joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010de0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140010e7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140010e71
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140010e1d
mov ebx, 0x80070005
jmp 0x140010e7f
test al, 0x10
je 0x140010e28
mov ebx, 0x8000ffff
jmp 0x140010e7f
test al, 1
jne 0x140010e34
test al, 2
jne 0x140010e34
test al, 4
je 0x140010e7f
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140010e5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010e7f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140010e7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140010e8c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [rax - 0x20], 0
and qword [rax - 0x28], 0
mov r14, rcx
mov r13, rdx
mov ebp, 0x104
lea rcx, [rax - 0x20]
mov rdx, rbp
mov rsi, r9
mov r12, r8
or rdi, 0xffffffffffffffff
call fcn.140010234
mov ebx, eax
test eax, eax
js 0x140010fc6
mov rdx, qword [rsp + 0x48]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebp, ebp
cmp rdi, 0xffffffffffffffff
jne 0x140010f89
mov r8, qword [rsp + 0x48]
lea rdx, str._s_S_05d._S
lea rcx, [rsp + 0x40]
mov r9, r14
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], ebp
call fcn.1400107bc
mov ebx, eax
test eax, eax
js 0x140010fc6
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x40]
lea eax, [rdi + 2]
mov r8d, eax
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140010f7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070050
jne 0x140010f77
xor ebx, ebx
jmp 0x140010f7b
test ebx, ebx
js 0x140010fb7
inc ebp
cmp ebp, 0x3e8
jl 0x140010eed
test r12, r12
je 0x140010fa6
mov rdx, qword [rsp + 0x40]
mov r9d, 0xfde9
xor r8d, r8d
mov rcx, r12
call fcn.140010468
mov ebx, eax
test rsi, rsi
je 0x140010fae
mov qword [rsi], rdi
test ebx, ebx
js 0x140010fb7
test rsi, rsi
jne 0x140010fc6
cmp rdi, 0xffffffffffffffff
je 0x140010fc6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140010fd5
call fcn.140010338
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140010fe4
call fcn.140010338
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140011008
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x270
mov rax, qword [0x140027028]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x40], 0
mov r14, rdx
mov r13, rcx
lea rdx, [rsp + 0x50]
mov ecx, 0x104
mov rbp, r9
mov r12, r8
or rdi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140011073
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001114a
jmp 0x140011077
mov ebx, dword [rsp + 0x40]
xor esi, esi
cmp rdi, 0xffffffffffffffff
jne 0x140011115
lea r8, [rsp + 0x50]
lea rdx, str._s_s_05d._s
lea rcx, [rsp + 0x40]
mov r9, r13
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], esi
call fcn.140010798
mov ebx, eax
test eax, eax
js 0x14001114a
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x40]
lea eax, [rdi + 2]
mov r8d, eax
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011107
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070050
jne 0x140011103
xor ebx, ebx
jmp 0x140011107
test ebx, ebx
js 0x14001113b
inc esi
cmp esi, 0x3e8
jl 0x140011079
test rbp, rbp
je 0x14001111e
mov qword [rbp], rdi
test r12, r12
je 0x140011132
mov rax, qword [rsp + 0x40]
and qword [rsp + 0x40], 0
mov qword [r12], rax
test ebx, ebx
js 0x14001113b
test rbp, rbp
jne 0x14001114a
cmp rdi, 0xffffffffffffffff
je 0x14001114a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140011159
call fcn.140010338
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400143fc
add rsp, 0x270
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140011b8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov r14, r9
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
mov r11d, eax
or r10d, 0xffffffff
mov r9, r15
add r11d, r11d
lea rdi, [0x140028510]
cmp dword [0x140028910], ebx
jne 0x140011c18
mov dword [0x140028910], 1
mov ecx, ebx
mov r8, rdi
mov eax, ecx
mov edx, 8
test al, 1
je 0x140011bff
shr eax, 1
xor eax, 0xedb88320
jmp 0x140011c01
shr eax, 1
dec edx
cmp edx, ebx
jg 0x140011bf2
inc ecx
mov dword [r8], eax
add r8, 4
cmp ecx, 0xff
jle 0x140011beb
cmp r11d, ebx
jbe 0x140011c43
mov edx, r11d
movzx ecx, byte [r9]
mov eax, r10d
inc r9
xor rcx, rax
movzx eax, cl
mov ecx, r10d
mov r10d, dword [rdi + rax*4]
shr ecx, 8
xor r10d, ecx
sub rdx, 1
jne 0x140011c20
xor edx, edx
not r10d
mov r12d, ebx
mov eax, r10d
div dword [r13 + 0x18]
mov edi, edx
cmp dword [r13 + 0x18], ebx
jbe 0x140011c8e
mov rbp, qword [r13 + 0x10]
mov eax, edi
lea rsi, [rax + rax*2]
mov rcx, qword [rbp + rsi*8 + 8]
cmp dword [rsp + 0x60], ebx
je 0x140011cb2
cmp rcx, rbx
je 0x140011c81
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebx
je 0x140011cdb
cmp qword [rbp + rsi*8 + 8], rbx
jne 0x140011cc4
cmp dword [rbp + rsi*8], ebx
jne 0x140011cc4
mov ebx, 1
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp rcx, rbx
je 0x140011cdb
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebx
je 0x140011cdb
inc edi
cmp edi, dword [r13 + 0x18]
jb 0x140011cd0
sub edi, dword [r13 + 0x18]
inc r12d
cmp r12d, dword [r13 + 0x18]
jb 0x140011c5a
jmp 0x140011c8e
mov dword [r14], edi
jmp 0x140011c93
Function at 0x14001243c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x270
mov rax, qword [0x140027028]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x40], 0
mov rdi, rcx
mov ebp, 0x80070000
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x14001252b
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001253e
mov rcx, qword [rsp + 0x40]
call fcn.14001243c
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001253e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001253e
jmp 0x140012533
cmp ebx, 0x80070103
je 0x14001253c
test ebx, ebx
jne 0x14001253e
jmp 0x14001246e
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001254e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400143fc
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140012578
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140027028]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x20]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.140014638
cmp eax, 0x50
jne 0x1400125bc
mov eax, 0x8007007a
jmp 0x1400125fe
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r11d, eax
cmp eax, edi
jne 0x14001261f
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.140015214
cmp rax, rdi
je 0x1400125f0
mov word [rax], di
cmp di, word [rax + 2]
je 0x1400125d3
cmp word [rsp + 0x20], di
je 0x1400125fc
cmp rax, rdi
jne 0x1400125be
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400143fc
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
cmp eax, 2
je 0x14001263a
cmp eax, 3
je 0x14001263a
movzx eax, ax
or eax, 0x80070000
cmp r11d, edi
cmovle eax, r11d
jmp 0x14001263c
mov eax, edi
cmp eax, 1
jne 0x1400125fe
jmp 0x1400125be
Function at 0x140012648
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov r9d, 0x2001f
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x140012684
lea ebx, [rax - 1]
jmp 0x1400126d1
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400126d1
mov rcx, qword [rsp + 0x50]
call fcn.14001243c
mov ebx, eax
test eax, eax
js 0x1400126d1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x50], 0
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400126e1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140012dbc
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x18], r8
push rdi
sub rsp, 0x50
lea rax, [r11 + 0x18]
xor ebx, ebx
mov r8d, edx
and qword [r11 - 0x10], rbx
and dword [rsp + 0x40], ebx
mov qword [r11 - 0x28], rax
and dword [rsp + 0x28], ebx
lea rax, [r11 - 0x10]
mov ebp, r9d
mov rdx, rcx
xor r9d, r9d
mov ecx, 0x900
mov qword [r11 - 0x38], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, eax
test eax, eax
jne 0x140012e2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012ebb
test esi, esi
je 0x140012e7a
mov rcx, qword [0x140027008]
and qword [rsp + 0x20], 0
mov r8d, esi
mov edx, edi
lea r9, [rsp + 0x40]
sub r8d, edi
add rdx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140012e72
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012ebb
add edi, dword [rsp + 0x40]
cmp edi, esi
jb 0x140012e31
test ebp, ebp
je 0x140012ebb
mov rdx, qword [0x140027018]
mov rcx, qword [0x140027008]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140012ebb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140012ecb
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140012ee4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov ebp, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rax - 0x18]
xor edi, edi
and dword [rax + 0x20], edi
call fcn.14001066c
mov ebx, eax
test eax, eax
js 0x140012fb9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test eax, eax
je 0x140012f78
mov rcx, qword [0x140027008]
and qword [rsp + 0x20], 0
mov r8d, esi
mov edx, edi
lea r9, [rsp + 0x68]
sub r8d, edi
add rdx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140012f70
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012fb9
add edi, dword [rsp + 0x68]
cmp edi, esi
jb 0x140012f2f
test ebp, ebp
je 0x140012fb9
mov rdx, qword [0x140027018]
mov rcx, qword [0x140027008]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140012fb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140012fc8
call fcn.140010338
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140013174
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x140027028]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor ebx, ebx
cmp qword [0x140027008], 0xffffffffffffffff
mov r8d, 0x104
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebx
lea rsi, str.unknown
je 0x1400132f1
cmp qword [0x140028920], rbx
je 0x1400132f1
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x208
cmp eax, ebx
jne 0x1400131f4
lea rcx, [rsp + 0x50]
mov r8, rdi
xor edx, edx
call fcn.140014560
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x50]
call fcn.140010c48
cmp eax, ebx
jge 0x140013214
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, ebx
jne 0x14001323d
lea rcx, [rsp + 0x260]
mov r8, rdi
xor edx, edx
call fcn.140014560
xor ecx, ecx
call fcn.1400140c8
mov edi, 1
lea rdx, str._Logging_started:__S_
mov r8, rax
mov ecx, edi
call fcn.140013150
mov r11d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x44]
movzx ecx, r11w
movzx eax, r9w
lea rdx, [rsp + 0x260]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ecx
shr r11d, 0x10
mov dword [rsp + 0x28], r11d
lea r8, [rsp + 0x50]
lea rdx, str.Executable:__S_v_d._d._d._d_r_nComputer__:__S
mov ecx, edi
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.140013150
mov r11d, dword [0x140027010]
cmp r11d, ebx
je 0x1400132d7
sub r11d, edi
je 0x1400132ce
sub r11d, edi
je 0x1400132c5
cmp r11d, edi
jne 0x1400132de
lea rsi, str.debug
jmp 0x1400132de
lea rsi, str.verbose
jmp 0x1400132de
lea rsi, str.standard
jmp 0x1400132de
lea rsi, str.none
lea rdx, str.____logging_level:__s____
mov r8, rsi
mov ecx, edi
call fcn.140013150
jmp 0x1400132f6
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400143fc
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140013d80
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x10058
call fcn.14001f7f4
sub rsp, rax
mov rax, qword [0x140027028]
xor rax, rsp
mov qword [rsp + 0x10040], rax
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
xor ebx, ebx
mov r12, r9
mov rbp, r8
mov edi, edx
mov rsi, rcx
mov r14d, 0x80070000
cmp qword [0x140028928], rbx
jne 0x140013e03
mov eax, dword [0x140028930]
lea r9d, [rbx + 1]
lea rcx, [0x140028928]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140013e03
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140013ec8
mov rcx, qword [0x140028928]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140013e47
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140013ec8
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x10000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140013e7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140013ec8
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test r8d, r8d
je 0x140013e9e
lea rdx, [rsp + 0x40]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
jmp 0x140013e2a
xor ebx, ebx
mov r9, r12
mov r8, rbp
and dword [rsp + 0x20], ebx
lea edx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x140013ec8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140013ed8
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, ebx
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.1400143fc
add rsp, 0x10058
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140013fa4
Capabilities:
Read http header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov rdi, rdx
xor ebx, ebx
and qword [r11 - 0x10], rbx
lea r9, [r11 + 0x20]
xor r8d, r8d
mov edx, 0x20000005
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140013ff7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140013ffe
mov ecx, dword [rsp + 0x58]
mov qword [rdi], rcx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001400c
Capabilities:
Read http header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
xor eax, eax
mov rdi, rdx
lea r9, [r11 - 0x18]
and qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x18]
xor r8d, r8d
mov edx, 0x4000000b
xor ebx, ebx
mov dword [rsp + 0x60], 0x10
mov qword [r11 - 0x28], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140014069
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001408f
lea rcx, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x14001408f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14001437c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov r11d, dword [r8]
mov rbx, rdx
mov r9, rcx
and r11d, 0xfffffff8
test byte [r8], 4
mov r10, rcx
je 0x1400143aa
mov eax, dword [r8 + 8]
movsxd r10, dword [r8 + 4]
neg eax
add r10, rcx
movsxd rcx, eax
and r10, rcx
movsxd rax, r11d
mov rdx, qword [rax + r10]
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax + 8]
add rcx, qword [rbx + 8]
test byte [rcx + 3], 0xf
je 0x1400143ce
movzx eax, byte [rcx + 3]
and eax, 0xfffffff0
cdqe
add r9, rax
xor r9, rdx
mov rcx, r9
add rsp, 0x20
pop rbx
jmp fcn.1400143fc
Function at 0x1400155e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001b1dc
nop
cmp dword [0x1400289b0], 1
je 0x140015590
mov dword [0x1400289ac], 1
mov byte [0x1400289a8], r12b
test ebx, ebx
jne 0x14001557c
mov rcx, qword [0x14002a8d8]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140015569
mov rcx, qword [0x14002a8d0]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140015508
call fcn.1400165f8
cmp qword [rdi], rax
jne 0x140015508
jmp 0x1400154ee
cmp rdi, rsi
jb 0x140015569
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400165f8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14002a8d8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14002a8d0]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140015547
cmp r13, rax
je 0x140015567
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400154ee
lea rdx, [0x140020660]
lea rcx, [0x140020648]
call fcn.140015338
lea rdx, [0x140020670]
lea rcx, [0x140020668]
call fcn.140015338
nop
test r12d, r12d
je 0x14001559f
mov ecx, 8
call fcn.14001b0dc
test r12d, r12d
jne 0x1400155ca
mov dword [0x1400289b0], 1
lea ecx, [r12 + 8]
call fcn.14001b0dc
mov ecx, r15d
call fcn.1400152c8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140015458

Function at 0x1400155f0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140015458
Function at 0x140016aef
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140027028]
jne 0x140014416
rol rcx, 0x10
test cx, 0xffff
jne 0x140014412
repz ret
ror rcx, 0x10
jmp 0x140016a48
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140028ea0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140028f98]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140016acd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140028ea0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140016aef
mov rax, qword [rsp + 0x88]
mov qword [0x140028f98], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140028f38], rax
mov rax, qword [0x140028f98]
mov qword [0x140028e10], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140028f20], rax
mov dword [0x140028e00], 0xc0000409
mov dword [0x140028e04], 1
mov rax, qword [0x140027028]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140027030]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140028e98], eax
mov ecx, 1
call fcn.14001bd10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140022578]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140028e98], 0
jne 0x140016b76
mov ecx, 1
call fcn.14001bd10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret