcx, rcx
je 0x14004f397
cmp byte [rcx], 0x2d
jne 0x14004f307
cmp byte [rcx + 1], 0
je 0x14004f397
mov edx, ebp
movzx ecx, dil
call fcn.140052600
mov rdx, rax
mov rcx, rsi
call sub.libcrypto_3_x64.dll_BIO_new_file
mov rbx, rax
test r14d, r14d
jne 0x14004f438
test rax, rax
jne 0x14004f48f
cmp dil, 0x61
je 0x14004f35f
cmp dil, 0x72
je 0x14004f356
cmp dil, 0x77
lea rbx, str._doing_something_
lea rax, str.writing
cmove rbx, rax
jmp 0x14004f366
lea rbx, str.reading
jmp 0x14004f366
lea rbx, str.appending
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400ac6a8]
lea rdx, str.Cant_open___s__for__s___s_n
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call sub.libcrypto_3_x64.dll_BIO_printf
jmp 0x14004f481
mov ecx, ebp
call fcn.14005b420
cmp dil, 0x72
jne 0x14004f3c2
neg eax
sbb ebx, ebx
xor ecx, ecx
and ebx, 0x10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_3_x64.dll_BIO_new_fp
mov rbx, rax
jmp 0x14004f433
neg eax
mov ecx, 1
sbb ebx, ebx
and ebx, 0x10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_3_x64.dll_BIO_new_fp
mov rbx, rax
test rax, rax
je 0x14004f433
mov ecx, ebp
call fcn.14005b420
test eax, eax
je 0x14004f433
lea rcx, str.HARNESS_OSSL_PREFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
je 0x14004f433
call sub.libcrypto_3_x64.dll_BIO_f_prefix
mov rcx, rax
call sub.libcrypto_3_x64.dll_BIO_new
mov rcx, rax
mov rdx, rbx
call sub.libcrypto_3_x64.dll_BIO_push
xor r8d, r8d
mov r9, rsi
mov rcx, rax
mov rbx, rax
lea edx, [r8 + 0x4f]
call sub.libcrypto_3_x64.dll_BIO_ctrl
test r14d, r14d
je 0x14004f442
call sub.libcrypto_3_x64.dll_ERR_clear_error
mov rax, rbx
jmp 0x14004f48f
test rbx, rbx
jne 0x14004f43d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400ac6a8]
lea r8, str.stdout
mov r9, rax
lea rdx, str.Cant_open__s___s_n
cmp dil, 0x72
lea rax, str.stdin
cmove r8, rax
call sub.libcrypto_3_x64.dll_BIO_printf
mov rcx, qword [0x1400ac6a8]
call sub.libcrypto_3_x64.dll_ERR_print_errors
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14004f2c0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.14005d7e0
sub rsp, rax
xor r9d, r9d
add rsp, 0x28
jmp 0x14004f2c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x30
call fcn.14005d7e0
sub rsp, rax
mov r14d, r9d
mov ebp, r8d
movzx edi, dl
mov rsi, rcx
test rcx, rcx
je 0x14004f397
cmp byte [rcx], 0x2d
jne 0x14004f307
cmp byte [rcx + 1], 0
je 0x14004f397
mov edx, ebp
movzx ecx, dil
call fcn.140052600
mov rdx, rax
mov rcx, rsi
call sub.libcrypto_3_x64.dll_BIO_new_file
mov rbx, rax
test r14d, r14d
jne 0x14004f438
test rax, rax
jne 0x14004f48f
cmp dil, 0x61
je 0x14004f35f
cmp dil, 0x72
je 0x14004f356
cmp dil, 0x77
lea rbx, str._doing_something_
lea rax, str.writing
cmove rbx, rax
jmp 0x14004f366
lea rbx, str.reading
jmp 0x14004f366
lea rbx, str.appending
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400ac6a8]
lea rdx, str.Cant_open___s__for__s___s_n
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call sub.libcrypto_3_x64.dll_BIO_printf
jmp 0x14004f481
mov ecx, ebp
call fcn.14005b420
cmp dil, 0x72
jne 0x14004f3c2
neg eax
sbb ebx, ebx
xor ecx, ecx
and ebx, 0x10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_3_x64.dll_BIO_new_fp
mov rbx, rax
jmp 0x14004f433
neg eax
mov ecx, 1
sbb ebx, ebx
and ebx, 0x10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_3_x64.dll_BIO_new_fp
mov rbx, rax
test rax, rax
je 0x14004f433
mov ecx, ebp
call fcn.14005b420
test eax, eax
je 0x14004f433
lea rcx, str.HARNESS_OSSL_PREFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
je 0x14004f433
call sub.libcrypto_3_x64.dll_BIO_f_prefix
mov rcx, rax
call sub.libcrypto_3_x64.dll_BIO_new
mov rcx, rax
mov rdx, rbx
call sub.libcrypto_3_x64.dll_BIO_push
xor r8d, r8d
mov r9, rsi
mov rcx, rax
mov rbx, rax
lea edx, [r8 + 0x4f]
call sub.libcrypto_3_x64.dll_BIO_ctrl
test r14d, r14d
je 0x14004f442
call sub.libcrypto_3_x64.dll_ERR_clear_error
mov rax, rbx
jmp 0x14004f48f
test rbx, rbx
jne 0x14004f43d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400ac6a8]
lea r8, str.stdout
mov r9, rax
lea rdx, str.Cant_open__s___s_n
cmp dil, 0x72
lea rax, str.stdin
cmove r8, rax
call sub.libcrypto_3_x64.dll_BIO_printf
mov rcx, qword [0x1400ac6a8]
call sub.libcrypto_3_x64.dll_ERR_print_errors
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140050280
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.14005d7e0
sub rsp, rax
mov edi, ecx
call fcn.14005b420
neg eax
mov ecx, 1
sbb ebx, ebx
and ebx, 0x10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_3_x64.dll_BIO_new_fp
mov rbx, rax
test rax, rax
jne 0x1400502c9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, edi
call fcn.14005b420
test eax, eax
je 0x140050316
lea rcx, str.HARNESS_OSSL_PREFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
je 0x140050316
call sub.libcrypto_3_x64.dll_BIO_f_prefix
mov rcx, rax
call sub.libcrypto_3_x64.dll_BIO_new
mov rcx, rax
mov rdx, rbx
call sub.libcrypto_3_x64.dll_BIO_push
xor r8d, r8d
mov r9, rdi
mov rcx, rax
mov rbx, rax
lea edx, [r8 + 0x4f]
call sub.libcrypto_3_x64.dll_BIO_ctrl
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400531d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.14005d7e0
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x40]
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x140053230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.14005d7e0
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x140058030
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.14005d7e0
sub rsp, rax
lea rax, [rdx*2 + 1]
mov rbx, rdx
mov rdi, rcx
cmp rax, rdx
jb 0x1400580bc
test eax, eax
js 0x1400580bc
movsxd rcx, eax
cmp rax, rcx
jne 0x1400580bc
lea rdx, str.TLSA_hex_data_buffer
call fcn.14004ece0
mov r9, rax
mov rdx, rax
test rbx, rbx
je 0x1400580ab
mov r8, qword [str.0123456789abcdef]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
shr rcx, 4
movzx ecx, byte [rcx + r8]
mov byte [rdx], cl
movzx eax, byte [rdi - 1]
and eax, 0xf
movzx eax, byte [rax + r8]
mov byte [rdx + 1], al
add rdx, 2
sub rbx, 1
jne 0x140058080
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov byte [rdx], 0
add rsp, 0x20
pop rdi
ret
call fcn.14004bf60
mov rcx, qword [0x1400ac6a8]
lea rdx, str._s:__zu_byte_buffer_too_large_to_hexencode_n
mov r8, rax
mov r9, rbx
call sub.libcrypto_3_x64.dll_BIO_printf
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140058cf0
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x70
call fcn.14005d7e0
sub rsp, rax
mov rsi, rdx
mov rbx, rcx
call sub.libssl_3_x64.dll_SSL_get_verify_result
test eax, eax
jne 0x140058d3b
mov rcx, rbx
call sub.libssl_3_x64.dll_SSL_get0_peername
lea rdx, str.Verification:_OK_n
mov rcx, rsi
mov rdi, rax
call sub.libcrypto_3_x64.dll_BIO_printf
test rdi, rdi
je 0x140058d54
mov r8, rdi
lea rdx, str.Verified_peername:__s_n
jmp 0x140058d4c
mov ecx, eax
call sub.libcrypto_3_x64.dll_X509_verify_cert_error_string
mov r8, rax
lea rdx, str.Verification_error:__s_n
mov rcx, rsi
call sub.libcrypto_3_x64.dll_BIO_printf
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rbx
call sub.libssl_3_x64.dll_SSL_get0_dane_authority
test eax, eax
js 0x140058efd
xor eax, eax
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0xa8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call sub.libssl_3_x64.dll_SSL_get0_dane_tlsa
mov rbx, qword [rsp + 0x60]
mov r14d, eax
cmp rbx, 0xc
jbe 0x140058de1
mov rcx, qword [rsp + 0x58]
mov edx, recv
add rcx, 0xfffffffffffffff4
add rcx, rbx
call fcn.140058030
mov rbp, rax
jmp 0x140058e5c
mov rdi, qword [rsp + 0x58]
lea rax, [rbx*2 + 1]
cmp rax, rbx
jb 0x140058f05
test eax, eax
js 0x140058f05
movsxd rcx, eax
cmp rax, rcx
jne 0x140058f05
lea rdx, str.TLSA_hex_data_buffer
call fcn.14004ece0
mov rbp, rax
mov rcx, rax
test rbx, rbx
je 0x140058e59
mov rdx, qword [str.0123456789abcdef]
nop dword [rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
shr rax, 4
movzx eax, byte [rax + rdx]
mov byte [rcx], al
movzx eax, byte [rdi - 1]
and eax, 0xf
movzx eax, byte [rax + rdx]
mov byte [rcx + 1], al
add rcx, 2
sub rbx, 1
jne 0x140058e30
mov byte [rcx], 0
cmp qword [rsp + 0x68], 0
je 0x140058e6d
lea rdx, str.signed_the_certificate
jmp 0x140058e82
test r14d, r14d
lea rax, str.matched_TA_certificate
lea rdx, str.matched_EE_certificate
cmovne rdx, rax
cmp qword [rsp + 0x60], 0xc
lea rax, [0x140093918]
movzx r9d, byte [rsp + 0xa8]
lea rcx, [0x140069bf4]
movzx r8d, byte [rsp + 0x50]
cmova rcx, rax
movzx eax, byte [rsp + 0xa0]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rdx
lea rdx, str.DANE_TLSA__d__d__d__s_s__s_at_depth__d_n
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call sub.libcrypto_3_x64.dll_BIO_printf
mov r8d, 0x4bc
lea rdx, str.appslib_s_cb.c
mov rcx, rbp
call sub.libcrypto_3_x64.dll_CRYPTO_free
mov rbp, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
call fcn.14004bf60
mov rcx, qword [0x1400ac6a8]
lea rdx, str._s:__zu_byte_buffer_too_large_to_hexencode_n
mov r8, rax
mov r9, rbx
call sub.libcrypto_3_x64.dll_BIO_printf
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14005e21c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005e266
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005e266
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005e266
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005e266
cmp dword [rcx + 0x84], 0xe
jbe 0x14005e266
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005e268
xor al, al
add rsp, 0x28
ret
Function at 0x140011420
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x1400bb5d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1400114ae
lea rdx, str.NtOpenKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDeleteKey
mov rcx, rbx
mov qword [0x1400ccb28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
mov qword [0x1400ccb38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rbx
mov qword [0x1400ccb08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetInformationProcess
mov rcx, rbx
mov qword [0x1400ccb10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ccb00], rax
add rsp, 0x20
pop rbx
ret
Function at 0x14001a050
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x3a0
mov rax, qword [0x1400c9080]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rsi, rcx
xor edx, edx
mov ecx, 2
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001a0ab
lea rdx, str.Failed_to_create_process_snapshot.
lea rcx, [0x1400cadc0]
call fcn.14000bd60
mov rcx, rax
call fcn.14000c010
xor al, al
jmp 0x14001a185
mov qword [rsp + 0x3c8], rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x3d0], r14
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001a14d
xor r14d, r14d
nop dword [rax + rax]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x280]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x6c]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp qword [rsi + 0x20], 0xf
lea rdx, [rsi + 8]
jbe 0x14001a123
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x280]
call fcn.140052c80
test eax, eax
je 0x14001a148
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001a0e0
jmp 0x14001a168
mov bpl, 1
jmp 0x14001a168
lea rdx, str.Failed_to_iterate_through_processes.
lea rcx, [0x1400cadc0]
call fcn.14000bd60
mov rcx, rax
call fcn.14000c010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x3d0]
movzx eax, bpl
mov rbx, qword [rsp + 0x3c8]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140034bd0
add rsp, 0x3a0
pop rdi
pop rsi
pop rbp
ret