joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cb8c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x14000cc08
movsxd rdx, ecx
lea rcx, [0x14000cc90]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x1401600f8]
test rbx, rbx
je 0x14000cc7b
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000cbfe
cmp byte [rbx + 0x20], 0
je 0x14000cbfe
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x14000cbc4
jmp 0x14000cc7b
mov rbx, qword [0x1401600f8]
test rbx, rbx
je 0x14000cc7b
mov rsi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000cc73
cmp byte [rbx + 0x21], 0
je 0x14000cc37
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14000cc63
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
or rdx, 0xffffffffffffffff
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x1401600f8]
call fcn.14000c338
mov rbx, rsi
test rsi, rsi
jne 0x14000cc14
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140013a10
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rdi, r9
cmp r8, rax
mov rsi, rdx
mov rbx, rcx
cmovb eax, r8d
test eax, eax
je 0x140013ab5
mov qword [rsp + 0x30], rbp
sub rsi, r9
mov ebp, eax
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x50]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x50], cl
mov ecx, dword [rbx]
not ecx
call fcn.14003b4d0
not eax
lea rdx, [rsp + 0x40]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x40], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14003b4d0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x140013a42
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a890
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, qword [rsp + 0x60]
mov rsi, r9
cmp r8, rbx
mov r14, rdx
mov rdi, rcx
cmovb ebx, r8d
test ebx, ebx
je 0x14001a957
mov qword [rsp + 0x40], rbp
sub r14, r9
mov ebp, ebx
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r14 + rsi]
mov r8d, 1
mov eax, dword [rdi + 8]
or eax, 2
mov byte [rsp + 0x60], dl
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
lea rdx, [rsp + 0x60]
mov byte [rsi], cl
mov ecx, dword [rdi]
not ecx
call fcn.14003b4d0
not eax
lea rdx, [rsp + 0x50]
mov dword [rdi], eax
mov r8d, 1
movzx eax, al
add eax, dword [rdi + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x50], cl
mov ecx, dword [rdi + 8]
not ecx
call fcn.14003b4d0
lea rsi, [rsi + 1]
not eax
mov dword [rdi + 8], eax
sub rbp, 1
jne 0x14001a8d0
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14001a970
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0xf8]
mov rbp, rcx
call fcn.1400504b0
mov rsi, rax
test rax, rax
jne 0x14001a9b6
lea r8, str.Encryption_needs_passphrase
mov rcx, rbp
lea rdx, [rax - 1]
call fcn.14003edd0
lea eax, [rsi - 0x19]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov edx, ntohl
lea rcx, [rsp + 0x20]
call fcn.14004f5b0
test eax, eax
je 0x14001a9f1
lea r8, str.Cant_generate_random_number_for_encryption
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call fcn.14003edd0
mov eax, 0xffffffe2
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14001aa00
mov dword [rdi + 0x50], 0x12345678
mov dword [rdi + 0x54], 0x23456789
mov dword [rdi + 0x58], 0x34567890
test rbx, rbx
je 0x14001aa80
mov ecx, dword [rdi + 0x50]
lea rdx, [rsp + 0x60]
movzx eax, byte [rsi]
not ecx
mov r8d, 1
mov byte [rsp + 0x60], al
call fcn.14003b4d0
not eax
lea rdx, [rsp + 0x68]
mov dword [rdi + 0x50], eax
mov r8d, 1
movzx eax, al
add eax, dword [rdi + 0x54]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 0x54], ecx
shr ecx, 0x18
mov byte [rsp + 0x68], cl
mov ecx, dword [rdi + 0x58]
not ecx
call fcn.14003b4d0
lea rsi, [rsi + 1]
not eax
mov dword [rdi + 0x58], eax
sub rbx, 1
jne 0x14001aa23
movzx eax, byte [rdi + 0x5d]
xor ebx, ebx
mov byte [rsp + 0x2b], al
lea esi, [rbx + 0xc]
nop dword [rax]
movzx edx, byte [rsp + rbx + 0x20]
mov r8d, 1
mov eax, dword [rdi + 0x58]
or eax, 2
mov byte [rsp + 0x60], dl
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
lea rdx, [rsp + 0x60]
mov byte [rsp + rbx + 0x30], cl
mov ecx, dword [rdi + 0x50]
not ecx
call fcn.14003b4d0
not eax
lea rdx, [rsp + 0x68]
mov dword [rdi + 0x50], eax
mov r8d, 1
movzx eax, al
add eax, dword [rdi + 0x54]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 0x54], ecx
shr ecx, 0x18
mov byte [rsp + 0x68], cl
mov ecx, dword [rdi + 0x58]
not ecx
call fcn.14003b4d0
lea rbx, [rbx + 1]
not eax
mov dword [rdi + 0x58], eax
sub rsi, 1
jne 0x14001aa90
lea r8d, [rsi + 0xc]
mov rcx, rbp
lea rdx, [rsp + 0x30]
call fcn.14004fe70
test eax, eax
jne 0x14001ab28
add qword [rdi + 0xb0], 0xc
add qword [rdi + 0x18], 0xc
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001b880
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
mov qword [rax + 0x10], rbx
mov rax, qword [rax]
mov word [rbx + rax], dx
add rsp, 0x20
pop rbx
ret
Function at 0x14001c0d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14001c116
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001c0e5
mov ecx, eax
call fcn.140024fc0
sub rax, rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x14001c100
add rsp, 0x20
pop rbx
ret
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.14001b880

Function at 0x14001c4ec
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12d, ecx
mov rsi, r9
mov rcx, qword [0x14015fd08]
mov rbp, r8
mov r14, rdx
xor ebx, ebx
call fcn.14000b694
mov r15, rax
test r14, r14
je 0x14001c625
mov rcx, qword [0x14015f7b8]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, r14
mov rdi, rax
or dword [rax + 4], 0xffffffff
mov dword [rax], 1
call fcn.14001cbe8
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call fcn.14001cbe8
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x78], rax
mov dword [rdi + 0x80], r12d
mov qword [rdi + 0x88], rsi
test cl, 1
je 0x14001c616
test rsi, rsi
je 0x14001c5d1
mov rcx, qword [0x14015f7b8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x14001c5cb
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.14001b8e0
cmp qword [rdi + 0x70], rbx
je 0x14001c60c
lea rax, [rsp + 0x68]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14001cbd8]
mov edx, 0x10000
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14001c606
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001c622
cmp dword [rsp + 0x68], ebx
jne 0x14001c622
mov rcx, rdi
call fcn.14001f540
jmp 0x14001c625
mov rcx, rdi
mov qword [rdi + 0x70], rbp
call fcn.14001c758
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140024fc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, ecx
mov esi, edx
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp esi, 0xffffffff
jne 0x140024ff0
mov esi, dword [rax + 0x10]
mov eax, dword [rax + 0x10]
mov r8, qword [rbx + 8]
lea edx, [rax + rbp*2]
movsxd rax, edx
lea rcx, [r8 - 4]
cmp rax, rcx
jl 0x140025011
lea eax, [rdx + 0x4000]
movsxd r9, eax
jmp 0x140025023
mov eax, 0x100000
cmp r8, rax
jle 0x140025040
cmp edx, eax
cmovl edx, eax
mov r9d, edx
mov r8, qword [rbx]
xor edx, edx
mov qword [rbx + 8], r9
add r9, 0xa
mov rcx, qword [0x1401600d0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbx], rax
mov rax, qword [rbx]
movsxd rdx, esi
mov rsi, qword [rsp + 0x40]
add rax, rdx
lea rcx, [rdx + rbp*2]
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140025070
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [rbx + rbx]
movsxd rdx, ecx
sub qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
ret
Function at 0x140025548
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, str.PB_WindowID
mov rcx, r14
mov rdi, rax
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetPropW]
lea r12d, [rbx + 9]
mov rsi, rax
test rax, rax
je 0x1400255f9
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400255f9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
jne 0x1400255f9
mov rcx, qword [0x140160988]
lea rdx, [rsi - 1]
call fcn.14000c450
mov rbx, rax
lea ebp, [r12 - 8]
cmp dword [rax + 0x20], 0
jle 0x1400255f9
mov rcx, qword [rax + 8]
xor edx, edx
movsxd rax, dword [rax + 0x20]
add rcx, 4
cmp word [rcx - 2], r12w
jne 0x1400255e9
mov r8d, 0xfa01
cmp word [rcx], r8w
je 0x1400255f7
inc rdx
add rcx, 6
cmp rdx, rax
jge 0x1400255f9
jmp 0x1400255d6
xor ebp, ebp
mov sil, 0x80
test rdi, rdi
je 0x1400256c9
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x1400256c9
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x1400256c9
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x1400256c9
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x1400256c9
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x1400256c9
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x20]
call fcn.140032bd8
test eax, eax
je 0x140025699
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x20]
call fcn.140032bd8
test eax, eax
jne 0x1400256b4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x140025730
lea rdx, str.Scintilla
lea rcx, [rsp + 0x20]
call fcn.140081988
test eax, eax
je 0x140025730
test r14, r14
je 0x14002570b
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x1400256fe
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x1400256fe
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14002570b
mov edx, 1
mov rcx, r14
call fcn.1400258c0
test rdi, rdi
je 0x140025725
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x140025730
test rbx, rbx
je 0x140025730
mov rax, qword [rbx + 0x10]
jmp 0x140025732
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x140027cf8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140082d50
sub rsp, rax
mov rax, qword [0x14015d000]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140038c4c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140027d47
mov rax, rbp
jmp 0x140027e4f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x160fa0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140082730
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x160fa0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140027e4b
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140027e4b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140082730
test rax, rax
js 0x140027e4b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140027e4b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140027e3d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140027e3d
cmp byte [rcx], 0xd
jne 0x140027e23
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140027e32
cmp byte [rcx + 1], 0xa
jne 0x140027e32
inc rcx
jmp 0x140027e32
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x15e160]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140027e05
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140027e4f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140039230
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140032b30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x140032b64
mov rdx, qword [rax + 0x10]
add rdx, rcx
cmp rbx, rdx
ja 0x140032b64
sub ebx, ecx
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140032b70
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec rbx
mov rax, qword [rax]
add rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140032ee0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x14015cc80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rbx, qword [rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400333d8
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x140160b18], 0
lea rbx, [0x140160b28]
mov r14, rdx
mov r15, rcx
jne 0x140033425
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140160b1c], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x140160b18], 1
mov ecx, dword [0x140160b1c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400334fa
mov rcx, qword [0x14015f7b8]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140033525
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140160b20]
test rax, rax
je 0x140033475
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x140160b20], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
lea r9, [rbp + 0x20]
and dword [rsp + 0x28], 0
mov rcx, rax
mov r8, rdi
mov dword [rsp + 0x20], 0x100000
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
lea r8, [0x1400335f4]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140160b1c]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x14015f7b8]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140033525
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140033790
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1401600d0]
xor edx, edx
mov r8d, 0x340
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x1401600d0]
xor edx, edx
mov rbx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], reloc.WS2_32.dll_recv
mov rdx, rbx
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x338], rax
mov ecx, dword [0x14015cc80]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x14004beb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov ebx, 0xffffffff
mov rdi, rdx
cmp r8, rbx
cmovbe rbx, r8
test ecx, ecx
jns 0x14004beea
call fcn.140037750
mov dword [rax], 9
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14004bf92
call fcn.14009ade4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14004bf83
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x14004bf43
call fcn.140037750
mov dword [rax], ntohl
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, 0x6d
je 0x14004bf92
cmp eax, 5
jne 0x14004bf6a
call fcn.140037750
mov dword [rax], 9
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.14004c2e0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x14004bfa0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rdx
test ecx, ecx
jns 0x14004bfc5
call fcn.140037750
mov dword [rax], 9
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rbx
mov ebx, 0xffffffff
cmp r8, rbx
cmovbe ebx, r8d
call fcn.14009ade4
mov rcx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x14004c038
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14004c024
call fcn.140037750
mov dword [rax], 9
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.14004c2e0
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14004f5b0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14004f621
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14004f611
mov r9d, 1
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14004f621
mov eax, 0xffffffe7
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
mov eax, 0xffffffe7
test ebx, ebx
mov rbx, qword [rsp + 0x40]
cmovne eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x140050c84
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14015d000]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x140149748]
mov rbp, rcx
call fcn.14009710c
xor edi, edi
test rax, rax
je 0x140050d6a
mov ebx, edi
call fcn.140037750
mov r14d, dword [rax]
call fcn.140037750
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.1400c6ff8
mov rsi, rax
test rax, rax
je 0x140050cfb
call fcn.140037750
mov dword [rax], r14d
jmp 0x140050d25
call fcn.140037750
cmp dword [rax], 0x22
jne 0x140050d62
call fcn.140037750
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1400c6ff8
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140050d62
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140050d29
cmp rax, 3
je 0x140050d44
mov rcx, rsi
call fcn.140050be0
test al, al
je 0x140050d55
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140050d55
mov dil, 1
mov rcx, rbx
call fcn.14001f7cc
mov al, dil
jmp 0x140050d6c
mov rcx, rbx
call fcn.14001f7cc
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140039230
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140058150
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x140058230
mov rdx, rcx
lea r8, [rsp + 0x40]
mov ecx, 2
call fcn.1400ddb70
test eax, eax
jne 0x140058230
lea r8, [rsp + 0x20]
mov rdx, rbx
lea ecx, [rax + 0x17]
call fcn.1400ddb70
test eax, eax
jne 0x140058230
mov qword [rsp + 0x48], rsi
xor esi, esi
mov qword [rsp + 0x50], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400581a7
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1400ddb50
test rax, rax
je 0x1400581ec
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1400ddb50
mov rsi, rax
test rax, rax
je 0x1400581ec
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rdi + rbx]
mov edi, 0x1505
cmp rbx, rsi
jae 0x14005821c
movzx ecx, byte [rbx]
call fcn.140066fc0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140058201
mov rsi, qword [rsp + 0x48]
movzx eax, dil
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret