joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002760
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140016040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400027bb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400027c2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14000285a
mov qword [rsp + 0x280], rsi
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400027e0
cmp qword [rdi + 0x20], 7
lea r8, [rdi + 8]
jbe 0x1400027f9
mov r8, qword [rdi + 8]
mov rdx, qword [rdi + 0x18]
cmp rdx, rax
jne 0x140002835
test rdx, rdx
je 0x140002828
lea rcx, [rsp + 0x4c]
sub r8, rcx
lea rax, [rsp + 0x4c]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x140002835
add rax, 2
sub rdx, 1
jne 0x140002814
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140002852
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400027d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rsi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000be00
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140004480
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
push r12
push r14
sub rsp, 0x498
mov rax, qword [0x140016040]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbp, rdx
mov qword [rsp + 0x28], rcx
mov rdi, rcx
xor edx, edx
mov ecx, 2
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400044e7
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140004510
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r12
lea rdx, [0x14000f724]
xorps xmm0, xmm0
xor r8d, r8d
movups xmmword [rdi + 8], xmm0
mov qword [rdi + 0x18], r12
mov rcx, rdi
mov qword [rdi + 0x20], r12
call fcn.14000a9d0
jmp 0x140004618
mov qword [rsp + 0x4c8], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x490], r15
mov qword [rsp + 0x4d0], rsi
nop
lea rcx, [rsp + 0x5c]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140004540
cmp qword [rbp + 0x20], 7
lea r9, [rbp + 8]
jbe 0x140004559
mov r9, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
cmp rcx, rax
jne 0x1400045bd
test rcx, rcx
je 0x14000459f
lea rdx, [rsp + 0x5c]
sub r9, rdx
lea rax, [rsp + 0x5c]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x140004639
add rax, 2
sub rcx, 1
jne 0x140004580
mov eax, r12d
test eax, eax
jne 0x1400045bd
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140004646
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004530
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov qword [rdi], r12
movups xmmword [rdi + 8], xmm0
mov qword [rdi + 0x18], r12
lea rdx, [0x14000f724]
mov qword [rdi + 0x20], r12
xor r8d, r8d
mov rcx, rdi
call fcn.14000a9d0
mov rsi, qword [rsp + 0x4d0]
mov rbx, qword [rsp + 0x4c8]
mov r15, qword [rsp + 0x490]
mov rax, rdi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000be00
add rsp, 0x498
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, 1
cmovb eax, ebx
jmp 0x14000459b
mov r9d, 0x104
lea r8, [rsp + 0x270]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov qword [rdi], r12
movups xmmword [rdi + 8], xmm0
mov qword [rdi + 0x18], r12
lea rax, [rsp + 0x270]
mov qword [rdi + 0x20], r12
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140004690
mov r8, rbx
lea rdx, [rsp + 0x270]
jmp 0x1400045f8
Function at 0x14000ca00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14000c550
movzx eax, al
test eax, eax
jne 0x14000ca20
mov ecx, 7
call fcn.14000d290
nop
mov byte [rsp + 0x20], 0
call fcn.14000c4e0
mov byte [rsp + 0x21], al
cmp dword [0x1400168c0], 1
jne 0x14000ca44
mov ecx, 7
call fcn.14000d290
nop
jmp 0x14000ca9c
cmp dword [0x1400168c0], 0
jne 0x14000ca97
mov dword [0x1400168c0], 1
lea rdx, [0x14000f508]
lea rcx, [0x14000f4f0]
call sub.ucrtbased.dll__initterm_e
test eax, eax
je 0x14000ca78
mov eax, 0xff
jmp 0x14000cba1
lea rdx, [0x14000f4e8]
lea rcx, [0x14000f4c0]
call sub.ucrtbased.dll__initterm
mov dword [0x1400168c0], 2
jmp 0x14000ca9c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14000c740
call fcn.14000d880
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14000caf9
mov rcx, qword [rsp + 0x30]
call fcn.14000c6b0
movzx eax, al
test eax, eax
je 0x14000caf9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14000f498]
nop
call fcn.14000d890
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14000cb2d
mov rcx, qword [rsp + 0x38]
call fcn.14000c6b0
movzx eax, al
test eax, eax
je 0x14000cb2d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call sub.ucrtbased.dll__register_thread_local_exe_atexit_callback
nop
call fcn.14000cbe0
mov dword [rsp + 0x28], eax
call fcn.14000d4b0
movzx eax, al
test eax, eax
jne 0x14000cb4c
mov ecx, dword [rsp + 0x28]
call sub.ucrtbased.dll_exit
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14000cb5b
call sub.ucrtbased.dll__cexit
nop
xor edx, edx
mov cl, 1
call fcn.14000c770
mov eax, dword [rsp + 0x28]
jmp 0x14000cba1
add rsp, 0x68
ret
Function at 0x1406d4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406d41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406d4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d406f
add dl, dl
jne 0x1406d4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d40f6
xor eax, eax
add dl, dl
jne 0x1406d40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d41ad
add dl, dl
jne 0x1406d40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406d40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406d407e
mov eax, 1
add dl, dl
jne 0x1406d4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d40fb
sub eax, ebx
mov ebx, 1
jne 0x1406d414c
mov ecx, 1
add dl, dl
jne 0x1406d412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406d4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d415d
cmp eax, 0x7d00
jae 0x1406d419b
cmp eax, 0x500
jb 0x1406d4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d407e
cmp eax, 0x7f
ja 0x1406d419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406d41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406d407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x113ec
Capabilities:
Map section object

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xb8
mov ebx, dword [rcx + 0xc]
mov ebp, dword [rcx + 8]
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
mov rdi, rcx
lea rdx, [0x00012100]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x80], 0
and qword [rsp + 0x98], 0
and qword [rsp + 0xa0], 0
and qword [rdi], 0
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x78]
mov edx, 0xf001f
mov rcx, rdi
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], 0x30
mov dword [rsp + 0x90], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov esi, eax
test eax, eax
js 0x115b4
mov rcx, qword [rdi]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov esi, eax
test eax, eax
js 0x115b4
and dword [rsp + 0xe0], 0
lea rax, [rbx + rbp]
xor edx, edx
lea ebp, [rdx + 1]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xf0]
lea r9, [rsp + 0xe0]
mov r8, rbx
mov ecx, ebp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf0], rbx
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
mov r8, qword [rsp + 0xe8]
and dword [rsp + 0xe0], 0
mov bl, al
lea rax, [rsp + 0xe8]
lea r9, [rsp + 0xe0]
xor edx, edx
mov ecx, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.HAL.dll_HalTranslateBusAddress]
test bl, bl
je 0x115bd
test al, al
je 0x115bd
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf0]
sub rax, rcx
test eax, eax
je 0x115bd
mov dword [rsp + 0x48], 0x204
and dword [rsp + 0x40], 0
mov qword [rsp + 0xf8], rcx
mov ecx, eax
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi]
lea r8, [rsp + 0x50]
xor r9d, r9d
or rdx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov esi, eax
test eax, eax
js 0x115b4
mov ecx, dword [rsp + 0xf0]
mov rax, qword [rsp + 0x50]
sub ecx, dword [rsp + 0xf8]
add rax, rcx
mov dword [rdi + 0x10], eax
jmp 0x115bd
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
add rsp, 0xb8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x115d4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
and dword [rax + 8], 0
and dword [rax + 0x18], 0
and dword [rax + 0x24], 0
and dword [rax + 0x20], 0
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
jne 0x11607
mov eax, 0xc0000001
jmp 0x116f1
and dword [rsp + 0x6c], 0
mov ecx, dword [rcx]
mov dword [rsp + 0x68], 0x1fffffff
mov rdx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_MmAllocateContiguousMemory]
mov rbx, rax
test rax, rax
je 0x115fd
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x115fd
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov dword [rdi + 8], eax
mov dword [rbp], eax
mov edx, dword [rdi]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rsi, rax
test rax, rax
jne 0x1166f
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x115fd
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x50], 6
jb 0x116be
cmp dword [rsp + 0x60], 1
jb 0x116be
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
mov dl, r8b
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
jmp 0x116c9
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
test eax, eax
jne 0x116d8
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x11664
mov dword [rdi + 4], eax
mov dword [rdi + 0x10], esi
mov dword [rdi + 0xc], ebx
cdqe
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rax
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x11704
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
lea rdx, [0x00012130]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x80]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], r11
mov r9d, 0xfa00
mov edx, 0x20
mov rcx, rdi
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
js 0x117d2
lea rdx, [0x00012160]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov rcx, qword [rsp + 0x80]
mov ebx, eax
test eax, eax
jns 0x11791
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x117d2
lea rax, [0x000117e8]
xor edx, edx
mov qword [rdi + 0xe0], rax
mov qword [rdi + 0x90], rax
mov qword [rdi + 0x88], rax
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x70], rax
lea rax, [0x00011868]
mov qword [rdi + 0x68], rax
mov rcx, qword [rcx + 0x40]
lea r8d, [rdx + 0x20]
call fcn.00012010
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x16064
Capabilities:
Create device object

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00016008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.00011704
Function at 0x1400044d0
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rsi, str.CCspHelper::CryptoAcquireSessionKey
mov qword [r11 - 0x58], rsi
lea r9, [0x1401cdac8]
mov r8d, 0x16b
lea rdx, str..ce_CspEncrypter.cpp
mov ecx, 0x44
call fcn.140038200
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14000457d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea r9, str._s___::CryptCreateHash_failed_with_Windows_error_code:__d_.
mov r8d, 0x172
lea rdx, str..ce_CspEncrypter.cpp
mov ecx, 0x45
call fcn.140038200
mov ebx, 0xffff4a51
jmp 0x1400046c0
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 0x24]
lea rcx, [rsp + 0x38]
call fcn.1400026b0
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0x40]
mov r9d, Ordinal_41
lea r8, str.AF187AB2_E29D_467e_8DF6_729167496FAB
call fcn.140041310
mov qword [rsp + 0x50], Ordinal_41
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [rax + 0x24], 0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140004643
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea r9, str._s___::CryptHashData_failed_with_Windows_error_code:__d_.
mov r8d, 0x17f
lea rdx, str..ce_CspEncrypter.cpp
mov ecx, 0x45
call fcn.140038200
mov ebx, 0xffff4a50
jmp 0x1400046ae
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x800000
mov r8, qword [rdi]
mov edx, 0x6801
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x14000469c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea r9, str._s___::CryptDeriveKey_failed_with_Windows_error_code:__d_.
mov r8d, 0x18c
lea rdx, str..ce_CspEncrypter.cpp
mov ecx, 0x45
call fcn.140038200
mov ebx, 0xffff4a4e
jmp 0x14000469e
xor ebx, ebx
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rdi], 0
cmp qword [rsp + 0x58], 0x10
jb 0x1400046c0
mov rcx, qword [rsp + 0x40]
call fcn.140041700
mov qword [rsp + 0x20], rsi
lea r9, str._s______
mov r8d, 0x199
lea rdx, str..ce_CspEncrypter.cpp
mov ecx, 0x44
call fcn.140038200
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140041910
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400049b0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x1050
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rbx, rdx
mov rsi, r8
mov rbp, rcx
lea r12, str.CCspHelper::CryptoDecryptStream
lea rdx, str..ce_CspEncrypter.cpp
lea r9, [0x1401cdac8]
mov r8d, 0x1f9
mov ecx, 0x44
mov qword [rsp + 0x20], r12
call fcn.140038200
mov rax, qword [rsi]
xor edx, edx
movsxd rcx, dword [rax + 4]
mov eax, 4
mov edi, 0xffff4a5b
add rcx, rsi
cmp qword [rcx + 0x48], rdx
cmove edx, eax
xor r8d, r8d
call fcn.1400033c0
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0xff7
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x40], 0
call fcn.140041940
mov r11, qword [rbx]
movsxd rax, dword [r11 + 4]
test byte [rax + rbx + 0x10], 1
jne 0x140004b13
nop
lea rdx, [rsp + 0x40]
mov r9d, 0xff8
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.14000a900
mov r11d, dword [rbx + 8]
test r11d, r11d
mov dword [rsp + 0x30], r11d
je 0x140004ad1
mov rax, qword [rbx]
xor r9d, r9d
xor edx, edx
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
mov r8b, byte [rcx + rbx + 0x10]
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
and r8d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140004ae1
mov r8d, dword [rsp + 0x30]
lea rcx, [rsi + 0x10]
lea rdx, [rsp + 0x40]
call fcn.140009550
xor edi, edi
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
test byte [rcx + rbx + 0x10], 1
je 0x140004a60
jmp 0x140004b13
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._s___::CryptDecrypt_failed_with_Windows_error_code:__d_.
lea rdx, str..ce_CspEncrypter.cpp
mov dword [rsp + 0x28], eax
mov r8d, 0x21b
mov ecx, 0x45
mov qword [rsp + 0x20], r12
call fcn.140038200
mov edi, 0xffff4a4c
lea r9, str._s______
lea rdx, str..ce_CspEncrypter.cpp
mov r8d, 0x227
mov ecx, 0x44
mov qword [rsp + 0x20], r12
call fcn.140038200
mov eax, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140041910
add rsp, 0x1050
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140005aa0
Capabilities:
Encode data using xor

Disassembly:
shr r11, 0x29
or rdi, 0xd0
xor r11, r11
xor rdi, 0xff
mov rbx, qword [rsp + r11]
add r10, rsi
add rdi, 0xa7
mov rsi, 0x6ca43510
nop
ror r12, 0x13
mov r14, 0x6ca077e8
or r12, 0x8b
xor rsi, r14
addps xmm7, xmm13
sub rbx, rsi
sub r12, rdi
add rdi, 0x37
mov r10, 0x3ff0efff
xorps xmm7, xmm15
mov r13, 0x3fe83a07
shr rax, 0x39
xor r10, r13
or rsi, r11
or r12, r14
add r10, rbx
rol r13, 0x2a
mov r13, qword [r10]
dec r15
mov r12, 0x343eb1fa
xor r11, 0x63
mov r10, 0x341b449a
and rax, r15
shl rsi, 0x1f
xor r12, r10
addps xmm11, xmm15
add r12, rbx
pop rsi
mov r15, rsi
push r15
mov rdi, 0x45d355a8
shl r14, 0x3a
mov r15, 0x45d2694d
xor r10, r11
xor rdi, r15
cmp rax, rsi
lea rbx, [rbx + 0xac]
mov r15, Ordinal_143
dec rsi
mov rax, reloc.WLDAP32.dll_Ordinal_143
or r14, r11
add r10, 0xf1
xor r15, rax
rol r10, 0x26
add rsi, rbx
push r12
shl rsi, 0x11
mov r11, Ordinal_211
push rdi
test r10, r14
push r13
ror rbx, 0x30
and rax, 0x56
sub rsp, 0x20
mov rax, reloc.WLDAP32.dll_Ordinal_41
add rsi, 0xde
mov rcx, r12
xor rbx, 0x9c
mov rdx, rdi
sub r14, rsi
mov r8, r15
or r12, 0xb0
lea r9, [rsp]
sub rax, 0x55
call r13
pop r13
mov r12, r13
push r12
or r13, r12
add rsp, 0x20
shl rdi, 0x34
add rsi, 0x7c
pop r15
shl rdi, 0x16
xor rsi, 0xfb
pop rbx
and rdi, r10
pop r13
add rax, r11
xor r12, r12
add r11, 0xe5
xorps xmm13, xmm0
lea rax, [r13 + r12]
or r10, 0xb
mov r11, rdi
mov sil, byte [rax]
nop
xor sil, 9
mov r10, 0xd5
add sil, 0x11
add r11, r14
mov r14, rdi
mov byte [rax], sil
add rdi, r11
inc r12
inc r10
sub r14, r11
cmp r12, rbx
mov r10, r14
mov r10, rdi
jne 0x140005c16
test r14, rdi
mov rsi, 0xcc
dec r12
xorps xmm14, xmm7
mov r10, 0xec
push r14
pop rdi
test rdi, r12
xor rsi, r10
xchg r11, rax
push r13
xor r12, 0x39
sub rsp, 0x20
and rdi, r10
mov rcx, r13
sub r11, 0x92
add rax, r14
mov rdx, rbx
nop
mov r8, rsi
or r11, rsi
lea r9, [rsp]
mov rax, 0xe0
call r15
and r12, 0x5e
rol r15, 0xc
add rsp, 0x20
mov r13, 0x42
ret
Function at 0x14000be70
Capabilities:
Initialize winsock library

Disassembly:
mov ecx, 3
jmp 0x140065f00
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov eax, dword [0x14023f2e0]
mov ebx, ecx
mov edx, eax
add eax, 1
test edx, edx
mov dword [0x14023f2e0], eax
jne 0x140065ff0
test cl, 1
lea rax, [fcn.140048900]
mov qword [fcn.140048900], rax
lea rax, [fcn.140046f30]
mov qword [fcn.140046f30], rax
lea rax, [fcn.14005e820]
mov qword [fcn.14005e820], rax
lea rax, [fcn.140065b10]
mov qword [fcn.140065b10], rax
lea rax, [fcn.14005e730]
mov qword [fcn.14005e730], rax
je 0x140065f8e
call fcn.140068e80
test eax, eax
je 0x140066011
test bl, 2
je 0x140065fc0
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140066011
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14006600b
shr ax, 8
cmp al, 2
jne 0x14006600b
call fcn.140067520
test eax, eax
jne 0x140066011
call fcn.1400e71c0
test eax, eax
jne 0x140066011
call fcn.140068000
mov eax, dword [0x14023f428]
test bl, 4
mov ecx, 1
mov dword [0x14023f2e4], ebx
cmovne eax, ecx
mov dword [0x14023f428], eax
call fcn.140067770
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140041910
add rsp, 0x1d0
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x140065ff2
Function at 0x140014f90
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
test rcx, rcx
je 0x14001505a
push rbx
sub rsp, 0x40
mov qword [rsp + 0x50], rsi
mov rbx, rcx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov edi, eax
jne 0x140014fd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, str.RemoveFileReadOnly
lea r9, str._s____RemoveFileReadOnly__Fail_to_get_file_attributes_file___s_error___d.
mov r8d, 0xff
jmp 0x14001502c
test al, 1
je 0x14001504b
lea rsi, str.RemoveFileReadOnly
lea r9, str._s____RemoveFileReadOnly__Remove_read_only_attribute_from__s
lea rdx, str..OfcDDAProtocolUploadSample.cpp
mov r8d, 0x107
mov ecx, 0x44
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call fcn.1400382e0
and edi, 0xfffffffe
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x14001504b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._s____RemoveFileReadOnly__Fail_to_set_file_attributes_file___s_error___d.
mov r8d, 0x10a
mov dword [rsp + 0x30], eax
lea rdx, str..OfcDDAProtocolUploadSample.cpp
mov ecx, 0x44
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call fcn.1400382e0
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret 0