joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400092d0
Capabilities:
Create device object
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rdi, rcx
call fcn.14000724c
test al, al
jne 0x140009009
mov ebx, 0xc0000424
jmp 0x1400090b4
and qword [rbp + 0x77], 0
lea rax, [0x14000f9e0]
mov qword [rbp - 0x51], rax
lea r8, [rbp - 0x59]
lea rax, [0x14000fa00]
mov dword [rbp - 0x59], 0x20001e
mov qword [rbp - 0x41], rax
mov r15d, 0x100
lea rax, [0x14000fa40]
mov dword [rbp - 0x49], 0x180016
mov qword [rbp - 0x31], rax
mov r9d, 0x22
lea rax, [rbp + 0x77]
mov dword [rbp - 0x39], 0x160014
mov qword [rsp + 0x30], rax
xor edx, edx
mov byte [rsp + 0x28], 0
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
jns 0x140009088
mov edx, eax
lea rcx, [0x14000fa60]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400090b4
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x1400090be
mov edx, eax
lea rcx, [0x14000fa90]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
call fcn.140007178
jmp 0x1400091f7
cmp byte [section..data], 0
jne 0x1400091aa
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
lea rdx, [0x140012080]
and qword [rbp + 0x1f], 0
mov ecx, 3
and qword [rbp + 0x3f], 0
and qword [rbp - 0x11], 0
mov qword [rbp + 7], rax
lea rax, [0x14000a890]
mov qword [rbp + 0x17], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rbp + 0x27], rax
lea rax, [0x14000a900]
mov qword [rbp + 0x37], rax
lea rax, [0x14000fa20]
mov qword [rbp - 0x19], rax
lea rax, [rbp + 7]
mov dword [rbp + 0xf], ecx
mov dword [rbp + 0x2f], ecx
lea rcx, [rbp - 0x29]
mov qword [rbp - 9], rax
mov dword [rbp - 0x29], 0x20100
mov dword [rbp - 0x21], 0x160014
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
test eax, eax
jns 0x14000915d
mov edx, eax
lea rcx, [0x14000fad0]
call sub.ntoskrnl.exe_DbgPrint
and word [0x140012006], 0
mov rax, qword [0x140012088]
lea rdx, [rbp - 0x39]
and qword [rsp + 0x28], 0
lea rcx, [0x14000bfa0]
add rax, 0x3140
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallbackEx]
mov ebx, eax
test eax, eax
jns 0x1400091bb
mov edx, eax
lea rcx, [0x14000fb10]
call sub.ntoskrnl.exe_DbgPrint
xor ebx, ebx
mov byte [0x140012005], bl
jmp 0x1400091bb
mov rax, qword [rbp + 0x77]
or dword [rax + 0x30], 4
mov rax, qword [rbp + 0x77]
btr dword [rax + 0x30], 7
lea rax, [0x140009220]
mov qword [rdi + 0x68], rax
lea rax, [0x1400075a0]
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x70], rax
lea rax, [0x1400075c0]
mov qword [rdi + 0xe0], rax
call fcn.140001190
lea rcx, [0x14000fb50]
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
jmp 0x140008fd4
Function at 0x14000a1c8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, edx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ecx, dword [0x140012048]
sub ecx, 0x2800
je 0x14000a238
sub ecx, 0x15a
je 0x14000a238
sub ecx, 0xedf
je 0x14000a238
sub ecx, 0x29e
je 0x14000a238
sub ecx, 0x4d4
je 0x14000a238
sub ecx, 0x343
je 0x14000a238
sub ecx, 0x275
je 0x14000a238
sub ecx, 0x257
je 0x14000a231
cmp ecx, 1
je 0x14000a231
mov ebx, 0x4b8
jmp 0x14000a23d
mov ebx, 0x360
jmp 0x14000a23d
mov ebx, 0x358
test eax, eax
js 0x14000a281
lea rdx, [rsp + 0x48]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14000a274
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbx + rax]
mov rax, qword [rsp + 0x40]
mov qword [rbx + rax], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000a28c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r14, r8
mov dword [rax + 0x18], r15d
mov rbp, rdx
mov ebx, r15d
test r8, r8
je 0x14000a3ab
test rdx, rdx
je 0x14000a3ab
xor edx, edx
lea r9, [rax + 0x18]
xor r8d, r8d
lea edi, [rdx + 5]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov r12d, 0x6864694e
jmp 0x14000a347
test rbx, rbx
je 0x14000a2f1
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x140012050]
mov edx, dword [rsp + 0x60]
test rax, rax
je 0x14000a31d
cmp dword [0x140012048], 0x4a61
jb 0x14000a31d
mov r8d, r12d
mov ecx, 0x100
call qword [0x1400102d0]
jmp 0x14000a32b
mov r8d, r12d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000a350
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov esi, eax
cmp eax, 0xc0000004
je 0x14000a2e0
test esi, esi
js 0x14000a39f
test rbx, rbx
je 0x14000a3a4
mov rdi, rbx
cmp dword [rbx], r15d
je 0x14000a387
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x14000a37d
cmp word [rdi + 0x38], r15w
jbe 0x14000a37d
mov rdx, rbp
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14000a397
mov eax, dword [rdi]
add rdi, rax
cmp dword [rdi], r15d
jne 0x14000a361
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x14000a3b0
mov eax, dword [rdi + 0x50]
mov dword [r14], eax
jmp 0x14000a387
test rbx, rbx
jne 0x14000a387
mov esi, 0xc000009a
jmp 0x14000a393
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000a5e8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, dword [0x140012048]
mov r14, rcx
mov ebp, edx
mov r8d, eax
mov edx, 0x257
mov ecx, 0x15a
mov edi, 0x4d4
mov esi, 0x343
mov r9d, 0xedf
lea r10d, [rdx + 0x47]
lea r11d, [rdx + 0x1e]
sub r8d, 0x2800
je 0x14000a66a
sub r8d, ecx
je 0x14000a66a
sub r8d, r9d
je 0x14000a66a
sub r8d, r10d
je 0x14000a663
sub r8d, edi
je 0x14000a663
sub r8d, esi
je 0x14000a663
sub r8d, r11d
je 0x14000a663
sub r8d, edx
je 0x14000a66a
cmp r8d, 1
je 0x14000a66a
mov ebx, 0x448
jmp 0x14000a66f
mov ebx, 0x2e8
jmp 0x14000a66f
mov ebx, 0x2f0
sub eax, 0x2800
je 0x14000a6a8
sub eax, ecx
je 0x14000a6a8
sub eax, r9d
je 0x14000a6a8
sub eax, r10d
je 0x14000a6a8
sub eax, edi
je 0x14000a6a8
sub eax, esi
je 0x14000a6a8
sub eax, r11d
je 0x14000a6a8
sub eax, edx
je 0x14000a6a1
cmp eax, 1
je 0x14000a6a1
mov esi, 0x438
jmp 0x14000a6ad
mov esi, 0x2e0
jmp 0x14000a6ad
mov esi, 0x2d8
mov rcx, rbp
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14000a71c
add rsi, qword [rsp + 0x50]
xor edx, edx
add rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov r8d, ebp
mov rdx, rbx
mov rcx, r14
call fcn.140009e08
test al, al
jne 0x14000a6ef
mov edi, 0xc0000001
jmp 0x14000a704
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rdx], rax
mov qword [rax + 8], rdx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14000ab70
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [rdx]
mov rdi, rdx
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000abd2
call fcn.14000b068
mov edx, eax
mov al, byte [rdi + 4]
add rdx, qword [rsp + 0x38]
shl al, 4
or al, byte [rdi + 5]
mov byte [rdx], al
mov al, byte [rdx + 2]
mov cl, al
xor cl, byte [rdi + 4]
and cl, 7
xor cl, al
mov byte [rdx + 2], cl
and cl, 0xf
mov al, byte [rdi + 5]
shl al, 4
or al, cl
mov byte [rdx + 2], al
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000abe0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
call fcn.14000a484
mov r14, rax
test rax, rax
jne 0x14000ac0c
mov eax, 0xc0000001
jmp 0x14000ad0a
mov eax, dword [0x140012048]
mov r8d, 0x257
mov ecx, eax
mov edx, 0x15a
mov edi, 0x4d4
mov esi, 0x343
mov r9d, 0xedf
lea r10d, [r8 + 0x47]
lea r11d, [r8 + 0x1e]
sub ecx, 0x2800
je 0x14000ac72
sub ecx, edx
je 0x14000ac72
sub ecx, r9d
je 0x14000ac72
sub ecx, r10d
je 0x14000ac6b
sub ecx, edi
je 0x14000ac6b
sub ecx, esi
je 0x14000ac6b
sub ecx, r11d
je 0x14000ac6b
sub ecx, r8d
je 0x14000ac72
cmp ecx, 1
je 0x14000ac72
mov ebx, 0x448
jmp 0x14000ac77
mov ebx, 0x2e8
jmp 0x14000ac77
mov ebx, 0x2f0
sub eax, 0x2800
je 0x14000acb1
sub eax, edx
je 0x14000acb1
sub eax, r9d
je 0x14000acb1
sub eax, r10d
je 0x14000acb1
sub eax, edi
je 0x14000acb1
sub eax, esi
je 0x14000acb1
sub eax, r11d
je 0x14000acb1
sub eax, r8d
je 0x14000acaa
cmp eax, 1
je 0x14000acaa
mov edi, 0x438
jmp 0x14000acb6
mov edi, 0x2e0
jmp 0x14000acb6
mov edi, 0x2d8
lea rdx, [rsp + 0x40]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x14000ad0a
add rdi, qword [rsp + 0x40]
xor edx, edx
add rbx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rax, qword [rbx]
xor edx, edx
mov qword [r14 + 8], rbx
mov rcx, rdi
mov qword [r14], rax
mov qword [rax + 8], r14
mov qword [rbx], r14
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000ad20
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
and qword [rsp + 0x58], 0
mov eax, dword [0x140012048]
mov r8d, eax
mov ecx, 0x2800
sub r8d, ecx
je 0x14000ada5
sub r8d, 0x15a
je 0x14000ada5
sub r8d, 0xedf
je 0x14000ada5
sub r8d, 0x29e
je 0x14000ada5
sub r8d, 0x4d4
je 0x14000ada5
sub r8d, 0x343
je 0x14000ada5
sub r8d, 0x275
je 0x14000ada5
sub r8d, 0x257
je 0x14000ad9e
cmp r8d, 1
je 0x14000ad9e
mov edi, 0x438
jmp 0x14000adaa
mov edi, 0x2e0
jmp 0x14000adaa
mov edi, 0x2d8
sub eax, ecx
je 0x14000adf2
sub eax, 0x15a
je 0x14000adeb
sub eax, 0xedf
je 0x14000adeb
sub eax, 0x29e
je 0x14000adeb
sub eax, 0x4d4
je 0x14000adeb
sub eax, 0x343
je 0x14000adeb
sub eax, 0x275
je 0x14000adeb
sub eax, 0x257
je 0x14000adeb
cmp eax, 1
je 0x14000adeb
mov esi, 0x5e0
jmp 0x14000adf7
mov esi, 0x488
jmp 0x14000adf7
mov esi, 0x480
mov ecx, dword [rdx]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x14000ae47
cmp eax, 0xc0000225
jne 0x14000aeab
and dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
lea rdx, [0x14000fc00]
mov rcx, r15
call fcn.14000a28c
test eax, eax
js 0x14000aeab
mov ecx, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000aeab
add rdi, qword [rsp + 0x58]
mov qword [rsp + 0x50], rdi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rcx, qword [rsp + 0x58]
lea rcx, [rsi + rcx]
mov rax, qword [r14 + 8]
mov rdx, qword [rcx + 8]
cmp qword [rdx], rcx
je 0x14000ae79
mov ecx, 3
int 0x29
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rcx + 8], rax
jmp 0x14000ae93
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000aec0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
and qword [rsp + 0x68], 0
mov r8d, edx
lea rdx, [rsp + 0x20]
call fcn.14000a52c
cmp dword [rsp + 0x24], 0
jne 0x14000aef4
mov eax, 0xc0000225
jmp 0x14000b059
mov eax, dword [0x140012048]
mov ecx, eax
mov edx, 0x2800
sub ecx, edx
je 0x14000af50
sub ecx, 0x15a
je 0x14000af50
sub ecx, 0xedf
je 0x14000af50
sub ecx, 0x29e
je 0x14000af50
sub ecx, 0x4d4
je 0x14000af50
sub ecx, 0x343
je 0x14000af50
sub ecx, 0x275
je 0x14000af50
sub ecx, 0x257
je 0x14000af49
cmp ecx, 1
je 0x14000af49
mov edi, 0x438
jmp 0x14000af55
mov edi, 0x2e0
jmp 0x14000af55
mov edi, 0x2d8
sub eax, edx
je 0x14000af9d
sub eax, 0x15a
je 0x14000af96
sub eax, 0xedf
je 0x14000af96
sub eax, 0x29e
je 0x14000af96
sub eax, 0x4d4
je 0x14000af96
sub eax, 0x343
je 0x14000af96
sub eax, 0x275
je 0x14000af96
sub eax, 0x257
je 0x14000af96
cmp eax, 1
je 0x14000af96
mov esi, 0x5e0
jmp 0x14000afa2
mov esi, 0x488
jmp 0x14000afa2
mov esi, 0x480
mov ecx, dword [rsp + 0x20]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x14000aff4
cmp eax, 0xc0000225
jne 0x14000b059
and dword [rsp + 0x60], 0
lea r8, [rsp + 0x60]
lea rdx, [0x14000fc00]
mov rcx, r14
call fcn.14000a28c
test eax, eax
js 0x14000b059
mov ecx, dword [rsp + 0x60]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000b059
add rdi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rcx, qword [rsp + 0x68]
lea rcx, [rsi + rcx]
mov rdx, qword [rcx + 8]
cmp qword [rdx], rcx
je 0x14000b022
mov ecx, 3
int 0x29
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rcx + 8], rax
jmp 0x14000b041
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400010b9
Capabilities:
Get hostname

Disassembly:
jmp 0x1400c3ac0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x1400c3afb
mov edx, 0x2e
mov rcx, rdi
call fcn.140001550
test rax, rax
je 0x1400c3af9
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001221
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
jmp 0x1400c6190
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14021cbc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400c61dc
mov eax, 0x1b
jmp 0x1400c62af
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400c6220
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x1400c62af
mov rcx, rbp
call fcn.1400031f7
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x1400c628b
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c629b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400c62ad
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000447b
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400017bc
Capabilities:
Parse pe header

Disassembly:
jmp 0x14018f494
xor r8d, r8d
xor edx, edx
jmp 0x14018f178
Function at 0x1400017ee
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
jmp 0x1400c7680
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14021cbc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400c7703
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400c7725
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000447b
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.1400031f7
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x1400c7784
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c7794
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400c77a6
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1400c7708
Function at 0x140001d4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14004c6c0
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x48
mov rax, qword [rcx]
lea rbp, [rcx + 0x18]
mov r12, qword [rbp]
mov rdi, rdx
mov r15, r8
mov r10, rcx
mov edx, dword [rax + 8]
and edx, 0xa
cmp edx, 0xa
jne 0x14004c6fe
add r12, 0x348
jmp 0x14004c705
add r12, 0x2d8
cmp edx, 0xa
mov eax, 0x5f8
mov ecx, 0x540
mov esi, 0
cmovne eax, ecx
mov qword [r9], rsi
mov bl, 1
add rax, rdi
je 0x14004c8b0
cmp byte [rax + 0x6c], sil
je 0x14004c8b0
cmp qword [rdi + 0xca0], rsi
je 0x14004c8b0
mov rax, qword [rdi + 0xf8]
mov qword [rsp + 0x88], r13
test rax, rax
je 0x14004c760
test byte [rax + 4], 0x10
lea r13, [rax + 0x118]
jne 0x14004c767
lea r13, [rdi + 0xca8]
cmp qword [rdi + 0x6c0], rsi
jbe 0x14004c85f
mov qword [rsp + 0x40], r14
mov r14, rsi
nop dword [rax]
mov rbx, qword [rdi + 0xca0]
add rbx, r14
cmp qword [rbx + 0x18], 0
je 0x14004c839
mov rdx, qword [rbx]
mov rcx, qword [r15]
call fcn.140007c11
test eax, eax
je 0x14004c839
mov rcx, qword [rbp]
mov rdx, qword [rbx + 8]
cmp byte [rcx + 0x3c0], 0
jne 0x14004c7c0
test rdx, rdx
je 0x14004c7d5
jmp 0x14004c839
test rdx, rdx
je 0x14004c839
mov rcx, qword [rcx + 0x98]
call fcn.140007c11
test eax, eax
je 0x14004c839
mov rcx, qword [rbp]
mov eax, dword [rbx + 0x38]
cmp byte [rcx + 0x3c1], 0
jne 0x14004c7ec
cmp eax, 0xffffffff
je 0x14004c7f9
jmp 0x14004c839
cmp eax, 0xffffffff
je 0x14004c839
cmp dword [rcx + 0x7d0], eax
jne 0x14004c839
mov eax, dword [rbx + 0x34]
cmp dword [r15 + 0x1c], eax
jne 0x14004c839
mov eax, dword [rbx + 0x3c]
cmp dword [r15 + 0x20], eax
jne 0x14004c839
mov rcx, qword [rcx + 0x3e0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rcx]
call fcn.140007c11
test eax, eax
je 0x14004c839
lea r8, [rbx + 0x40]
mov rdx, r12
mov rcx, rdi
call fcn.14004ddd0
test al, al
jne 0x14004c8c0
inc rsi
add r14, 0xb0
cmp rsi, qword [rdi + 0x6c0]
jb 0x14004c780
mov bl, 1
mov r10, qword [rsp + 0x80]
mov r14, qword [rsp + 0x40]
mov rax, qword [r10 + 0x18]
lea r9, str.Found
mov ecx, dword [r15 + 0x1c]
lea r8, str._s_cached_session_ID_for__s:___s:_d
mov dword [rsp + 0x30], ecx
test bl, bl
mov rcx, qword [r15]
mov rdx, qword [rax + 0x3e0]
lea rax, [0x1401cfcd0]
mov qword [rsp + 0x28], rcx
cmovne r9, rax
mov rcx, qword [rdx]
mov rdx, r10
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.140006dc0
mov r13, qword [rsp + 0x88]
movzx eax, bl
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
inc dword [r13]
mov eax, dword [r13]
mov rcx, qword [rsp + 0x98]
mov dword [rbx + 0x30], eax
mov rax, qword [rbx + 0x18]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14004c8ee
mov rax, qword [rbx + 0x20]
mov qword [rcx], rax
xor bl, bl
jmp 0x14004c852
Function at 0x140001e51
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400658e0
push rbx
sub rsp, 0x30
mov eax, dword [0x14021f9f4]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140065948
mov r9d, 2
mov dword [rsp + 0x20], 3
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140006acd
test al, al
je 0x14006593c
mov dword [0x14021f9f4], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x14021f9f4], 1
jmp 0x14006594d
cmp eax, 2
je 0x14006599f
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14006597e
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x14006599f
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x140002081
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401aeed0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, eax
test eax, eax
je 0x1401aef18
test rdi, rdi
je 0x1401aef07
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.14000232e
cmp eax, 1
je 0x1401aef18
mov eax, 4
jmp 0x1401aef5d
call fcn.1400074af
cmp eax, 2
jne 0x1401aef54
call fcn.140002405
test al, al
je 0x1401aef54
call fcn.1400051a5
test al, al
jne 0x1401aef4a
bts esi, 0x15
xor ecx, ecx
mov rdx, rdi
mov r8, rbp
mov r9d, esi
call fcn.14000751d
jmp 0x1401aef5d
call fcn.1400071e9
mov rcx, rax
jmp 0x1401aef3a
neg ebx
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret