joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400083cc
Capabilities:
Create process on windows

Disassembly:
push rbx
mov eax, 0x1170
call fcn.140037820
sub rsp, rax
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x1160], rax
xor edx, edx
mov ebx, ecx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140024b80
xor r11d, r11d
lea rdx, str.inetcpl.cpl
lea rcx, [rsp + 0x160]
mov r8b, 1
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
mov dword [rsp + 0x70], 0x68
call fcn.14000895c
test ebx, ebx
je 0x14000846a
lea r8, str.___d
lea rcx, [rsp + 0xe0]
mov r9d, ebx
mov edx, 0x40
call fcn.140022158
lea r8, [rsp + 0xe0]
lea rcx, [rsp + 0x160]
mov edx, 0x800
call fcn.140022978
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x160]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400084cb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400084cd
xor al, al
mov rcx, qword [rsp + 0x1160]
xor rcx, rsp
call fcn.140021c70
add rsp, 0x1170
pop rbx
ret
Function at 0x140008888
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, str.SeDebugPrivilege
mov edx, 1
call fcn.1400087c8
lea rcx, str.SeIncreaseQuotaPrivilege
mov edx, 1
call fcn.1400087c8
lea rcx, str.SeAssignPrimaryTokenPrivilege
mov edx, 1
call fcn.1400087c8
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32
mov qword [0x140056430], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140056428], rax
test rax, rax
jne 0x140008919
mov byte [0x140056449], al
jmp 0x140008953
and dword [rsp + 0x20], 0
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x2c]
call fcn.140024b80
lea rcx, [rsp + 0x20]
call rbx
cmp word [rsp + 0x20], 9
je 0x14000894c
cmp word [rsp + 0x20], 6
mov byte [0x140056449], 0
jne 0x140008953
mov byte [0x140056449], 1
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14000895c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x880
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rdi, rdx
mov rbx, rcx
mov esi, 0x104
test r8b, r8b
je 0x1400089ae
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x1400089bb
lea rcx, [rsp + 0x30]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x660]
mov rdx, rsi
call fcn.140021c90
lea rdx, str.rundll32.exe
lea rcx, [rsp + 0x660]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x450]
mov rdx, rsi
call fcn.140021c90
lea rdx, str.shell32.dll
lea rcx, [rsp + 0x450]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov rdx, rsi
call fcn.140021c90
lea rcx, [rsp + 0x240]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r11, [rsp + 0x240]
lea rax, [rsp + 0x450]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x660]
lea r8, str.__ws____ws__Control_RunDLL___ws_
mov edx, 0x800
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140022158
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140021c70
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000a198
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, 0x105
lea rcx, [rsp + 0x20]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14000a267
lea r8, str._SYSTEMROOT__system32
lea rax, [rsp + 0x130]
xor ebx, ebx
mov rdx, rdi
lea rcx, [rsp + 0x130]
sub r8, rax
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x14000a20f
mov al, byte [r8 + rcx]
test al, al
je 0x14000a20f
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000a1f0
test rdx, rdx
jne 0x14000a21c
dec rcx
mov ebx, 0x8007007a
mov byte [rcx], 0
test ebx, ebx
jns 0x14000a234
call fcn.140022c90
lea rdx, str.LoadUpdateProviderFunctions:_StringCchCopyA_failed:_0x_x_n
jmp 0x14000a363
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x14000a267
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140022c90
lea rdx, str.LoadUpdateProviderFunctions:_Unable_to_expand_environment_string:__d_n
jmp 0x14000a363
mov rax, rdi
lea rcx, [rsp + 0x20]
xor ebx, ebx
cmp byte [rcx], bl
je 0x14000a27e
inc rcx
sub rax, 1
jne 0x14000a271
test rax, rax
jne 0x14000a28c
mov ebx, 0x80070057
xor ecx, ecx
jmp 0x14000a292
mov rcx, rdi
sub rcx, rax
test ebx, ebx
js 0x14000a357
sub rdi, rcx
lea rax, [rsp + rcx + 0x20]
mov ebx, 0
je 0x14000a2db
lea r8, str.ws2_32.dll
lea rdx, [rdi + rcx + 0x7ffffefa]
sub r8, rax
test rdx, rdx
je 0x14000a2d6
mov cl, byte [r8 + rax]
test cl, cl
je 0x14000a2d6
mov byte [rax], cl
dec rdx
inc rax
sub rdi, 1
jne 0x14000a2bb
test rdi, rdi
jne 0x14000a2e3
dec rax
mov ebx, 0x8007007a
mov byte [rax], 0
test ebx, ebx
js 0x14000a357
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x14000a324
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140022c90
lea r8, [rsp + 0x20]
lea rdx, str.LoadUpdateProviderFunctions:_Unable_to_load__s:__d_n
lea rcx, [rax + 0x60]
mov r9d, ebx
call fcn.140022b18
jmp 0x14000a36f
lea rdx, str.WSCUpdateProvider
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WSCUpdateProvider32
mov rcx, rbx
mov qword [0x140056450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140056458], rax
mov rax, rbx
jmp 0x14000a371
call fcn.140022c90
lea rdx, str.LoadUpdateProviderFunctions:_StringCchCatA_failed:_0x_x_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.140022b18
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140021c70
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x14000a684
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov edx, 0x101
lea rcx, [rsp + 0x30]
cmp r8, rsi
jne 0x14000a6d6
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, esi
jne 0x14000a70d
xor eax, eax
jmp 0x14000a723
lea rax, [rsp + 0x30]
sub r8, rax
lea rax, [rdx + 0x7ffffefd]
cmp rax, rsi
je 0x14000a701
movzx eax, word [r8 + rcx]
cmp ax, si
je 0x14000a701
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000a6de
cmp rdx, rsi
jne 0x14000a70a
sub rcx, 2
mov word [rcx], si
lea r9, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.14000a8e8
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140021c70
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000a748
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xa60
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rsi, r9
mov r12, r8
mov rbp, rcx
cmp rdx, 0xffffffff80000000
je 0x14000a7c1
cmp rdx, 0xffffffff80000001
je 0x14000a7b8
cmp rdx, 0xffffffff80000002
je 0x14000a7af
cmp rdx, 0xffffffff80000003
jne 0x14000a8e1
lea rbx, str.USERS
jmp 0x14000a7c8
lea rbx, str.MACHINE
jmp 0x14000a7c8
lea rbx, str.CURRENT_USER
jmp 0x14000a7c8
lea rbx, str.CLASSES_ROOT
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x202
call fcn.140024b80
lea rcx, [rsp + 0x250]
xor edx, edx
mov r8d, 0x800
call fcn.140024b80
xor r13d, r13d
cmp rsi, r13
je 0x14000a8bf
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x14000a8bf
lea rax, [rsp + 0x40]
mov edx, 0x101
lea rcx, [rsp + 0x40]
sub rsi, rax
lea rax, [rdx + 0x7ffffefd]
cmp rax, r13
je 0x14000a849
movzx eax, word [rsi + rcx]
cmp ax, r13w
je 0x14000a849
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000a826
cmp rdx, r13
jne 0x14000a852
sub rcx, 2
mov word [rcx], r13w
lea r8, str._s_s
lea rcx, [rsp + 0x250]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], r12
call fcn.140008a90
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x250]
mov r8d, 4
mov rcx, rbp
call fcn.14000a8e8
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.140021c70
lea r11, [rsp + 0xa60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
mov edx, 0x101
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, r13d
jne 0x14000a856
xor eax, eax
jmp 0x14000a892
Function at 0x14000a8e8
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x280
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r13d, r13d
mov r12d, r8d
mov rbp, rdx
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov rsi, r9
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r13d
mov word [rsp + 0x60], r13w
call fcn.140024b80
mov dword [rsp + 0x44], 0x104
mov edi, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
lea edx, [r13 + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r13d
je 0x14000aa8e
mov rbx, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rdx, str.SeTakeOwnershipPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, r13d
je 0x14000aa8e
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14000a604
cmp eax, r13d
je 0x14000aa8e
mov rbx, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rdx, str.SeRestorePrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, r13d
je 0x14000aa8e
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14000a604
cmp eax, r13d
je 0x14000aa8e
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov rdx, rsi
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, r13d
jne 0x14000aa13
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000aa8e
mov ecx, dword [rsp + 0x40]
call fcn.1400141b0
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rbx, rax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, r13d
je 0x14000aa81
mov qword [rsp + 0x30], r13
mov esi, 1
mov r9, rbx
mov edx, r12d
mov rcx, rbp
mov r8d, esi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
cmp eax, r13d
cmove edi, esi
cmp rbx, r13
je 0x14000aa8e
mov rcx, rbx
call fcn.1400141b8
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x14000aa9e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140021c70
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ad08
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdx, rcx
lea r8, [0x140041f40]
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
call fcn.1400235bc
mov r9, qword [rsp + 0x20]
cmp r9, rbx
je 0x14000adb0
lea edx, [rbx + 0x40]
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x40]
call fcn.14002393c
mov edx, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x20]
add edx, 4
xor r8d, r8d
call fcn.140023a10
mov r9, qword [rsp + 0x20]
lea edx, [rbx + 0x14]
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x28]
call fcn.14002393c
mov rcx, qword [rsp + 0x20]
call fcn.140023b4c
mov r11d, 0x200
cmp word [rsp + 0x28], r11w
je 0x14000ada7
mov eax, 0x8664
cmp word [rsp + 0x28], ax
jne 0x14000adac
mov ebx, 1
mov eax, ebx
jmp 0x14000adb2
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140021c70
add rsp, 0x90
pop rbx
ret
Function at 0x14000c110
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov edi, dword [rcx + 0x1c]
mov rbp, rcx
mov rcx, qword [rcx]
mov rsi, rdx
lea rdx, [rsp + 0x40]
xor ebx, ebx
mov r12, r8
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14000c166
lea r9, str.GetFileSizeEx__
lea rcx, str..QHImageHlp.c
xor r8d, r8d
mov edx, 0x11e
call fcn.140011ed0
xor eax, eax
jmp 0x14000c1dc
mov rax, rdi
mov rdi, qword [rsp + 0x40]
sub rdi, rax
mov eax, dword [rbp + 0xb8]
sub rdi, 0x298
cmp rdi, rax
jl 0x14000c1d7
mov rcx, qword [rbp]
mov r9d, 0x298
mov r8, rsi
mov rdx, rdi
call fcn.14000dd20
test eax, eax
je 0x14000c162
cmp dword [rsi], 0x63576c6f
jne 0x14000c1d7
cmp dword [rsi + 0x294], 0x6232383d
jne 0x14000c1d7
movzx edx, word [rsi + 0x84]
lea r8, [0x140041ff8]
nop
movzx eax, bx
lea rcx, [rax + rax*2]
cmp word [r8 + rcx*8], dx
je 0x14000c1ef
inc bx
cmp bx, 1
jb 0x14000c1c0
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
cmp bx, 1
jae 0x14000c1d7
lea rax, [rdi + 0x90]
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14000c162
mov dword [rbp + 0xac], eax
lea eax, [rdi + 0x298]
mov dword [rbp + 0xb0], 0x200
mov dword [rbp + 0xb4], eax
test r12, r12
je 0x14000c1d7
mov dword [r12], 1
jmp 0x14000c1d7

Function at 0x14000c510
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x2c], 0x10325476
call fcn.140010cf0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140010dc0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140021c70
add rsp, 0x90
pop rbx
ret
Function at 0x14000c6d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
lea rax, [rsp + 0x38]
mov r13, r9
mov rsi, r8
mov rdi, rcx
lea rdx, str.SOFTWARE360MachineSignature
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor r12d, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000c8a0
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x60], rbx
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rbp
mov ebp, 0x400
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.Operator
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov ebx, ebp
mov dword [rsp + 0x30], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c795
cmp dword [rsp + 0x34], 1
jne 0x14000c88b
mov eax, dword [rsp + 0x30]
mov qword [rsi], rdi
add rdi, rax
sub ebx, eax
je 0x14000c88b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.IssueDate
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c7e4
cmp dword [rsp + 0x34], 1
jne 0x14000c88b
mov eax, dword [rsp + 0x30]
mov qword [rsi + 8], rdi
add rdi, rax
sub ebx, eax
je 0x14000c88b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.ExpirationDate
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c82b
cmp dword [rsp + 0x34], 1
jne 0x14000c88b
mov eax, dword [rsp + 0x30]
mov qword [rsi + 0x10], rdi
add rdi, rax
sub ebx, eax
je 0x14000c88b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.SignData
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000c88b
cmp dword [rsp + 0x34], 3
jne 0x14000c88b
mov eax, dword [rsp + 0x30]
mov qword [rsi + 0x30], rdi
sub ebx, eax
mov dword [rsi + 0x28], eax
je 0x14000c88b
lea rcx, [rsi + 0x18]
call fcn.14000c590
test eax, eax
je 0x14000c88b
sub ebp, ebx
mov r12d, 1
mov dword [r13], ebp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov eax, r12d
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x14000d030
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x100]
xor ebx, ebx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rbp, r9
mov esi, r8d
mov r12, rdx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [0x14000d110]
lea edx, [rbx + 0xf]
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
call fcn.14000f350
test eax, eax
jne 0x14000d0b9
jmp 0x14000d0f1
test esi, esi
je 0x14000d0cd
lea rcx, [rsp + 0x40]
mov r8d, esi
mov rdx, r12
call fcn.140010cf0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140010dc0
test rdi, rdi
je 0x14000d0ec
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
sete bl
mov dword [rdi], ebx
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140021c70
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14000d150
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0xe0], rax
cmp dword [rcx + 0x20], 0
mov rbp, rdx
je 0x14000d2d8
lea rsi, [rcx + 0x24]
test rsi, rsi
je 0x14000d2d8
xor ebx, ebx
mov dword [rdx], 1
lea r9, [rsp + 0x60]
lea r8, [0x14000d110]
lea edx, [rbx + 0xf]
mov dword [rsp + 0x60], 0x67452301
mov dword [rsp + 0x74], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x64], 0xefcdab89
mov dword [rsp + 0x68], 0x98badcfe
mov dword [rsp + 0x6c], 0x10325476
mov dword [rsp + 0x20], 1
call fcn.14000f5d0
test eax, eax
je 0x14000d2dc
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140010dc0
movzx eax, word [0x140042440]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edi, eax
cmp eax, 0x80
jb 0x14000d2dc
lea rax, [0x140042440]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov r9d, 0x80
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.140010a40
test eax, eax
jne 0x14000d2dc
cmp dword [rsp + 0x30], edi
jne 0x14000d2dc
cmp byte [rsp + 0x60], bl
jne 0x14000d2dc
cmp byte [rsp + 0x61], 1
jne 0x14000d2dc
lea edx, [rdi - 1]
mov ecx, 2
cmp edx, ecx
jbe 0x14000d27e
lea rax, [rsp + 0x62]
nop word [rax + rax]
cmp byte [rax], 0xff
jne 0x14000d27e
inc ecx
inc rax
cmp ecx, edx
jb 0x14000d270
mov eax, ecx
inc ecx
cmp byte [rsp + rax + 0x60], bl
jne 0x14000d2dc
mov edx, edi
sub edx, ecx
cmp edx, 0x10
ja 0x14000d2dc
lea eax, [rdx + 0xb]
cmp eax, edi
ja 0x14000d2dc
mov r8d, edx
lea rdx, [rsp + rcx + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140024e60
lea r11, [rsp + 0x38]
lea rax, [rsp + 0x48]
mov rcx, qword [r11]
cmp rcx, qword [rax]
jne 0x14000d2c6
mov rcx, qword [r11 + 8]
cmp rcx, qword [rax + 8]
je 0x14000d2cb
sbb ebx, ebx
sbb ebx, 0xffffffff
test ebx, ebx
jne 0x14000d2dc
mov dword [rbp], 3
jmp 0x14000d2dc
xor ebx, ebx
mov dword [rdx], ebx
mov eax, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140021c70
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d310
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rdi, r8
movzx r8d, word [rdx + 0x84]
xor r9d, r9d
mov rbp, rdx
mov r10, rcx
mov byte [rsp + 0xb0], 0x30
mov byte [rsp + 0xb1], 0x2d
mov byte [rsp + 0xb2], 0x30
mov byte [rsp + 0xb3], 9
mov byte [rsp + 0xb4], 6
mov byte [rsp + 0xb5], 5
mov byte [rsp + 0xb6], 0x2b
mov byte [rsp + 0xb7], 0xe
mov byte [rsp + 0xb8], 3
mov byte [rsp + 0xb9], 2
mov byte [rsp + 0xba], 0x1a
mov byte [rsp + 0xbb], 5
mov byte [rsp + 0xbc], 0
mov byte [rsp + 0xbd], 4
mov byte [rsp + 0xbe], 0x20
movzx edx, r9w
test rdi, rdi
je 0x14000d3c8
mov dword [rdi], 1
lea rsi, [0x140041ff8]
nop
movzx eax, dx
lea rcx, [rax + rax*2]
cmp word [rsi + rcx*8], r8w
je 0x14000d3ec
inc dx
cmp dx, 1
jb 0x14000d3d0
jmp 0x14000d596
cmp dx, 1
jae 0x14000d596
movzx eax, dx
mov qword [rsp + 0x60], r9
lea r8, [0x14000d130]
lea rdx, [rax + rax*2]
lea r9, [rsp + 0x40]
mov rcx, r10
mov rsi, qword [rsi + rdx*8 + 8]
mov edx, 0xf
mov dword [rsp + 0x40], 0x6a09e667
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
call fcn.14000f760
test eax, eax
je 0x14000d596
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x348], rbx
call fcn.140010830
movzx eax, word [rsi]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov ebx, eax
cmp eax, 0x200
jb 0x14000d58e
lea r8, [rbp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
mov r9d, 0x200
mov qword [rsp + 0x20], rsi
call fcn.1400101f0
test eax, eax
jne 0x14000d58e
cmp dword [rsp + 0x30], ebx
jne 0x14000d58e
cmp byte [rsp + 0x110], al
jne 0x14000d58e
cmp byte [rsp + 0x111], 1
jne 0x14000d58e
lea edx, [rbx - 1]
mov ecx, 2
cmp edx, ecx
jbe 0x14000d511
lea rax, [rsp + 0x112]
cmp byte [rax], 0xff
jne 0x14000d511
inc ecx
inc rax
cmp ecx, edx
jb 0x14000d503
mov eax, ecx
inc ecx
cmp byte [rsp + rax + 0x110], 0
jne 0x14000d58e
mov edx, ebx
sub edx, ecx
cmp edx, 0x2f
ja 0x14000d58e
lea eax, [rdx + 0xb]
cmp eax, ebx
ja 0x14000d58e
mov r8d, edx
lea rdx, [rsp + rcx + 0x110]
lea rcx, [rsp + 0xc0]
call fcn.140024e60
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xb0]
mov r8d, 0xf
call fcn.1400248d0
test eax, eax
jne 0x14000d58e
lea r8d, [rax + 0x20]
lea rdx, [rsp + 0xcf]
lea rcx, [rsp + 0xf0]
call fcn.1400248d0
test eax, eax
jne 0x14000d58e
test rdi, rdi
je 0x14000d58e
mov dword [rdi], 3
mov rbx, qword [rsp + 0x348]
mov eax, 1
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140021c70
add rsp, 0x320
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000dd20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rsi, r8
xor r9d, r9d
xor r8d, r8d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14000dd75
lea r9, str.SetFilePointerEx__
lea rcx, str..QHImageHlp.c
xor r8d, r8d
mov edx, 0xf9
call fcn.140011ed0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000ddc3
lea r9, str.ReadFile__
lea rcx, str..QHImageHlp.c
xor r8d, r8d
mov edx, 0xfc
call fcn.140011ed0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, dword [rsp + 0x48]
je 0x14000ddf9
lea r9, [0x1400427b0]
lea rcx, str..QHImageHlp.c
mov edx, 0xfe
mov r8d, 1
call fcn.1400120c0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret