joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140170300
Capabilities:
Create directory
Get file attributes

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x98], rax
call fcn.1401fb040
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysisdata_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jae 0x14017033d
lea rcx, [0x14034b340]
call fcn.14028c4fc
lea rcx, [0x14034b340]
call fcn.1401fb110
test al, al
jne 0x140170437
lea rcx, [0x14034b340]
call fcn.14028aeb4
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], SafeArrayLock
mov byte [rsp + 0x58], al
lea ecx, [rax + 0x50]
call fcn.1400eb1a0
mov rcx, rax
mov qword [rsp + 0x68], 0x4a
mov qword [rsp + 0x70], 0x4f
movaps xmm0, xmmword [0x14034b340]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14034b350]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14034b360]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14034b370]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x14034b380]
movsd qword [rax + 0x40], xmm0
movzx eax, word [0x14034b388]
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0
mov qword [rsp + 0x58], rcx
lea r8, [rsp + 0x58]
lea rdx, str.CreateSqliteDBFolder:
lea rcx, [rsp + 0x38]
call fcn.1400eafe0
mov rcx, rax
call fcn.1401a7f60
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140170437
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017045c
call fcn.14021ecec
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysisdata_
call fcn.140205ee0
nop
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14021f250
add rsp, 0xa8
ret
call fcn.140260f54
nop
int3
Function at 0x140189fc0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14018a078
cmp rax, 0xffffffffffffffff
je 0x14018a078
lea rcx, [rsp + 0x20]
call fcn.1401ff3e0
nop
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
lea rcx, [0x14047d120]
call fcn.140137d20
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14018a065
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018a060
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018a084
call fcn.14021ecec
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14021f250
add rsp, 0x50
pop rbx
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140260f54
int3
Function at 0x14018a5d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x38], SafeArrayLock
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14018a773
cmp rax, 0xffffffffffffffff
je 0x14018a773
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140127290
mov rbx, rax
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x14018a6bf
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14018a68c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018a687
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018a785
call fcn.14021ecec
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], SafeArrayLock
mov byte [rsp + 0x20], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], SafeArrayLock
mov byte [rbx], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14018a6fc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018a6f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018a785
call fcn.14021ecec
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
lea rcx, [0x14047d120]
call fcn.140137d20
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14018a758
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018a753
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018a77f
call fcn.14021ecec
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14021f250
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140260f54
nop
call fcn.140260f54
int3
Function at 0x14018d3c0
Capabilities:
Create service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4a8
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r15, qword [rsp + 0x500]
mov ebp, r8d
mov r12, qword [rsp + 0x508]
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x70]
mov r8d, 0x104
xor ecx, ecx
mov r14, r9
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14018d42f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.14013c790
jmp 0x14018d51b
lea r8, [rsp + 0x70]
mov qword [rsp + 0x4a0], rbx
lea rdx, [0x140352f08]
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14018d480
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.14013c790
jmp 0x14018d513
mov qword [rsp + 0x60], r12
xor eax, eax
mov qword [rsp + 0x58], r15
mov r9d, 4
mov qword [rsp + 0x50], r14
mov r8, rdi
mov qword [rsp + 0x48], rax
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov rcx, rbx
lea rax, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], SafeArrayLock
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14018d4f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.14013c790
mov rcx, rbx
jmp 0x14018d50d
mov rdx, rsi
lea rcx, str._s_is_installed._n
call fcn.14013c790
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14021f250
add rsp, 0x4a8
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14018d540
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x38], eax
xor ecx, ecx
lea r8d, [rax + 1]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14018d59e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.14013c790
jmp 0x14018d6ba
mov r8d, 0x10024
mov qword [rsp + 0x68], rbx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14018d5d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.14013c790
mov rcx, rsi
jmp 0x14018d6af
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14018d671
mov rdx, rdi
lea rcx, str.Stopping__s.
call fcn.14013c790
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14018d652
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x14018d656
lea rcx, [0x14034f38c]
call fcn.14013c790
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14018d620
mov eax, dword [rsp + 0x24]
lea rcx, str._n_s_is_stopped._n
mov rdx, rdi
cmp eax, 1
je 0x14018d66c
lea rcx, str._n_s_failed_to_stop._n
call fcn.14013c790
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14018d694
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.14013c790
jmp 0x14018d6a3
mov rdx, rdi
lea rcx, str._s_is_removed._n
call fcn.14013c790
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14021f250
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1401a8aa0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x60
movzx edi, dx
mov rsi, rcx
mov edx, 0x2710
lea rcx, [0x14047c458]
call fcn.1401eb3a0
test al, al
je 0x1401a8b4b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
lea r14, str.ASUSSystemAnalysis
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1401a8b3e
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rsi
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], rdx
xor r9d, r9d
movzx edx, di
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rcx, [0x14047c458]
call fcn.1401eb4f0
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop r14
ret
Function at 0x1401ad980
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1401ada7e
mov r8d, 0xf003f
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1401ada75
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.1402539e0
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.1402539e0
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, str.__s__129
lea rcx, [rsp + 0x240]
call fcn.1401adaa0
lea rax, [rsp + 0x240]
mov edx, 1
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1401ada6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SERVICE_CONFIG_DESCRIPTION_failed_w_err_0x_08lx_n
call fcn.14013c790
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14021f250
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x1401b29c0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1404779b8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [r8 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
xor esi, esi
cmp rdx, r8
jae 0x1401b2a20
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], SafeArrayLock
mov byte [rbx], sil
jmp 0x1401b2b50
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], SafeArrayLock
mov byte [rsp + 0x28], sil
test rdx, rdx
jne 0x1401b2a48
mov qword [rsp + 0x38], rdx
mov byte [rsp + rdx + 0x28], dl
jmp 0x1401b2a58
lfence
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.140101ca0
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rax, qword [rsp + 0x28]
lea r8, [r14 + rdi]
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r14, 3
jl 0x1401b2aea
nop word [rax + rax]
movzx ecx, byte [rdi]
shr rcx, 2
movzx ecx, byte [rcx + r9]
mov byte [rax], cl
movzx edx, byte [rdi]
and edx, 3
shl rdx, 4
movzx ecx, byte [rdi + 1]
shr rcx, 4
or rdx, rcx
movzx ecx, byte [rdx + r9]
mov byte [rax + 1], cl
movzx edx, byte [rdi + 1]
and edx, 0xf
shl rdx, 2
movzx ecx, byte [rdi + 2]
shr rcx, 6
or rdx, rcx
movzx ecx, byte [rdx + r9]
mov byte [rax + 2], cl
movzx ecx, byte [rdi + 2]
and ecx, 0x3f
movzx ecx, byte [rcx + r9]
mov byte [rax + 3], cl
add rax, 4
add rdi, 3
sub r14, 3
cmp r14, 3
jge 0x1401b2a80
sub r8, rdi
je 0x1401b2b3f
movzx ecx, byte [rdi]
shr rcx, 2
movzx ecx, byte [rcx + r9]
mov byte [rax], cl
movzx edx, byte [rdi]
and edx, 3
shl rdx, 4
cmp r8, 1
jne 0x1401b2b19
movzx ecx, byte [rdx + r9]
mov byte [rax + 1], cl
mov cl, 0x3d
jmp 0x1401b2b38
movzx ecx, byte [rdi + 1]
shr rcx, 4
or rcx, rdx
movzx ecx, byte [rcx + r9]
mov byte [rax + 1], cl
movzx ecx, byte [rdi + 1]
and ecx, 0xf
movzx ecx, byte [r9 + rcx*4]
mov byte [rax + 2], cl
mov byte [rax + 3], 0x3d
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14021f250
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1401e2500
Capabilities:
Initialize winhttp library
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ebp, ebp
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
lea r8d, [rbp + 0x73]
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.128_Safari_537.36
call fcn.140101ff0
nop
mov byte [rdi + 0x20], bpl
mov qword [rdi + 0x28], rbp
mov qword [rdi + 0x30], rbp
mov qword [rdi + 0x38], rbp
mov dword [rdi + 0x40], 0x7530
mov dword [rdi + 0x44], 0x7530
mov dword [rdi + 0x48], 0x7530
mov qword [rdi + 0x50], rbp
mov qword [rdi + 0x58], rbp
mov qword [rdi + 0x60], rbp
lea rsi, [rdi + 0x68]
mov qword [rsi + 0x38], rbp
lea rbx, [rdi + 0xb0]
mov qword [rsp + 0x58], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
lfence
lea ecx, [rbp + 0x28]
call fcn.14021ecb0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rdi + 0xc0]
call fcn.1401e1f20
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi + 0x50], xmm0
mov qword [rdi + 0x60], rax
mov byte [rdi + 0xa8], al
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1401e25e3
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x1400ed125.0]
mov qword [rsi + 0x38], rbp
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401e25f0
mov rcx, qword [rdi]
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, rax
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x1401e2617
mov dword [rdi + 0x60], 2
jmp 0x1401e262f
mov eax, dword [rdi + 0x48]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x44]
mov r8d, dword [rdi + 0x40]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
nop
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e33a0
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
movzx r15d, r9b
mov rsi, r8
mov r14, rdx
mov r13, rcx
mov dword [rsp + 0x48], 0
lea rdi, [rcx + 0xc0]
mov qword [rsp + 0x70], rdi
test rdi, rdi
je 0x1401e33f3
mov rcx, rdi
call fcn.1401e1f70
nop
mov rcx, r14
call fcn.1401e8ac0
mov dword [rsp + 0x48], 1
xor ebx, ebx
mov qword [rsp + 0x60], rbx
xor eax, eax
mov r12d, 0x4000
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov rcx, r13
call fcn.1401e4010
mov rcx, r14
call fcn.1401ea480
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov r9, r14
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call fcn.1401e3760
test al, al
je 0x1401e35f6
lea rdx, [r14 + 8]
mov rcx, r13
call fcn.1401e3f20
test al, al
je 0x1401e34c8
mov rcx, r14
call fcn.1401e8df0
lea r8, [r14 + 0x80]
cmp qword [r14 + 0x98], 8
jb 0x1401e348b
mov r8, qword [r14 + 0x80]
cmp qword [r14 + 0x90], 3
jne 0x1401e3628
mov edx, 3
lea rcx, [0x140360678]
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1401e3628
add rcx, 2
sub rdx, 1
jne 0x1401e34b0
test r15b, r15b
jne 0x1401e352b
mov rcx, r12
call fcn.14021f4ec
mov rbx, rax
mov qword [rsp + 0x60], rax
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1402539e0
movzx esi, byte [rsp + 0xd0]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x40]
mov rcx, qword [r13 + 0x38]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x1401e360f
mov r8d, dword [rsp + 0x40]
test r8d, r8d
jne 0x1401e3530
mov byte [r14], 1
xor eax, eax
mov dword [r13 + 0x60], eax
jmp 0x1401e35ba
cmp r8d, r12d
jbe 0x1401e356c
mov rcx, r8
call fcn.14021f4ec
mov r15, rax
mov rcx, rbx
mov rbx, rax
mov qword [rsp + 0x60], rax
test rcx, rcx
je 0x1401e3555
call fcn.14021f46c
mov r12d, dword [rsp + 0x40]
mov r8d, r12d
xor edx, edx
mov rcx, r15
call fcn.1402539e0
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov rdx, rbx
mov rcx, qword [r13 + 0x38]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401e3641
lea rcx, [r14 + 0x20]
mov r9d, dword [rsp + 0x44]
add r9, rbx
mov rdx, qword [rcx + 8]
mov byte [rsp + 0x20], sil
mov r8, rbx
call fcn.1401e2240
jmp 0x1401e3500
test rbx, rbx
je 0x1401e35c8
mov rcx, rbx
call fcn.14021f46c
nop
test rdi, rdi
je 0x1401e35d6
mov rcx, rdi
call fcn.1401e1f80
nop
mov rax, r14
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [rsp + 0x4c], 2
lea rdx, [0x1403d02b8]
lea rcx, [rsp + 0x4c]
call fcn.14025213c
mov dword [rsp + 0x54], 9
lea rdx, [0x1403d02b8]
lea rcx, [rsp + 0x54]
call fcn.14025213c
mov dword [rsp + 0x50], 6
lea rdx, [0x1403d02b8]
lea rcx, [rsp + 0x50]
call fcn.14025213c
mov dword [rsp + 0x58], 9
lea rdx, [0x1403d02b8]
lea rcx, [rsp + 0x58]
call fcn.14025213c
int3
Function at 0x1401e3690
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1401e36a3
mov rcx, qword [rcx]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx + 0x28], rax
mov rcx, rax
test rax, rax
jne 0x1401e36d2
mov dword [rbx + 0x60], 2
add rsp, 0x30
pop rbx
ret
mov eax, dword [rbx + 0x48]
xor edx, edx
mov r9d, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x40]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1401e3f20
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov rbx, rdx
mov dword [rsp + 0x40], 0
mov rbp, rcx
lea rax, [rsp + 0x40]
mov rcx, qword [rcx + 0x38]
xor r8d, r8d
lea edx, [r9 + 0x16]
mov qword [rsp + 0x20], rax
xor dil, dil
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401e3ff7
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x48], rsi
call fcn.14021f4ec
mov rcx, qword [rbp + 0x38]
mov rsi, rax
xor r8d, r8d
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov r9, rsi
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x16]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1401e3fea
mov rdx, qword [rbx]
mov qword [rbx + 8], rdx
cmp rdx, qword [rbx + 0x10]
je 0x1401e3fcb
mov rcx, rbx
call fcn.1401e4ef0
mov rdx, qword [rbx + 8]
mov r9d, dword [rsp + 0x40]
mov r8, rsi
movzx eax, byte [rsp + 0x40]
add r9, rsi
mov rcx, rbx
mov byte [rsp + 0x20], al
call fcn.1401e2240
mov dil, 1
mov rcx, rsi
call fcn.14021f46c
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
movzx eax, dil
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401e5bb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
jb 0x1401e5bc8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401e5be7
test al, 0x10
jne 0x1401e5be7
mov rcx, rbx
call fcn.14011ed90
mov al, 1
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
call fcn.14011ed90
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x1401e5c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov qword [rsp + 0x20], rcx
jb 0x1401e5c48
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401e5c67
test al, 0x10
je 0x1401e5c67
mov rcx, rbx
call fcn.14011ed90
mov al, 1
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
call fcn.14011ed90
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1401e7350
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x30], 1
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], 7
lea r8d, [rbp + 0x15]
lea rdx, str.Drives_Bitmap:_0x_08x
lea rcx, [rsp + 0x38]
call fcn.140101ff0
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.1401a82f0
mov ecx, reloc.OLEAUT32.dll_SafeArrayPutElement
nop dword [rax + rax]
mov eax, 1
shl eax, cl
test edi, eax
je 0x1401e73e5
sub ecx, 1
jns 0x1401e73d0
jmp 0x1401e74a1
mov dword [rsi], eax
add cl, 0x41
movsx edx, cl
mov qword [rbx + 0x10], 1
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401e7402
mov rax, qword [rbx]
mov word [rax], dx
mov word [rax + 2], bp
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rax, 2
jb 0x1401e743e
lea rdx, [rcx + 2]
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp r8, 8
jb 0x1401e7431
mov rax, qword [rbx]
mov dword [rax + rcx*2], 0x5c003a
mov word [rax + rdx*2], bp
jmp 0x1401e7460
lfence
mov qword [rsp + 0x20], 2
lea r9, [0x140360d1c]
xor r8d, r8d
lea edx, [r8 + 2]
mov rcx, rbx
call fcn.14012c340
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], 7
mov r8d, 0x1b
lea rdx, str.Available_volume_label___s_
lea rcx, [rsp + 0x58]
call fcn.140101ff0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401e7497
mov rdx, qword [rbx]
lea rcx, [rsp + 0x58]
call fcn.1401a82f0
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret