joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012aa60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x230
mov qword [rsp + 0x228], 0xfffffffffffffffe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x240]
mov r8, qword [rsp + 0x248]
mov rax, qword [rsp + 0x240]
mov edx, dword [rax + 0x28]
xor ecx, ecx
call fcn.140157f68
mov rdx, rax
mov rax, qword [rsp + 0x240]
mov qword [rax + 0x18], rdx
mov rcx, qword [rsp + 0x240]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0x20], eax
mov rax, qword [rsp + 0x240]
cmp qword [rax + 0x18], 0
jne 0x14012ab82
lea rax, [rsp + 0x128]
mov qword [rsp + 0x130], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.cannot_create_thread
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x160], rcx
mov r8, qword [rsp + 0x160]
lea rdx, str.cannot_create_thread
lea rcx, [rsp + 0x88]
call fcn.1400128b0
nop
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x38]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x38]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x88]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x240]
cmp dword [rax + 0x24], 0
je 0x14012ac59
mov rax, qword [rsp + 0x240]
mov edx, dword [rax + 0x24]
mov rcx, qword [rsp + 0x240]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x14012ac59
lea rax, [rsp + 0x1a1]
mov qword [rsp + 0x1a8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.cannot_set_thread_priority
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x1d8], rcx
mov r8, qword [rsp + 0x1d8]
lea rdx, str.cannot_set_thread_priority
lea rcx, [rsp + 0x100]
call fcn.1400128b0
nop
xor r8d, r8d
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xb0]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0xb0]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x100]
call fcn.140011d00
nop
add rsp, 0x230
pop rdi
ret

Function at 0x14012bb40
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
mov qword [rsp + 0x158], 0xfffffffffffffffe
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, eax
mov rax, qword [rsp + 0x170]
mov dword [rax], edx
mov rax, qword [rsp + 0x170]
cmp dword [rax], 0xffffffff
jne 0x14012bc0a
lea rax, [rsp + 0x98]
mov qword [rsp + 0xa0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.cannot_allocate_thread_context_key
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0xd0], rcx
mov r8, qword [rsp + 0xd0]
lea rdx, str.cannot_allocate_thread_context_key
lea rcx, [rsp + 0x70]
call fcn.1400128b0
nop
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x20]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x14012e370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
mov qword [rsp + 0x128], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011d00
mov rdx, qword [rsp + 0x158]
add rdx, 0x28
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.140011b30
nop
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [0x14019e894]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x88], rcx
mov r8, qword [rsp + 0x88]
lea rdx, [0x14019e894]
lea rcx, [rsp + 0x30]
call fcn.14002d980
mov rax, qword [rsp + 0x150]
movzx eax, byte [rax + 0x20]
test eax, eax
je 0x14012e46e
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x50], 0x10
jb 0x14012e42c
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x130], rax
jmp 0x14012e439
lea rax, [rsp + 0x38]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14012e512
lea rax, [rsp + 0x98]
mov qword [rsp + 0xa0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140043d00
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0xd0], rdx
cmp qword [rsp + 0x80], 8
jb 0x14012e4c4
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x138], rax
jmp 0x14012e4d1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.1400010c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140011d00
add rsp, 0x140
pop rdi
ret
Function at 0x140136130
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xf0
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rax, qword [rsp + 0x100]
cmp qword [rax + 0x90], 0
jne 0x140136176
mov rax, qword [rsp + 0x100]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x100]
call qword [rax + 0x18]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x88], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400010c0
nop
mov rcx, qword [rsp + 0x108]
add rcx, 0x28
lea rdx, [rsp + 0x58]
call fcn.140043d00
cmp qword [rsp + 0x78], 8
jb 0x1401361c3
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xe8], rax
jmp 0x1401361d0
lea rax, [rsp + 0x60]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x108]
call fcn.140136610
mov ebx, eax
mov rcx, qword [rsp + 0x108]
call fcn.1401365b0
mov r11d, eax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
movzx r8d, bx
movzx edx, r11w
mov rcx, qword [rsp + 0x100]
mov rcx, qword [rcx + 0x90]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.1400010c0
add rsp, 0xf0
pop rbx
ret
Function at 0x140140840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x148
mov rax, qword [rsp + 0x150]
cmp qword [rax + 0x28], 0xffffffffffffffff
jne 0x14014086d
mov rcx, qword [rsp + 0x150]
call fcn.140140b30
mov rax, qword [rsp + 0x158]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x158]
cmp qword [rax + 0x20], 0x10
jb 0x1401408a6
mov rax, qword [rsp + 0x158]
mov rax, qword [rax + 8]
mov qword [rsp + 0x130], rax
jmp 0x1401408ba
mov rax, qword [rsp + 0x158]
add rax, 8
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x128]
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14014091b
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x38]
call fcn.1400423f0
lea rdx, [0x1401d7d98]
lea rcx, [rsp + 0x38]
call fcn.1400e0fa4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 2
lea rdx, [0x14019e894]
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14014097f
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x88]
call fcn.1400423f0
lea rdx, [0x1401d7d98]
lea rcx, [rsp + 0x88]
call fcn.1400e0fa4
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1401409c8
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0xd8]
call fcn.1400423f0
lea rdx, [0x1401d7d98]
lea rcx, [rsp + 0xd8]
call fcn.1400e0fa4
add rsp, 0x148
ret
Function at 0x140001000
Capabilities:
Enumerate processes
Execute command

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x270], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400010e2
xor edx, edx
mov qword [rsp + 0x280], rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x140001132
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000108c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.copy__runshelldraw_x86.exe__C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUp_runshelldraw_x86.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.copy__desk_compositor_x86.dll__C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUpdesk_compositor_x86.dll_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.copy__msvcr120.dll__C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUpmsvcr120.dll_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.copy__msvcp120.dll__C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUpmsvcp120.dll_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_____C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUp_runshelldraw_x86.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_____FileVPN.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x280]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001170
add rsp, 0x288
ret
lea rdx, [0x140002280]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rbx
test rax, rax
jne 0x14000112a
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14000107f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000113d
cmp byte [rsp + 0x20], 0
je 0x14000108c
mov r9d, 0x30
lea r8, [0x140002288]
lea rdx, [0x140002290]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400010da
Function at 0x142501058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1425011df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142501089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14250106f
add dl, dl
jne 0x142501096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1425010f6
xor eax, eax
add dl, dl
jne 0x1425010a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1425011ad
add dl, dl
jne 0x1425010b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1425010c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1425010d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1425010dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1425010ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14250107e
mov eax, 1
add dl, dl
jne 0x142501106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142501113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1425010fb
sub eax, ebx
mov ebx, 1
jne 0x14250114c
mov ecx, 1
add dl, dl
jne 0x14250112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14250113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142501123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14250107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142501168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142501175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14250115d
cmp eax, 0x7d00
jae 0x14250119b
cmp eax, 0x500
jb 0x142501196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14250107e
cmp eax, 0x7f
ja 0x14250119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14250107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1425011d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14250107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14004b420
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov rax, qword [0x140370028]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor r14d, r14d
lea r15, [0x140391ec0]
mov qword [rsp + 0x38], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x40], 1
lea rsi, [0x140379b20]
cmp qword [0x140379b30], r14
jne 0x14004b568
call fcn.1400c7ba0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x118]
call qword [case.0x140067d03.0]
mov bl, al
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140023610
cmp byte [0x140391ea8], r14b
je 0x14004b4c9
test bl, bl
lea edx, [r14 + 0x26]
jne 0x14004b4ce
mov edx, 0x1c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14004b568
mov qword [rsp + 0x48], r14
movdqa xmm0, xmmword [0x14031af70]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
cmp byte [0x140391ea8], r14b
je 0x14004b517
test bl, bl
lea rdx, str.Microsoft_OneDrive_setuplogs
jne 0x14004b51e
lea rdx, str.MicrosoftOneDrive_setuplogs
lea rcx, [rsp + 0x48]
call fcn.14000ece4
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
xor r9d, r9d
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14004b980
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.140007f78
test ebx, ebx
js 0x14004b568
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14000ece4
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae rsi, qword [0x140379b20]
mov r8, qword [0x140379b30]
mov rdx, rsi
mov rcx, rdi
call fcn.14000eea4
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140021280
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14007374c
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140073781
mov edi, 0x80004004
mov r8d, 0x277
mov ecx, edi
jmp 0x140073888
lea rdi, [rbx + 0x108]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1400737ae
and qword [rbx + 0x58], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140067d03.0]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.BITS
lea rax, str.URLMon
cmp byte [rbx + 0x175], 0
cmovne rax, rcx
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.WebClient__p_:_BeginDownloadAttempt:_using__ls
lea rdx, str.WebClient
mov ecx, dword [rbx + 0x16c]
call fcn.14004d690
cmp byte [rbx + 0x175], 0
je 0x140073814
mov rcx, rbx
call fcn.1400738d0
mov edi, eax
test eax, eax
jns 0x140073894
mov r8d, 0x280
jmp 0x140073886
cmp byte [rbx + 0x40], 0
je 0x140073857
mov r9, rbx
lea r8, str.WebClient__p_:_BeginDownloadAttempt:_using_WinHTTP_instead_of_URLMon
lea rdx, str.WebClient
mov ecx, dword [rbx + 0x16c]
call fcn.14004d690
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x90]
call qword [case.0x140067d03.0]
mov edi, eax
test eax, eax
jns 0x140073894
mov r8d, 0x285
jmp 0x140073886
call fcn.14005694c
lea rdx, [rbx + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x14007386d
mov rdx, qword [rdx]
mov r9, rbx
xor r8d, r8d
xor ecx, ecx
call sub.urlmon.dll_URLOpenStreamW
mov edi, eax
test eax, eax
jns 0x140073894
mov r8d, 0x289
mov ecx, eax
lea rdx, str.D:dbs_shodct0805_201735cmd_nclientonedriveSetupStandalonewebclientwebclient.cpp
call fcn.14004ac0c
mov r9, rbx
lea r8, str.WebClient__p_:_Leaving_BeginDownloadAttempt__
lea rdx, str.WebClient
mov ecx, edi
call fcn.14004b074
test edi, edi
jns 0x1400738c2
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x78]
mov edx, edi
mov rcx, rbx
call qword [case.0x140067d03.0]
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140074250
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140370028]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
cmp qword [rcx + 0xe0], rdi
je 0x14007439a
lea rbx, [rcx + 0xd0]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14007429c
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140074386
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
lea rsi, vtable.ClassPtr_struct_IFSManager_.0
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rdi
lea rcx, [rbp + 0xf]
call fcn.14004b27c
test eax, eax
js 0x140074367
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400742de
mov rdx, qword [rbx]
mov qword [rbp - 0x19], rdi
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rdi
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x1400742ee
lea rcx, [rbp - 0x19]
call fcn.14000ed64
nop
mov qword [rbp + 0x17], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x27], xmm0
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov r8, qword [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.14000eea4
mov qword [rbp + 0x37], 0xffffffff80000001
mov byte [rbp + 0x3f], dil
lea rcx, [rbp - 0x19]
call fcn.140007f78
mov rcx, qword [rbp + 0xf]
test rcx, rcx
jne 0x140074348
int3
mov rax, qword [rcx]
lea rdx, [rbp + 0x17]
mov rax, qword [rax + 0x80]
call qword [case.0x140067d03.0]
nop
lea rcx, [rbp + 0x17]
call fcn.140007f78
nop
mov qword [rbp + 7], rsi
mov rcx, qword [rbp + 0xf]
mov qword [rbp + 0xf], rdi
test rcx, rcx
je 0x140074386
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140067d03.0]
nop
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140074393
mov rax, qword [rbx]
mov qword [rbx + 0x10], rdi
mov word [rax], di
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140021280
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140075534
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rsi, rcx
test rdx, rdx
jne 0x14007556e
mov r8d, 0x155
mov ecx, 0x80004003
lea rdx, str.D:dbs_shodct0805_201735cmd_nclientonedriveSetupStandalonewebclientwebclient.cpp
mov edi, ecx
call fcn.14004ac0c
jmp 0x1400755cc
test rbp, rbp
jne 0x14007557b
mov r8d, 0x156
jmp 0x140075559
call fcn.1400752e8
mov edi, eax
test eax, eax
js 0x1400755cc
cmp qword [rsi + 0xe0], 0
je 0x1400755bd
lea rbx, [rsi + 0xd0]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400755a4
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400755bd
cmp qword [rbx + 0x18], 8
jb 0x1400755b8
mov rbx, qword [rbx]
mov rdx, rbx
jmp 0x1400755c4
lea rdx, [0x140318ee8]
mov rcx, rbp
call fcn.14000ece4
mov r9, rsi
lea r8, str.WebClient__p_:_Leaving_GetDownloadedData__
lea rdx, str.WebClient
mov ecx, edi
call fcn.14004b074
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140075658
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140370028]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
mov ebx, 0x208
mov r8d, ebx
lea rcx, [r11 - 0x228]
xor edx, edx
call fcn.140023610
mov r8d, ebx
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140023610
mov edi, 0x104
lea rdx, [rsp + 0x230]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ebp, ebp
test eax, eax
jne 0x1400756f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140075787
mov r8d, 0x541
lea rdx, str.D:dbs_shodct0805_201735cmd_nclientonedriveSetupStandalonewebclientwebclient.cpp
mov ecx, ebx
call fcn.14004ac0c
jmp 0x140075787
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [0x1402c9538]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x14007573a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140075787
mov r8d, 0x542
jmp 0x1400756e6
lea rax, [rsp + 0x20]
cmp word [rax], bp
je 0x14007574e
add rax, 2
sub rdi, 1
jne 0x14007573f
mov rax, rdi
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rdi, rdi
jne 0x14007576e
mov r8d, 0x543
jmp 0x1400756e6
mov rcx, rsi
call fcn.140074250
lea rcx, [rsi + 0xd0]
lea rdx, [rsp + 0x20]
call fcn.14000ece4
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140021280
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret