joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056a14
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [rax - 0x40], 0
and dword [rax - 0x38], 0
and qword [rax + 0x20], 0
mov dword [rax - 0x48], 0x80
mov rdi, rdx
mov rdx, rcx
mov rbp, r8
mov dword [rax - 0x50], 3
and qword [rax - 0x58], 0
lea rcx, [rax + 0x20]
mov r9d, 1
mov r8d, 0x80000000
call fcn.1400034e0
mov rbx, qword [rsp + 0x98]
test rbx, rbx
jne 0x140056a7e
xor eax, eax
jmp 0x140056b66
and dword [rsp + 0x98], 0
lea r13, [rsp + 0x98]
test rdi, rdi
cmovne r13, rdi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r14d, r14d
test rbp, rbp
setne r14b
mov esi, eax
mov dword [r13], esi
test r14d, r14d
je 0x140056aeb
mov rdx, rsi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp], rax
test rax, rax
jne 0x140056add
cmp rbx, 0xffffffffffffffff
je 0x140056a77
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140056a77
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
jmp 0x140056b25
lea eax, [rsi + 8]
movsxd r12, eax
mov rcx, qword [0x1400f1ff0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x140056b18
lea ecx, [rax + 2]
call fcn.14004b9a0
cmp eax, 4
je 0x140056af1
mov dword [rdi + 4], 0xaa55
mov dword [rdi], esi
add rdi, 8
test rdi, rdi
je 0x140056acc
mov r8d, dword [r13]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test r14d, r14d
je 0x140056b54
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp rbx, 0xffffffffffffffff
je 0x140056b63
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140056eb8
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rsi, rcx
mov rdi, r8
mov r12b, dl
mov ecx, 0x18
test r8, r8
je 0x140056f5d
call fcn.1400b9688
mov rbx, rax
test rax, rax
je 0x140056f0a
and dword [rax + 0x14], 0
and qword [rbx + 8], 0
mov byte [rax + 0x10], 0
lea rax, [0x1400ddc60]
mov qword [rbx], rax
jmp 0x140056f0c
xor ebx, ebx
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400f2c58]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [rbx + 8], 0
je 0x140056f9d
xor ecx, ecx
cmp ebp, 0xb7
sete cl
mov dword [rdi], ecx
jmp 0x140056f96
call fcn.1400b9688
mov rbx, rax
test rax, rax
je 0x140056f94
and qword [rax + 8], 0
and dword [rax + 0x14], 0
mov byte [rax + 0x10], 0
lea rax, [0x1400ddc60]
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
jmp 0x140056f96
xor ebx, ebx
cmp qword [rbx + 8], 0
jne 0x140056fc7
xor r8d, r8d
lea rcx, [0x1400f1e30]
lea edx, [r8 + 1]
call fcn.140013908
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
cmp rax, 0
je 0x140056f9d
test r12b, r12b
je 0x140056fdd
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [rbx + 0x10], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x140057760
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov edi, 0x104
mov edx, edi
mov rcx, rbx
call fcn.14004bf70
mov r11, qword [rbx]
xor ebp, ebp
mov word [r11], bp
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, ebp
mov edi, eax
jle 0x1400577ca
mov rcx, qword [rbx]
cmp word [rcx], bp
jne 0x1400577ca
lea edx, [rax + 2]
mov rcx, rbx
call fcn.14004bf70
mov rdx, qword [rbx]
lea r8d, [rdi + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140057920
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
xor edi, edi
mov esi, edx
mov eax, 3
cmp edx, edi
jge 0x140057a25
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x140057951
mov eax, 0xffdf
and cx, ax
mov r8d, 0x3a
mov word [rsp + 0x40], cx
mov word [rsp + 0x50], cx
lea edx, [r8 + 0x22]
mov word [rsp + 0x42], r8w
mov word [rsp + 0x52], r8w
lea eax, [rdx - 0x2e]
mov word [rsp + 0x44], dx
mov word [rsp + 0x48], dx
mov word [rsp + 0x4a], dx
mov word [rsp + 0x4e], dx
mov qword [rsp + 0x30], rdi
lea r8d, [rax - 0x2b]
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], edi
mov word [rsp + 0x46], di
mov word [rsp + 0x4c], ax
mov word [rsp + 0x54], di
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400579cf
mov eax, 1
jmp 0x140057b0c
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rbp
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
lea rcx, [rsp + 0x40]
cmovne esi, dword [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp esi, 0xffffffff
je 0x1400579c5
xor r8d, r8d
mov edx, eax
mov ecx, esi
mov dword [rsp + 0x2a8], edi
call fcn.14004b17c
cmp eax, edi
je 0x1400579c5
lea rcx, [rsp + 0x2a8]
xor r8d, r8d
mov edx, eax
mov dword [rsp + 0x2b8], edi
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x2b0], edi
mov dword [rsp + 0x2a8], eax
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
mov r8d, dword [rsp + 0x2a8]
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x2b8]
xor r9d, r9d
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov ebx, dword [rsp + 0x2b8]
mov esi, 1
shr ebx, 0xe
mov ebp, 0x208
and bl, 1
mov ecx, dword [rsp + 0x2a8]
mov word [rsp + 0x70], di
mov dword [rsp + 0x20], edi
mov r9d, ebp
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x2b0]
cmp bl, dil
je 0x140057acf
call qword [sym.imp.SETUPAPI.dll_CM_Request_Device_EjectW]
jmp 0x140057ad5
call qword [sym.imp.SETUPAPI.dll_CM_Query_And_Remove_SubTreeW]
cmp eax, edi
jne 0x140057ae2
cmp dword [rsp + 0x2b0], edi
je 0x140057aff
lea rcx, [0x1400f1e30]
xor r8d, r8d
mov edx, 0xc8
call fcn.140013908
inc esi
cmp esi, 3
jg 0x140057b02
jmp 0x140057aa2
mov dil, 1
neg dil
sbb eax, eax
not eax
and eax, 2
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140058354
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rsi, rdx
cmp rcx, rbx
jne 0x14005842d
cmp rdx, rbx
jne 0x140058380
mov eax, 0x80070057
jmp 0x140058459
cmp dword [0x1400f2420], ebx
jle 0x140058457
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400583d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rdi + 2]
cmp eax, ebx
cmove eax, ecx
jmp 0x140058459
mov r8d, dword [0x1400f2420]
mov rdx, qword [0x1400f2c08]
lea r9, [rsp + 0x50]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [0x1400f2c08]
mov dword [0x1400f2420], ebx
cmp r8, rbx
je 0x140058424
mov rcx, qword [0x1400f1ff0]
add r8, 0xfffffffffffffff8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x1400f2c08], rbx
jmp 0x140058457
call fcn.14004b61c
mov rdi, rax
cmp rax, rbx
jne 0x140058441
mov eax, 1
jmp 0x140058459
mov rdx, rsi
mov rcx, rax
call fcn.140057f14
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14005a1d4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov rdi, r8
lea rcx, [rsp + 0x78]
or r8d, 0xffffffff
call fcn.140058960
lea rcx, [rsp + 0x30]
or r8d, 0xffffffff
mov rbx, qword [rax]
mov rdx, rdi
call fcn.140058960
lea rdx, str._r_nRegSetDHCP__s__s__r_n
lea rcx, [0x1400f1e30]
mov r9, qword [rax]
mov r8, rbx
call fcn.140012fac
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x30]
call fcn.140044f24
mov rax, qword [str.0.0.0.0]
mov rcx, qword [rsi]
lea r11, [rsp + 0x38]
mov r9d, 4
lea rdx, str.EnableDHCP
mov qword [r11], rax
mov al, byte [0x1400de588]
mov dword [rsp + 0x28], r9d
mov byte [r11 + 8], al
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
mov ebx, 9
lea rax, [rsp + 0x38]
lea rdx, str.IPAddress
lea r9d, [rbx - 2]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
lea rax, [rsp + 0x38]
lea r9d, [rbx - 2]
lea rdx, str.SubnetMask
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
lea rbx, [0x1400d6cc0]
lea rdx, str.DefaultGateway
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test rdi, rdi
je 0x14005a339
cmp byte [rdi], 0x2d
cmovne rbx, rdi
cmp byte [rdi], 0
je 0x14005a339
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsi]
lea rdx, str.NameServer
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, 1
add rsp, 0x50
pop rdi
ret
Function at 0x140061598
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
xor esi, esi
xor ecx, ecx
mov word [rax], si
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, esi
je 0x1400615f2
lea ecx, [rsi + 0xd]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
cmp rax, rsi
je 0x1400615ec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbx
mov rdx, rax
call fcn.1400589a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140064d18
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, edx
movzx esi, cx
call fcn.140057920
xor edx, edx
mov edi, eax
cmp ebx, edx
jge 0x140064da8
lea ecx, [rdx + 0x20]
lea eax, [rdx + 0x2a]
mov word [rsp + 0x26], si
mov word [rsp + 0x22], ax
lea eax, [rdx + 0x2c]
mov word [rsp + 0x20], cx
mov word [rsp + 0x24], cx
lea ecx, [rdx + 0x3a]
mov word [rsp + 0x2a], ax
lea eax, [rdx + 0x5c]
mov word [rsp + 0x28], cx
mov word [rsp + 0x52], cx
lea rcx, [rsp + 0x50]
mov word [rsp + 0x2c], dx
mov word [rsp + 0x50], si
mov word [rsp + 0x54], ax
mov word [rsp + 0x56], dx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x140064d94
cmp edi, 2
je 0x140064da8
lea rdx, [rsp + 0x20]
lea rcx, [0x1400f1e30]
xor r8d, r8d
call fcn.14005ecf8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007ff48
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x80
xor ebx, ebx
lea rax, [r11 + 0x20]
xor r9d, r9d
mov qword [r11 - 0x40], rbx
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], rbx
mov qword [r11 - 0x58], rbx
mov qword [r11 - 0x60], rbx
mov qword [r11 - 0x68], rbx
mov qword [r11 - 0x70], rax
lea rax, [r11 - 0x38]
xor r8d, r8d
xor edx, edx
mov rbp, rcx
mov dword [rsp + 0x60], ebx
mov qword [r11 - 0x78], rax
mov dword [r11 + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp eax, ebx
jne 0x140080101
mov edx, dword [rsp + 0xb8]
lea rcx, [rsp + 0x78]
lea edx, [rdx*4 + 8]
call fcn.14004bedc
cmp dword [rsp + 0x60], ebx
mov esi, ebx
jle 0x1400800f5
mov rbx, qword [rsp + 0x78]
xor ecx, ecx
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x28], rcx
shl eax, 2
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x20], rcx
mov word [rbx], cx
lea r9, [rsp + 0x64]
mov rcx, rbp
mov r8, rbx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor ecx, ecx
mov edi, eax
cmp eax, ecx
jne 0x1400800e9
cmp word [rbx], cx
je 0x1400800e9
mov rax, qword [rsp + 0xb0]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
call fcn.140058920
lea rdx, [0x1400d6778]
lea rcx, [rsp + 0x68]
call fcn.14004bfa8
lea rcx, [rsp + 0x68]
mov rdx, rbx
call fcn.14004bfa8
mov rax, qword [rsp + 0xa8]
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
lea eax, [r9 + 4]
mov r8d, eax
mov edx, eax
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
lea r11, [rsp + 0x70]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x70]
mov edi, eax
test rcx, rcx
je 0x1400800dd
mov rdx, qword [rsp + 0xa8]
lea r8, [rsp + 0x68]
call fcn.14007ff48
mov rcx, qword [rsp + 0x70]
mov edi, eax
test rcx, rcx
je 0x1400800dd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x68]
call fcn.140044f24
xor ecx, ecx
inc esi
cmp esi, dword [rsp + 0x60]
jl 0x14007ffd9
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008b92c
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x3a0
mov rbx, rcx
mov rcx, rdx
mov ebp, r9d
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x38]
mov edi, eax
mov eax, 0xb4
mov r8d, 0x368
cmp edi, eax
cmovg edi, eax
xor r12d, r12d
xor edx, edx
mov qword [rsp + 0x30], r12
call fcn.1400b93b0
mov rax, qword [rsp + 0x3d0]
mov ecx, dword [rsp + 0x3d8]
mov qword [rsp + 0x2c0], rbx
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x3e0]
mov dword [rsp + 0x2dc], ecx
movsxd rbx, edi
lea rcx, [rsp + 0x124]
lea r8, [rbx + rbx]
mov rdx, rsi
mov qword [rsp + 0x50], rax
mov byte [rsp + 0xe0], 0x40
mov dword [rsp + 0x120], ebp
mov dword [rsp + 0x2b4], r12d
call fcn.1400177f8
lea rcx, [0x1400f2808]
mov word [rsp + rbx*2 + 0x124], r12w
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [0x1400f18ac]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
lea r8, [0x14008acbc]
mov edx, 0x20000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rax, r12
je 0x14008ba66
mov ebx, 0x270f
cmp dword [rsp + 0x120], ebp
jne 0x14008ba5d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x14008ba31
jmp 0x14008ba54
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x120], ebp
je 0x14008ba49
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ebx, byte [rsp + 0x2b4]
lea rcx, [0x1400f2808]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x3a0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1400a6fc8
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbx, r9
mov sil, r8b
mov bpl, dl
mov rdi, rcx
test rcx, rcx
jne 0x1400a6ff4
xor eax, eax
jmp 0x1400a7079
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [rsp + 0x58], 0
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x3c], eax
movsx eax, sil
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x98]
mov byte [rsp + 0x38], bpl
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x1400a7062
lea r8, [rsp + 0x20]
lea rdx, [0x14005cd50]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1400a7074
lea rdx, [rsp + 0x20]
lea rcx, [0x14005cd50]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x28]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400a7090
Capabilities:
Read file via mapping

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
lea r10, [rdx + r9]
mov rdi, r9
mov r9, r10
mov qword [r11 - 0x10], rax
xor edx, edx
shr r9, 0x20
mov ebx, r8d
mov dword [r11 - 0x18], r10d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x1400a7100
and qword [rsp + 0x20], 0
and ebx, 4
mov r8, rdi
or ebx, 8
mov r9d, edi
mov rcx, rax
shr ebx, 1
shr r8, 0x20
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a7938
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
mov rbp, rcx
mov rdi, r9
mov r12d, r8d
mov rsi, rdx
lea rcx, [rax - 0x18]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rax - 0x38], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
xor ebx, ebx
cmp eax, ebx
jne 0x1400a798a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a7aab
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, ebx
jne 0x1400a79c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x1400a7aab
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, ebx
jne 0x1400a79f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400a79b4
mov rcx, qword [rsp + 0x38]
mov edx, 4
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0x34]
lea rcx, [rsp + 0x48]
call fcn.14004bc80
mov rsi, qword [rsp + 0x48]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov r8, rsi
mov edx, 2
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea rdx, [0x1400d6cc0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [rsp + 0x30], ebx
jbe 0x1400a7a87
movzx r8d, byte [rsi]
lea rdx, str._02X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
inc ebx
add rdi, 2
inc rsi
cmp ebx, dword [rsp + 0x30]
jb 0x1400a7a64
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [rsp + 0x48]
call fcn.140044f24
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret

Function at 0x1400a7ac8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rcx, qword [0x1400f1ff0]
xor edx, edx
mov r8d, 0x408
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, rbx
jne 0x1400a7b00
mov ecx, 2
call fcn.14004b9a0
cmp eax, 4
je 0x1400a7ad4
lea rcx, [rdi + 8]
mov dword [rdi + 4], 0xaa55
mov dword [rdi], 0x400
mov qword [0x1400f2d00], rcx
mov eax, ebx
mov edx, 8
test al, 1
je 0x1400a7b2c
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400a7b2e
shr eax, 1
sub rdx, 1
jne 0x1400a7b1f
inc ebx
mov dword [rcx], eax
add rcx, 4
cmp ebx, 0x100
jl 0x1400a7b18
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret