joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9280
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400adb44
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400b9321
cmp ebx, dword [rsp + 0x30]
je 0x1400b931a
test esi, esi
je 0x1400b931a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400b92f5
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400b9302
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400b92df
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400b9306
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400b9323
mov eax, 1
jmp 0x1400b9323
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bfaec
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400b28fc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400b28fc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400bfc3c
cmp rax, 0xffffffffffffffff
je 0x1400bfc3c
xor edi, edi
test rbp, rbp
jle 0x1400bfbe7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400b1324
mov rbx, rax
test rax, rax
jne 0x1400bfb74
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400bfbdd
mov edx, 0x8000
mov ecx, r14d
call fcn.1400a55d4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400b044c
cmp eax, 0xffffffff
je 0x1400bfbbd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400bfb84
mov edx, r15d
mov ecx, r14d
call fcn.1400a55d4
jmp 0x1400bfbdd
cmp byte [rsi + 0x38], dil
je 0x1400bfbd4
cmp dword [rsi + 0x34], 5
jne 0x1400bfbd4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400bfbdd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400adea4
jmp 0x1400bfc50
jns 0x1400bfc50
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400b28fc
cmp rax, 0xffffffffffffffff
jne 0x1400bfc08
cmp byte [rsi + 0x30], dil
je 0x1400bfc50
mov edi, dword [rsi + 0x2c]
jmp 0x1400bfc50
mov ecx, r14d
call fcn.1400b6b9c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400bfc50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400bfc50
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400bfc49
mov eax, dword [rsi + 0x2c]
jmp 0x1400bfc4e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400b28fc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800628ac
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1800ef8c0
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1800ee910
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800ef8f7
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x180174020]
jmp 0x1800ef8fd
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret

Function at 0x180063522
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1800dc5c0
mov rax, rcx
neg rcx
test rax, 7
je 0x1800dc5dd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1800dc638
test al, 7
jne 0x1800dc5d0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1800dc5f1
mov rdx, qword [rax - 8]
test dl, dl
je 0x1800dc662
test dh, dh
je 0x1800dc65c
shr rdx, 0x10
test dl, dl
je 0x1800dc656
test dh, dh
je 0x1800dc650
shr rdx, 0x10
test dl, dl
je 0x1800dc64a
test dh, dh
je 0x1800dc644
shr edx, 0x10
test dl, dl
je 0x1800dc63e
test dh, dh
jne 0x1800dc5f1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x18006372a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x180068620
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x180173012]
call fcn.180064e4f
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 8], rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x116
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x28], rax
mov r8d, 0x116
lea rdx, section..data
mov rcx, qword [rbp + 0x28]
call fcn.1800636c1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call qword [rbp + 8]
xor eax, eax
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180063833
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1800856d0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.180085050
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18008570f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180174020]
jmp 0x180085719
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x180063969
Capabilities:
Query environment variable

Disassembly:
jmp 0x1800ecf80
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x1800ed068
mov rsi, rax
cmp word [rax], r14w
je 0x1800ecfd3
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1800ecfbb
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x1800ecfb7
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.1800642ce
movsxd rbp, eax
test eax, eax
je 0x1800ed068
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.180063734
mov rdi, rax
test rax, rax
je 0x1800ed056
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1800642ce
test eax, eax
je 0x1800ed056
mov rsi, rdi
mov rdi, r14
jmp 0x1800ed059
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.180062825
jmp 0x1800ed06b
mov rsi, r14
test rbx, rbx
je 0x1800ed079
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x18006396e
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x180085600
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.180084fd0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180085641
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180174020]
jmp 0x180085647
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1800639e6
Capabilities:
Get geographical location

Disassembly:
jmp 0x1800efb90
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1800eeb10
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800efbe3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x180174020]
jmp 0x1800efc05
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.1800632bb
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret
Function at 0x1800639f0
Capabilities:
Terminate process

Disassembly:
jmp 0x18006bdc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x180063bc6
Capabilities:
Print debug messages

Disassembly:
jmp 0x1801036b0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x180162178]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1801036d6
jmp 0x180103753
mov rcx, qword [rbp + 0x30]
call fcn.180063522
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1801036ef
jmp 0x180103753
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x18010370c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18006284d
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.180062bf9
test eax, eax
jne 0x180103753
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1800636bc
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x18006442c
Capabilities:
Terminate process

Disassembly:
jmp 0x1800dcda0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1800dcdce
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.180064aee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1800644d6
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1800ef980
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1800ee990
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800ef9b5
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x180174020]
jmp 0x1800ef9bf
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x1800648e1
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1800ef9e0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1800ee9d0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800efa1f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x180174020]
jmp 0x1800efa2e
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x180064b4d
Capabilities:
Print debug messages

Disassembly:
jmp 0x1800e47f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180064be3
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x180085740
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.180085090
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180085789
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180174020]
jmp 0x180085798
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x140002140
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rbx, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jae 0x14000217c
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xf
cmp eax, 1
jbe 0x140002184
cmp eax, 0xb
je 0x140002184
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140003110
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rdx + 0x18]
mov rbx, rdx
test rcx, rcx
je 0x14000312a
xor edx, edx
call qword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000313b
xor edx, edx
call qword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000314a
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140003159
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140003169
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx + 0x238], 1
jne 0x1400031a6
mov rcx, qword [rbx + 0x2480]
test rcx, rcx
jne 0x140003182
xor eax, eax
jmp 0x14000318f
imul rax, qword [rbx + 0x2478], 0x64
xor edx, edx
div rcx
mov r9, qword [rbx + 8]
lea rcx, str.Success
mov r8d, eax
mov edx, 1
call qword [rbx]
jmp 0x1400031b0
lea rcx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x2488
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14002aa04

Function at 0x140003680
Capabilities:
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rdx + 0x268], 0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
jne 0x1400036bd
mov dword [rdx + 0x238], 1
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140003a60
test al, al
jne 0x1400036d6
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140003870
Function at 0x140003700
Capabilities:
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [r8 + 8], 0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
je 0x14000376c
mov rcx, qword [rdx + 0x2480]
mov dword [rdx + 0x238], 2
test rcx, rcx
je 0x140003745
imul rax, qword [rdx + 0x2478], 0x64
xor edx, edx
div rcx
mov rcx, rax
mov r9, qword [rbx + 8]
mov r8d, ecx
lea rcx, str.Request_failed
mov edx, 2
call qword [rbx]
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, str.InternetOpenUrl
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbx + rcx*2 + 0x2278]
cmp ax, word [rdx + rcx*2]
jne 0x140003803
movzx eax, word [rbx + rcx*2 + 0x227a]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140003803
add rcx, 2
cmp rcx, 0x10
jne 0x140003780
mov rdx, rbx
mov rcx, rdi
call fcn.1400039c0
test al, al
je 0x1400037d3
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140003870
mov r9, qword [rbx + 8]
lea rcx, str.URL_not_found
xor r8d, r8d
mov dword [rbx + 0x238], 2
lea edx, [r8 + 2]
call qword [rbx]
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, str.InternetReadFileEx
mov rcx, 0xffffffffffffffff
movzx eax, word [rbx + rcx*2 + 0x227a]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140003838
add rcx, 2
cmp rcx, 0x13
je 0x14000384a
movzx eax, word [rbx + rcx*2 + 0x2278]
cmp ax, word [rdx + rcx*2]
je 0x140003811
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x10]
Function at 0x140003870
Capabilities:
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea r8, str.InternetReadFileEx
lea rcx, [rdx + 0x2278]
mov rbx, rdx
mov edx, 0x100
call fcn.140071094
xor ebp, ebp
lea rax, [rbx + 0x278]
mov qword [rbx + 0x244], rbp
lea rdx, [rbx + 0x240]
mov qword [rbx + 0x24c], rbp
mov r9, rbx
mov qword [rbx + 0x254], rbp
mov dword [rbx + 0x25c], ebp
lea r8d, [rbp + 1]
mov qword [rbx + 0x26c], rbp
mov dword [rbx + 0x274], ebp
mov rcx, qword [rbx + 0x20]
mov dword [rbx + 0x240], 0x38
mov dword [rbx + 0x268], 0x2000
mov qword [rbx + 0x260], rax
call qword [sym.imp.WININET.dll_InternetReadFileExW]
test eax, eax
je 0x140003945
nop word [rax + rax]
cmp dword [rbx + 0x268], ebp
je 0x140003991
mov rdx, rbx
mov rcx, rsi
call fcn.140003a60
test al, al
je 0x14000398d
mov rcx, qword [rbx + 0x20]
lea rdx, [rbx + 0x240]
mov r9, rbx
mov r8d, 1
call qword [sym.imp.WININET.dll_InternetReadFileExW]
test eax, eax
jne 0x140003910
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14000399b
mov rcx, qword [rbx + 0x2480]
mov dword [rbx + 0x238], 2
test rcx, rcx
je 0x140003978
imul rax, qword [rbx + 0x2478], 0x64
xor edx, edx
div rcx
mov rbp, rax
mov r9, qword [rbx + 8]
lea rcx, str.Download_failed
mov r8d, ebp
mov edx, 2
call qword [rbx]
xor al, al
jmp 0x14000399d
mov dword [rbx + 0x238], 1
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400039c0
Capabilities:
Check http status code
Get http content length

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x58]
xor ebx, ebx
lea r9, [rsp + 0x60]
mov dword [rsp + 0x58], ebx
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov rcx, qword [rdi + 0x20]
mov edx, 0x20000013
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x140003a4e
cmp dword [rsp + 0x68], 0xc8
jne 0x140003a4e
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov dword [rsp + 0x30], 4
mov edx, 0x20000005
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x140003a3a
mov ebx, dword [rsp + 0x34]
mov qword [rdi + 0x2480], rbx
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x40
pop rdi
ret
Function at 0x140003a60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
lea r9, [rsp + 0x48]
xor edi, edi
add rdx, 0x278
mov qword [rsp + 0x20], rdi
mov r8d, dword [rbx + 0x268]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [rbx + 0x2480]
test eax, eax
jne 0x140003add
mov dword [rbx + 0x238], 2
test r8, r8
je 0x140003abb
imul rax, qword [rbx + 0x2478], 0x64
xor edx, edx
div r8
mov rdi, rax
mov r9, qword [rbx + 8]
lea rcx, str.Failed_writing_to_file
mov r8d, edi
mov edx, 2
call qword [rbx]
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edx, dword [rsp + 0x48]
add rdx, qword [rbx + 0x2478]
mov qword [rbx + 0x2478], rdx
test r8, r8
je 0x140003b00
imul rax, rdx, 0x64
xor edx, edx
div r8
mov rdi, rax
mov r9, qword [rbx + 8]
lea rcx, str.RECEIVING...
mov edx, dword [rbx + 0x238]
mov r8d, edi
call qword [rbx]
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400040f0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx - 0x128]
mov rbx, rcx
add rcx, 0xfffffffffffffed8
movsxd rdx, dword [rax + 4]
add rcx, rdx
call fcn.140012cd0
mov rax, qword [rbx - 0x128]
mov edx, dword [rbx - 0x20]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx - 0x120]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbx - 0x128]
mov edx, dword [rbx - 4]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx - 0x120]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbx - 0x128]
mov edx, dword [rbx - 0x1c]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx - 0x120]
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [rbx - 0xc], 0
mov edx, pe_nt_image_headers64
mov ecx, 0xa0
cmove ecx, edx
mov rdx, rbx
sub rdx, rcx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
mov dword [rbx - 8], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140006470
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x6e0]
mov r8d, 2
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 1
jl 0x1400065cb
mov qword [rsp + 0x158], rdi
mov eax, 0xff
movzx edi, word [rsp + 0x20]
cmp di, ax
ja 0x1400065c3
mov rcx, qword [rbx + 0x1e0]
lea edx, [rax + 0x48]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x1400065c3
mov rcx, qword [rbx + 0x1e0]
xor r9d, r9d
mov qword [rsp + 0x178], rbp
mov edx, 0x150
mov qword [rsp + 0x180], rsi
movsxd r8, eax
mov qword [rsp + 0x150], r14
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rsi, eax
lea r14, [0x1401be8a0]
add rsi, rsi
mov ebp, dword [r14 + rsi*8 + 4]
cmp ebp, 0x14
jge 0x14000653c
movzx ecx, dil
call fcn.140071b4c
movzx edi, al
movsxd rax, dword [rbx + 0x10f4]
lea rdx, str.___c_t_s
movzx r8d, dil
lea rcx, [rsp + 0x40]
mov byte [rbx + rax*8 + 0x8f4], dil
movsxd rax, dword [rbx + 0x10f4]
mov dword [rbx + rax*8 + 0x8f8], ebp
inc dword [rbx + 0x10f4]
mov r9, qword [r14 + rsi*8 + 8]
call fcn.1400080e0
mov rcx, qword [rbx + 0x1d0]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x180
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x1d0]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14002a970
add rsp, 0x160
pop rbx
ret

Function at 0x140007300
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401cb558]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x6e0]
mov r8d, 2
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 1
jge 0x140007366
mov rcx, qword [rbx + 0x1f8]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x508]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a970
add rsp, 0x50
pop rbx
ret
movzx edx, byte [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
call fcn.140006260
mov rcx, qword [rbx + 0x1f8]
xor ebp, ebp
movsxd rsi, eax
mov edx, ebp
cmp esi, 0xffffffff
sete dl
call qword [sym.imp.USER32.dll_EnableWindow]
cmp esi, 0xffffffff
je 0x1400073c1
mov rcx, qword [rbx + 0x1d0]
mov r8, rsi
xor r9d, r9d
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call int.140007f30
mov rcx, qword [rbx + 0x1d0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x188
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x508]
cmp eax, 0xffffffff
setne bpl
mov edx, ebp
call qword [sym.imp.USER32.dll_EnableWindow]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a970
add rsp, 0x50
pop rbx
ret