joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016ca4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x5e0
and dword [rsp + 0x70], 0
lea rcx, [rsp + 0x74]
xor edx, edx
mov r8d, 0x94
call fcn.140014560
lea r11, [rsp + 0x70]
lea rax, [rsp + 0x110]
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x208]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call sub.KERNEL32.dll_RtlLookupFunctionEntry
test rax, rax
je 0x140016d40
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x110]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140016d60
mov rax, qword [rsp + 0x5e8]
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0x5e8]
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x5e8]
mov dword [rsp + 0x70], 0xc0000417
mov dword [rsp + 0x74], 1
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140016dab
test ebx, ebx
jne 0x140016dab
lea ecx, [rax + 2]
call fcn.14001bd10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x5e0
pop rbx
ret
Function at 0x14001b5fc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400165f8
xor ebx, ebx
mov rdi, rax
cmp qword [0x140029620], rbx
jne 0x14001b702
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14001b7d7
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b7d7
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140029620], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140029628], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140029630], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140029640], rax
test rax, rax
je 0x14001b6f9
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140029638], rax
jmp 0x14001b709
mov rax, qword [0x140029638]
jmp 0x14001b710
mov rax, qword [0x140029638]
mov r11, qword [0x140029640]
cmp rax, rdi
je 0x14001b778
cmp r11, rdi
je 0x14001b778
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140029640]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14001b778
test rax, rax
je 0x14001b778
call rsi
test rax, rax
je 0x14001b772
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001b772
test byte [rsp + 0x38], 1
jne 0x14001b778
bts ebp, 0x15
jmp 0x14001b7b6
mov rcx, qword [0x140029628]
cmp rcx, rdi
je 0x14001b7b6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001b7b6
call rax
mov rbx, rax
test rax, rax
je 0x14001b7b6
mov rcx, qword [0x140029630]
cmp rcx, rdi
je 0x14001b7b6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001b7b6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140029620]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001b7d7
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14001b7d9
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400012d0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.1400136b0
test rax, rax
je 0x140001501
mov rbx, rax
movzx eax, word [rbp + rax*2 - 2]
cmp ax, 0x5c
je 0x1400014f9
cmp ax, 0x2f
je 0x1400014f9
lea rax, [rbx + 2]
add rax, rax
mov rcx, 0xffffffffffffffff
cmovae rcx, rax
call fcn.1400135c4
mov rdi, rax
lea r8, [rbx + rbx]
add r8, 4
xor r14d, r14d
mov rcx, rax
xor edx, edx
call fcn.140015b80
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, rbp
call fcn.140013870
mov rcx, rdi
call fcn.1400138c8
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x38]
mov qword [rcx], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001506
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001539
add ebx, ebx
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001539
lea r9, [rsp + 0x2c]
mov dword [r9], 4
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001539
lea r14, [rsp + 0x28]
mov ebp, dword [r14]
mov rcx, rbp
call fcn.1400135c4
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.140015b80
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, r15
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001539
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001464
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001476
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.140013868
lea rdx, str.SOFTWAREMozillaMaintenanceService_
mov r8d, 0x104
mov rcx, rsi
call fcn.140013870
mov r14d, 1
cmp dword [rsp + 0x28], 0
je 0x1400014d1
add rsi, 0x48
xor ebp, ebp
lea rdi, str._.2x
mov rbx, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [r15 + rbp]
mov rcx, rsi
mov rdx, rdi
call rbx
add rsi, 4
inc rbp
mov eax, dword [rsp + 0x28]
cmp rbp, rax
jb 0x1400014b4
mov rdi, r15
mov rcx, rdi
call fcn.140013868
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140023af0
mov eax, r14d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec rbx
jmp 0x14000131b
xor r14d, r14d
jmp 0x1400014dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140001539
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140001397
xor r14d, r14d
jmp 0x1400014d4
Function at 0x140001bb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 2
mov edx, 0x4000000
call fcn.14000f3a0
test rax, rax
je 0x140001cdd
mov r12, rax
mov rax, qword [rbx + 8]
lea r15, [rsp + 0x28]
mov qword [r15], rax
xorps xmm0, xmm0
movups xmmword [r15 + 8], xmm0
mov rax, qword [rbx + 0x10]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], 0
mov rax, qword [rbx + 0x20]
mov qword [r15 + 0x28], rax
xor esi, esi
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x140001ce4
cmp esi, eax
jge 0x140001c6d
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x38]
jne 0x140001c6d
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbx]
mov r9, qword [rbx + 8]
mov dword [rsp + 0x20], eax
mov rdx, rdi
mov r8d, esi
call fcn.14000d3e0
test eax, eax
jle 0x140001cf2
add esi, eax
mov eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rcx, r12
mov rdx, r15
call fcn.14000e310
mov ebp, eax
mov r8, qword [rsp + 0x48]
cmp r8, qword [rbx + 0x20]
jne 0x140001ca9
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, r14
call fcn.140020dcc
cmp rax, qword [rsp + 0x48]
jne 0x140001ceb
mov qword [rsp + 0x48], 0
xor r8d, r8d
test ebp, ebp
je 0x140001c1f
mov esi, 0x27
cmp ebp, 1
jne 0x140001cf7
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, r14
call fcn.140020dcc
xor ecx, ecx
cmp rax, qword [rsp + 0x48]
mov esi, 0x46
cmove esi, ecx
jmp 0x140001cf7
mov esi, 0x27
jmp 0x140001cff
mov esi, 0x28
jmp 0x140001cf7
mov esi, 0x46
jmp 0x140001cf7
mov esi, 6
mov rcx, r12
call fcn.14000f4a0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023af0
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140003ff0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov dx, 0x2f
call fcn.140015ee8
test rax, rax
je 0x140004025
mov rsi, rax
mov word [rax], 0
mov rcx, rdi
call fcn.140003ff0
mov ebx, eax
test eax, eax
je 0x140004031
mov word [rsi], 0x2f
jmp 0x140004027
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
cmp word [rdi], 0
je 0x14000401e
mov rcx, rdi
call fcn.14001f1d0
test eax, eax
jns 0x14000401e
call fcn.14001b3d4
cmp dword [rax], 0x11
je 0x14000401e
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004095
call fcn.14001b3d4
mov r9d, dword [rax]
lea rcx, [0x140047ea8]
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
mov r8, rdi
call fcn.1400116d0
mov ebx, 7
jmp 0x14000401e
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140004070
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140004070
Function at 0x140005ba0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rsi, r8
mov ebp, edx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.MOZ_LAUNCHED_CHILD1
call fcn.14001e0ac
mov rcx, rdi
call fcn.14001e844
test eax, eax
je 0x140005c1a
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005cd0
lea rcx, [0x140047ea8]
lea rdx, str.Warning:_chdir_failed
call fcn.1400116d0
test bl, bl
je 0x140005c3d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140023af0
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea r9, [rsp + 0x28]
mov edx, ebp
mov r8, rsi
call fcn.140032860
test eax, eax
je 0x140005c1e
mov rsi, qword [rsp + 0x28]
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbp
mov edi, eax
call rbp
sub eax, edi
cmp eax, 0x270f
ja 0x140005cc0
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [sym.imp.USER32.dll_WaitForInputIdle]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0x2710
sub ebx, eax
xor ecx, ecx
call r14
mov rcx, rsi
mov edx, ebx
call r15
cmp eax, 0xffffffff
jne 0x140005cc0
call r12
cmp eax, 0x5bf
jne 0x140005cc0
mov ecx, 0xa
call r13
call rbp
sub eax, edi
cmp eax, 0x2710
jb 0x140005c8a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005c1e
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x140005c07
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x140005c07
Function at 0x140008470
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x248
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
xor edx, edx
call fcn.140015b80
cmp byte [0x140047c98], 0
je 0x1400084ca
lea rcx, [0x140047250]
lea rdx, [0x14003d246]
lea r8, [rsp + 0x30]
call fcn.140012090
test eax, eax
jne 0x1400084f3
jmp 0x14000854c
lea rax, [0x14003d23a]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea r9, [0x140047250]
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.140004840
lea rdx, [0x14003db78]
lea rcx, [rsp + 0x30]
call fcn.14001f0a4
test rax, rax
je 0x14000854c
mov rdi, rax
mov rcx, rsi
call fcn.140021560
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov r9, rdi
call fcn.140020dcc
cmp rax, 1
jne 0x140008550
cmp byte [0x140047c98], 0
je 0x140008547
lea rcx, [0x140047250]
call fcn.140012120
test eax, eax
je 0x140008550
mov sil, 1
jmp 0x140008552
xor esi, esi
jmp 0x14000855a
xor esi, esi
mov rcx, rdi
call fcn.140020548
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140023af0
mov eax, esi
add rsp, 0x248
pop rdi
pop rsi
ret

Function at 0x140008580
Capabilities:
Copy file

Disassembly:
push rsi
sub rsp, 0x660
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov eax, dword [0x1400480b8]
mov ecx, dword [0x140045e5c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400086f1
mov rcx, qword [0x140047ea8]
test rcx, rcx
je 0x1400085db
call fcn.140020548
mov qword [0x140047ea8], 0
cmp byte [0x140047a89], 1
jne 0x1400086d7
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rcx, [0x140047250]
lea rdx, [0x14003d246]
mov r8, rsi
call fcn.140012090
test eax, eax
je 0x140008661
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea r8, str._supdate.status
lea r9, [0x140047250]
mov edx, 0x105
mov rcx, rsi
call fcn.140004840
lea rcx, [rsp + 0x440]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rcx, [0x140047250]
lea rdx, [0x14003d7be]
mov r8, rsi
call fcn.140012090
test eax, eax
je 0x1400086d7
lea rsi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea r8, str._supdate.log
lea r9, [0x140047250]
mov edx, 0x105
mov rcx, rsi
call fcn.140004840
lea rcx, [rsp + 0x230]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.140023af0
nop
add rsp, 0x660
pop rsi
ret
lea rcx, [0x1400480b8]
call fcn.140013ae0
cmp dword [0x1400480b8], 0xffffffff
jne 0x1400085bf
mov qword [0x140047ea8], 0
lea rcx, [0x14000acf0]
call fcn.140013c98
lea rcx, [0x1400480b8]
call fcn.140013b48
jmp 0x1400085bf
Function at 0x14000b110
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
lea rsi, [rsp + 0x50]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rcx, [0x140047250]
lea rdx, [0x14003d246]
mov r8, rsi
call fcn.140012090
test eax, eax
je 0x14000b2a8
lea rdx, [0x14003da44]
lea rcx, [rsp + 0x50]
call fcn.14001f0a4
test rax, rax
je 0x14000b24c
mov rsi, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 1
mov r8d, 0x1f
mov r9, rax
call fcn.140020b08
mov rdi, rax
mov rcx, rsi
call fcn.14002065c
test eax, eax
sete bl
jne 0x14000b2a0
mov byte [rsp + rdi + 0x30], 0
test r15, r15
je 0x14000b1de
cmp byte [r15 + 4], 0
je 0x14000b1de
mov byte [r15 + 4], 0
lea r13, [rsp + 0x30]
mov rcx, r13
mov edx, 0x3a
call fcn.140015d10
mov rdi, rax
test rax, rax
jne 0x14000b221
lea rcx, [rsp + 0x30]
mov edx, 0xa
call fcn.140015d10
mov rdi, rax
test rax, rax
jne 0x14000b221
lea rcx, [rsp + 0x30]
call fcn.140021560
lea rdi, [rsp + rax]
add rdi, 0x30
mov rbp, rdi
sub rbp, r13
mov rcx, r12
call fcn.140021560
cmp rbp, rax
jne 0x14000b250
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r8, rbp
call fcn.140021620
test eax, eax
sete bpl
jmp 0x14000b252
xor ebx, ebx
jmp 0x14000b2a8
xor ebp, ebp
test r15, r15
je 0x14000b29d
cmp byte [rdi], 0x3a
jne 0x14000b29d
inc rdi
lea r12, [rsp + 0x28]
mov qword [r12], 0
mov rcx, rdi
mov rdx, r12
mov r8d, 0xa
call fcn.140021cfc
cmp qword [r12], rdi
je 0x14000b29d
lea ecx, [rax - 0x7fffffff]
cmp ecx, 2
jb 0x14000b29d
cmp byte [r15 + 4], 0
jne 0x14000b2ce
mov dword [r15], eax
mov byte [r15 + 4], 1
mov byte [r14], bpl
mov rcx, rsi
call fcn.140020548
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140023af0
mov eax, ebx
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
Function at 0x14000bd50
Capabilities:
Hash data via wincrypt
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14000bdce
mov rsi, rdx
test rdx, rdx
je 0x14000bdce
mov rdi, r9
test r9, r9
je 0x14000bdce
mov r14, qword [rsp + 0x88]
test r14, r14
je 0x14000bdce
mov ebp, r8d
mov r9, rcx
mov edx, r8d
mov r8d, 1
mov rcx, rsi
call fcn.140020b08
cmp rax, 1
jne 0x14000bdf4
mov r15d, dword [rsp + 0x80]
xor ebx, ebx
mov r12, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rdi + rbx*8]
mov rdx, rsi
mov r8d, ebp
xor r9d, r9d
call r12
test eax, eax
je 0x14000be24
inc rbx
cmp r15, rbx
jne 0x14000bdae
xor eax, eax
jmp 0x14000be15
mov ecx, 2
call fcn.140016378
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140020dcc
jmp 0x14000be10
mov ecx, 2
call fcn.140016378
lea rdx, str.ERROR:_Could_not_read__s_n
mov rcx, rax
mov r8, r14
call fcn.140001260
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call fcn.140016378
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
mov r8, r14
call fcn.140001260
mov eax, 0xfffffffe
jmp 0x14000be15
Function at 0x14000c8a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 1
mov r8d, 0x20
mov rcx, rsi
mov r9, rdi
call fcn.140020b08
mov ebx, 6
cmp rax, 0x20
jne 0x14000c97d
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
mov rcx, rdi
call fcn.14001b7b0
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.14001ba14
mov ebx, 6
test eax, eax
jne 0x14000c97d
movabs rax, 0x303146464944424d
mov ebx, 0x29
cmp qword [rsi], rax
jne 0x14000c97d
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14000c97d
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14000c97d
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14000c97d
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14000c97d
xor edx, edx
cmp rax, rcx
mov ebx, 0x29
cmove ebx, edx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023af0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c9a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
mov rbx, rdx
mov r13, rcx
mov r14d, dword [rcx + 8]
mov esi, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
add ebp, esi
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.140021290
test rax, rax
je 0x14000ca37
mov r15, rax
test rbp, rbp
je 0x14000ca1d
mov r12d, 0x7fffffff
mov rsi, r15
cmp rbp, r12
mov edi, 0x7fffffff
cmovb rdi, rbp
mov edx, 1
mov rcx, rsi
mov r8, rdi
mov r9, rbx
call fcn.140020b08
cmp rax, rdi
jne 0x14000ca41
add rsi, rdi
sub rbp, rdi
jne 0x14000c9ed
mov esi, dword [r13 + 0x14]
imul eax, esi, 0xaaaaaaab
ror eax, 2
cmp eax, 0x15555555
jbe 0x14000ca4b
mov ebp, 0x29
jmp 0x14000cb8d
mov ebp, ntohl
jmp 0x14000cb95
mov ebp, 6
jmp 0x14000cb8d
test esi, esi
je 0x14000cb8b
mov rcx, qword [rsp + 0x20]
add r14, rcx
mov eax, esi
mov rdi, r15
add rdi, rax
mov ebx, dword [r13 + 0x18]
add rbx, rdi
mov eax, dword [r13 + 0x1c]
add rax, rbx
mov qword [rsp + 0x38], rax
mov r13, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov r12, r15
mov ecx, dword [r12]
mov rsi, qword [sym.imp.WS2_32.dll_ntohl]
call rsi
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r14
sub rcx, r13
cmp rcx, rax
jb 0x14000ca2d
mov rcx, qword [rsp + 0x40]
sub rcx, rdi
cmp rcx, rax
jb 0x14000ca2d
test eax, eax
je 0x14000caef
xor ecx, ecx
mov al, byte [r13 + rcx]
add byte [rdi + rcx], al
inc rcx
mov eax, dword [r12]
cmp rcx, rax
jb 0x14000cad9
jmp 0x14000caf1
xor eax, eax
mov r8d, eax
mov edx, 1
mov rcx, rdi
mov r9, qword [rsp + 0x28]
call fcn.140020dcc
mov rsi, rax
mov ebp, 0x40
cmp dword [r12], esi
jne 0x14000cb8d
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, r8
jb 0x14000ca2d
mov edx, 1
mov rcx, rbx
mov r9, qword [rsp + 0x28]
call fcn.140020dcc
cmp dword [r12 + 4], eax
jne 0x14000cb8d
mov edx, esi
add r13, rdx
movsxd rcx, dword [r12 + 8]
mov rbp, qword [rsp + 0x20]
sub rbp, r13
cmp rbp, rcx
jg 0x14000ca2d
mov rbp, r14
sub rbp, r13
cmp rbp, rcx
jl 0x14000ca2d
add rdi, rdx
mov eax, eax
add rbx, rax
add r13, rcx
add r12, 0xc
xor ebp, ebp
cmp r12, qword [rsp + 0x30]
jb 0x14000ca86
jmp 0x14000cb8d
xor ebp, ebp
mov rcx, r15
call fcn.140020db8
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000cc20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea r8, [0x14003da44]
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.14001f0b0
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000cc82
mov ecx, 0x818
call fcn.140021290
test rax, rax
je 0x14000ccb0
mov rsi, rax
mov qword [rax], rdi
mov rcx, rax
add rcx, 8
mov r8d, 0x80c
xor edx, edx
call fcn.140015b80
jmp 0x14000ccba
mov ecx, 2
call fcn.140016378
lea rcx, str.ERROR:_could_not_open_file_in_mar_wopen___n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.140020dcc
mov rcx, rsi
call fcn.14001f1fc
jmp 0x14000ccb8
mov rcx, rdi
call fcn.140020548
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140023af0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret