joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c854
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x14000c9ca
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x14000c9ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x14000c9ca
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x14000c900
cmp rdi, r11
jae 0x14000c9ca
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x14000c8ea
cmp rdi, r11
jae 0x14000c9ca
cmp word [rdi], r13w
je 0x14000c9ca
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x14000c932
mov edx, ebx
mov rcx, rsi
call fcn.14000ccbc
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x14000c953
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x14000c9a2
cmp eax, 0xc
je 0x14000c997
cmp eax, 0x16
je 0x14000c98c
cmp eax, 0x22
je 0x14000c98c
cmp eax, 0x50
je 0x14000c9a2
mov ecx, 0x80004005
call fcn.140008378
int3
mov ecx, 0x80070057
call fcn.140008378
int3
mov ecx, 0x8007000e
call fcn.140008378
int3
cmp ebx, r13d
jl 0x14000c9bf
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x14000c9bf
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x14000c9cc
mov ecx, 0x80070057
call fcn.140008378
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x14000c9f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x140036660]
xor edx, edx
xor ebx, ebx
call fcn.1400297cc
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x14000cada
test rbx, rbx
jne 0x14000cae6
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x14000cac9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000ca76
xor ebx, ebx
jmp 0x14000cac4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14000ca72
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x14000cab3
cmp rdi, r11
jae 0x14000ca72
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x14000caa1
cmp rdi, r11
jae 0x14000ca72
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x14000cae8
lea rcx, [0x140036660]
mov edx, ebp
call fcn.1400297cc
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x14000ca33
xor esi, esi
test rsi, rsi
jne 0x14000caf1
xor eax, eax
jmp 0x14000caff
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.14000c854
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1400202b4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
sub rsp, 0x128
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0x100], rax
and qword [rsp + 0x20], 0
cmp qword [0x140036fe8], 0
xorpd xmm6, xmm6
je 0x140020361
cmp qword [0x140036ff0], 0
je 0x140020361
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140020309
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140020361
mov rax, qword [rsp + 0x20]
pxor xmm1, xmm1
pxor xmm6, xmm6
sub rax, qword [0x140036fe8]
lea r8, [0x140005ba0]
lea rcx, [rsp + 0x30]
cvtsi2sd xmm1, qword [0x140036ff0]
cvtsi2sd xmm6, rax
mov edx, 0x64
divsd xmm1, qword [0x140007288]
divsd xmm6, xmm1
movapd xmm3, xmm6
movq r9, xmm3
call fcn.140018158
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movsd qword [0x140036ff8], xmm6
movapd xmm0, xmm6
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140029f80
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x128
ret
Function at 0x140021d90
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
lea rcx, [0x140036100]
mov rax, qword [0x140036100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov r9, rdi
mov r8, rbx
lea rdx, [0x140006280]
lea rcx, [rsp + 0x48]
call fcn.1400181c8
lea rcx, [0x140036100]
mov rax, qword [0x140036100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x40], 1
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], ebp
je 0x140021ea5
mov word [rsp + 0x60], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9d, [rbp + 2]
lea r8, [0x1400062c0]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, ebp
jne 0x140021ea5
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14000cd0c
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, ebp
jg 0x140021ec0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140029f80
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023fb4
Capabilities:
Get keyboard layout

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov qword [r11 - 0x28], rax
lea r9, [0x140006520]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1400064f0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x1400240ea
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx edi, ax
and qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
lea rdx, [0x140006530]
call qword [rax]
mov ebx, eax
test eax, eax
js 0x1400240b6
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400240bb
and qword [rsp + 0x50], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea rdx, [0x140006500]
mov r9, rdx
xor r8d, r8d
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
js 0x140024089
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14002408e
mov rax, qword [rcx]
mov r9d, edi
or r8d, 0xffffffff
xor edx, edx
call qword [rax + 0x18]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
jmp 0x14002408e
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400240a4
and qword [rsp + 0x50], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400240b6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
jmp 0x1400240bb
mov rcx, qword [rsp + 0x58]
cmp ebx, 0x80004002
jne 0x1400240de
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov r9d, edi
or r8d, 0xffffffff
xor edx, edx
call qword [rax + 0x18]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400240ea
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400240fa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14002438c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140036e60]
test rcx, rcx
jne 0x1400243b2
call fcn.140024440
test eax, eax
je 0x1400243d9
mov rcx, qword [0x140036e60]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x14002442d
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400243dd
xor eax, eax
jmp 0x14002442d
mov eax, dword [rax]
mov rcx, qword [0x140036e60]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x14002440a
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x14002442d
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x140036e60]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x140024411
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140027298
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
mov rdi, r8
lea rdx, [0x140004340]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20106
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140027321
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 4]
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x14002731b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140027321
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140027334
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
mov dword [rax - 0x18], 4
lea rax, [rax - 0x10]
mov rbx, r9
mov rdi, r8
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400273ba
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400273ad
cmp dword [rsp + 0x34], 4
jne 0x1400273ad
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400273ba
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400273cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x40
mov rbx, qword [rsp + 0x70]
mov rsi, r8
lea rax, [r11 - 0x18]
mov r12, rcx
mov rcx, qword [rbx]
mov qword [r11 - 0x20], rax
mov rdi, r9
mov qword [r11 - 0x28], r9
mov rbp, rdx
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140027428
cmp dword [rsp + 0x34], 4
je 0x140027478
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140027455
and qword [rbx], 0
jmp 0x140027478
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140028764
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r13, r8
mov r14, rdx
mov qword [rdx], rbx
mov rbp, rcx
or r15, 0xffffffffffffffff
mov dword [r8], ebx
mov r12d, ebx
cmp qword [rbp + 0xe8], rbx
je 0x1400287b4
mov rcx, qword [rbp + 0xe8]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax]
jmp 0x1400287be
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rcx, eax
mov edi, eax
mov eax, 8
mul rcx
cmovo rax, r15
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, rbx
je 0x14002881a
cmp edi, ebx
je 0x14002880f
cmp qword [rbp + 0xe8], rbx
je 0x140028800
mov rcx, qword [rbp + 0xe8]
mov r8, rax
mov edx, edi
mov r9, qword [rcx]
call qword [r9]
jmp 0x14002880b
mov rdx, rax
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
cmp edi, eax
je 0x140028832
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rsi, rbx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r12d
cmp r12d, 5
jl 0x140028798
cmp edi, ebx
jle 0x140028870
movsxd rbp, edi
mov eax, 2
mul rbp
cmovo rax, r15
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
cmp rax, rbx
je 0x140028870
cmp rbp, rbx
jle 0x140028867
movzx ecx, word [rsi + rbx*8]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, rbp
jl 0x140028857
mov qword [r14], rax
mov bl, 1
mov dword [r13], edi
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140028c84
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x480
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r13, qword [rsp + 0x4d0]
mov rbp, rdx
lea rdx, [rsp + 0x260]
mov ecx, 0x104
mov rsi, r9
mov r12d, r8d
xor edi, edi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140028cff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140028ce9
mov edi, 0x8000ffff
jmp 0x140028de8
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140028de8
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x260]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140028d34
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140028cdf
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140028de8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x50]
not rcx
lea r8d, [rcx - 1]
mov rcx, r13
call fcn.14000cd0c
and qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x2100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140028d98
call fcn.1400083c0
mov edi, eax
jmp 0x140028d9d
mov rbx, rax
xor edi, edi
test edi, edi
js 0x140028dda
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, r12d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140028dc8
call fcn.1400083c0
mov edi, eax
jmp 0x140028dca
xor edi, edi
test rbx, rbx
je 0x140028de8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test rbx, rbx
je 0x140028de8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140029f80
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140029184
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0xe0
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor r12d, r12d
mov rbx, rcx
mov rbp, rdx
lea rcx, [rsp + 0x48]
lea r9d, [r12 + 1]
xor r8d, r8d
xor edx, edx
mov edi, 0x80004005
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, r12d
je 0x140029358
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, r12d
je 0x14002934b
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov byte [rsp + 0x50], r12b
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov word [rsp + 0x61], ax
mov byte [rsp + 0x63], al
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x40], r12d
mov r8d, dword [rdx - 0x10]
xor r9d, r9d
add r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, r12d
je 0x140029340
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
lea edx, [r12 + 4]
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, r12d
je 0x140029340
mov rcx, qword [rsp + 0x38]
lea ebx, [r12 + 0x14]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
lea edx, [rbx - 0x12]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, r12d
je 0x140029340
mov edi, dword [rsp + 0x30]
lea r8d, [r12 + 0x50]
lea rcx, [rsp + 0x72]
cmp edi, ebx
mov word [rsp + 0x70], r12w
cmova edi, ebx
xor edx, edx
mov dword [rsp + 0x30], edi
call sub.msvcrt.dll_memset
mov rsi, r12
cmp edi, r12d
jbe 0x14002931b
mov rdi, r12
lea rbx, [rsp + 0x70]
movzx r9d, byte [rsp + rsi + 0x50]
mov edx, 0x29
lea r8, [0x1400070a0]
sub rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_swprintf_s
mov eax, dword [rsp + 0x30]
inc rsi
add rdi, 2
add rbx, 4
cmp rsi, rax
jb 0x1400292ea
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x70]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.14000cd0c
mov edi, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140029f80
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140029850
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1400298e3
cmp dword [rsp + 0x24], 5
jb 0x1400298fd
jmp 0x1400298f9
cmp dword [rsp + 0x30], esi
jne 0x1400298fd
cmp dword [rsp + 0x24], 4
ja 0x1400298f9
jne 0x1400298fd
cmp dword [rsp + 0x28], 0
jbe 0x1400298fd
mov byte [rbx + 0x18], sil
lea rax, [0x140001f80]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140008398
movzx ecx, byte [0x1400370c0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1400370c0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140029f80
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140029f80
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140036138]
jne 0x140029f9b
rol rcx, 0x10
test cx, 0xffff
jne 0x140029f97
ret 0
ror rcx, 0x10
jmp 0x14002a610
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400368c0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1400369b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002a695
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400368c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x14002a6b7
mov rax, qword [rsp + 0x88]
mov qword [0x1400369b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140036958], rax
mov rax, qword [0x1400369b8]
mov qword [0x140036830], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140036940], rax
mov dword [0x140036820], 0xc0000409
mov dword [0x140036824], 1
mov rax, qword [0x140036138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140036140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140002068]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14002a4ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x14002a4f9
cmp rcx, 0xffffffffffffffff
je 0x14002a4f9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002a4f1
cmp dword [rcx + 0x3c], edx
jl 0x14002a4f1
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14002a4f1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14002a4f9
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14002a744
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002a7af
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14002a7cf
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x140002078]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret