joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400de408
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404a5b10]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1404a1948]
test eax, eax
je 0x1400de453
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1404a1948]
test eax, eax
jne 0x1400de45c
call fcn.1400af7fc
test eax, eax
je 0x1400de478
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140498008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400de480
xor eax, eax
jmp 0x1400de4e5
test rbx, rbx
jne 0x1400de4a0
lea rcx, str.DestroyPropertySheetPage
call fcn.1400de5fc
mov rbx, rax
test rax, rax
je 0x1400de4b3
mov qword [0x1404a5b10], rax
mov rcx, rbx
call fcn.14025df68
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400de4c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400de4ca
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400de4e3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400de4fc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x1404a5b18]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x1404a1948]
test eax, eax
je 0x1400de54b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1404a1948]
test eax, eax
jne 0x1400de554
call fcn.1400af7fc
test eax, eax
je 0x1400de570
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140498008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400de57a
or rax, 0xffffffffffffffff
jmp 0x1400de5e4
test rbx, rbx
jne 0x1400de59a
lea rcx, str.PropertySheetW
call fcn.1400de5fc
mov rbx, rax
test rax, rax
je 0x1400de5af
mov qword [0x1404a5b18], rax
mov rcx, rbx
call fcn.14025df68
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x1400de5c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400de5c8
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400de5e1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400ff2c4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x1400ff2f6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400ff2f6
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1401e66ac
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ff308
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400ff333
mov r8, rdx
mov rdx, qword [rdi]
call fcn.1400d4f10
jmp 0x1400ff3ab
cmp byte [0x1404a6d68], 0
jne 0x1400ff37a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ff36a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1404a6d60], rax
jmp 0x1400ff371
mov rbx, qword [0x1404a6d60]
mov byte [0x1404a6d68], 1
jmp 0x1400ff381
mov rbx, qword [0x1404a6d60]
test rbx, rbx
je 0x1400ff39f
mov rcx, rbx
call fcn.14025df68
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x1400ff3ab
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14011078c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404a6dd8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1404a1948]
test eax, eax
je 0x1401107d7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1404a1948]
test eax, eax
jne 0x1401107e0
call fcn.1400af7fc
test eax, eax
je 0x1401107fc
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140498008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140110804
xor eax, eax
jmp 0x140110869
test rbx, rbx
jne 0x140110824
lea rcx, str.ImageList_GetImageCount
call fcn.1400af1e0
mov rbx, rax
test rax, rax
je 0x140110837
mov qword [0x1404a6dd8], rax
mov rcx, rbx
call fcn.14025df68
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14011084c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14011084e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140110867
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140115064
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x140115095
call fcn.1400d5b6c
mov rdi, qword [rax + 0x18]
lea r8, [0x140383d68]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x1401150b4
xor eax, eax
jmp 0x140115100
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1401150b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1401150f5
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.14011511c
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1401a2f40
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1401a3110
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1401a3152
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x1401a35dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1401a36ae
test rbx, rbx
je 0x1401a36b4
test r9, r9
je 0x1401a36ba
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401a3697
cmp dword [rsp + 0x48], 3
jne 0x1401a3697
test eax, eax
jne 0x1401a3697
cmp dword [rdi], eax
je 0x1401a3697
mov ecx, dword [rdi]
call fcn.1400a50b4
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401a368b
cmp dword [rsp + 0x48], 3
jne 0x1401a368b
test eax, eax
jne 0x1401a368b
mov eax, 1
jmp 0x1401a3699
mov rcx, qword [rbx]
call fcn.1400a50bc
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.1400b2878
int3
call fcn.1400b2878
int3
call fcn.1400b2878
int3

Function at 0x1401a39e4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401a39f5
xor eax, eax
jmp 0x1401a3a23
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401a3a2c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401a3a3d
xor eax, eax
jmp 0x1401a3a61
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140220948
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404aa708]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1404a1948]
test eax, eax
je 0x140220993
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1404a1948]
test eax, eax
jne 0x14022099c
call fcn.1400af7fc
test eax, eax
je 0x1402209b8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140498008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1402209c0
xor eax, eax
jmp 0x140220a25
test rbx, rbx
jne 0x1402209e0
lea rcx, str.ChooseColorW
call fcn.1400bb06c
mov rbx, rax
test rax, rax
je 0x1402209f3
mov qword [0x1404aa708], rax
mov rcx, rbx
call fcn.14025df68
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140220a08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140220a0a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140220a23
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140239bd8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404aaaa0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1404a1948]
test eax, eax
je 0x140239c23
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1404a1948]
test eax, eax
jne 0x140239c2c
call fcn.1400af7fc
test eax, eax
je 0x140239c48
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140498008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140239c50
xor eax, eax
jmp 0x140239cb5
test rbx, rbx
jne 0x140239c70
lea rcx, str.GetOpenFileNameW
call fcn.1400bb06c
mov rbx, rax
test rax, rax
je 0x140239c83
mov qword [0x1404aaaa0], rax
mov rcx, rbx
call fcn.14025df68
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140239c98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140239c9a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140239cb3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140239ccc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404aaaa8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1404a1948]
test eax, eax
je 0x140239d17
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1404a1948]
test eax, eax
jne 0x140239d20
call fcn.1400af7fc
test eax, eax
je 0x140239d3c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140498008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140239d44
xor eax, eax
jmp 0x140239da9
test rbx, rbx
jne 0x140239d64
lea rcx, str.GetSaveFileNameW
call fcn.1400bb06c
mov rbx, rax
test rax, rax
je 0x140239d77
mov qword [0x1404aaaa8], rax
mov rcx, rbx
call fcn.14025df68
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140239d8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140239d8e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140239da7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14025c90c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1404ab4a0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1404a1948]
test eax, eax
je 0x14025c957
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1404a1948]
test eax, eax
jne 0x14025c960
call fcn.1400af7fc
test eax, eax
je 0x14025c97c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140498008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14025c984
xor eax, eax
jmp 0x14025c9e9
test rbx, rbx
jne 0x14025c9a4
lea rcx, str.PrintDlgW
call fcn.1400bb06c
mov rbx, rax
test rax, rax
je 0x14025c9b7
mov qword [0x1404ab4a0], rax
mov rcx, rbx
call fcn.14025df68
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14025c9cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14025c9ce
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14025c9e7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140263d90
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14025e110
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1402a1a30
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14025e110
sub rsp, rax
lea rcx, [0x1404aeb40]
add rsp, 0x28
jmp fcn.140263bf0
Function at 0x1402dd420
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, gethostbyname
call fcn.14025e110
sub rsp, rax
xor esi, esi
lea edx, [rax - 0x2f]
mov ebx, esi
mov rdi, rcx
call fcn.14029aee0
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.14029ad50
mov r14, rax
test rax, rax
je 0x1402dd4ca
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1402dd4a3
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.14029ade0
mov rcx, rdi
call fcn.14029afe0
mov rbx, rax
test rax, rax
jne 0x1402dd566
mov edx, 1
mov rcx, rdi
call fcn.14029aee0
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.14029ad50
mov r14, rax
test rax, rax
je 0x1402dd554
mov r9d, socket
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1402dd536
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.14029ade0
mov rcx, rdi
call fcn.14029afe0
mov rbx, rax
test rbx, rbx
je 0x1402dd55e
mov rax, rbx
jmp 0x1402dd566
mov rcx, rdi
call fcn.14029afe0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14031ee60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.14025e110
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x14031ee89
lea rax, [0x14031d4d0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140316230
lea rax, [0x14031c690]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140315f70
Function at 0x140325e79
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14032606a
push rbx
mov eax, 0xd0
call fcn.14025e110
sub rsp, rax
mov rax, qword [0x140499908]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.14030c0d0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14030ba70
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1403087b0
mov rcx, r15
call fcn.14030c0d0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.14030ba70
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1403087b0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x140325ee0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14025d560
add rsp, 0xd0
pop rbx
ret
Function at 0x14034cdc0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14034cb94
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14034cb94
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14034cb94
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14034cb94
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14034cb94
cmp dword [rcx + 0x84], 0xe
jbe 0x14034cb94
cmp dword [rcx + 0xf8], esi
je 0x14034cb94
mov ecx, r14d
call fcn.14034ccdc
mov ecx, 2
call fcn.140353fb4
nop
cmp byte [0x1404af380], 0
jne 0x14034cc5e
mov r15d, 1
mov eax, r15d
xchg dword [0x1404af374], eax
test ebx, ebx
jne 0x14034cc07
mov rdi, qword [0x140499908]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1404af378]
cmp rcx, rax
je 0x14034cbfe
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140079ca0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1404af390]
jmp 0x14034cc13
cmp ebx, r15d
jne 0x14034cc19
lea rcx, [0x1404af3a8]
call fcn.14034d4d8
nop
test ebx, ebx
jne 0x14034cc30
lea rdx, [0x1403700c8]
lea rcx, [0x1403700a8]
call fcn.14034ca54
lea rdx, [0x1403700d8]
lea rcx, [0x1403700d0]
call fcn.14034ca54
movzx eax, byte [0x1404af380]
test esi, esi
cmove eax, r15d
mov byte [0x1404af380], al
jmp 0x14034cc5e
mov ecx, 2
call fcn.140354008
test esi, esi
jne 0x14034cc75
mov ecx, r14d
call fcn.14034cc90
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14034cb24

Function at 0x140352e58
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140352e35
call fcn.14033a1cc
mov dword [rax], socket
call fcn.14033a07c
or eax, 0xffffffff
jmp 0x140352e52
sub dword [rcx + 0x10], 1
jns 0x140352e44
add rsp, 0x28
jmp fcn.14035570c
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140352e14