joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051560
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xa0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, rdx
mov r12, rcx
xor edi, edi
mov dword [rax - 0x78], edi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rsi, rax
test eax, eax
je 0x140051746
mov rax, qword [0x140160e18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov r8, qword [0x140167138]
mov edx, 0x475
lea rcx, [rsp + 0x48]
call fcn.14002e500
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xd0]
mov r8d, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, edi
mov dword [rsp + 0x44], ebx
nop
cmp ebx, esi
jae 0x140051729
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x50], 4
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1005
mov rcx, qword [r12 + 0xb8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x14005171d
cmp qword [rdx + 0x108], 0
je 0x14005171d
mov rax, qword [rdx + 0x108]
cmp byte [rax], 0
je 0x14005171d
mov rax, qword [0x140160e18]
mov qword [rsp + 0xd8], rax
mov rdx, qword [rdx + 0x108]
lea rcx, [rsp + 0xd8]
call fcn.14002d430
lea rdx, [0x1400e7464]
lea rcx, [rsp + 0xd8]
call fcn.14002d580
mov rdx, qword [rsp + 0xd8]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xd0]
mov r8d, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0xd8]
call fcn.14002d2c0
add ebx, 1
mov dword [rsp + 0x44], ebx
jmp 0x140051630
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x48]
call fcn.14002d2c0
nop
mov eax, edi
jmp 0x14005174e
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400659e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, rdx
mov r13, rcx
xor esi, esi
mov dword [rsp + 0x40], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov r12, rax
test eax, eax
je 0x140065c0d
mov rax, qword [0x140160e18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
mov r8, qword [0x140167138]
mov edx, 0x475
lea rcx, [rsp + 0x48]
call fcn.14002e500
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xe0]
mov r8d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, esi
mov dword [rsp + 0x44], ebx
lea r15, [0x1400f71bc]
nop
nop
cmp ebx, r12d
jae 0x140065bf0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x50], 4
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1005
mov rcx, qword [r13 + 0xb8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x140065be4
cmp qword [rdi + 0x108], 0
je 0x140065be4
mov rax, qword [rdi + 0x108]
cmp byte [rax], 0
je 0x140065be4
mov rax, qword [0x140160e18]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rdi + 0x108]
lea rcx, [rsp + 0xe8]
call fcn.14002d430
lea rdx, [0x1400e4f74]
lea rcx, [rsp + 0xe8]
call fcn.14002d580
lea rdx, [0x1400f71b8]
cmp dword [rdi], 0
cmovne rdx, r15
lea rcx, [rsp + 0xe8]
call fcn.14002d580
lea rdx, [0x1400e7464]
lea rcx, [rsp + 0xe8]
call fcn.14002d580
mov rdx, qword [rsp + 0xe8]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xe0]
mov r8d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0xe8]
call fcn.14002d2c0
add ebx, 1
mov dword [rsp + 0x44], ebx
jmp 0x140065ac0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x48]
call fcn.14002d2c0
nop
mov eax, esi
jmp 0x140065c15
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140066a90
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rdx
mov r14, rcx
xor r13d, r13d
mov dword [rax - 0x58], r13d
test rdx, rdx
je 0x140066c97
cmp byte [rdx], r13b
je 0x140066c97
mov rcx, rdx
call fcn.1400b6a90
test eax, eax
je 0x140066c97
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea ecx, [rax + 1]
mov edi, ecx
call fcn.1400c7310
mov r15, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.1400c2840
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xb0]
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x48]
call fcn.1400b7d10
test eax, eax
je 0x140066c79
mov r8, qword [rsp + 0xb8]
test r8, r8
je 0x140066c74
movzx eax, byte [r8]
test al, al
je 0x140066c74
cmp al, 0x23
je 0x140066c74
cmp al, 0xd
je 0x140066c74
cmp al, 0xa
je 0x140066c74
mov r12d, 1
mov dword [rsp + 0x44], r12d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rsi, [r8 + rcx - 1]
mov qword [rsp + 0x50], rsi
lea edx, [rax + 0x20]
mov rcx, r8
call fcn.1400c2dd0
test rax, rax
je 0x140066c08
movzx ecx, byte [rax + 1]
cmp cl, 0x30
je 0x140066bf1
cmp cl, 0x31
jne 0x140066c08
mov rsi, rax
mov qword [rsp + 0x50], rax
mov r12d, r13d
cmp cl, 0x30
setne r12b
mov dword [rsp + 0x44], r12d
mov rcx, rsi
sub rcx, qword [rsp + 0xb8]
add rcx, 9
call fcn.1400c7310
mov rbx, rax
mov r8, rsi
sub r8, qword [rsp + 0xb8]
add r8, 1
xor edx, edx
lea rcx, [rax + 4]
call fcn.1400c2840
mov rdx, qword [rsp + 0xb8]
sub rsi, rdx
mov r8, rsi
lea rcx, [rbx + 4]
call fcn.1400c2b80
mov dword [rbx], r12d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call fcn.140066480
mov rcx, rbx
call fcn.14008c4f0
mov dword [r14 + 0xa8], 1
jmp 0x140066b61
mov rcx, r15
call fcn.14002d0b0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, 1
mov dword [rsp + 0x40], r13d
mov eax, r13d
jmp 0x140066ca0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006e660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r10, r8
mov rbx, rdx
mov r11, rcx
test r10, r10
je 0x14006e6db
movzx eax, byte [r11]
add eax, 1
mov byte [r11], al
movzx r8d, al
movzx r9d, byte [r8 + r11 + 2]
movzx ecx, byte [r11 + 1]
lea edx, [rcx + r9]
mov byte [r11 + 1], dl
movzx eax, dl
movzx ecx, byte [rax + r11 + 2]
mov byte [r8 + r11 + 2], cl
movzx eax, byte [r11 + 1]
mov byte [rax + r11 + 2], r9b
add cl, r9b
movzx eax, cl
mov cl, byte [rax + r11 + 2]
mov al, byte [rbx]
xor ecx, eax
mov byte [rbx], cl
add rbx, 1
mov qword [rsp + 0x48], rbx
sub r10, 1
mov qword [rsp + 0x50], r10
jmp 0x14006e678
add rsp, 0x30
pop rbx
ret

Function at 0x14006e910
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
lea rax, [r11 + 0x20]
mov rbx, r8
xor r9d, r9d
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14006e976
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x14006e980
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006ea8d
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x170], rbp
xor ebp, ebp
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14006ea66
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.14006e980
test eax, eax
mov ebx, eax
jne 0x14006eaa7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14006ea11
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14006ea7d
Function at 0x14006eac0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, qword [rsp + 0x4b0]
test r8, r8
mov rdi, r9
mov rbx, rcx
lea r9, [0x1400e4ec8]
lea rcx, [0x1400e5fa8]
mov rax, r9
cmovne rax, r8
test r8, r8
mov r8, rdx
cmovne r9, rcx
lea rcx, [rsp + 0x60]
lea rdx, str._s_s_s
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
xor r11d, r11d
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r11
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14006eba3
test rdi, rdi
je 0x14006eb91
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
add eax, 1
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14006eba5
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x470
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006ebc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
test rcx, rcx
mov rsi, r9
mov r12, r8
mov rbx, rdx
mov rbp, rcx
je 0x14006ecd9
test rdx, rdx
je 0x14006ecd9
test r9, r9
je 0x14006ecd9
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x40], dil
call fcn.1400c2840
lea rdx, [rsp + 0x40]
sub rdx, rbx
nop
nop
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rdx + rbx - 1], al
jne 0x14006ec30
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006ecd9
mov eax, dword [rsp + 0x4a8]
mov dword [rsp + 0x30], edi
sub eax, 1
je 0x14006ec83
sub eax, 3
je 0x14006eccf
cmp eax, 3
jne 0x14006ec8e
mov eax, dword [rsp + 0x4a0]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x4a8]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, 1
test eax, eax
cmove edi, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x14006ecdb
mov dword [rsp + 0x30], 4
jmp 0x14006ec8e
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x450
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140070520
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov r13, rdx
or r12, 0xffffffffffffffff
mov qword [rax - 0x60], r12
xor r15d, r15d
mov rsi, r15
mov qword [rax - 0x58], r15
mov r14, r15
mov qword [rax - 0x50], r15
test rdx, rdx
je 0x140070796
cmp byte [rdx], sil
je 0x140070796
lea rcx, [0x140166688]
call fcn.1400389c0
nop
lea rdx, [0x140166688]
lea rcx, [rsp + 0x68]
call fcn.140038b50
nop
lea rcx, [rsp + 0x68]
call fcn.140039440
mov r11, rax
test rax, rax
je 0x1400705d4
mov r8, r13
sub r8, rax
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400705c4
add rax, 1
test ecx, ecx
jne 0x1400705b0
test edx, edx
jne 0x1400705d2
mov rsi, r11
mov qword [rsp + 0x50], r11
jmp 0x1400705d4
jmp 0x140070591
test rsi, rsi
jne 0x140070740
mov ebx, r15d
mov dword [rsp + 0x40], ebx
cmp ebx, 0x32
jge 0x140070639
cmp r12, 0xffffffffffffffff
jne 0x140070643
test ebx, ebx
jle 0x1400705fe
lea ecx, [r12 + 0x15]
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 1
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
mov qword [rsp + 0x48], rax
jmp 0x1400705e4
cmp r12, 0xffffffffffffffff
je 0x140070740
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [rax + 1]
mov ebx, ecx
call fcn.14008c4a0
mov r14, rax
mov qword [rsp + 0x58], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1400c2840
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xb8]
mov r8d, edi
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007072e
mov ecx, 0x118
call fcn.14008c4a0
mov rsi, rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x1400706dc
mov rax, qword [0x140160e18]
mov qword [rsi + 0x108], rax
mov rax, qword [0x140160e18]
mov qword [rsi + 0x110], rax
jmp 0x1400706df
mov rsi, r15
mov qword [rsp + 0x50], rsi
mov r8d, 0x103
mov rdx, r13
mov rcx, rsi
call fcn.1400c2b80
lea rcx, [rsi + 0x108]
mov rdx, r14
call fcn.14002d430
mov rdx, r14
lea rcx, [rsi + 0x110]
call fcn.14002d430
lea rcx, [rsi + 0x110]
call fcn.14002d830
mov rdx, rsi
lea rcx, [0x140166688]
call fcn.140038ce0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or r12, 0xffffffffffffffff
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x68]
call fcn.140038b70
nop
jmp 0x14007075c
test r14, r14
je 0x14007076a
mov rcx, r14
call fcn.14008c4f0
nop
jmp 0x140070776
lea rcx, [0x140166688]
call fcn.140038a10
cmp r12, 0xffffffffffffffff
je 0x140070791
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x140070798
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400708c0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r13d, edx
mov r12, rcx
xor esi, esi
mov dword [rax - 0x38], esi
or rdi, 0xffffffffffffffff
mov qword [rax - 0x28], rdi
lea rcx, [0x140166688]
call fcn.1400389c0
nop
mov ebx, esi
mov dword [rsp + 0x44], ebx
cmp ebx, 0x32
jge 0x140070955
cmp rdi, 0xffffffffffffffff
jne 0x14007095f
test ebx, ebx
jle 0x14007091b
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 1
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsp + 0x50], rax
jmp 0x140070903
cmp rdi, 0xffffffffffffffff
je 0x1400709fc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, esi
mov dword [rsp + 0x48], ebx
cmp ebx, 0xa
jae 0x1400709d4
mov rdx, qword [r12 + 0x108]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x90]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400709c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, 1
mov dword [rsp + 0x40], esi
jmp 0x1400709d4
mov ecx, SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 1
mov dword [rsp + 0x48], ebx
jmp 0x140070976
test r13d, r13d
je 0x1400709e2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov rcx, r12
call fcn.140039ad0
xor edx, edx
mov r8d, 0x104
mov rcx, r12
call fcn.1400c2840
lea rcx, [r12 + 0x108]
call fcn.14002e250
lea rcx, [r12 + 0x110]
call fcn.14002e250
lea rcx, [0x140166688]
call fcn.140039050
mov rbx, rax
test rbx, rbx
je 0x140070a7f
mov rdx, rbx
lea rcx, [0x140166688]
call fcn.140039060
mov r13, rax
mov rcx, rbx
call fcn.140038640
test rax, rax
je 0x140070a7a
mov rcx, rbx
call fcn.140038640
cmp r12, rax
jne 0x140070a7a
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x140166688]
call fcn.140038f30
jmp 0x140070a7f
mov rbx, r13
jmp 0x140070a35
mov qword [rsp + 0x90], r12
test r12, r12
je 0x140070ab0
lea rcx, [r12 + 0x110]
call fcn.14002d2c0
nop
lea rcx, [r12 + 0x108]
call fcn.14002d2c0
mov rcx, r12
call fcn.14008c4f0
nop
jmp 0x140070abb
lea rcx, [0x140166688]
call fcn.140038a10
cmp rdi, 0xffffffffffffffff
je 0x140070ada
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x140070adc
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x14007c200
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x14007c2bc
lea rcx, str.Mozilla_4.0__compatible__MSIE_5.5__Windows_NT_4.0_
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
mov rdi, rax
je 0x14007c2af
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x14007bfe0]
mov edx, 0xfa0
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x40], 0
call fcn.1400c45f0
mov edx, 0xbb8
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x14007c400
Capabilities:
Initialize iwebbrowser2

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
cmp dword [0x140166798], ebx
mov qword [rsp + 0x68], rbx
jne 0x14007c427
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [0x140166798], 1
xor edx, edx
lea rax, [rsp + 0x68]
lea r9, [0x14011dd50]
lea r8d, [rdx + 4]
lea rcx, [0x14011dd30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov r11, qword [rsp + 0x68]
test r11, r11
je 0x14007c554
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x78], rbx
mov rax, qword [r11]
lea r8, [rsp + 0x30]
lea rdx, [0x14011dd90]
mov rcx, r11
call qword [rax]
test eax, eax
jne 0x14007c549
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14007c549
mov rax, qword [rcx]
lea r8, [rsp + 0x78]
lea rdx, [0x14011dd40]
call qword [rax + 0x20]
test eax, eax
jne 0x14007c53e
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007c53e
mov qword [rsp + 0x70], rbx
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x38]
test eax, eax
jne 0x14007c533
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14007c533
mov dword [rsp + 0x60], ebx
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x14007c528
cmp dword [rsp + 0x60], 1
jne 0x14007c528
mov rcx, qword [rsp + 0x78]
mov edx, dword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x60], ebx
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
je 0x14007c4f0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x68]
add rsp, 0x50
pop rbx
ret
mov rax, r11
add rsp, 0x50
pop rbx
ret