joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039d10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
xor edi, edi
lea r9, [rsp + 0x58]
xor bl, bl
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140039d44
mov edi, dword [rsp + 0x58]
mov bl, 1
test rsi, rsi
mov al, bl
je 0x140039d50
mov ecx, edi
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140039fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
lea rdx, [rsp + 0x58]
call fcn.140039d60
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14003a045
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140039e00
test al, al
je 0x14003a069
mov eax, dword [rsp + 0x40]
test rbx, rbx
je 0x14003a04c
mov dword [rbx], eax
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004c890
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
xor al, al
jmp 0x14003a04e

Function at 0x14003a0b0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
call fcn.140039d60
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x38
ret

Function at 0x14003a0f0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x14003a110
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
call fcn.140039d60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x38
ret

Function at 0x14003a150
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x14003a190
Capabilities:
Copy file

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
lea r8, [0x14003a170]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x14003a1d0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140006d20
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14003a1d0
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x14003a790
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rsp + 0x60]
mov rax, r9
mov rbp, rdx
mov qword [rbx], 0
mov edx, dword [rax]
mov rsi, r8
lea r8, [r9 + 4]
xor r9d, r9d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14003a7f8
mov r9, rbx
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003a7f8
cmp qword [rbx], 0
setne al
jmp 0x14003a7fa
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003b770
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov dword [rsp + 0x58], 1
call fcn.14003b6e0
test rax, rax
mov rsi, rax
jne 0x14003b7ef
mov rcx, qword [0x140080018]
lea rdi, [0x140080018]
cmp rcx, rdi
je 0x14003b7e2
test byte [rcx + 0x1c], 1
je 0x14003b7e2
cmp byte [rcx + 0x19], 5
jb 0x14003b7e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140080018]
lea r8, [0x14006e3b0]
mov rcx, qword [rcx + 0x10]
mov r9, rbp
mov dx, 0xb
mov dword [rsp + 0x20], eax
call fcn.14003b600
mov rcx, qword [0x140080018]
xor ebx, ebx
mov eax, ebx
mov dword [rsp + 0x58], ebx
jmp 0x14003b885
lea rax, [rsp + 0x60]
lea rdx, str.LockDownEnabled
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
lea rdi, [0x140080018]
test eax, eax
je 0x14003b872
mov rax, qword [0x140080018]
cmp rax, rdi
je 0x14003b86e
test byte [rax + 0x1c], 1
je 0x14003b86e
cmp byte [rax + 0x19], 5
jb 0x14003b86e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140080018]
lea r8, [0x14006e3b0]
mov rcx, qword [rcx + 0x10]
mov r9, rbp
mov dx, 0xc
mov dword [rsp + 0x20], eax
call fcn.14003b600
mov dword [rsp + 0x58], ebx
mov rcx, rsi
call fcn.140039380
mov eax, dword [rsp + 0x58]
mov rcx, qword [0x140080018]
cmp rcx, rdi
je 0x14003b8b5
test byte [rcx + 0x1c], 1
je 0x14003b8b5
cmp byte [rcx + 0x19], 5
jb 0x14003b8b5
mov rcx, qword [rcx + 0x10]
lea r8, [0x14006e3b0]
mov r9, rbp
mov dx, 0xd
mov dword [rsp + 0x20], eax
call fcn.140001330
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test eax, eax
setne al
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003bbd0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, rcx
mov qword [rsp + 0x70], rdi
call fcn.140036f70
lea r9, [rsp + 0x70]
mov rbx, rax
lea rax, [rsp + 0x68]
lea edx, [rdi + 2]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
mov rcx, rbx
mov ebp, eax
call fcn.140038240
test ebp, ebp
jne 0x14003bcb9
cmp qword [rsp + 0x70], rdi
je 0x14003bcb9
lea rdx, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x78], rdi
call fcn.14003b8d0
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
mov ebx, eax
je 0x14003bc6d
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test ebx, ebx
jne 0x14003bca9
mov rcx, qword [0x140080018]
lea rdx, [0x140080018]
cmp rcx, rdx
je 0x14003bca7
test byte [rcx + 0x1c], 1
je 0x14003bca7
cmp byte [rcx + 0x19], 5
jb 0x14003bca7
mov rcx, qword [rcx + 0x10]
lea r8, [0x14006e3b0]
mov r9, rsi
mov dx, FDICreate
call fcn.1400012a0
test ebx, ebx
setne al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x140080018]
lea rdx, [0x140080018]
cmp rcx, rdx
je 0x14003bcf3
test byte [rcx + 0x1c], 1
je 0x14003bcf3
cmp byte [rcx + 0x19], 2
jb 0x14003bcf3
mov rcx, qword [rcx + 0x10]
lea r8, [0x14006e3b0]
mov r9, rsi
mov dx, FDICreate
mov dword [rsp + 0x20], ebp
call fcn.14003b600
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003c8b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rdi
sub rsp, 0x48
xor edi, edi
lea rcx, str..WGUARDNT
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14003c936
mov qword [rsp + 0x30], rdi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14003c936
mov rbx, rdi
jmp 0x14003c96d
test rbx, rbx
je 0x14003c96d
cmp rbx, 0xffffffffffffffff
je 0x14003c96d
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call fcn.14003b6b0
lea rcx, [rsp + 0x78]
lea rdx, str.SOFTWAREMcAfeeSystemCoreVSCORE
or eax, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov r9d, eax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003ca21
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
lea rdx, str.LockdownEnabled
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x60]
cmp dword [rsp + 0x68], r11d
je 0x14003ca16
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea rdx, str.LockdownEnabled
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14003b6b0
lea rdx, [rsp + 0x78]
xor r8d, r8d
or eax, 3
mov qword [rsp + 0x20], rdx
lea rdx, str.SOFTWAREMcAfeeVSCORE
mov r9d, eax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003cad5
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
lea rdx, str.LockdownEnabled
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x60]
cmp dword [rsp + 0x68], r11d
je 0x14003caca
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea rdx, str.LockdownEnabled
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14003cae9
cmp rbx, 0xffffffffffffffff
je 0x14003cae9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x14003cb00
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x110
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
cmp byte [0x14008cec0], 0
mov qword [r11 - 0x10], rbp
mov rsi, rdx
mov rbp, rcx
jne 0x14003cc90
mov qword [r11 + 0x18], rbx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x9c
mov qword [r11 - 0x18], rdi
mov byte [0x14008cec0], 1
call fcn.14004c980
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14003cbb0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x64]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x14003cbb0
movsx edi, byte [rsp + rcx + 0x63]
lea eax, [rdi - 0x31]
cmp eax, 8
ja 0x14003cbb0
sub di, 0x30
mov word [rsp + 0xe4], di
jmp 0x14003cbb8
mov di, word [rsp + 0xe4]
cmp dword [rsp + 0x60], 2
jne 0x14003cbd7
movzx eax, byte [rsp + 0xea]
mov ecx, 1
test eax, eax
cmove eax, ecx
mov dword [0x14008cebc], eax
mov eax, dword [rsp + 0x54]
xor ebx, ebx
lea ecx, [rax + rax*4]
mov eax, dword [rsp + 0x58]
lea ecx, [rax + rcx*2]
movzx eax, di
lea edx, [rcx + rcx*4]
lea ecx, [rax + rdx*2]
movzx eax, word [rsp + 0xe6]
lea edx, [rcx + rcx*4]
lea ecx, [rax + rdx*2]
mov dword [0x14008ceb8], ecx
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x14003cc2c
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
xor eax, eax
test rbx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
je 0x14003cc5a
lea rcx, [rsp + 0x20]
call rbx
jmp 0x14003cc65
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
test rdi, rdi
mov rbx, qword [rsp + 0x130]
je 0x14003cc7b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [rsp + 0x20]
mov rdi, qword [rsp + 0x100]
mov dword [0x14008ceb4], eax
jmp 0x14003cc96
mov eax, dword [0x14008ceb4]
test rbp, rbp
je 0x14003cc9e
mov dword [rbp], eax
test rsi, rsi
mov rbp, qword [rsp + 0x108]
je 0x14003ccb3
mov eax, dword [0x14008cebc]
mov dword [rsi], eax
mov eax, dword [0x14008ceb8]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x110
pop rsi
ret
Function at 0x14003eb90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov r11, qword [rsp + 0x40]
lea rbp, [rcx + rdx]
xor dil, dil
xor edx, edx
test r11, r11
mov r12, rcx
mov r10, rcx
mov r13, r8
lea rbx, [r8 + r9*2]
je 0x14003ebd8
mov edx, dword [r11]
movzx edi, byte [r11]
sar edx, 6
and dil, 0x3c
test rcx, rcx
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__n_
mov esi, 3
je 0x14003ecaa
cmp r8, rbx
jae 0x14003ecaa
cmp r10, rbp
jb 0x14003ec11
cmp edx, esi
jne 0x14003ecaa
movzx eax, dil
xor dil, dil
xor edx, edx
jmp 0x14003ec94
cmp edx, esi
jne 0x14003ec20
movzx eax, dil
xor dil, dil
xor edx, edx
jmp 0x14003ec94
movzx r9d, byte [r10]
add r10, 1
test edx, edx
mov ecx, edx
je 0x14003ec7d
sub ecx, 1
je 0x14003ec57
cmp ecx, 1
jne 0x14003ec9d
movzx eax, dil
movzx ecx, r9b
mov dil, r9b
shr rcx, 6
mov edx, esi
or rcx, rax
and dil, 0x3f
movzx eax, byte [rcx + r14]
jmp 0x14003ec99
movzx eax, dil
movzx ecx, r9b
mov dil, r9b
shr rcx, 4
and dil, 0xf
mov edx, 2
or rcx, rax
shl dil, 2
movzx eax, byte [rcx + r14]
jmp 0x14003ec99
mov dil, r9b
movzx eax, r9b
mov edx, 1
and dil, sil
shr rax, 2
shl dil, 4
movzx eax, byte [rax + r14]
mov word [r8], ax
add r8, 2
cmp r8, rbx
jb 0x14003ebf6
test edx, edx
je 0x14003ecf7
test r10, r10
je 0x14003ecb8
test r11, r11
jne 0x14003ecfc
movsxd rax, edx
imul rax, rax, 0xfffffffffffffffe
lea rax, [rax + r8 + 6]
cmp rax, rbx
jae 0x14003ecf7
movzx eax, dil
add r8, 2
cmp edx, esi
movzx eax, byte [rax + r14]
mov word [r8 - 2], ax
jge 0x14003ecf2
sub esi, edx
mov rdi, r8
mov eax, 0x3d
mov ecx, esi
lea r8, [r8 + rsi*2]
rep stosw word [rdi], ax
xor dil, dil
xor edx, edx
test r11, r11
je 0x14003ed08
shl edx, 6
movzx eax, dil
or edx, eax
mov dword [r11], edx
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14003ed18
sub r10, r12
mov qword [rax], r10
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
sub r8, r13
sar r8, 1
mov rax, r8
pop r14
pop r13
pop r12
ret
Function at 0x14003ed40
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r10d, r10d
cmp rdx, 0x7fffffff
mov rsi, r9
mov rbp, r8
mov r11, rdx
mov rbx, rcx
jb 0x14003ed82
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r11, rcx
mov r9, qword [rsp + 0x28]
xor edx, edx
xor dil, dil
test r9, r9
je 0x14003ed9f
mov edx, dword [r9]
movzx edi, byte [r9]
and edx, 3
and dil, 0xfc
xor r8d, r8d
test r11, r11
je 0x14003ee7b
nop
nop
cmp r10, rsi
jae 0x14003ee7b
movzx ecx, word [rbx + r8*2]
cmp ecx, 0x2b
mov eax, ecx
je 0x14003ee14
cmp eax, 0x2f
je 0x14003ee10
cmp eax, 0x3d
je 0x14003ee0c
cmp cx, 0x30
jb 0x14003ee6e
cmp cx, 0x39
ja 0x14003ede4
add cl, 4
jmp 0x14003ee05
cmp cx, 0x41
jb 0x14003ee6e
cmp cx, 0x5a
ja 0x14003edf9
sub cl, 0x41
jmp 0x14003ee05
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14003ee6e
sub cl, 0x47
cmp cl, 0xff
je 0x14003ee6e
jmp 0x14003ee16
xor edx, edx
jmp 0x14003ee6e
mov cl, 0x3f
jmp 0x14003ee16
mov cl, 0x3e
test edx, edx
jne 0x14003ee28
mov dil, cl
mov edx, 1
shl dil, 2
jmp 0x14003ee6e
sub edx, 1
je 0x14003ee52
cmp edx, 1
je 0x14003ee3c
or cl, dil
xor edx, edx
movzx eax, cl
jmp 0x14003ee66
mov al, cl
mov edx, 3
shr al, 2
or al, dil
mov dil, cl
shl dil, 6
jmp 0x14003ee66
mov al, cl
mov edx, 2
shr al, 4
or al, dil
mov dil, cl
shl dil, 4
mov byte [r10 + rbp], al
add r10, 1
add r8, 1
cmp r8, r11
jb 0x14003edb0
test r9, r9
je 0x14003ee89
movzx ecx, dil
or ecx, edx
mov dword [r9], ecx
mov rcx, qword [rsp + 0x30]
mov rax, r10
test rcx, rcx
je 0x14003ee99
mov qword [rcx], r8
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x14003ffb0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x14], eax
mov dword [rcx + 0x58], eax
lea r8d, [rax + 0x40]
add rcx, 0x18
xor edx, edx
jmp fcn.14004c980
Function at 0x140040d10
Capabilities:
Hash data using sha224

Disassembly:
xor eax, eax
mov dword [rcx], 0xcbbb9d5d
mov dword [rcx + 4], 0xc1059ed8
mov dword [rcx + 8], 0x629a292a
mov dword [rcx + 0xc], 0x367cd507
mov dword [rcx + 0x10], 0x9159015a
mov dword [rcx + 0xd0], eax
mov dword [rcx + 0xcc], eax
mov dword [rcx + 0xc8], eax
mov dword [rcx + 0xc4], eax
mov dword [rcx + 0xc0], eax
mov dword [rcx + 0x14], 0x3070dd17
mov dword [rcx + 0x18], 0x152fecd8
mov dword [rcx + 0x1c], 0xf70e5939
mov dword [rcx + 0x20], 0x67332667
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x8eb44a87
mov dword [rcx + 0x2c], 0x68581511
mov dword [rcx + 0x30], 0xdb0c2e0d
mov dword [rcx + 0x34], 0x64f98fa7
mov dword [rcx + 0x38], 0x47b5481d
mov dword [rcx + 0x3c], 0xbefa4fa4
ret

Function at 0x140040da0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xf3bcc908
mov dword [rcx + 8], 0xbb67ae85
mov dword [rcx + 0xc], 0x84caa73b
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0xd0], eax
mov dword [rcx + 0xcc], eax
mov dword [rcx + 0xc8], eax
mov dword [rcx + 0xc4], eax
mov dword [rcx + 0xc0], eax
mov dword [rcx + 0x14], 0xfe94f82b
mov dword [rcx + 0x18], 0xa54ff53a
mov dword [rcx + 0x1c], 0x5f1d36f1
mov dword [rcx + 0x20], 0x510e527f
mov dword [rcx + 0x24], 0xade682d1
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x2b3e6c1f
mov dword [rcx + 0x30], 0x1f83d9ab
mov dword [rcx + 0x34], 0xfb41bd6b
mov dword [rcx + 0x38], 0x5be0cd19
mov dword [rcx + 0x3c], 0x137e2179
ret
Function at 0x1400426c0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x68], eax
lea rax, [0x140041e50]
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov qword [rcx + 0x70], rax
mov dword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x140045040
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 0x14], eax
mov dword [rcx + 0x18], eax
mov dword [rcx + 0x5c], eax
lea rax, [0x140042c40]
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x10], 0xc3d2e1f0
ret
Function at 0x140048e00
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x830
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140048e3f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140048c50
mov al, 1
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x830
pop rbx
ret

Function at 0x140048e60
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x830
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140048e9f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140048c50
mov al, 1
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x830
pop rbx
ret

Function at 0x140048f00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rdx, [rsp + 0x38]
lea rcx, str.PATH
mov r8d, 1
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, eax
mov ebx, eax
add rcx, rcx
call fcn.14004c8b0
test rax, rax
mov rbp, rax
je 0x140048fb3
lea rcx, str.PATH
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r11, rbp
mov rbx, rbp
nop
cmp word [rbx], 0
je 0x140048f76
cmp word [rbx], 0x3b
je 0x140048f7c
add rbx, 2
cmp word [rbx], 0
jne 0x140048f66
cmp word [rbx], 0x3b
jne 0x140048f83
mov word [rbx], 0
jmp 0x140048f86
mov dil, 1
mov rdx, r11
mov rcx, rsi
call fcn.140048c50
mov rcx, rsi
call fcn.140048ec0
test al, al
je 0x140048fab
test dil, dil
jne 0x140048fab
lea r11, [rbx + 2]
mov rbx, r11
jmp 0x140048f60
mov rcx, rbp
call fcn.14004ca6c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14004b4e0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov edx, 0x40
mov rbp, r8
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x14004b519
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
cmp word [rsi], 0x5a4d
jne 0x14004b507
mov qword [rsp + 0x48], rbx
movsxd rbx, dword [rsi + 0x3c]
mov edx, 0x108
add rbx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14004b588
cmp dword [rbx], 0x4550
jne 0x14004b588
mov eax, dword [rbx + 0x90]
add rax, rsi
cmp rax, rbx
je 0x14004b588
add rax, 0xc
cmp dword [rax], 0
je 0x14004b588
nop
mov ebx, dword [rax + 4]
add rbx, rsi
cmp qword [rbx], 0
je 0x14004b57f
nop
cmp qword [rbx], rdi
je 0x14004b59f
add rbx, 8
cmp qword [rbx], 0
jne 0x14004b570
add rax, 0x14
cmp dword [rax], 0
jne 0x14004b560
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rsp + 0x40], 0x80
mov rcx, qword [0x140080018]
lea rsi, [0x140080018]
cmp rcx, rsi
je 0x14004b5da
test byte [rcx + 0x3c], 1
je 0x14004b5da
cmp byte [rcx + 0x39], 5
jb 0x14004b5da
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400714b0]
mov dx, 0x39
call fcn.1400249f0
mov edx, 8
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8d, [rdx + 0x78]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x40]
mov rdi, qword [rbx]
cmp r8d, 0x80
mov qword [rbx], rbp
je 0x14004b618
lea r9, [rsp + 0x40]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x140080018]
cmp rcx, rsi
je 0x14004b64f
test byte [rcx + 0x3c], 1
je 0x14004b64f
cmp byte [rcx + 0x39], 5
jb 0x14004b64f
mov rdx, qword [rbx]
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400714b0]
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov dx, 0x3a
call fcn.14004a4b0
mov rax, rdi
jmp 0x14004b58a