joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140117380
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov ebp, r9d
mov rsi, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x1401173c7
mov rax, qword [rbx]
mov rcx, rsi
mov rdi, qword [rax + 0x150]
call fcn.140114a00
mov edx, eax
mov rcx, rbx
call rdi
mov rcx, rsi
mov dword [rsp + 0x70], r15d
call fcn.140114e60
mov rcx, rsi
mov edi, eax
call fcn.140114980
mov rdx, qword [r14]
lea r9, [rsp + 0x70]
mov r8, qword [r14 + 8]
mov rcx, qword [rbx + 0x10]
sub r8, rdx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
sar r8, 4
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x14011741c
call fcn.1401163f0
mov edi, dword [rsp + 0x70]
cmp byte [rbx + 0x28], r15b
je 0x14011743b
test edi, edi
jns 0x140117444
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1401173a7
test edi, edi
jns 0x140117444
call fcn.1401163f0
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140117460
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15d, dword [rsp + 0x70]
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
nop dword [rax]
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x1401174b0
mov rax, qword [rbx]
mov rcx, rsi
mov rdi, qword [rax + 0x150]
call fcn.140114a00
mov edx, eax
mov rcx, rbx
call rdi
mov rcx, rsi
call fcn.140114e60
mov rcx, rsi
mov edi, eax
call fcn.140114980
mov rcx, qword [rbx + 0x10]
mov r9d, r15d
mov r8d, ebp
mov dword [rsp + 0x28], edi
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp byte [rbx + 0x28], 0
mov edi, eax
je 0x1401174f7
test eax, eax
jns 0x140117502
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140117490
test edi, edi
jns 0x140117500
call fcn.1401163f0
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140117520
Capabilities:
Send data
Send data on socket

Disassembly:
mov byte [rsp + 0x10], dl
sub rsp, 0x78
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140117557
mov r9d, 1
lea rdx, [rsp + 0x88]
mov r8d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140117552
call fcn.1401163f0
add rsp, 0x78
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x20]
call fcn.1402b8690
int3
Function at 0x140117610
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x88
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140117644
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14011763c
call fcn.1401163f0
add rsp, 0x88
ret
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x30]
call fcn.1402b8690
int3

Function at 0x1401214e0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x80
mov rax, rdx
mov rbx, rcx
cmp qword [rdx + 0x10], 0
je 0x14012158b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x50], 4
cmp qword [rdx + 0x18], 0xf
jbe 0x14012151e
mov rax, qword [rdx]
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14012158b
mov rax, qword [rsp + 0x98]
mov r8, qword [rax + 0x20]
lea rdx, [r8 + 8]
mov r8d, dword [r8 + 0x18]
lea rcx, [rsp + 0x28]
call fcn.140120d30
nop
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140120cb0
nop
lea rcx, [rsp + 0x28]
call fcn.140120db0
mov rax, rbx
add rsp, 0x80
pop rbx
ret
mov rcx, rbx
call fcn.140120d80
mov rax, rbx
add rsp, 0x80
pop rbx
ret

Function at 0x140122b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [r8 - 1]
mov r15, r9
sar rbp, 1
mov r13, r8
mov rdi, rdx
mov rsi, rcx
mov r14, rdx
mov rbx, rdx
cmp rdx, rbp
jge 0x140122bd6
nop word [rax + rax]
add rbx, rbx
lea rcx, [rsi + 0x10]
lea rcx, [rcx + rbx*8]
lea rdx, [rcx - 8]
call fcn.140113920
movzx eax, al
lea rcx, [rsi + rdi*8]
xor rax, 1
inc rax
add rbx, rax
lea rdx, [rsi + rbx*8]
call fcn.140113850
mov rdi, rbx
cmp rbx, rbp
jl 0x140122ba0
cmp rbx, rbp
jne 0x140122bf6
test r13b, 1
jne 0x140122bf6
lea rdx, [r13 - 1]
lea rdx, [rsi + rdx*8]
lea rcx, [rsi + rdi*8]
call fcn.140113850
lea rdi, [r13 - 1]
cmp r14, rdi
jge 0x140122c2e
nop dword [rax + rax]
lea rbx, [rdi - 1]
mov rdx, r15
sar rbx, 1
lea rbp, [rsi + rbx*8]
mov rcx, rbp
call fcn.140113920
test al, al
je 0x140122c2e
lea rcx, [rsi + rdi*8]
mov rdx, rbp
call fcn.140113850
mov rdi, rbx
cmp r14, rbx
jl 0x140122c00
lea rcx, [rsi + rdi*8]
mov rdx, r15
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140113850
Function at 0x1401234f0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
cmp qword [rdx + 0x18], 0xf
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rdi, rcx
mov dword [rsp + 0x28], r8d
mov rbx, rdx
mov rcx, rdx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
jbe 0x140123524
mov rcx, qword [rdx]
lea r9, [rsp + 0x78]
xor edx, edx
lea r8, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140123560
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140123190
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x60
pop rdi
ret
mov rdx, rbx
mov ecx, eax
call fcn.1401233c0
int3

Function at 0x140124030
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140124123
lea rdx, str.NtCancelIoFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140124123
lea rdx, str.NtCreateFile
mov qword [0x1404a5db0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140124123
lea rdx, str.NtCreateKeyedEvent
mov qword [0x1404a5db8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140124123
lea rdx, str.NtDeviceIoControlFile
mov qword [0x1404a5dc0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140124123
lea rdx, str.NtReleaseKeyedEvent
mov qword [0x1404a5dc8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140124123
lea rdx, str.NtWaitForKeyedEvent
mov qword [0x1404a5dd0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140124123
lea rdx, str.RtlNtStatusToDosError
mov qword [0x1404a5dd8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140124123
mov qword [0x1404a5de0], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x140125970
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14012599f
mov ecx, eax
call fcn.140123f80
mov eax, 0xffffffff
add rsp, 0x1c8
ret
xor eax, eax
add rsp, 0x1c8
ret
Function at 0x1401373e0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, r8d
mov rax, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0
je 0x1401374a6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x14043ca90]
movdqu xmmword [rsp + 0x30], xmm1
xor ecx, ecx
mov word [rsp + 0x20], cx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140137040
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
lea rcx, [rbx + 0x28]
cmp qword [rcx + 0x18], 7
jbe 0x140137447
mov rcx, qword [rcx]
and edi, 1
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1401374c3
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140137495
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140137490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401374a0
call fcn.1402b5c4c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.1402c5d0c
int3
xor r9d, r9d
mov r8d, pe_nt_image_headers64
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.1401345f0
nop
lea rcx, [rbx + 8]
call fcn.140137770
int3

Function at 0x140137580
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x1401375d9
call fcn.140137660
test al, al
je 0x1401375ad
mov rcx, rbx
call fcn.140137b70
test al, al
je 0x1401375ad
xor al, al
add rsp, 0x20
pop rbx
ret
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x1401375bb
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1401375cf
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140137770
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0x183
lea rcx, str.__path.empty__
call fcn.1401345f0
int3

Function at 0x140137660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x1401376bd
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x14013767e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1401376ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x1401376a3
sub eax, 1
je 0x1401376a3
sub eax, 0xc
je 0x1401376a3
cmp eax, 6
jne 0x1401376b3
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140137770
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
lea r8d, [r9 + 0x5e]
call fcn.1401345f0
int3
Function at 0x140137b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x140137bae
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x140137b8e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140137ba4
shr eax, 4
and al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140137770
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0x9f
lea rcx, str.__path.empty__
call fcn.1401345f0
int3

Function at 0x140137bd0
Capabilities:
Check if file exists

Disassembly:
jmp 0x140137be0
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x140137c26
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x140137bfe
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140137c1c
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140137770
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.1401345f0
int3

Function at 0x140137be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140137be0
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x140137c26
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x140137bfe
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140137c1c
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140137770
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.1401345f0
int3

Function at 0x140137ed0
Capabilities:
Delete directory
Delete file

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rdi, rcx
je 0x140137f2d
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x28]
call fcn.140137b70
test al, al
je 0x140137f14
cmp qword [rbx + 0x18], 7
jbe 0x140137efc
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140137f4a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x18], 7
jbe 0x140137f1e
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140137f4a
jmp 0x140137f09
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0x160
lea rcx, str.__path.empty__
call fcn.1401345f0
int3
lea rcx, [rdi + 8]
call fcn.140137770
int3
Function at 0x140137f90
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, r8d
mov rax, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0
je 0x14013808b
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x14043ca90]
movdqu xmmword [rsp + 0x30], xmm1
xor ecx, ecx
mov word [rsp + 0x20], cx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140137040
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x28]
test dil, 1
je 0x140138053
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
cmp qword [rcx + 0x18], 7
jbe 0x140137ffd
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140138081
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140138048
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140138043
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013807b
call fcn.1402b5c4c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
cmp qword [rcx + 0x18], 7
jbe 0x140138069
mov rcx, qword [rcx]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140138081
jmp 0x14013800a
call fcn.1402c5d0c
nop
lea rcx, [rbx + 8]
call fcn.140137770
nop
xor r9d, r9d
mov r8d, 0x133
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.1401345f0
int3

Function at 0x1401419a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0xa8], 0xffffffffffffffff
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140141a24
mov eax, dword [rcx + 0x80]
test al, 1
je 0x140141a24
test al, 2
je 0x1401419d6
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [rbx + 0xa8]
lea r9, [rsp + 0x40]
xor eax, eax
mov r8d, edi
mov rdx, rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140141a09
lea rcx, [rbx + 0x88]
call fcn.140137760
mov eax, dword [rsp + 0x40]
add qword [rbx + 0xb0], rax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140141d90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx + 0xa8]
mov rsi, rdx
cmp rcx, 0xffffffffffffffff
je 0x140141e66
mov eax, dword [rbx + 0x80]
test al, 2
je 0x140141e66
test al, 8
je 0x140141e12
mov r9d, 2
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x5c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
jne 0x140141e06
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140141e06
lea rcx, [rbx + 0x88]
call fcn.140137760
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0xb0], rax
mov rcx, qword [rbx + 0xa8]
lea r9, [rsp + 0x40]
mov r8d, edi
mov dword [rsp + 0x40], 0
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140141e4b
lea rcx, [rbx + 0x88]
call fcn.140137760
mov eax, dword [rsp + 0x40]
add qword [rbx + 0xb0], rax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140148b40
Capabilities:
Hash data with md5

Disassembly:
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x18], rax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x1401498d0
Capabilities:
Hash data using sha1

Disassembly:
xorps xmm0, xmm0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
xor eax, eax
mov qword [rcx + 0x1c], rax
mov dword [rcx + 0x64], eax
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
movups xmmword [rcx + 0x24], xmm0
movups xmmword [rcx + 0x34], xmm0
movups xmmword [rcx + 0x44], xmm0
movups xmmword [rcx + 0x54], xmm0
ret
Function at 0x14014d230
Capabilities:
Hash data using sha224
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14014d247
call fcn.1402c5d84
mov edx, 0xd0
mov ecx, 1
call fcn.1402c5d98
mov ecx, dword [rbx + 0x10]
mov qword [rbx + 8], rax
cmp ecx, 1
jne 0x14014d2a0
mov dword [rax + 0x10], 0xc1059ed8
mov dword [rax + 0x14], 0x367cd507
mov dword [rax + 0x18], 0x3070dd17
mov dword [rax + 0x1c], 0xf70e5939
mov dword [rax + 0x20], 0xffc00b31
mov dword [rax + 0x24], 0x68581511
mov dword [rax + 0x28], 0x64f98fa7
mov dword [rax + 0x2c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
cmp ecx, 2
jne 0x14014d2e3
mov dword [rax + 0x10], 0x6a09e667
mov dword [rax + 0x14], 0xbb67ae85
mov dword [rax + 0x18], 0x3c6ef372
mov dword [rax + 0x1c], 0xa54ff53a
mov dword [rax + 0x20], 0x510e527f
mov dword [rax + 0x24], 0x9b05688c
mov dword [rax + 0x28], 0x1f83d9ab
mov dword [rax + 0x2c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret
cmp ecx, 3
jne 0x14014d35e
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax + 0x10], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 0x18], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x20], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x28], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x30], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x38], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x40], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
cmp ecx, 4
jne 0x14014d3d9
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax + 0x10], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 0x18], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x20], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x28], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x30], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x38], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x40], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
cmp ecx, 5
jne 0x14014d454
movabs rcx, 0x8c3d37c819544da2
mov qword [rax + 0x10], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 0x18], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x20], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x28], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x30], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x38], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x40], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
movabs rcx, 0x22312194fc2bf72c
mov qword [rax + 0x10], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 0x18], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x20], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x28], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x30], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x38], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x40], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x140157ad0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x140157ae0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x38], 0x2c0
mov dword [rcx], eax
mov rbx, rcx
mov word [rcx + 4], ax
mov ecx, 0x2c0
call fcn.1402b6274
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140157b33
mov rcx, rdi
call fcn.1402b5c4c
mov ecx, dword [rsp + 0x38]
call fcn.1402b6274
mov rdi, rax
jmp 0x140157b37
test eax, eax
jne 0x140157b8e
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140157b86
xor dl, dl
mov rax, rdi
test rdi, rdi
je 0x140157b86
test dl, dl
jne 0x140157b86
cmp dword [rax + 0x1a4], 6
jne 0x140157b7e
cmp dword [rax + 0x194], 6
jne 0x140157b7e
mov ecx, dword [rax + 0x198]
mov dl, 1
mov dword [rbx], ecx
movzx ecx, word [rax + 0x19c]
mov word [rbx + 4], cx
mov rax, qword [rax]
test rax, rax
jne 0x140157b53
mov rcx, rdi
call fcn.1402b5c4c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140157ae0
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x140157ae0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x38], 0x2c0
mov dword [rcx], eax
mov rbx, rcx
mov word [rcx + 4], ax
mov ecx, 0x2c0
call fcn.1402b6274
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140157b33
mov rcx, rdi
call fcn.1402b5c4c
mov ecx, dword [rsp + 0x38]
call fcn.1402b6274
mov rdi, rax
jmp 0x140157b37
test eax, eax
jne 0x140157b8e
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140157b86
xor dl, dl
mov rax, rdi
test rdi, rdi
je 0x140157b86
test dl, dl
jne 0x140157b86
cmp dword [rax + 0x1a4], 6
jne 0x140157b7e
cmp dword [rax + 0x194], 6
jne 0x140157b7e
mov ecx, dword [rax + 0x198]
mov dl, 1
mov dword [rbx], ecx
movzx ecx, word [rax + 0x19c]
mov word [rbx + 4], cx
mov rax, qword [rax]
test rax, rax
jne 0x140157b53
mov rcx, rdi
call fcn.1402b5c4c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140158080
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x50], 0
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov rcx, qword [rsp + 0x50]
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14017f7f0
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x1403636e0]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret