joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400086c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rsp + 0x50]
xor esi, esi
mov byte [rcx + 0xc], al
mov rdi, rcx
movzx eax, byte [rsp + 0x58]
movzx ebx, r9b
mov byte [rcx + 0x44], al
lea rax, [0x140290f80]
mov dword [rcx + 0x3c], edx
lea edx, [rsi + 2]
mov qword [rcx], rax
mov dword [rcx + 0x38], 5
mov dword [rcx + 0x40], r8d
mov dword [rcx + 8], esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov dword [rcx + 0x20], esi
mov dword [rcx + 0x24], 5
mov dword [rcx + 0x28], 1
mov dword [rcx + 0x2c], 1
mov dword [rcx + 0x30], 1
mov dword [rcx + 0x34], 1
mov qword [rcx + 0x70], rsi
mov qword [rcx + 0x78], rsi
mov qword [rcx + 0x80], rsi
mov qword [rcx + 0x88], rsi
mov qword [rcx + 0x90], rsi
mov qword [rcx + 0x98], rsi
add rcx, 0xa0
call fcn.1401574d0
mov eax, dword [0x1402917cc]
mov dword [rdi + 0x6c], eax
mov rax, rdi
mov byte [rdi + 0x6f], bl
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x50], rsi
mov qword [rdi + 0x58], rsi
mov dword [rdi + 0x60], esi
mov byte [rdi + 0x64], sil
mov dword [rdi + 0x68], esi
mov dword [rdi + 0x100], esi
mov qword [rdi + 0x108], rsi
mov rsi, qword [rsp + 0x38]
mov qword [rdi + 0x48], 1
mov qword [rdi + 0xf0], 0x1dcd6500
mov qword [rdi + 0xf8], 0x1dcd6500
add rsp, 0x20
pop rdi
ret

Function at 0x14000c3e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x48
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140017c80
cmp qword [rax + 0x18], 8
jb 0x14000c3fb
mov rax, qword [rax]
mov rcx, rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000c416
test al, 0x10
je 0x14000c416
mov bl, 1
jmp 0x14000c418
xor bl, bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14000c456
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c451
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c463
call fcn.1401594f8
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.14015fc24
int3
Function at 0x14000c5b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
sub rsp, 0x68
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
mov rsi, r8
mov qword [rdx + 8], rax
mov rbx, rdx
test rcx, rcx
je 0x14000c6a1
test r8, r8
je 0x14000c6a1
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120089
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x40], 0
lea r8d, [r9 + 5]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c690
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000c687
mov edx, dword [rsp + 0x48]
mov rcx, rbx
cmp rsi, rdx
cmovb rdx, rsi
call fcn.14000cda0
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx]
mov rcx, rdi
mov rdx, qword [rbx]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c680
mov rcx, qword [rbx + 8]
sub rcx, qword [rbx]
mov eax, dword [rsp + 0x40]
cmp rax, rcx
je 0x14000c687
mov rax, qword [rbx]
mov qword [rbx + 8], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
mov rdi, qword [rsp + 0x60]
setne al
jmp 0x14000c6a3
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x68
pop rsi
pop rbx
ret
Function at 0x1400162e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea rbx, [rcx + 0x28]
mov rdi, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 0x10], 0
jne 0x140016344
xor eax, eax
xchg byte [rdi + 0x20], al
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rdi + 8]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400161f0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140016349
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor dil, dil
jmp 0x14001634c
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x48]
movzx eax, dil
add rsp, 0x30
pop rdi
ret

Function at 0x140016f00
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x260
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov rax, rcx
jb 0x140016f2f
mov rax, qword [rcx]
xor ebp, ebp
xor r9d, r9d
mov qword [rcx + 0x10], rbp
xor r8d, r8d
mov word [rax], bp
mov edx, 0x801a
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140017064
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bp
jne 0x140016f70
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400047e0
mov edx, 0x5c
mov rcx, rbx
call fcn.1400173e0
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0xd
jb 0x140016ff8
mov qword [rsp + 0x278], rsi
lea rsi, [rcx + 0xd]
mov qword [rsp + 0x280], rdi
mov rdi, rbx
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x140016fcc
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x1a
lea rdx, str.EasyAntiCheat
call fcn.14015b790
mov word [rdi + rsi*2], bp
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x278]
jmp 0x14001701b
movzx r8d, byte [rsp + 0x30]
lea r9, str.EasyAntiCheat
mov edx, reloc.WS2_32.dll_listen
mov qword [rsp + 0x20], reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.14000fae0
mov edx, 0x5c
mov rcx, rbx
call fcn.1400173e0
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140017035
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140017048
test al, 0x10
je 0x140017048
mov al, 1
jmp 0x140017066
cmp qword [rbx + 0x18], 8
jb 0x140017052
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
jmp 0x140017066
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140158fa0
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rbp
ret
Function at 0x140018720
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14037ae78], eax
jg 0x140018798
mov ecx, dword [0x1403755ec]
mov eax, dword [0x1403755e4]
mov r8d, dword [0x1403755e0]
ror eax, 5
sub r8d, eax
mov eax, dword [0x1403755e8]
mov edx, eax
add eax, ecx
ror edx, 0xf
xor edx, dword [0x1403755e4]
mov dword [0x1403755e4], eax
lea eax, [rcx + r8]
mov dword [0x1403755e8], eax
shl rax, 0x20
lea ecx, [rdx + r8]
mov dword [0x1403755e0], edx
mov dword [0x1403755ec], ecx
or rax, rcx
add rsp, 0x28
ret
lea rcx, [0x14037ae78]
call fcn.140159148
cmp dword [0x14037ae78], 0xffffffff
jne 0x140018740
rdtsc
shl rdx, 0x20
or rax, rdx
imul rcx, rax, 0x343fd
add rcx, 0x269ec3
shr rcx, 0x10
mov dword [0x1403755e4], ecx
rdtsc
shl rdx, 0x20
or rax, rdx
imul rdx, rax, 0x343fd
add rdx, 0x269ec3
shr rdx, 0x10
mov dword [0x1403755e8], edx
rdtsc
shl rdx, 0x20
lea rcx, [0x14037ae78]
or rax, rdx
imul rdx, rax, 0x343fd
add rdx, 0x269ec3
shr rdx, 0x10
mov dword [0x1403755ec], edx
call fcn.1401590e8
jmp 0x140018740
Function at 0x140018a70
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub rsp, 0x468
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x450], rax
cmp byte [0x14037a500], 0
je 0x140018aac
mov al, 1
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x468
ret
mov qword [rsp + 0x470], rbx
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov qword [rsp + 0x460], rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x30]
call fcn.140017610
lea rax, str.wintrust.dll
mov edx, 0x104
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0x240]
call fcn.1400176f0
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea r9, [rsp + 0x30]
mov edx, 0x104
mov rdi, rax
lea r8, str._s_s
lea rax, str.crypt32.dll
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x20], rax
call fcn.1400176f0
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rdi, rdi
je 0x140018cc3
test rax, rax
je 0x140018cc3
lea rdx, str.WinVerifyTrust
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a4e0], rax
test rax, rax
je 0x140018cc3
lea rdx, str.CryptDecodeObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a4e8], rax
test rax, rax
je 0x140018cc3
lea rdx, [0x140347880]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a508], rax
test rax, rax
je 0x140018cc3
lea rdx, str.CryptMsgGetParam
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a4c0], rax
test rax, rax
je 0x140018cc3
lea rdx, [0x1403478b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a518], rax
test rax, rax
je 0x140018cc3
lea rdx, [0x140347900]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a4f0], rax
test rax, rax
je 0x140018cc3
lea rdx, [0x1403478e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a4c8], rax
test rax, rax
je 0x140018cc3
lea rdx, [0x140347938]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a510], rax
test rax, rax
je 0x140018cc3
lea rdx, str.CertOpenSystemStoreW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a4f8], rax
test rax, rax
je 0x140018cc3
lea rdx, [0x140347968]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14037a4d0], rax
test rax, rax
je 0x140018cc3
lea rdx, str.CryptMsgClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx ecx, byte [0x14037a500]
mov edx, 1
test rax, rax
mov qword [0x14037a4d8], rax
cmovne ecx, edx
mov byte [0x14037a500], cl
jmp 0x140018cca
movzx ecx, byte [0x14037a500]
mov rdi, qword [rsp + 0x460]
movzx eax, cl
mov rbx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x468
ret
Function at 0x140019280
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rdx + 0x14]
xor r9d, r9d
movzx r11d, word [rdx + 6]
add rax, 0x18
add rax, rdx
mov rbx, r8
mov r10, rcx
test r11, r11
je 0x1400192cc
mov edx, dword [rax + 8]
test edx, edx
jne 0x1400192ad
mov edx, dword [rax + 0x10]
mov r8d, dword [rax + 0xc]
cmp r10, r8
jb 0x1400192c0
mov ecx, edx
add rcx, r8
cmp r10, rcx
jb 0x1400192d4
inc r9
add rax, 0x28
cmp r9, r11
jb 0x1400192a3
xor eax, eax
mov rbx, qword [rsp + 8]
ret
sub r8d, dword [rax + 0x14]
mov eax, r8d
sub r10, rax
lea rax, [rbx + r10]
mov rbx, qword [rsp + 8]
ret

Function at 0x1400192f0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r8
mov rsi, rdx
mov r9, rcx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x20], xmm1
xor ebp, ebp
mov qword [rsp + 0x30], rbp
cmp qword [rcx + 0x10], rbp
je 0x140019471
test rdx, rdx
je 0x140019471
mov rdi, rdx
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
cmp qword [r9 + 0x18], 8
jb 0x14001934c
mov r9, qword [r9]
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
mov rcx, r9
call fcn.14000c5b0
mov rdi, qword [rsp + 0x20]
test al, al
je 0x140019476
mov rcx, qword [rsp + 0x28]
sub rcx, rdi
test rdi, rdi
je 0x140019476
cmp rcx, 0x40
jb 0x140019476
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140019476
movsxd rdx, dword [rdi + 0x3c]
test edx, edx
jle 0x140019476
mov eax, edx
cmp rax, rcx
jae 0x140019476
mov eax, 0xffffffab
cmp rdx, rax
jae 0x140019476
lea rax, [rdx + 0x2c]
cmp rax, rcx
jae 0x140019476
lea rbx, [rdx + rdi]
cmp rbx, rdi
jb 0x140019476
lea rdx, [rbx + 0x108]
cmp rdx, rbx
jbe 0x140019476
lea rax, [rdi + rcx]
cmp rdx, rax
ja 0x140019476
cmp dword [rbx], 0x4550
jne 0x140019476
lea rdx, [rbx + 0x88]
movzx ecx, word [rbx + 4]
mov r8d, 0x200
bt cx, 8
mov rax, rdx
cmovae rax, rbp
and cx, r8w
cmove rdx, rax
test rdx, rdx
je 0x140019476
mov eax, dword [rdx + 0x70]
test eax, eax
je 0x140019476
mov ecx, eax
mov r8, rdi
mov rdx, rbx
call fcn.140019280
test rax, rax
je 0x140019476
movzx ecx, word [rbx + 0x18]
mov word [r14], cx
movups xmm0, xmmword [rax]
movaps xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsi + 0x30], xmm1
movsd xmm0, qword [rax + 0x40]
movsd qword [rsi + 0x40], xmm0
mov bl, 1
jmp 0x140019478
mov rdi, qword [rsp + 0x20]
xor bl, bl
test rdi, rdi
je 0x1400194ae
mov rdx, qword [rsp + 0x30]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400194a6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400194c9
mov rcx, rdi
call fcn.1401594f8
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14015fc24
int3
Function at 0x140019e40
Capabilities:
Check if process is running under wine

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14037ae98], eax
jg 0x140019fdb
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
cmp qword [rsi + 0x10], 0
je 0x140019fc2
mov rdi, qword [0x14037aea8]
test rdi, rdi
je 0x140019fc2
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140017c80
nop
cmp qword [rax + 0x18], 8
jb 0x140019eca
mov rax, qword [rax]
mov rcx, rax
mov rax, rdi
call qword [case.0x1401289aa.0]
mov rdi, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140019f1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a033
call fcn.1401594f8
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bp
test rdi, rdi
je 0x140019fc2
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x140019f51
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140004930
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400045b0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140019fae
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019fa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019fd5
call fcn.1401594f8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.14015fc24
int3
lea rcx, [0x14037ae98]
call fcn.140159148
cmp dword [0x14037ae98], 0xffffffff
jne 0x140019e7d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a018
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14001a01b
mov rax, rbp
mov qword [0x14037aea8], rax
lea rcx, [0x14037ae98]
call fcn.1401590e8
jmp 0x140019e7d
call fcn.14015fc24
int3
Function at 0x14001c070
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x58
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rcx + 0x10]
mov rbx, rcx
test rbp, rbp
je 0x14001c22f
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rbp
cmp rax, 9
jb 0x14001c249
cmp qword [rbx + 0x18], 0x10
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
mov r14, rbx
mov qword [r11 - 0x18], r15
jb 0x14001c0cf
mov r14, qword [rbx]
xor edx, edx
lea r15, [rbp + 9]
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], rdx
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x38], rdx
cmp r15, rsi
jbe 0x14001c16e
mov rsi, r15
or rsi, 0xf
cmp rsi, rcx
jbe 0x14001c104
mov rsi, rcx
jmp 0x14001c110
mov eax, socket
cmp rsi, rax
cmovb rsi, rax
mov rcx, rsi
mov rax, 0xffffffffffffffff
add rcx, 1
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001c157
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001c24f
mov rcx, rax
call fcn.140159258
test rax, rax
je 0x14001c243
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001c169
test rcx, rcx
je 0x14001c166
call fcn.140159258
mov rdi, rax
jmp 0x14001c169
mov rdi, rdx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov qword [rsp + 0x30], r15
mov rdx, r14
mov qword [rsp + 0x38], rsi
mov rcx, rdi
call fcn.14015b790
movsd xmm0, qword [str..metadata]
movsd qword [rdi + rbp], xmm0
movzx eax, byte [0x140347bc8]
mov byte [rdi + rbp + 8], al
mov byte [rdi + r15], 0
cmp qword [rbx + 0x18], 0x10
jb 0x14001c1ad
mov rbx, qword [rbx]
test rbx, rbx
je 0x14001c1bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x20]
cmp rax, 0x10
jb 0x14001c1d5
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14001c1e5
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
cmp rax, 0x10
jb 0x14001c215
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c210
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c243
call fcn.1401594f8
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x58
pop rbp
pop rbx
ret
call fcn.14015fc24
int3
call fcn.140001b10
int3
call fcn.140001a70
int3
Function at 0x14001c700
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rdx
xor sil, sil
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
xor edi, edi
mov qword [rsp + 0x58], rdi
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14001c747
mov rax, qword [rdx]
mov qword [rdx + 0x10], rdi
mov byte [rax], 0
cmp qword [rcx + 0x10], 0
je 0x14001c8b9
cmp qword [rcx + 0x18], 0x10
jb 0x14001c763
mov rcx, qword [rcx]
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0x48]
call fcn.14000c470
test al, al
je 0x14001c8b9
mov dword [rsp + 0x30], setsockopt
mov dword [rsp + 0x20], 0xf0000000
mov ebp, 1
mov r9d, ebp
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14001c8bc
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14001c81f
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
sub r8, rdx
xor r9d, r9d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14001c814
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x60]
lea edx, [rbp + 1]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
movzx esi, sil
test eax, eax
cmovne esi, ebp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test sil, sil
je 0x14001c8bc
lea r14, [0x1402917f0]
nop dword [rax]
movzx eax, byte [rsp + rdi + 0x60]
mov rdx, qword [r14 + rax*8]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14001c850
mov rcx, rbx
call fcn.140004a90
inc rdi
cmp rdi, 0x14
jb 0x14001c840
mov r10, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001c881
mov r9, qword [rbx]
add r10, r9
mov rbx, r9
jmp 0x14001c887
add r10, rbx
mov r9, rbx
cmp r9, r10
je 0x14001c8bc
sub rbx, r9
nop
movsx r8d, byte [r9]
lea edx, [r8 - 0x41]
movzx eax, r8b
or al, 0x20
movzx ecx, al
movzx eax, r8b
cmp edx, 0x19
cmova ecx, eax
mov byte [rbx + r9], cl
inc r9
cmp r9, r10
jne 0x14001c890
jmp 0x14001c8bc
xor sil, sil
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001c8f4
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c8ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c91d
call fcn.1401594f8
movzx eax, sil
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140158fa0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14015fc24
int3
Function at 0x14001ea00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001eae0
cmp byte [rcx + 0x71], 0
je 0x14001eae0
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x1401289aa.0]
cmp eax, 0xffffffff
je 0x14001eadc
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x1401289aa.0]
test eax, eax
je 0x14001eaa2
sub eax, 1
je 0x14001eaa6
cmp eax, 2
jne 0x14001eadc
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001ead3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140165680
cmp rdi, rax
jne 0x14001eadc
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001ea8a
xor al, al
jmp 0x14001ea8a
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x60
pop rbx
ret