joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400233bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x1400233bc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rdx
mov r12, rcx
call fcn.14002cc14
mov rbx, qword [rax + 0x18]
mov r8d, 0xf1
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r14d, r14d
cmp rax, r14
jne 0x140023402
xor eax, eax
jmp 0x1400234db
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
cmp rax, r14
je 0x1400233fb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
cmp rax, r14
je 0x1400233fb
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000f980
mov r9d, r14d
mov rbp, rax
cmp r14w, word [rbx + 6]
jae 0x140023474
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
add r8, 2
mov dword [rdx], ecx
movzx eax, word [rbx + 6]
add rdx, 4
cmp r9d, eax
jl 0x14002345a
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r12
call fcn.140021bd8
mov rcx, rbp
mov esi, eax
call fcn.14000f9cc
cmp esi, r14d
je 0x1400234d0
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140022400
mov rdx, r13
mov rcx, r12
call fcn.1400224d4
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x14002a114
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x14002a137
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.1400440fc
add rsp, 0x20
pop rbx
ret

Function at 0x14002a140
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002a163
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.1400440fc
add rsp, 0x20
pop rbx
ret
Function at 0x140031514
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor esi, esi
xor ebx, ebx
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
je 0x140031586
call fcn.14002cc14
mov r8d, 0xf0
mov rdx, rdi
mov r13, qword [rax + 0x18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x140031586
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400315d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov edi, 1
test rsi, rsi
je 0x1400315b3
mov r10, qword [r14]
mov r9, r12
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call qword [r10 + 0x40]
mov edi, eax
test rbx, rbx
je 0x1400315b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [rbp + 0x98], 0
je 0x1400315d1
mov rcx, qword [rbp + 0x98]
mov rdx, r12
mov r8, qword [rcx]
call qword [r8 + 0x140]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x14003252c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x1400325a3
call fcn.1400324b8
mov rsi, rax
test rax, rax
jne 0x14003255f
mov eax, edi
jmp 0x1400325b9
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14003255b
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003c764
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.1400115bc
nop
cmp rbx, 0xffffffff80000000
jne 0x14003c7f0
call fcn.14002c1cc
cmp eax, 1
jne 0x14003c7f0
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.140033058
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400021ec
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003c7e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14003c827
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14003c83c
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400115bc
nop
cmp rbx, 0xffffffff80000000
jne 0x14003c8c8
call fcn.14002c1cc
cmp eax, 1
jne 0x14003c8c8
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.140033058
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400021ec
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003c8c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14003c907
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14005f5b8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140067c80
nop
cmp dword [0x140283d58], 1
je 0x14005f564
mov dword [0x140283d54], 1
mov byte [0x140283d50], r12b
test ebx, ebx
jne 0x14005f550
mov rcx, qword [0x140286010]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14005f53d
mov rcx, qword [0x140286008]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14005f4dc
call fcn.140062834
cmp qword [rdi], rax
jne 0x14005f4dc
jmp 0x14005f4c2
cmp rdi, rsi
jb 0x14005f53d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140062834
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140286010]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140286008]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14005f51b
cmp r13, rax
je 0x14005f53b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14005f4c2
lea rdx, [0x1400790d0]
lea rcx, [0x1400790b8]
call fcn.14005f30c
lea rdx, [0x1400790e0]
lea rcx, [0x1400790d8]
call fcn.14005f30c
nop
test r12d, r12d
je 0x14005f573
mov ecx, 8
call fcn.140067b80
test r12d, r12d
jne 0x14005f59e
mov dword [0x140283d58], 1
lea ecx, [r12 + 8]
call fcn.140067b80
mov ecx, r15d
call fcn.14005f2a0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14005f42c

Function at 0x14005f5c4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14005f42c
Function at 0x140060cc3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400a3158]
jne 0x14005cb5a
rol rcx, 0x10
test cx, 0xffff
jne 0x14005cb56
repz ret
ror rcx, 0x10
jmp 0x140060c1c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140283e00]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140283ef8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140060ca1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140283e00]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140060cc3
mov rax, qword [rsp + 0x88]
mov qword [0x140283ef8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140283e98], rax
mov rax, qword [0x140283ef8]
mov qword [0x140283d70], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140283e80], rax
mov dword [0x140283d60], 0xc0000409
mov dword [0x140283d64], 1
mov rax, qword [0x1400a3158]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400a3160]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140283df8], eax
mov ecx, 1
call fcn.14006a328
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400871b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140283df8], 0
jne 0x140060d4a
mov ecx, 1
call fcn.14006a328
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14006b38c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140062834
xor ebx, ebx
mov rdi, rax
cmp qword [0x140284b48], rbx
jne 0x14006b492
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14006b567
lea rdx, [0x1400883b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006b567
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1400883a0]
mov rcx, rsi
mov qword [0x140284b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140088388]
mov rcx, rsi
mov qword [0x140284b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140284b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140284b68], rax
test rax, rax
je 0x14006b489
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140284b60], rax
jmp 0x14006b499
mov rax, qword [0x140284b60]
jmp 0x14006b4a0
mov rax, qword [0x140284b60]
mov r11, qword [0x140284b68]
cmp rax, rdi
je 0x14006b508
cmp r11, rdi
je 0x14006b508
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140284b68]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14006b508
test rax, rax
je 0x14006b508
call rsi
test rax, rax
je 0x14006b502
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14006b502
test byte [rsp + 0x38], 1
jne 0x14006b508
bts ebp, 0x15
jmp 0x14006b546
mov rcx, qword [0x140284b50]
cmp rcx, rdi
je 0x14006b546
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14006b546
call rax
mov rbx, rax
test rax, rax
je 0x14006b546
mov rcx, qword [0x140284b58]
cmp rcx, rdi
je 0x14006b546
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14006b546
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140284b48]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14006b567
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14006b569
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140004f47
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140009028]
jne 0x14000491a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004916
repz ret
ror rcx, 0x10
jmp 0x140004ea0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140009230]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140009328]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140004f25
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140009230]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140004f47
mov rax, qword [rsp + 0x88]
mov qword [0x140009328], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400092c8], rax
mov rax, qword [0x140009328]
mov qword [0x1400091a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400092b0], rax
mov dword [0x140009190], 0xc0000409
mov dword [0x140009194], 1
mov rax, qword [0x140009028]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140009030]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140009228], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140007680]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140009228], 0
jne 0x140004fce
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400012d0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.140013730
test rax, rax
je 0x1400014ff
mov rbx, rax
movzx eax, word [rbp + rax*2 - 2]
cmp eax, 0x5c
je 0x1400014f7
cmp eax, 0x2f
je 0x1400014f7
lea rax, [rbx + 2]
add rax, rax
mov rcx, 0xffffffffffffffff
cmovae rcx, rax
call fcn.140013644
mov rdi, rax
lea r8, [rbx + rbx]
add r8, 4
xor r14d, r14d
mov rcx, rax
xor edx, edx
call fcn.140015c00
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, rbp
call fcn.1400138f0
mov rcx, rdi
call fcn.140013948
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x38]
mov qword [rcx], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001504
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001537
add ebx, ebx
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001537
lea r9, [rsp + 0x2c]
mov dword [r9], 4
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001537
lea r14, [rsp + 0x28]
mov ebp, dword [r14]
mov rcx, rbp
call fcn.140013644
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.140015c00
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, r15
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001537
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001462
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001474
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.1400138e8
lea rdx, [0x14003f9e4]
mov r8d, 0x104
mov rcx, rsi
call fcn.1400138f0
mov r14d, 1
cmp dword [rsp + 0x28], 0
je 0x1400014cf
add rsi, 0x48
xor ebp, ebp
lea rdi, str._.2x
mov rbx, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [r15 + rbp]
mov rcx, rsi
mov rdx, rdi
call rbx
add rsi, 4
inc rbp
mov eax, dword [rsp + 0x28]
cmp rbp, rax
jb 0x1400014b2
mov rdi, r15
mov rcx, rdi
call fcn.1400138e8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400246e0
mov eax, r14d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec rbx
jmp 0x140001319
xor r14d, r14d
jmp 0x1400014da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140001537
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140001395
xor r14d, r14d
jmp 0x1400014d2
Function at 0x140001bb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 2
mov edx, 0x4000000
call fcn.14000f320
test rax, rax
je 0x140001cdd
mov r12, rax
mov rax, qword [rbx + 8]
lea r15, [rsp + 0x28]
mov qword [r15], rax
xorps xmm0, xmm0
movups xmmword [r15 + 8], xmm0
mov rax, qword [rbx + 0x10]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], 0
mov rax, qword [rbx + 0x20]
mov qword [r15 + 0x28], rax
xor esi, esi
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x140001ce4
cmp esi, eax
jge 0x140001c6d
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x38]
jne 0x140001c6d
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbx]
mov r9, qword [rbx + 8]
mov dword [rsp + 0x20], eax
mov rdx, rdi
mov r8d, esi
call fcn.14000d3c0
test eax, eax
jle 0x140001cf2
add esi, eax
mov eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rcx, r12
mov rdx, r15
call fcn.14000e350
mov ebp, eax
mov r8, qword [rsp + 0x48]
cmp r8, qword [rbx + 0x20]
jne 0x140001ca9
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, r14
call fcn.14002176c
cmp rax, qword [rsp + 0x48]
jne 0x140001ceb
mov qword [rsp + 0x48], 0
xor r8d, r8d
test ebp, ebp
je 0x140001c1f
mov esi, 0x27
cmp ebp, 1
jne 0x140001cf7
mov rcx, qword [rbx + 0x10]
mov edx, 1
mov r9, r14
call fcn.14002176c
xor ecx, ecx
cmp rax, qword [rsp + 0x48]
mov esi, 0x46
cmove esi, ecx
jmp 0x140001cf7
mov esi, 0x27
jmp 0x140001cff
mov esi, 0x28
jmp 0x140001cf7
mov esi, 0x46
jmp 0x140001cf7
mov esi, 6
mov rcx, r12
call fcn.14000f420
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400246e0
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140004020
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov dx, 0x2f
call fcn.140015f68
test rax, rax
je 0x140004055
mov rsi, rax
mov word [rax], 0
mov rcx, rdi
call fcn.140004020
mov ebx, eax
test eax, eax
je 0x140004061
mov word [rsi], 0x2f
jmp 0x140004057
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
cmp word [rdi], 0
je 0x14000404e
mov rcx, rdi
call fcn.14001fb70
test eax, eax
jns 0x14000404e
call fcn.14001b454
cmp dword [rax], 0x11
je 0x14000404e
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400040c5
call fcn.14001b454
mov r9d, dword [rax]
lea rcx, [0x140049e88]
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
mov r8, rdi
call fcn.1400116a0
mov ebx, 7
jmp 0x14000404e
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400040a0
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400040a0
Function at 0x140005bd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rsi, r8
mov ebp, edx
mov rdi, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.MOZ_LAUNCHED_CHILD1
call fcn.14001e974
mov rcx, rdi
call fcn.14001f1e4
test eax, eax
je 0x140005c4a
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005d00
lea rcx, [0x140049e88]
lea rdx, str.Warning:_chdir_failed
call fcn.1400116a0
test bl, bl
je 0x140005c6d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400246e0
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea r9, [rsp + 0x28]
mov edx, ebp
mov r8, rsi
call fcn.140035290
test eax, eax
je 0x140005c4e
mov rsi, qword [rsp + 0x28]
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbp
mov edi, eax
call rbp
sub eax, edi
cmp eax, 0x270f
ja 0x140005cf0
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [sym.imp.USER32.dll_WaitForInputIdle]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0x2710
sub ebx, eax
xor ecx, ecx
call r14
mov rcx, rsi
mov edx, ebx
call r15
cmp eax, 0xffffffff
jne 0x140005cf0
call r12
cmp eax, 0x5bf
jne 0x140005cf0
mov ecx, 0xa
call r13
call rbp
sub eax, edi
cmp eax, 0x2710
jb 0x140005cba
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005c4e
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x140005c37
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x140005c37