joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400574c0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14008cf10]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140057528
mov r9d, 2
mov dword [rsp + 0x20], 3
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14005f380
test al, al
je 0x14005751c
mov dword [0x14008cf10], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x14008cf10], 1
jmp 0x14005752d
cmp eax, 2
je 0x14005757f
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14005755e
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x14005757f
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x140058110
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x14008c7c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, qword [rcx]
mov rsi, r9
mov rdi, rcx
mov rbp, r8
mov r14, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [r14 + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x1400581b3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140058177
mov dword [rsi], 0x51
jmp 0x1400581ac
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, ebx
call fcn.140037160
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.140022bd0
mov rax, qword [rdi + 8]
mov dword [rax + 0xc8c], ebx
mov dword [rsi], gethostname
mov rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu__fd_qd______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x30], edx
mov rdx, qword [r14 + 0x98]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdi]
call fcn.140022d10
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006d400
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140058200
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x14008c7c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
mov r9, qword [rbx + 0x98]
cmp r9, 0xffffffffffffffff
je 0x14005834e
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax + 0x360]
test dword [rcx + 0x8c], 0x800
jne 0x14005834e
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
mov rcx, r9
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400582de
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.140037160
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140022bd0
mov eax, 2
jmp 0x140058350
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x140]
lea r8, [rbx + 0x10e]
lea rcx, [rsp + 0x30]
call fcn.1400253a0
test al, al
jne 0x14005834e
mov qword [rsp + 0x1e0], rdi
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov ebx, dword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.140037160
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140022bd0
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x140058350
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14006d400
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret
Function at 0x14006a050
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x14006a08b
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14006a089
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006b5c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x14006b603
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x14006b650
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x14006b6b2
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x14006b670
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x14006b6f1
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1400802c9]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400802ca]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x14006b6c0
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x14006b8e0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14008c7c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_27
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14006b92c
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14006b9ff
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14006b970
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x14006b9ff
mov rcx, rbp
call fcn.1400269d0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14006b9db
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14006b9eb
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006b9fd
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006d400
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14006c7c0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x14006c825
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x14006c7d0
ret
Function at 0x14006c830
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14008c7c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14006c8b3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14006c8d5
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006d400
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.1400269d0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x14006c934
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14006c944
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006c956
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x14006c8b8

Function at 0x14006c964
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14006c99e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14006c9a3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14006c9ec
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14006c9ec
dec r8
sub rdx, 1
jne 0x14006c9d2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14006d054
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.14006ca7c
mov ebx, eax
test eax, eax
jne 0x14006d084
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14006d0e7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006d0de
test al, 0x10
je 0x14006d0de
bt eax, 0xa
jae 0x14006d0d7
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.14006d0f8
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14006d0d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14006d0d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x14006d0de
and dword [rsp + 0x3c], 0
jmp 0x14006d0e3
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006e208
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006e252
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006e252
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006e252
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006e252
cmp dword [rcx + 0x84], 0xe
jbe 0x14006e252
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006e254
xor al, al
add rsp, 0x28
ret
Function at 0x14002ea40
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x28
call fcn.1400797b8
mov qword [rbp - 8], rax
mov rcx, rax
mov rdx, rbx
call fcn.14002ec40
mov r9, qword [rbp - 8]
mov qword [r9 + 0x20], rdi
mov qword [rbp - 0x10], r9
lea rdi, [rsi + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x14002eba0]
xor ecx, ecx
xor edx, edx
call fcn.14008d220
mov qword [rsi], rax
test rax, rax
je 0x14002eab5
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov dword [rdi], 0
mov ecx, 6
call fcn.14007aaa4
int3
Function at 0x140074d80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
cmp edx, 0xffffffff
je 0x140074e9a
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140074dcb
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x140074dcb
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x140074edd
cmp qword [rdi + 0x80], 0
je 0x140074e9e
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x140074e05
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140074ea5
mov byte [rsp + 0x4f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x50]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x4f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x140074ebd
mov r15, qword [rsp + 0x50]
sub r15, r14
je 0x140074e8a
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call fcn.140091e50
cmp r15, rax
jne 0x140074edb
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x58], rbx
mov eax, 0xffffffff
jmp 0x140074ed6
xor esi, esi
jmp 0x140074edd
mov esi, 0xffffffff
jmp 0x140074edd
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call fcn.140091688
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x140074edd
cmp eax, 3
jne 0x140074edb
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x4f]
call fcn.140091688
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140075320
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x1400753b6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400753bd
mov r15, rsi
jmp 0x14007537b
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.1400ab0b0
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x1400753ae
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140075393
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x140075350
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400753ae
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x14007537b
sub rsi, r15
jmp 0x1400754aa
xor esi, esi
jmp 0x1400754aa
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140075410
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140075410
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.1400ab0b0
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x140075421
jmp 0x1400754a7
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x1400754a7
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x140075450
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x140075483
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.140091a48
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140075450
jmp 0x1400754a7
test r14, r14
je 0x1400754a4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.140091a48
sub r14, rax
jmp 0x1400754a7
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400754c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140075559
mov r14, rsi
test rsi, rsi
jle 0x1400755cd
mov r14, rsi
jmp 0x14007551f
cmp r14, r15
cmovb r15, r14
mov rdx, rdi
mov r8, r15
call fcn.1400ab0b0
add rdi, r15
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jle 0x1400755cd
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140075537
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jg 0x1400754f0
movzx edx, byte [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400755cd
inc rdi
dec r14
test r14, r14
jg 0x14007551f
jmp 0x1400755cd
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400755a6
test rsi, rsi
jle 0x1400755a6
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x1400755a6
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call fcn.1400ab0b0
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x1400755ae
jmp 0x1400755cd
mov r14, rsi
test r14, r14
jle 0x1400755cd
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x1400755cd
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.140091e50
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140075960
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov al, 1
cmp qword [rcx + 0x68], 0
je 0x1400759f8
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x1400759f8
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400759f6
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x140075a00
cmp eax, 1
je 0x1400759c7
test eax, eax
jne 0x1400759f6
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1400759ed
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call fcn.140091e50
cmp rbx, rax
jne 0x1400759f6
cmp byte [rsi + 0x71], 0
sete al
jmp 0x1400759f8
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov al, 1
jmp 0x1400759f8

Function at 0x140076d50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret

Function at 0x140083258
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400832a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400832a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400832a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400832a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400832a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400832a4
xor al, al
add rsp, 0x28
ret
Function at 0x14008d42c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14008d55c

Function at 0x140093ec0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140093ee8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140093ee8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400a1ca4
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400a1cac
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400a1ce2
call fcn.14008f848
mov dword [rax], 0x16
call fcn.140090030
jmp 0x1400a1e2d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400a1e2d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400a1e2d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400a1d11
lock or dword [rcx + 0x14], 0x10
jmp 0x1400a1e2d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400a1d25
call fcn.1400a41f4
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400a1d35
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400a1d38
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14009c03c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400a229c
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400a1e1b
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400a1dc9
mov rcx, rbx
call fcn.14009c03c
cmp eax, 0xffffffff
je 0x1400a1db4
mov rcx, rbx
call fcn.14009c03c
cmp eax, 0xfffffffe
je 0x1400a1db4
mov rcx, rbx
call fcn.14009c03c
movsxd rdi, eax
lea r14, [0x1400d64a0]
mov rcx, rbx
sar rdi, 6
call fcn.14009c03c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400a1dbb
lea rdx, [0x1400ceb50]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400a1dc9
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400a1ded
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1400a1ded
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1400a1ded
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1400a1e0b
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1400a1e16
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400a1e32
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x100411cb0
Capabilities:
Authenticate hmac

Disassembly:
cmpsd dword [rsi], dword [rdi]
xor al, 0x97
xor al, 0xa6
xor al, 0x9d
xor al, 0xa4
xor al, 0x97
xor al, 0x9d
xor al, 0x27
xor al, 0xa2
xor al, 0x6e
xor al, 0x54
xor al, 0x70
xor al, 0x9a
xor al, 0xa3
xor al, 0xa2
xor al, 0xa8
xor al, 0x54
push rsp
xor al, 0x9a
xor al, 0xa3
xor al, 0xa6
xor al, 0x99
xor al, 0x9b
xor al, 0xa6
xor al, 0xa3
xor al, 0xa9
test eax, 0x9834a234
xor al, 0x61
xor al, 0x97
xor al, 0xa3
xor al, 0xa0
xor al, 0xa3
xor al, 0xa6
cmpsb byte [rsi], byte [rdi]
xor al, 0x71
xor al, 0x56
xor al, 0x86
xor al, 0x7b
xor al, 0x76
xor al, 0x7d
xor al, 0x56
xor al, 0x72
xor al, 0x79
xor al, 0xa7