joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r13
push r14
sub rsp, 0xb8
mov r13, rcx
movsxd rax, r9d
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xe8], ecx
mov r14, rdx
test r9d, r9d
jle 0x14007a072
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rbp
movzx ebp, byte [r13 + 0x24]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov edi, 0x100
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
movzx r11d, byte [r13 + 0x20]
movss xmm8, dword [0x1402b6b00]
nop word [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140079eda
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, di
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, di
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140079ef9
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
xor edi, edi
mov byte [rbx], r11b
mov byte [rbx + 1], bpl
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x14007a010
mov r15, qword [rsp + 0xf0]
mov rax, r12
shl rax, 4
add r15, 6
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140079f40
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x140079f43
mov edx, dword [rax + rsi]
mov eax, dword [r13 + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [r13 + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140075110
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.140077a60
movzx ecx, word [r13 + 0x1c]
inc r12
movzx r11d, word [r13 + 0x20]
movzx eax, cx
sub ax, word [rsp + 0x50]
dec cx
movzx ebp, word [r13 + 0x24]
dec ax
add ax, r11w
inc edi
add ax, word [rsp + 0x54]
add rsi, 4
mov word [r15 - 2], ax
movzx eax, bp
sub ax, word [rsp + 0x58]
add ax, cx
mov ecx, dword [rsp + 0xe8]
add ax, word [rsp + 0x5c]
inc ecx
mov word [r15], ax
add r15, 0x10
mov dword [rsp + 0xe8], ecx
cmp edi, dword [rbx - 0x10]
jl 0x140079f30
jmp 0x14007a017
mov ecx, dword [rsp + 0xe8]
add rbx, 0x28
mov edi, 0x100
sub qword [rsp + 0x60], 1
jne 0x140079e90
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, ecx
add rsp, 0xb8
pop r14
pop r13
ret
Function at 0x140222cb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140222cfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140222cfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140222cfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140222cfa
cmp dword [rcx + 0x84], 0xe
jbe 0x140222cfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140222cfc
xor al, al
add rsp, 0x28
ret

Function at 0x180770058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1807701df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180770089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18077006f
add dl, dl
jne 0x180770096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807700f6
xor eax, eax
add dl, dl
jne 0x1807700a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807701ad
add dl, dl
jne 0x1807700b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807700c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807700d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807700dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807700ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18077007e
mov eax, 1
add dl, dl
jne 0x180770106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180770113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807700fb
sub eax, ebx
mov ebx, 1
jne 0x18077014c
mov ecx, 1
add dl, dl
jne 0x18077012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18077013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180770123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18077007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180770168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180770175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18077015d
cmp eax, 0x7d00
jae 0x18077019b
cmp eax, 0x500
jb 0x180770196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18077007e
cmp eax, 0x7f
ja 0x18077019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18077007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807701d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18077007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14004b9a8
Capabilities:
Query environment variable

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov r14, rcx
mov rcx, rdx
call fcn.14004a0f6
lea rdx, [rax + 0x104]
lea rsi, [rbp - 0x28]
mov rcx, rsi
xor r8d, r8d
call fcn.14004ba96
mov rcx, rsi
call fcn.14004a0f6
mov rbx, rax
mov rcx, rsi
call fcn.14004bbb2
mov rsi, rax
mov rcx, rdi
call fcn.14003c316
mov rcx, rax
mov rdx, rsi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14004ba33
dec eax
lea rcx, [rbp - 0x28]
mov rdx, rax
xor r8d, r8d
call fcn.14004bc88
lea rdx, [rbp - 0x28]
mov rcx, r14
call fcn.14003df8c
jmp 0x14004ba3e
mov rcx, r14
mov rdx, rdi
call fcn.14003bec6
lea rcx, [rbp - 0x28]
call fcn.140003d86
mov rax, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x140061930
Capabilities:
Get hostname

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov r14, rdx
lea rdi, [rbp + 0x54]
mov dword [rdi], 0x104
lea rbx, [rbp - 8]
mov rcx, rbx
call fcn.14000e25a
lea rsi, [rbp + 0x38]
mov edx, 0x104
mov rcx, rsi
mov r8, rbx
call fcn.14004bee2
mov rcx, rsi
call fcn.14004bf6e
mov ecx, 1
mov rdx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov edi, eax
test eax, eax
setne cl
call fcn.140061b5a
test al, al
je 0x1400619cc
mov edx, dword [rbp + 0x54]
lea rcx, [rbp + 0x38]
call fcn.140061f3e
lea rcx, [rbp + 0x38]
call fcn.14004bf6e
lea r8, [rbp + 0x54]
mov ecx, 1
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov edi, eax
test edi, edi
je 0x140061a15
lea rcx, [rbp - 8]
lea rdx, [rbp + 0x38]
call fcn.140048cba
lea rcx, [rbp - 8]
mov rdx, r14
call fcn.14004a884
lea rcx, [rbp + 0x18]
call fcn.140003d86
lea rcx, [rbp - 8]
call fcn.140003dce
lea rcx, [rbp + 0x38]
call fcn.14004c8fc
mov rax, r14
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x48]
mov edx, eax
call fcn.1400e0e71
lea rcx, [rbp - 0x48]
call fcn.140049776
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140149934]
lea rcx, [rbp - 8]
mov r8d, eax
mov r9, rsi
call fcn.14004788a
lea rcx, [rbp - 8]
call fcn.1400496a0
lea rsi, [rbp - 0x60]
mov rcx, rsi
mov rdx, rax
call fcn.140017a9e
lea rdx, [0x140166b18]
mov rcx, rsi
call fcn.14012b400
int3
Function at 0x14006200a
Capabilities:
Get session user name

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov r14, rdx
lea rdi, [rbp + 0x54]
mov dword [rdi], 0x104
lea rbx, [rbp - 8]
mov rcx, rbx
call fcn.14000e25a
lea rsi, [rbp + 0x38]
mov edx, 0x104
mov rcx, rsi
mov r8, rbx
call fcn.14004bee2
mov rcx, rsi
call fcn.14004bf6e
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
setne cl
call fcn.140061b5a
test al, al
je 0x14006209c
mov edx, dword [rbp + 0x54]
lea rcx, [rbp + 0x38]
call fcn.140061f3e
lea rcx, [rbp + 0x38]
call fcn.14004bf6e
lea rdx, [rbp + 0x54]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test edi, edi
je 0x14006210d
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0x38]
call fcn.140048cba
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 8]
call fcn.14004a884
lea rcx, [rbp - 8]
mov r9d, 0x40
mov rdx, r14
xor r8d, r8d
call fcn.14004b1ba
lea rcx, [rbp + 0x18]
call fcn.140003d86
lea rcx, [rbp - 8]
call fcn.140003dce
lea rcx, [rbp - 0x28]
call fcn.140003d86
lea rcx, [rbp - 0x48]
call fcn.140003dce
lea rcx, [rbp + 0x38]
call fcn.14004c8fc
mov rax, r14
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x48]
mov edx, eax
call fcn.1400e0e71
lea rcx, [rbp - 0x48]
call fcn.140049776
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140149994]
lea rcx, [rbp - 8]
mov r8d, eax
mov r9, rsi
call fcn.14004788a
lea rcx, [rbp - 8]
call fcn.1400496a0
lea rsi, [rbp - 0x60]
mov rcx, rsi
mov rdx, rax
call fcn.140017a9e
lea rdx, [0x140166b18]
mov rcx, rsi
call fcn.14012b400
int3

Function at 0x14008361c
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov r8d, 0x198
mov rcx, rdi
xor edx, edx
call fcn.14012bb80
mov cx, 0x202
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rax, rsi
add rsp, 0x1b8
pop rdi
pop rsi
ret
Function at 0x14008cef2
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
call fcn.14008efb2
mov qword [rbp - 8], rsi
lea rcx, [rsi + 0x18]
call fcn.14011903c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14008cf88]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x20], rax
mov rax, rcx
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x1400cbd4c
Capabilities:
Get session user name

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x890
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x800], 0xfffffffffffffffe
mov rbx, rcx
lea rsi, [rbp + 0x7f0]
mov dword [rsi], 0x3ff
lea rdi, [rbp - 0x60]
mov r8d, 0x7fe
mov rcx, rdi
xor edx, edx
call fcn.14012bb80
mov ecx, 2
mov rdx, rdi
mov r8, rsi
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x1400cbec4
mov qword [rbp + 0x7e8], rbx
mov eax, dword [rbp + 0x7f0]
dec eax
cmp word [rbp + rax*2 - 0x60], 0x24
jne 0x1400cbede
mov rcx, qword [0x140186c68]
xor edx, edx
call fcn.1400db164
lea rdx, [rbp + 0x7a8]
mov rcx, rax
call fcn.1400df00c
lea rcx, [rbp + 0x7a8]
mov rdx, qword [rbp + 0x7e8]
call fcn.140049682
mov eax, dword [0x14018b9f0]
mov ecx, dword [0x14018b9ec]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0x7f7]
cmp ecx, 0xa
setl byte [rbp + 0x7f8]
mov eax, 0xabe33767
lea r14, [rbp + 0x7c8]
mov ebx, 0xf2ab1951
lea rdi, [rbp + 0x7a8]
mov esi, 0x762c38e3
cmp eax, 0x63b7b0cc
jg 0x1400cbe7e
cmp eax, 0xabe33767
je 0x1400cbe8e
cmp eax, 0xf2ab1951
jne 0x1400cbe36
mov rcx, r14
call fcn.140003d86
mov rcx, rdi
call fcn.140003dce
mov eax, dword [0x14018b9f0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x63b7b0cd
cmove eax, esi
cmp dword [0x14018b9ec], 0xa
cmovl eax, esi
jmp 0x1400cbe36
cmp eax, 0x63b7b0cd
je 0x1400cbeaa
cmp eax, 0x762c38e3
jne 0x1400cbe36
jmp 0x1400cbed5
mov cl, byte [rbp + 0x7f7]
cmp byte [rbp + 0x7f8], 0
mov eax, 0x63b7b0cd
cmovne eax, ebx
test cl, cl
cmovne eax, ebx
jmp 0x1400cbe36
mov rcx, r14
call fcn.140003d86
mov rcx, rdi
call fcn.140003dce
mov eax, 0xf2ab1951
jmp 0x1400cbe36
lea rdx, [0x14014a0b0]
mov rcx, rbx
call fcn.140049142
jmp 0x1400cbf14
mov rbx, qword [rbp + 0x7e8]
jmp 0x1400cbf14
lea rsi, [rbp + 0x7f8]
mov rcx, rsi
call fcn.14000e25a
mov eax, dword [rbp + 0x7f0]
lea r8, [rax*2 - 0x60]
add r8, rbp
lea rdx, [rbp - 0x60]
mov rbx, qword [rbp + 0x7e8]
mov rcx, rbx
mov r9, rsi
call fcn.1400a9b54
mov rax, rbx
add rsp, 0x890
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400d3030
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x100
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x78], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 0x10
call fcn.1401281b8
mov rsi, rax
xorps xmm0, xmm0
movaps xmmword [rax], xmm0
mov qword [rax], rbx
mov rcx, rdi
call fcn.1400d7bac
mov qword [rsi + 8], rax
lea rcx, [rbp + 0x50]
mov qword [rcx], 0
mov edx, dword [rdi]
mov dword [rcx - 8], edx
mov edx, dword [rdi + 4]
mov dword [rcx - 4], edx
mov qword [rcx + 8], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x1400d31d6]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
setne cl
cmp rax, 0xffffffffffffffff
setne al
cmp cl, al
jne 0x1400d30f3
lea rsi, [r14 + 0x18]
mov rcx, rsi
call fcn.14001155e
lea rdx, [rbp + 0x48]
mov rcx, r14
call fcn.1400d3488
mov rcx, rsi
call fcn.140011772
nop
add rsp, 0x100
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rbp - 0x48]
mov rcx, rsi
mov edx, eax
call fcn.1400e0e71
mov rcx, rsi
call fcn.140049776
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14014c372]
lea rcx, [rbp + 8]
mov r8d, eax
mov r9, rsi
call fcn.14004788a
lea rcx, [rbp + 8]
call fcn.1400496a0
lea rcx, vtable.std::exception.0
lea rdx, [rbp + 0x68]
mov qword [rdx - 8], rcx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
lea rcx, [rbp - 8]
mov qword [rcx], rax
mov byte [rcx + 8], 1
call fcn.14012bf08
lea rdx, [0x140166b18]
lea rcx, [rbp + 0x60]
call fcn.14012b400
int3
Function at 0x1400e035e
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x14018b6c0]
mov ecx, dword [0x14018b6bc]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0x698eecc5
mov rdi, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0xdb1b1520
mov ebp, 0x15725b74
cmp eax, 0x15725b73
jg 0x1400e03c4
cmp eax, 0xdb1b1520
je 0x1400e0414
cmp eax, 0x35d3960
jne 0x1400e03a1
mov rcx, qword [rsi]
xor edx, edx
call rdi
mov eax, 0x15725b74
jmp 0x1400e03a1
cmp eax, 0x15725b74
je 0x1400e03ea
cmp eax, 0x698eecc5
jne 0x1400e03a1
mov cl, byte [rsp + 0x26]
cmp byte [rsp + 0x27], 0
mov eax, 0x35d3960
cmovne eax, ebp
test cl, cl
cmovne eax, ebp
jmp 0x1400e03a1
mov rcx, qword [rsi]
xor edx, edx
call rdi
mov eax, dword [0x14018b6c0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x35d3960
cmove eax, ebx
cmp dword [0x14018b6bc], 0xa
cmovl eax, ebx
jmp 0x1400e03a1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400e1180
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
mov qword [rbp - 0x18], rcx
call fcn.140059458
mov dword [rbp - 0x10], 0
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.140049682
lea rsi, [rbp - 0x58]
mov rcx, rsi
call fcn.1400a01c2
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
mov rcx, rsi
call fcn.140003d86
xor ebx, ebx
mov r15d, 0x5055e6fe
mov r12d, 0x9ec00dfd
cmp ebx, dword [rbp - 0x10]
jge 0x1400e12d0
movsxd rax, ebx
mov rdx, qword [r14 + rax*8]
mov rcx, rsi
call fcn.14004746a
mov rcx, qword [rbp - 0x18]
mov rdx, rsi
call fcn.14008e4b8
mov eax, dword [0x14018b9e0]
mov ecx, dword [0x14018b9dc]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 9]
cmp ecx, 0xa
setl byte [rbp - 0xa]
mov eax, 0x64d9fbcf
lea rdi, [rbp - 0x38]
cmp eax, 0x5055e6fd
jg 0x1400e126b
cmp eax, 0x9ec00dfd
je 0x1400e1291
cmp eax, 0xff0da288
jne 0x1400e123f
mov rcx, rdi
call fcn.140003d86
mov rcx, rsi
call fcn.140003dce
mov eax, 0x9ec00dfd
jmp 0x1400e123f
cmp eax, 0x5055e6fe
je 0x1400e12c9
cmp eax, 0x64d9fbcf
jne 0x1400e123f
mov cl, byte [rbp - 9]
cmp byte [rbp - 0xa], 0
mov eax, 0xff0da288
cmovne eax, r12d
test cl, cl
cmovne eax, r12d
jmp 0x1400e123f
mov rcx, rdi
call fcn.140003d86
mov rcx, rsi
call fcn.140003dce
mov eax, dword [0x14018b9e0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xff0da288
cmove eax, r15d
cmp dword [0x14018b9dc], 0xa
cmovl eax, r15d
jmp 0x1400e123f
inc ebx
jmp 0x1400e11f2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x18]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x1400e28e4
Capabilities:
Initialize winhttp library

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x18], rcx
call fcn.140047d8e
call fcn.1400e2a1d
mov dword [rsp + 0x20], 0
lea rcx, [0x14014a0b0]
mov edx, eax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, qword [rbp - 0x18]
mov qword [rcx + 0x40], rax
mov rax, rcx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400e2d08
Capabilities:
Initialize winhttp library

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
add rcx, 0x40
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov eax, 0xff665d8f
lea rdi, [rsp + 0x48]
mov r15d, 0xba59b6
mov r12d, 0x93980a54
mov r13, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ebp, 0xc662b4c0
mov r14d, 0xaca6d49e
cmp eax, 0xe5325d89
jle 0x1400e2da2
cmp eax, 0xba59b5
jle 0x1400e2de3
cmp eax, 0x5e255d6c
je 0x1400e2e31
cmp eax, 0x6cce2934
jne 0x1400e2f50
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5e255d6c
cmove eax, r14d
cmp dword [0x14018b9c4], 0xa
cmovl eax, r14d
jmp 0x1400e2d59
cmp eax, 0xaca6d49d
jg 0x1400e2e11
cmp eax, 0x93980a54
je 0x1400e2e43
cmp eax, 0xaad5e9f1
jne 0x1400e2d59
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe5325d8a
cmove eax, r12d
cmp dword [0x14018b9c4], 0xa
cmovl eax, r12d
jmp 0x1400e2d59
cmp eax, 0xe5325d8a
je 0x1400e2ec8
cmp eax, 0xff665d8f
jne 0x1400e2d59
cmp qword [rsp + 0x38], 0
mov eax, 0x6cce2934
mov ecx, 0xaad5e9f1
cmove eax, ecx
jmp 0x1400e2d59
cmp eax, 0xaca6d49e
je 0x1400e2f22
cmp eax, 0xc662b4c0
jne 0x1400e2d59
mov eax, 0xaad5e9f1
jmp 0x1400e2d59
mov rcx, qword [rsp + 0x38]
call r13
mov eax, 0xaca6d49e
jmp 0x1400e2d59
call fcn.1400e2a1d
mov ebx, eax
mov rcx, rsi
mov rdx, rdi
call fcn.140049682
mov rcx, rdi
call fcn.1400812ec
mov rcx, rax
call fcn.14003c316
mov dword [rsp + 0x20], 0
mov rcx, rax
mov edx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rcx, rdi
call fcn.140003d86
mov rax, qword [rsp + 0x30]
xor ecx, ecx
cmp qword [rax], 0
setne cl
mov dword [rsp + 0x44], ecx
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe5325d8a
cmove eax, r15d
cmp dword [0x14018b9c4], 0xa
cmovl eax, r15d
jmp 0x1400e2d59
call fcn.1400e2a1d
mov ebx, eax
mov rcx, rsi
mov rdx, rdi
call fcn.140049682
mov rcx, rdi
call fcn.1400812ec
mov rcx, rax
call fcn.14003c316
mov dword [rsp + 0x20], 0
mov rcx, rax
mov edx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rcx, rdi
call fcn.140003d86
mov rax, qword [rsp + 0x30]
mov eax, 0x93980a54
jmp 0x1400e2d59
mov rcx, qword [rsp + 0x38]
call r13
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5e255d6c
cmove eax, ebp
cmp dword [0x14018b9c4], 0xa
cmovl eax, ebp
jmp 0x1400e2d59
cmp eax, 0xba59b6
jne 0x1400e2d59
mov eax, dword [rsp + 0x44]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400e3c6a
Capabilities:
Read http header

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rcx, rdx
mov edx, r8d
call fcn.1400e59d0
mov esi, eax
lea r12, [rbp + 0x20]
mov dword [r12], eax
lea r15, [rbp - 0x38]
mov rcx, r15
call fcn.14000e25a
mov edx, esi
lea rsi, [rbp + 8]
mov rcx, rsi
mov r8, r15
call fcn.14004bee2
mov rcx, rsi
call fcn.14004bf6e
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
mov rcx, rbx
mov edx, edi
xor r8d, r8d
mov r9, rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1400e3d1b
lea rdx, [rbp + 8]
mov rcx, r14
call fcn.140048cba
lea rcx, [rbp + 8]
call fcn.14004c8fc
mov rax, r14
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14014d2ba]
lea rcx, [rbp - 0x38]
mov r8d, eax
call fcn.14004788a
lea rcx, [rbp - 0x38]
call fcn.1400496a0
lea rsi, [rbp - 0x50]
mov rcx, rsi
mov rdx, rax
call fcn.140017a9e
lea rdx, [0x140166b18]
mov rcx, rsi
call fcn.14012b400
int3

Function at 0x1400e4ef4
Capabilities:
Receive http response

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov r15, rdx
mov rdi, rcx
lea r14, [rbp - 0x10]
mov rcx, r14
call fcn.1400331b6
lea rsi, [rbp - 0x30]
mov edx, 0x1000
mov rcx, rsi
mov r8, r14
call fcn.1400438f2
lea r14, [rbp - 4]
mov dword [r14], 0
mov rcx, rsi
call fcn.140001a90
mov rbx, rax
mov rcx, rsi
call fcn.1400472ac
mov rcx, qword [r15]
mov rdx, rax
mov r8d, ebx
mov r9, r14
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1400e5041
cmp dword [rbp - 4], 0
je 0x1400e5041
add rdi, 0x20
lea rbx, [rbp - 0x30]
lea r13, [rbp - 4]
mov r12, qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rcx, rbx
call fcn.140043e34
mov rcx, rax
call fcn.1400b43ae
mov rcx, rbx
call fcn.140043e34
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov r8d, dword [rbp - 4]
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x18]
call fcn.1400e50b0
mov rcx, rbx
call fcn.140043e34
mov rcx, rax
call fcn.1400b43ae
mov rcx, rbx
call fcn.140043e34
mov r14, qword [rax]
mov rcx, rdi
call fcn.140043e34
mov rcx, rax
call fcn.1400b43ae
mov rcx, rdi
call fcn.14000db6c
mov r8, qword [rax]
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea rdx, [rbp - 0x38]
mov r9, r14
call fcn.1400b307a
mov dword [rbp - 4], 0
mov rcx, rbx
call fcn.140001a90
mov rsi, rax
mov rcx, rbx
call fcn.1400472ac
mov rcx, qword [r15]
mov rdx, rax
mov r8d, esi
mov r9, r13
call r12
test eax, eax
je 0x1400e5041
cmp dword [rbp - 4], 0
jne 0x1400e4f8c
lea rcx, [rbp - 0x30]
call fcn.140001cd0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret