joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404160
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x180001000
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
xor eax, eax
lea rcx, [rbp - 0x15]
mov rbx, r8
mov qword [rbp - 0x39], rax
xor edx, edx
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
lea r8d, [rax + 0x64]
call fcn.1800061c0
mov dword [rbp - 0x19], 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x41]
mov edx, 0xb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800010ff
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea edx, [r9 + 2]
call qword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
test eax, eax
je 0x1800010f5
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x19]
mov r8, rbx
mov qword [rsp + 0x48], rax
xor edx, edx
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x10
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1800010eb
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret

Function at 0x180001d68
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov r10, rcx
movups xmm0, xmmword [0x180025f80]
movdqu xmmword [rsp + 0x50], xmm0
mov r8d, edx
and r8d, 7
mov eax, r8d
neg eax
sbb r9d, r9d
and r9d, 8
add r9d, 8
lea rax, [0x180025fc8]
lea rcx, [0x180025fa8]
test r8d, r8d
cmove rcx, rax
and dword [rsp + 0x48], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x38], edx
mov qword [r11 - 0x38], r10
mov dword [r11 - 0x40], r9d
lea rax, [r11 - 0x18]
mov qword [r11 - 0x48], rax
xor r9d, r9d
mov r8d, edx
mov rdx, r10
mov rcx, qword [rcx]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
jmp 0x180001de0
add rsp, 0x68
ret
Function at 0x24e6160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x24e62e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x24e6191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x24e6177
add dl, dl
jne 0x24e619e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x24e61fe
xor eax, eax
add dl, dl
jne 0x24e61ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x24e62b5
add dl, dl
jne 0x24e61be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24e61cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24e61d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24e61e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x24e61f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x24e6186
mov eax, 1
add dl, dl
jne 0x24e620e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24e621b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x24e6203
sub eax, ebx
mov ebx, 1
jne 0x24e6254
mov ecx, 1
add dl, dl
jne 0x24e6236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24e6243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x24e622b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x24e6186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x24e6270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24e627d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x24e6265
cmp eax, 0x7d00
jae 0x24e62a3
cmp eax, 0x500
jb 0x24e629e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x24e6186
cmp eax, 0x7f
ja 0x24e62a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x24e6186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x24e62da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x24e6186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000f5e4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14015a834]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x1400105b8
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x1400105c4
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x1400107b0
cmp word [rdx], r13w
je 0x1400107b0
add byte [rax], al
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400107ab
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x1400107a2
mov ecx, ebp
call fcn.1400123b0
mov rdi, rax
test rax, rax
je 0x1400107a2
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140010672
mov edx, ebp
call fcn.140010990
mov rbx, rax
test rax, rax
je 0x14001079a
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x14015d920]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400106dc
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x1400106e5
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.14005aeb0
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140010796
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x14001070f
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.14005a200
mov r15, rax
test rax, rax
je 0x140010784
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140010756
mov rcx, r15
call fcn.14001248c
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140010765
mov r8d, 1
jmp 0x140010768
xor r8d, r8d
call fcn.14005a6f0
test eax, eax
je 0x140010777
cmp ebp, esi
jl 0x140010701
jmp 0x140010796
mov rcx, rdi
call fcn.14005a530
mov dword [rbx + 0x24], eax
jmp 0x14001078b
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.140012588
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.14005a880
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x1400107b2
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400105c4
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x1400105c4
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x1400107b0
cmp word [rdx], r13w
je 0x1400107b0
add byte [rax], al
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400107ab
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x1400107a2
mov ecx, ebp
call fcn.1400123b0
mov rdi, rax
test rax, rax
je 0x1400107a2
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140010672
mov edx, ebp
call fcn.140010990
mov rbx, rax
test rax, rax
je 0x14001079a
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x14015d920]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400106dc
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x1400106e5
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.14005aeb0
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140010796
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x14001070f
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.14005a200
mov r15, rax
test rax, rax
je 0x140010784
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140010756
mov rcx, r15
call fcn.14001248c
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140010765
mov r8d, 1
jmp 0x140010768
xor r8d, r8d
call fcn.14005a6f0
test eax, eax
je 0x140010777
cmp ebp, esi
jl 0x140010701
jmp 0x140010796
mov rcx, rdi
call fcn.14005a530
mov dword [rbx + 0x24], eax
jmp 0x14001078b
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.140012588
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.14005a880
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x1400107b2
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140011e28
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [rcx + 0x20]
and qword [rsp + 0x20], 0
mov r8d, 0x1000
sub r8d, dword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 0x1000
sub eax, dword [rbx + 8]
cmp dword [rsp + 0x40], eax
jne 0x140011e77
mov rax, qword [rbx + 0x20]
mov dword [rbx + 8], 0x1000
mov qword [rbx], rax
mov eax, 1
jmp 0x140011e79
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400139c4
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140013a8a
lea rcx, [0x14015f7a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14015dd90]
jmp 0x140013a4e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140013a4b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x14015dd90]
mov rdx, rsi
call fcn.140052330
jmp 0x140013a4e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140013a1b
mov rdx, qword [0x14015a3c8]
lea rcx, [0x14015dd90]
mov rdi, rdx
inc rdx
mov qword [0x14015a3c8], rdx
lea edx, [rbx + 0x20]
call fcn.140052378
lea rcx, [0x14015f7a0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x14001735c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x1400173d3
movsxd rdx, ecx
lea rcx, [0x1400172b8]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [0x14015dda0]
test rbx, rbx
je 0x140017446
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400173c9
cmp byte [rbx + 0x20], 0
je 0x1400173c9
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x14001738f
jmp 0x140017446
mov rbx, qword [0x14015dda0]
test rbx, rbx
je 0x140017446
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14001743e
cmp byte [rbx + 0x21], 0
je 0x140017402
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14001742e
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.DLL_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x14015dda0]
call fcn.140052330
mov rbx, rdi
test rdi, rdi
jne 0x1400173df
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140017b00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x14015f7e0]
call fcn.140051f1c
test rax, rax
je 0x140017b3d
cmp dword [rax + 0x28], 0
je 0x140017b3d
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140017720
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.140052e40
Function at 0x140034d64
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x14015f820]
call fcn.14005170c
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x140034e61
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x140034dbb
add rax, 2
cmp word [rax], 0x20
je 0x140034db1
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x140034df9
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x140034e39
cmp cx, r9w
je 0x140034deb
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140034dd9
cmp word [rax], bp
je 0x140034e39
mov rcx, rax
add rax, 2
jmp 0x140034e41
test dx, dx
je 0x140034e3e
mov rbx, rax
cmp dx, 0x20
je 0x140034deb
add rax, 2
cmp word [rax], r9w
jne 0x140034e2f
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x140034e39
cmp cx, r9w
je 0x140034e2f
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140034e1d
movzx edx, word [rax]
test dx, dx
jne 0x140034e01
jmp 0x140034deb
mov rcx, rax
jmp 0x140034e41
mov r8d, ebp
cmp dword [r14], esi
jne 0x140034e4b
test rdi, rdi
jne 0x140034e6b
test r8d, r8d
je 0x140034e52
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x140034dab
test rdi, rdi
jne 0x140034e80
movsxd rax, esi
jmp 0x140034e82
test rbx, rbx
je 0x140034e80
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x140034e82
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140034eb4
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
lea rcx, [rax + 0x10]
xor ebp, ebp
mov dword [rax + 0x10], ebp
call fcn.140034d64
mov esi, dword [rsp + 0x38]
mov ecx, esi
mov edx, ebx
mov rdi, rax
call fcn.1400529e0
mov ecx, ebp
jmp 0x140034f0a
test esi, esi
je 0x140034f0f
movzx edx, word [rdi]
cmp dx, 0x22
jne 0x140034efd
inc ecx
jmp 0x140034f04
mov word [rax], dx
add rax, 2
add rdi, 2
dec esi
cmp word [rdi], bp
jne 0x140034eec
mov word [rax], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.140052b20
Function at 0x140036ad0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [rcx], 1
jne 0x140036ae2
mov rcx, qword [rcx + 8]
test rcx, rcx
jne fcn.140053130
mov ecx, edx
jmp fcn.140052e40

Function at 0x140038aa4
Capabilities:
Reference http user-agent string

Disassembly:
lea r9, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
xor r8d, r8d
jmp 0x140038ac0

Function at 0x140038ab4
Capabilities:
Reference http user-agent string

Disassembly:
lea r9, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
jmp 0x140038ac0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x140038b90
test rdx, rdx
je 0x140038b90
mov rcx, qword [0x14015d920]
lea edx, [rbx + 8]
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
or dword [rax + 4], 0xffffffff
mov dword [rax], ebx
mov rdi, rax
call sub.msvcrt.dll__wcsdup
mov rcx, rsi
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov rcx, r15
mov qword [rdi + 0x10], rax
call sub.msvcrt.dll__wcsdup
mov dword [rdi + 0x40], r14d
mov qword [rdi + 0x58], rax
test r14b, 1
je 0x140038b7d
lea rax, [rsp + 0x50]
lea r8, [0x140038d64]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140038b88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
jmp 0x140038b90
mov rcx, rdi
call fcn.140038bac
movsxd rbx, eax
mov rcx, rdi
call fcn.140038e04
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140038ac0
Capabilities:
Create thread

Disassembly:
lea r9, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
jmp 0x140038ac0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x140038b90
test rdx, rdx
je 0x140038b90
mov rcx, qword [0x14015d920]
lea edx, [rbx + 8]
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
or dword [rax + 4], 0xffffffff
mov dword [rax], ebx
mov rdi, rax
call sub.msvcrt.dll__wcsdup
mov rcx, rsi
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov rcx, r15
mov qword [rdi + 0x10], rax
call sub.msvcrt.dll__wcsdup
mov dword [rdi + 0x40], r14d
mov qword [rdi + 0x58], rax
test r14b, 1
je 0x140038b7d
lea rax, [rsp + 0x50]
lea r8, [0x140038d64]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140038b88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
jmp 0x140038b90
mov rcx, rdi
call fcn.140038bac
movsxd rbx, eax
mov rcx, rdi
call fcn.140038e04
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140038bac
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rcx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 8]
xor ebx, ebx
mov esi, ebx
call fcn.1400ef190
mov rcx, qword [rdi + 0x58]
mov r12, rax
call fcn.1400ef190
mov r13, rax
call fcn.1400b30b0
mov rbp, rax
test rax, rax
je 0x140038d27
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140038d0d
test byte [rdi + 0x40], 2
mov qword [rdi + 0x18], rax
jne 0x140038c4c
lea edx, [rbx + 0x34]
lea r8d, [rbx + 1]
mov rcx, rbp
call fcn.1400b5c20
mov r8, qword [0x14015df50]
test r8, r8
je 0x140038c65
mov edx, 0x2714
mov rcx, rbp
call fcn.1400b5c20
mov r8, qword [0x14015df58]
test r8, r8
je 0x140038c9b
cmp qword [0x14015df60], rbx
je 0x140038c9b
mov edx, 0x27bf
mov rcx, rbp
call fcn.1400b5c20
mov r8, qword [0x14015df60]
mov edx, 0x27c0
mov rcx, rbp
call fcn.1400b5c20
mov r8, r12
mov edx, 0x2712
mov rcx, rbp
call fcn.1400b5c20
mov r8, r13
mov edx, 0x2722
mov rcx, rbp
call fcn.1400b5c20
lea r8, [0x140038d74]
mov edx, 0x4e2b
mov rcx, rbp
call fcn.1400b5c20
mov r8, rdi
mov edx, 0x2711
mov rcx, rbp
call fcn.1400b5c20
mov rcx, rbp
call fcn.1400b32e0
test eax, eax
jne 0x140038cf7
cmp dword [rdi + 4], 0xfffffffb
mov eax, 1
cmovne esi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140038d0d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call fcn.1400b2e40
mov eax, 1
cmp esi, eax
jne 0x140038d27
mov dword [rdi + 4], 0xfffffffe
jmp 0x140038d34
cmp dword [rdi + 4], 0xfffffffb
setne bl
add ebx, 0xfffffffc
mov dword [rdi + 4], ebx
mov rcx, r12
call fcn.1400ef180
mov rcx, r13
call fcn.1400ef180
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret