joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bc40
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48be7b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x48bcda
mov qword [rsp + 0x88], rax
lea rbx, [0x00591c20]
mov rcx, rax
lea rax, [0x006e0240]
call sym.sync._Map_.Load
test cl, cl
jne 0x48bcc3
mov rax, qword [rsp + 0x88]
call sym.reflect._rtype_.String
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x005d77b8]
call sym.runtime.concatstring2
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call sym.reflect.typesByString
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x48bcf7
lea rdx, [0x0058d1e0]
cmp rax, rdx
jne 0x48bce5
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call sym.reflect.resolveTypeOff
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x00568ba0]
call sym.runtime.panicdottypeE
inc rdx
cmp rbx, rdx
jle 0x48bd41
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x48bcf4
lea rax, [0x006e0240]
lea rbx, [0x00591c20]
lea rdi, [0x0058d1e0]
nop dword [rax + rax]
call sym.sync._Map_.LoadOrStore
lea rdx, [0x0058d1e0]
cmp rax, rdx
jne 0x48be6b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x0055e1e0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
lea rax, [0x00571260]
call sym.runtime.newobject
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00765a70], 0
nop
je 0x48bd9b
mov rbx, rax
lea rax, [0x00571260]
call sym.runtime.wbMove
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call sym.internal_abi.NewName
call sym.reflect.addReflectOff
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x48be02
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x48bdf4
mov dword [rsi + 0x10], edx
cmp dword [0x00765a70], 0
je 0x48be23
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x006e0240]
lea rbx, [0x00591c20]
lea rdi, [0x0058d1e0]
nop dword [rax]
call sym.sync._Map_.LoadOrStore
lea rdx, [0x0058d1e0]
cmp rax, rdx
jne 0x48be5c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x00568ba0]
call sym.runtime.panicdottypeE
mov rbx, rdx
lea rcx, [0x00568ba0]
call sym.runtime.panicdottypeE
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._rtype_.ptrTo
Function at 0x499120
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4991ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x007659a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4991cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00562b40]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4991be
mov edi, 1
lea rsi, [0x00562b40]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005d99e8]
lea rsi, [0x005d8b28]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4cbac0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cc1ff
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4cbaed
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4cbd71
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4cbd9d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005dcf60]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x00562a40]
lea rbx, [0x005d96d0]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4cbdc2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4cbdf7
lea rdi, [0x00562ac0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4cbae3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4cbddb
jmp 0x4cbdb0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4cc3a0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4cc3b7
inc rax
cmp rax, 4
jge 0x4cc3cf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4cc3b4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4cc3e0
inc rax
cmp rax, 4
jge 0x4cc3ee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4cc417
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4cc3fb
jmp 0x4cc3dd
Function at 0x4dbe80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dbfce
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006cca50]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x007659a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4dbf92
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4dbfc8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4dbfbd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x5462c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x546395
movdqa xmm0, xmmword [0x005d8d50]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x546301
movdqa xmm0, xmmword [0x005d8d60]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x546417
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5463eb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005d8b18]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x005d8d70]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x14004a47c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14009b408], rbx
je 0x14004a4e3
cmp rax, rbx
jne 0x14004a4d6
mov ebx, 1
mov esi, ebx
jmp 0x14004a4e8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14004a4bb
mov ebx, 1
mov eax, dword [0x14009b410]
cmp eax, ebx
jne 0x14004a500
mov edi, AtlInternalQueryInterface
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14004a56c
mov eax, dword [0x14009b410]
test eax, eax
jne 0x14004a561
mov dword [0x14009b410], ebx
lea r15, [0x140051d58]
lea rdi, [0x140051d40]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14004a553
test eax, eax
jne 0x14004a557
cmp qword [rdi], r14
je 0x14004a548
mov rax, qword [rdi]
mov rcx, qword [0x140051cb8]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14004a52a
test eax, eax
je 0x14004a567
mov eax, 0xff
jmp 0x14004a6c2
mov dword [0x14009a724], ebx
mov edi, AtlInternalQueryInterface
mov eax, dword [0x14009b410]
cmp eax, ebx
jne 0x14004a593
lea rdx, [0x140051d38]
lea rcx, [0x140051cc0]
call sub.msvcrt.dll__initterm
mov dword [0x14009b410], 2
test esi, esi
jne 0x14004a5a1
mov rax, r14
xchg qword [0x14009b408], rax
cmp qword [0x14009b428], r14
je 0x14004a5d4
lea rcx, [0x14009b428]
call fcn.14004ac30
test eax, eax
je 0x14004a5d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14009b428]
mov r9, qword [0x140051cb8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14004a5ed
mov eax, 0xff
jmp 0x14004a6c2
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14004a673
test ax, ax
je 0x14004a608
test edx, edx
jne 0x14004a673
sub ax, bx
cmp ax, di
ja 0x14004a61e
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14004a608
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140006308
mov dword [0x14009a720], eax
cmp dword [0x14009a740], r14d
jne 0x14004a65c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14009a724], r14d
jne 0x14004a671
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14009a720]
jmp 0x14004a6c2
cmp ax, 0x22
jne 0x14004a687
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14004a5f6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14004acb0
add rsp, 0x28
jmp 0x14004a47c
Function at 0x140001290
Capabilities:
Check mutex on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, str.Global_viHyEBJCef
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400012f9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001485
call fcn.140004f50
movzx eax, al
test eax, eax
je 0x140001317
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001485
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140001336
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001485
call fcn.140002f50
movzx eax, al
test eax, eax
je 0x140001414
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Waiting_for_internet_connection...
lea rcx, [0x14004acb0]
call fcn.1400060f0
lea rdx, [0x140009a00]
mov rcx, rax
call fcn.14000bee0
nop
call fcn.140005ca0
movzx eax, al
test eax, eax
jne 0x1400013b0
lea rdx, str.No_internet_connection._Retrying_in_1_second...
lea rcx, [0x14004acb0]
call fcn.1400060f0
lea rdx, [0x140009a00]
mov rcx, rax
call fcn.14000bee0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x140001374
lea rdx, str.Internet_connected__Proceeding...
lea rcx, [0x14004acb0]
call fcn.1400060f0
lea rdx, [0x140009a00]
mov rcx, rax
call fcn.14000bee0
call fcn.140004dc0
call fcn.140003a90
call fcn.140003600
call fcn.1400039f0
call fcn.1400042b0
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x28]
call fcn.140004c70
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001485
lea rcx, [rsp + 0x38]
call fcn.1400032b0
nop
lea rcx, [rsp + 0x38]
call fcn.140010e00
movzx eax, al
test eax, eax
jne 0x14000146d
call fcn.140001620
test eax, eax
jne 0x140001462
call fcn.1400042b0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x38]
call fcn.14000b540
mov eax, dword [rsp + 0x2c]
jmp 0x140001485
lea rcx, [rsp + 0x38]
call fcn.1400034e0
nop
lea rcx, [rsp + 0x38]
call fcn.14000b540
nop
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140015340
add rsp, 0x68
ret
Function at 0x1400020c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rsp + 0x38], 0
je 0x1400020f5
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x1400020f5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0
je 0x140002111
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14000213e
mov edx, 0xffffffff
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x28
ret
Function at 0x140002dd0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.MyUserAgent
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140002e12
xor eax, eax
jmp 0x140002f43
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140002e58
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x140002f43
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
add eax, 0x1000
mov eax, eax
mov edx, eax
mov rcx, qword [rsp + 0x40]
call fcn.14001bd2c
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140002eaa
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x140002f43
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
lea r9, [rsp + 0x34]
mov r8d, 0x1000
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140002f02
mov rcx, qword [rsp + 0x40]
call fcn.14001bd10
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x140002f43
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x34], 0
ja 0x140002e69
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
mov rax, qword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140002f50
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 0
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x73], 0
mov byte [rsp + 0x74], 0
mov byte [rsp + 0x75], 5
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140002ff0
xor al, al
jmp 0x140003031
lea r8, [rsp + 0x64]
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000300e
mov dword [rsp + 0x64], 0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x64], 0
je 0x140003027
mov byte [rsp + 0x60], 1
jmp 0x14000302c
mov byte [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140015340
add rsp, 0x88
ret

Function at 0x1400031c0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1c8
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
lea r8, str.WinDrive_
mov rdx, qword [rsp + 0x1d0]
lea rcx, [rsp + 0x50]
call fcn.1400066c0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.14000f5c0
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
call fcn.14000b540
nop
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140003284
lea r8, [rsp + 0x9c]
mov rdx, qword [rsp + 0x1d0]
lea rcx, [rsp + 0x30]
call fcn.1400066c0
lea rcx, [rsp + 0x30]
call fcn.14000f5c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x30]
call fcn.14000b540
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000322c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140015340
add rsp, 0x1c8
ret
Function at 0x1400032b0
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2f8
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov dword [rsp + 0x20], 0
mov r8d, 0x104
lea rdx, [rsp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0xc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call fcn.14000a2e0
nop
lea rcx, [rsp + 0x80]
call fcn.1400031c0
nop
lea rcx, [rsp + 0x80]
call fcn.14000b540
nop
lea rcx, [rsp + 0x60]
call fcn.140003050
nop
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
call fcn.14000a2e0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140006600
nop
lea rcx, [rsp + 0xa0]
call fcn.14000b540
nop
lea rcx, [rsp + 0x40]
call fcn.14000f5c0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140003463
mov dword [rsp + 0x24], 0x64
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x38]
call fcn.140005e60
mov rcx, rax
call fcn.140009bb0
nop
lea rcx, [rsp + 0x40]
call fcn.14000f5c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140003423
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x300]
call fcn.14000a170
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x40]
call fcn.14000b540
nop
lea rcx, [rsp + 0x60]
call fcn.14000b540
mov rax, qword [rsp + 0x300]
jmp 0x1400034b6
lea rdx, [0x14003764c]
mov rcx, qword [rsp + 0x300]
call fcn.14000a2e0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x40]
call fcn.14000b540
nop
lea rcx, [rsp + 0x60]
call fcn.14000b540
mov rax, qword [rsp + 0x300]
jmp 0x1400034b6
lea rdx, [0x14003764d]
mov rcx, qword [rsp + 0x300]
call fcn.14000a2e0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x40]
call fcn.14000b540
nop
lea rcx, [rsp + 0x60]
call fcn.14000b540
mov rax, qword [rsp + 0x300]
jmp 0x1400034b6
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140015340
add rsp, 0x2f8
ret
Function at 0x1400034e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
lea rdx, [rsp + 0xc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x98]
call fcn.14000a2e0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140006600
nop
lea rcx, [rsp + 0x98]
call fcn.14000b540
nop
lea rcx, [rsp + 0x20]
call fcn.1400078b0
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.140010e30
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14000f520
mov rcx, qword [rsp + 0x38]
mov r9, rcx
mov rcx, qword [rsp + 0x40]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x78]
call fcn.140005f60
nop
lea rcx, [rsp + 0x78]
call fcn.14000f5e0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140001b60
nop
lea rcx, [rsp + 0x78]
call fcn.14000b570
nop
lea rcx, [rsp + 0x58]
call fcn.14000b540
nop
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140015340
add rsp, 0x1e8
ret