joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140bdf058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140bdf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140bdf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bdf06f
add dl, dl
jne 0x140bdf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bdf0f6
xor eax, eax
add dl, dl
jne 0x140bdf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bdf1ad
add dl, dl
jne 0x140bdf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140bdf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140bdf07e
mov eax, 1
add dl, dl
jne 0x140bdf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bdf0fb
sub eax, ebx
mov ebx, 1
jne 0x140bdf14c
mov ecx, 1
add dl, dl
jne 0x140bdf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bdf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bdf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bdf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140bdf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bdf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bdf15d
cmp eax, 0x7d00
jae 0x140bdf19b
cmp eax, 0x500
jb 0x140bdf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bdf07e
cmp eax, 0x7f
ja 0x140bdf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bdf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140bdf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140bdf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
enter 0x50c4, 0x33
sub dword [rbp + 0x15713db2], esp
invalid
Function at 0x14001114a
Capabilities:
Access the windows event log

Disassembly:
jmp 0x140011a10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x288]
mov rax, qword [0x140020018]
xor rax, rbp
mov qword [rbp + 0x208], rax
lea rcx, [0x1400260b2]
call fcn.140011483
cmp dword [0x140020184], 0
jne 0x140011b36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140020180], eax
lea rdx, str.SimpleService
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rbp + 0x108], rax
mov eax, dword [0x140020180]
mov dword [rsp + 0x20], eax
lea r9, str.SimpleService
lea r8, str._s_error:__d
mov edx, 0x6b
lea rcx, [rbp + 0x10]
call fcn.140011159
mov eax, 8
imul rax, rax, 0
lea rcx, [rbp + 0x10]
mov qword [rbp + rax + 0x128], rcx
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x230]
mov qword [rbp + rax + 0x128], rcx
cmp qword [rbp + 0x108], 0
je 0x140011b36
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x128]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dx, 1
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rcx, [rbp - 0x50]
lea rdx, [0x14001cdd0]
call fcn.1400113d9
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret

Function at 0x14001124e
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x140011bc0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x148]
mov rax, qword [0x140020018]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400260b2]
call fcn.140011483
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140011c38
lea rcx, str.CmdDebugService_CommandLineToArgvW_returned_NULL_n
call fcn.14001102d
jmp 0x140011c73
lea rdx, str.Simple_Service
lea rcx, str.Debugging__s._n
call fcn.14001102d
mov edx, 1
lea rcx, [0x14001116d]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rdx, qword [rbp + 0x28]
mov ecx, dword [rbp + 4]
call fcn.140011140
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001cee0]
call fcn.1400113d9
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001126c
Capabilities:
Terminate process

Disassembly:
jmp 0x140014e90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001130c
Capabilities:
Terminate process

Disassembly:
jmp 0x140012690
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x148]
mov rax, qword [0x140020018]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400260b2]
call fcn.140011483
lea rax, str.SimpleService
mov qword [rbp + 8], rax
lea rax, [0x140011320]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
cmp dword [rbp + 0x120], 1
jle 0x140012802
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx + rax]
movsx eax, byte [rax]
cmp eax, 0x2d
je 0x14001274b
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx + rax]
movsx eax, byte [rax]
cmp eax, 0x2f
jne 0x140012802
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx + rax]
inc rax
mov rdx, rax
lea rcx, str.install
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14001277d
call fcn.140011401
jmp 0x1400127fa
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx + rax]
inc rax
mov rdx, rax
lea rcx, str.remove
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1400127af
call fcn.1400114b0
jmp 0x1400127fa
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx + rax]
inc rax
mov rdx, rax
lea rcx, str.debug
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1400127f8
mov dword [0x140020184], 1
mov rdx, qword [rbp + 0x128]
mov ecx, dword [rbp + 0x120]
call fcn.14001124e
jmp 0x1400127fa
jmp 0x140012802
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rdx, str.Simple
lea rcx, str._s__install__________to_install_the_service_n
call fcn.1400111f4
lea rdx, str.Simple
lea rcx, str._s__remove___________to_remove_the_service_n
call fcn.1400111f4
lea rdx, str.Simple
lea rcx, str._s__debug__params____to_run_as_a_console_app_for_debugging_n
call fcn.1400111f4
lea rcx, str._nStartServiceCtrlDispatcher_being_called._n
call fcn.1400111f4
lea rcx, str.This_may_take_several_seconds.__Please_wait._n
call fcn.1400111f4
lea rcx, [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14001286d
lea rcx, str.StartServiceCtrlDispatcher_failed.
call fcn.14001114a
jmp 0x140012871
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001cfe0]
call fcn.1400113d9
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001131b
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400161e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016200
xor al, al
jmp 0x140016281
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016213
xor al, al
jmp 0x140016281
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001623d
xor al, al
jmp 0x140016281
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016251
xor al, al
jmp 0x140016281
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016263
xor al, al
jmp 0x140016281
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001627f
xor al, al
jmp 0x140016281
mov al, 1
add rsp, 0x38
ret
Function at 0x1400114b0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
jmp 0x140011f00
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400260b2]
call fcn.140011483
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140012083
mov r8d, 0x10024
lea rdx, str.SimpleService
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140012057
lea r8, [0x140020ba0]
mov edx, 1
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140012008
lea rdx, str.Simple_Service
lea rcx, str.Stopping__s.
call fcn.14001102d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140020ba0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140011fd7
cmp dword [0x140020ba4], 3
jne 0x140011fd3
lea rcx, [0x14001d358]
call fcn.14001102d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140011fd5
jmp 0x140011fd7
jmp 0x140011f9c
cmp dword [0x140020ba4], 1
jne 0x140011ff5
lea rdx, str.Simple_Service
lea rcx, str._n_s_stopped._n
call fcn.14001102d
jmp 0x140012008
lea rdx, str.Simple_Service
lea rcx, str._n_s_failed_to_stop._n
call fcn.14001102d
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14001202b
lea rdx, str.Simple_Service
lea rcx, str._s_removed._n
call fcn.14001102d
jmp 0x14001204b
mov edx, 0x100
lea rcx, [0x140020980]
call fcn.1400111b3
mov rdx, rax
lea rcx, str.DeleteService_failed____s_n
call fcn.14001102d
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140012077
mov edx, 0x100
lea rcx, [0x140020980]
call fcn.1400111b3
mov rdx, rax
lea rcx, str.OpenService_failed____s_n
call fcn.14001102d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400120a3
mov edx, 0x100
lea rcx, [0x140020980]
call fcn.1400111b3
mov rdx, rax
lea rcx, str.OpenSCManager_failed____s_n
call fcn.14001102d
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14000d5b0
Capabilities:
Delete file

Disassembly:
push rsi
xchg edx, eax
sub esp, 0x20
mov rsi, rcx
mov esi, ecx

Function at 0x14003d39f
Capabilities:
Read file on windows

Disassembly:
mov esi, ecx
mov rsi, qword [rax + rbp*4 - 0x44]
mov esp, 0x31480005
loopne 0x14003d3f4
mov cl, 0x84
add rax, 0x438248c
add byte [rax], al
cmp rax, 0xffffffffb8a9e8e1
invalid
invalid
invalid
invalid

Function at 0x14004228c
Capabilities:
Encode data using xor

Disassembly:
pop rsp
add byte [rax], al
mov qword [rsi + rax*2 - 0x7a], rcx
mov dword [rsi + rax*2 - 0x7a], ecx
lea r8, [rdi + 0x24]
xor byte [rcx], dh
leave
xor dword [rbx], ecx
mov r9, rax
call 0x108035fd0
mov rsi, rax
jge 0x14004228a

Function at 0x1400460a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
movabs rdi, 0xe2fa4058b4840ec
add byte [rax + 0x31], cl
loopne 0x140046125
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0x7a4b0000
invalid

Function at 0x1400461f0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
or dword [r9 + 0x30], 0x4c
mov qword [rbx + 0x4ccb8948], rax
mov ecx, eax
mov cl, 0x48
mov ch, 8
add byte [rbx + 0x44aa01c0], al
and al, 0x28
mov qword [rsp + 0x20], rsi

Function at 0x140057710
Capabilities:
Encode data using xor

Disassembly:
push rsi
adc byte [rbx + 0x48], dl
sub esp, 0x80
mov rsi, r8
mov rax, qword [0x140131250]
shl al, cl
insb byte [rdi], dx
and al, 0x78
call 0x140a67840
popfq
pushfq
invalid
Function at 0x1400bb550
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400bb55d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400bb56d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400bb555
lea eax, [rcx + 1]
jmp 0x1400bb57b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400bb58e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400bb574
sub eax, 3
jb 0x1400bb5ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400bb5fd
sar eax, 1
movsxd rbp, eax
jb 0x1400bb5e4
jmp 0x1400bb5bc
add ebx, ebx
jne 0x1400bb5ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400bb5e4
inc ecx
add ebx, ebx
jne 0x1400bb5ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400bb5e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400bb5dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400bb5cc
add ecx, 2
jmp 0x1400bb5e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400bb512
jmp 0x1400bb55d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x85e00
mov dl, 0x19
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400bb649
cmp rsi, rcx
jae 0x1400bb651
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400bb630
cmp al, 0x8f
ja 0x1400bb630
cmp byte [rsi - 2], 0xf
je 0x1400bb636
sub al, 0xe8
cmp al, 1
ja 0x1400bb61a
cmp rsi, rcx
jae 0x1400bb651
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400bb620
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400bb651
lodsb al, byte [rsi]
jmp 0x1400bb630
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb8000]
mov eax, dword [rdi]
or eax, eax
je 0x1400bb6ba
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xbb7f0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400bb65e
jns 0x1400bb693
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400bb69d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400bb6b4
mov qword [rbx], rax
add rbx, 8
jmp 0x1400bb67e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400bb6f4
cmp al, 0xef
ja 0x1400bb6e6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400bb6c6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400bb6d5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400bb748
sub rsp, 0xffffffffffffff80
jmp 0x14006131c
Function at 0x4037d5
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
lea r11, [rsp + 0x60]
mov r8, qword [rax + 0x30]
mov r9d, dword [r8 + 0x138dfb]
mov r10d, dword [r8 + 0x138dff]
test r9d, r9d
je 0x403832
mov rdx, r11
add r9d, 2
mov eax, 2
mov ecx, eax
add eax, 1
add rdx, 4
mov ebx, dword [r8 + rcx*4 + 0x138dfb]
add ebx, r10d
mov dword [rdx - 4], ebx
cmp r9d, eax
jne 0x403816
mov eax, dword [rsp + 0xe0]
mov qword [rsp + 0x20], r11
lea rcx, [rsp + 0x20]
add r8, rax
call r8
nop
add rsp, 0x230
pop rbx
ret

Function at 0x4039a4
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, qword [rcx + 0xa8]
mov r12, rcx
mov r8, rdx
test rbx, rbx
je 0x4039d6
lea edx, [rax + 1]
cmp dword [r12 + 0xb0], eax
je 0x4039e7
mov rbx, qword [rbx + 0x28]
mov eax, edx
jmp 0x4039bc
mov rax, qword [r12]
xor edx, edx
mov rcx, r12
call qword [rax + 0x28]
jmp 0x403b0a
cmp qword [r12 + 0x78], 0xffffffffffffffff
mov dword [r12 + 0xb0], edx
je 0x403a29
mov rcx, qword [r12 + 0x68]
call method.IWindow.getHandle__
mov rcx, qword [r12 + 0x78]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov rcx, qword [r12 + 0x78]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [r12 + 0x78], 0xffffffffffffffff
mov ecx, dword [rbx + 4]
mov edx, dword [rbx + 8]
mov r8d, dword [rbx + 0xc]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [r12 + 0x78], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x403a60
lea r13, [rsp + 0x28]
lea rdx, str.socket_error
mov rcx, r13
call fcn.004cdfee
jmp 0x403af6
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov dword [rsp + 0x24], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [r12 + 0x68]
call method.IWindow.getHandle__
mov rcx, qword [r12 + 0x78]
mov r8d, 0x8001
mov r9d, 0x10
mov rdx, rax
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [r12 + 0x78]
mov r8d, dword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x403b0a
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
cmp eax, 0x2733
jne 0x403ae5
mov rdx, qword [r12 + 0x98]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x2710
call sym.winbox.exe_addTimer_unsigned_int__EventListener__void__bool_
mov dword [r12 + 0xa0], eax
jmp 0x403b0a
call rbx
lea r13, [rsp + 0x28]
mov edx, eax
mov rcx, r13
call fcn.00402c1d
mov rcx, r12
mov rdx, r13
call fcn.004039a4
mov rcx, r13
call fcn.004cddea
nop
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
Function at 0x4a7744
Capabilities:
Get http content length

Disassembly:
sub rsp, 0x48
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x38], 0
test rcx, rcx
je 0x4a777f
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x38]
mov edx, 0x20000005
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [rsp + 0x38]
add rsp, 0x48
ret

Function at 0x4a7b42
Capabilities:
Read file on windows

Disassembly:
push r14
mov eax, 0x1030
push r13
push r12
call fcn.004d3790
sub rsp, rax
lea rdx, [0x00535779]
mov rcx, qword [rcx]
add rcx, 4
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x4a7bbd
lea r14, [rsp + 0x30]
mov r9, rax
mov r8d, 0x1000
mov edx, 1
mov rcx, r14
lea r13, [rsp + 0x28]
call sub.msvcrt.dll_fread
mov rdx, r14
mov rcx, r13
mov eax, eax
lea r8, [r14 + rax]
call fcn.004ce00e
mov rcx, r13
call fcn.004a7ab1
mov rcx, r13
call fcn.004cddea
mov rcx, r12
call sub.msvcrt.dll_fclose
mov al, 1
jmp 0x4a7bda
mov rcx, qword [0x0053bb30]
lea rdx, str.file_does_noth
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
xor eax, eax
add rsp, 0x1030
pop r12
pop r13
pop r14
ret