joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b5d0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140091240]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140095ad8], eax
inc eax
cmp eax, 1
jne 0x14002b61f
mov ecx, 2
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140095adc], eax
test bl, bl
je 0x14002b631
xor ebx, ebx
lock xadd dword [0x140095adc], ebx
test ebx, ebx
jne 0x14002b655
mov rax, rdi
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140036b80
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov rax, qword gs:[0x58]
mov edx, 4
mov dword [rsp + 0x24], 0
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140095ac0], eax
jle 0x14002b6a6
lea rcx, [0x140095ac0]
call fcn.140036ebc
cmp dword [0x140095ac0], 0xffffffff
jne 0x14002b6a6
lea rcx, [0x140055390]
call fcn.140036dd0
lea rcx, [0x140095ac0]
call fcn.140036e50
lea rax, [0x140091e30]
mov dword [rsp + 0x20], ebx
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.14002c310
int3

Function at 0x14002ba70
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140091240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140095ae0], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x14002baed
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140036b80
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.140002120]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140036b80
add rsp, 0x40
pop rbx
ret
Function at 0x14002c9f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x140091240]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov eax, ebx
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x14002ca46
call fcn.14002c360
mov dword [rbp - 0x59], ebx
lea rax, [0x140091f48]
mov qword [rbp - 0x51], rax
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x14002cb33
mov dword [rbp + 0x17], ebx
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], rbx
lea rcx, [rbp + 0x1f]
call fcn.1400360b8
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
xor eax, eax
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], rax
lea rax, [rdi + 0x28]
test rdi, rdi
cmove rax, rbx
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 0x51], rax
mov ecx, dword [0x140095af8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x59]
mov ecx, dword [0x140095af8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rbp - 0x39]
mov rcx, rdi
call fcn.14002c4b0
test rax, rax
je 0x14002caf3
nop word [rax + rax]
lea rax, [rbx + 1]
cmp rbx, 0xffffffffffffffff
cmove rax, rbx
mov rbx, rax
mov r9, rsi
lea r8, [rbp - 0x39]
mov rcx, rdi
call fcn.14002c4b0
test rax, rax
jne 0x14002cad0
mov rdx, qword [rbp - 0x49]
mov ecx, dword [0x140095af8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rdi, [rbp - 0x39]
mov esi, 0xa
nop dword [rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14002cb1d
call fcn.140036b60
add rdi, 8
sub rsi, 1
jne 0x14002cb10
lea rcx, [rbp + 0x1f]
call fcn.140036144
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140036b80
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030550
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140030577
add rcx, 8
call fcn.14002e730
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400305c3
mov ecx, dword [0x140095af8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400305b3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400305b3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400305ce
inc ecx
inc rax
cmp rax, 6
jl 0x1400305a1
mov rcx, rbx
call fcn.140036b60
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x80]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140030680
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400306a7
add rcx, 8
call fcn.14002ed70
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400306f3
mov ecx, dword [0x140095af8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400306e3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400306e3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400306fe
inc ecx
inc rax
cmp rax, 6
jl 0x1400306d1
mov rcx, rbx
call fcn.140036b60
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x90]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140031b40
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
lea rsi, [0x140091e18]
mov rcx, qword [0x140091e18]
cmp rcx, rsi
je 0x140031b83
test byte [rcx + 0x1c], 1
je 0x140031b83
mov edx, ntohl
lea r8, [0x140083290]
mov rcx, qword [rcx + 0x10]
call fcn.140001790
mov rdx, rbx
mov rcx, rdi
call fcn.140031d20
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140031b9b
mov rcx, qword [rbx]
mov dword [rsp + 0x20], 0x10000000
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, rax
mov qword [rdi], rax
test rax, rax
je 0x140031c6f
mov eax, dword [rbx + 0xcc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0xc8]
mov r8d, dword [rbx + 0xc4]
mov edx, dword [rbx + 0xc0]
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
je 0x140031cc0
xor r9d, r9d
mov r8d, 0x1200000
lea rdx, [0x1400321b0]
mov rcx, qword [rdi]
call qword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
cmp rax, 0xffffffffffffffff
je 0x140031c1e
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x140091e18]
cmp rcx, rsi
je 0x140031c50
test byte [rcx + 0x1c], 4
je 0x140031c50
mov edx, reloc.WS2_32.dll_ntohs
mov r9d, eax
lea r8, [0x140083290]
mov rcx, qword [rcx + 0x10]
call fcn.1400082f0
lea rdx, str.Failed_to_set_HTTP_status_callback.
lea rcx, [rsp + 0x30]
call fcn.14001d570
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.14001e750
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x140091e18]
cmp rcx, rsi
je 0x140031ca1
test byte [rcx + 0x1c], 4
je 0x140031ca1
mov edx, reloc.WS2_32.dll_listen
mov r9d, eax
lea r8, [0x140083290]
mov rcx, qword [rcx + 0x10]
call fcn.1400082f0
lea rdx, str.Failed_to_open_HTTP_session.
lea rcx, [rsp + 0x30]
call fcn.14001d570
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.14001e750
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x140091e18]
cmp rcx, rsi
je 0x140031cf2
test byte [rcx + 0x1c], 4
je 0x140031cf2
mov edx, reloc.WS2_32.dll_ntohl
mov r9d, eax
lea r8, [0x140083290]
mov rcx, qword [rcx + 0x10]
call fcn.1400082f0
lea rdx, str.Failed_to_set_HTTP_timeouts.
lea rcx, [rsp + 0x30]
call fcn.14001d570
nop
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.14001e750
int3
Function at 0x140035260
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14003529a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003529f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400352e8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140074bb0]
cmp byte [rcx + rax], 0
je 0x1400352e8
dec r8
sub rdx, 1
jne 0x1400352ce
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140037b58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140037ba2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140037ba2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140037ba2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140037ba2
cmp dword [rcx + 0x84], 0xe
jbe 0x140037ba2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140037ba4
xor al, al
add rsp, 0x28
ret

Function at 0x1400405f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140040627
call fcn.14003cf7c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14003cc38
xor eax, eax
jmp 0x1400406b5
mov rdx, r9
mov rcx, r8
call fcn.14004058c
mov rbx, rax
test rax, rax
je 0x1400406b2
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400404b8]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14004069f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003cef0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140040686
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140040695
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140044b7c
jmp 0x1400406b2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400406af
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140042188
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400421f7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400421f7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400421f7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400421f7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400421f7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400421f7
cmp dword [rcx + 0xf8], 0
je 0x1400421f7
mov ecx, ebx
call fcn.1400422a8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140042084
nop
cmp dword [rbp + 0x20], 0
je 0x140042245
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140042250
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140042188

Function at 0x14004238c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140042188
Function at 0x14004a198
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14004a21f
mov rsi, rbx
cmp word [rax], bp
je 0x14004a1de
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14004a1c8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14004a1c4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140045594
mov rdi, rax
test rax, rax
je 0x14004a20c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140052470
mov rbp, rdi
xor ecx, ecx
call fcn.140044b7c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004ccac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140044fe8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14004cd4d
cmp ebx, dword [rsp + 0x30]
je 0x14004cd46
test esi, esi
je 0x14004cd46
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14004cd21
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14004cd2e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14004cd0b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14004cd32
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14004cd4f
mov eax, 1
jmp 0x14004cd4f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140051d10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140051d38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140051d38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400012d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x14000138c
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.140013cf0
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x140001350
sub eax, ebx
jmp 0x140001352
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x140001340
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x140001380
sub eax, ebx
jmp 0x140001382
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x140001370
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x14000147c
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.140001080
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x1400013f4
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x14000140a
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1400012f0
mov ecx, dword [rdi + 0x1718]
mov esi, dword [rdi + 0x58]
cmp ecx, esi
jae 0x14000147c
mov eax, dword [rdi + 0x94]
lea ebx, [r9 + rax]
cmp ecx, ebx
jae 0x14000144e
sub esi, ebx
mov eax, 0x102
mov ecx, ebx
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, esi
call fcn.140018a40
lea r11d, [rsi + rbx]
mov dword [rdi + 0x1718], r11d
jmp 0x14000147c
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x14000147c
sub ebx, ecx
sub esi, ecx
mov eax, 0x102
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, ebx
call fcn.140018a40
add dword [rdi + 0x1718], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003f10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov r15, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x140003f2c
test rax, rax
jne 0x140003f40
xor eax, eax
jmp 0x14000403d
mov ecx, 0x18
call fcn.140007580
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140003f39
xor eax, eax
mov rdi, rsi
mov ecx, 0x238
rep stosb byte [rdi], al
mov rax, qword [0x1400a07b8]
mov dword [rsi], 0x238
test rax, rax
jne 0x140003f8b
lea edx, [rax + 0x2b]
xor ecx, ecx
call fcn.140007338
mov qword [0x1400a07b8], rax
test rax, rax
jne 0x140003f8b
mov eax, ebx
jmp 0x140003f93
mov rdx, rsi
mov rcx, rbp
call rax
test eax, eax
je 0x140004025
lea r14, [rsi + 0x130]
mov ecx, ebx
test r14, r14
je 0x140003fd2
or rax, 0xffffffffffffffff
inc rax
cmp byte [r14 + rax], bl
jne 0x140003fad
test eax, eax
je 0x140003fd2
mov rdx, r14
mov edi, eax
movsx eax, byte [rdx]
imul ecx, ecx, 0x811c9dc5
inc rdx
xor ecx, eax
dec rdi
jne 0x140003fbf
shr ecx, 1
mov rdx, r15
add dword [0x1400a0710], ecx
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140004020
mov rax, qword [0x1400a07b0]
test rax, rax
jne 0x140004012
lea edx, [rax + 0x2c]
xor ecx, ecx
call fcn.140007338
mov qword [0x1400a07b0], rax
test rax, rax
jne 0x140004012
mov eax, ebx
jmp 0x14000401a
mov rdx, rsi
mov rcx, rbp
call rax
test eax, eax
je 0x140004025
jmp 0x140003fa2
mov ebx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x238
mov rcx, rsi
call fcn.140010a84
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006120
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rsp + 0x28], rax
call fcn.140005744
xor ebx, ebx
test eax, eax
je 0x140006147
mov eax, 1
jmp 0x1400061bd
call fcn.140004050
test eax, eax
jne 0x140006140
call fcn.140005e80
test eax, eax
jne 0x140006140
lea rdx, [rsp + 0x20]
lea rcx, [0x140005bbc]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [rsp + 0x20], ebx
jne 0x140006140
call fcn.1400046b8
test eax, eax
jne 0x140006140
call fcn.140005ad4
test eax, eax
jne 0x140006140
call fcn.1400067f8
test eax, eax
jne 0x140006140
call fcn.140006628
test eax, eax
jne 0x140006140
mov edx, 0xce4
mov ecx, 0x898
call fcn.140011430
call fcn.140004c1c
test eax, eax
jne 0x140006140
call fcn.1400066ec
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140012b40
add rsp, 0x30
pop rbx
ret

Function at 0x1400066ec
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, 0x104
lea rcx, [rsp + 0x131]
xor ebx, ebx
mov r8d, edi
xor edx, edx
mov byte [rsp + 0x130], bl
call fcn.140018a40
lea rcx, [rsp + 0x21]
mov r8d, edi
xor edx, edx
mov byte [rsp + 0x20], bl
call fcn.140018a40
mov edi, ebx
mov esi, 0x105
lea rcx, str.__jCc:bk_dcReh_0oYRWbZf
lea rdx, [rsp + 0x130]
mov r8d, esi
mov rcx, qword [rdi + rcx]
call fcn.14000fe00
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
call fcn.140018a40
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x14000679e
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140013330
test eax, eax
je 0x1400067ad
add rdi, 8
cmp rdi, 0x290
jae 0x1400067b2
jmp 0x14000674a
mov ebx, 1
lea rcx, [rsp + 0x130]
mov rdx, rsi
call fcn.140010a84
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.140010a84
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140006abc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x310
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov edi, 0x104
lea rcx, [rbp - 0x1f]
xor ebx, ebx
mov r8d, edi
xor edx, edx
mov byte [rbp - 0x20], bl
call fcn.140018a40
lea rcx, [rbp + 0xf1]
mov r8d, edi
xor edx, edx
mov byte [rbp + 0xf0], bl
call fcn.140018a40
lea r8d, [rbx + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
mov dword [rsp + 0x70], ebx
call fcn.140018a40
xor eax, eax
lea esi, [rdi + 1]
lea rdx, [rbp + 0xf0]
lea rcx, str.ee77J7:FF
mov r8d, esi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.14000fe00
lea edx, [rbx + 0x68]
xor eax, eax
mov ecx, edx
lea rdi, [rsp + 0x70]
lea r15d, [rbx + 1]
rep stosb byte [rdi], al
mov dword [rsp + 0x70], edx
lea rdi, [rsp + 0x50]
lea ecx, [rbx + 0x18]
lea r14d, [rbx + 5]
mov r8d, esi
rep stosb byte [rdi], al
lea rcx, [rbp - 0x20]
xor edx, edx
mov dword [rbp - 0x54], r15d
mov word [rbp - 0x50], r14w
call fcn.140018a40
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xf0]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x140006c1a
lea rcx, [rbp - 0x20]
mov edx, 0x5c
call fcn.140012f94
test rax, rax
je 0x140006bc4
mov byte [rax], bl
lea rax, [rsp + 0x50]
lea rcx, [rbp - 0x20]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x28], ebx
call fcn.14000747c
test eax, eax
jne 0x140006bfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r14d
cmovne ebx, r15d
lea rcx, [rbp + 0xf0]
mov rdx, rsi
call fcn.140010a84
lea rcx, [rbp - 0x20]
mov rdx, rsi
call fcn.140010a84
mov eax, ebx
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400083e8
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140008467
lea r9d, [rax + 1]
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400084c3
mov rcx, qword [rsp + 0x30]
mov edi, 0x20
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1400084ac
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140013cc8
call fcn.140013c9c
and eax, 0x800000ff
jge 0x1400084a2
dec eax
or eax, 0xffffff00
inc eax
mov byte [rbx], al
inc rbx
dec rdi
jne 0x14000848d
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400084be
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140012b40
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret