joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c10], 0
lea rbx, [rcx + 0x5c18]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001a327
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001a2da
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001c410
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140005470
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c10]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c20]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140122210]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001a32f
mov rcx, rbx
call fcn.140005470
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a7b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140122218]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001a813
mov qword [rsp], rbx
lea rbx, [0x140043e40]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001a7f3
cmp byte [r8], r9b
jne 0x14001a7f3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001a7e0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b88]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001a847
mov r10, qword [r10 + 0x5b90]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001a84e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001a834
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14003c5a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
lea r13, [rbp + 0x5f]
movabs r12, 0xff00ff00ff00ff00
mov qword [rbp - 1], r12
mov qword [rbp + 7], r13
mov r14, qword [r13]
xor r14, r12
mov qword [rbp - 9], r14
mov qword [r13], r15
movabs rax, 0xf373dbce0ecf1aa6
mov qword [rbp + 0x17], rax
movabs rax, 0x665378897d42e51f
mov qword [rbp + 0x1f], rax
movabs rax, 0x9607b2a07abd75e0
mov qword [rbp - 0x29], rax
movabs rax, 0x665378897d42c53f
mov qword [rbp - 0x21], rax
movdqa xmm0, xmmword [rbp - 0x29]
xorps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x29], xmm0
lea rdx, [rbp - 0x29]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rcx, [rbp + 0x5f]
mov rsi, qword [rcx]
mov qword [rcx], r15
lea rdx, [0x140122268]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x14003c695
mov eax, dword [0x140122270]
sub eax, dword [0x140122268]
mov dword [0x140122240], eax
mov eax, dword [0x140122274]
sub eax, dword [0x14012226c]
mov dword [0x140122250], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
lea rbx, [rbp + 0x5f]
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], rbx
mov rax, rsi
xor rax, r12
mov qword [rbp - 0x29], rax
mov qword [rbx], r15
call fcn.140036ef0
test eax, eax
jne 0x14003c6c3
mov edi, r15d
jmp 0x14003c6e3
call fcn.1400370c0
test eax, eax
jne 0x14003c6d1
mov edi, r15d
jmp 0x14003c6e3
call fcn.1400365b0
nop
test eax, eax
mov edi, r15d
je 0x14003c6e3
mov edi, 1
mov qword [rbx], rsi
mov ecx, 1
call fcn.14003eeac
mov qword [rbp + 0x17], rax
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14003eb80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x79], rax
test rax, rax
je 0x14003c7bf
cmp dword [rbp - 0x71], 0
je 0x14003c7b3
movaps xmm0, xmmword [rbp - 0x79]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003c7b3
test edi, edi
je 0x14003c77d
cmp edi, 1
jne 0x14003c77d
lea rbx, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
lea rdi, [0x14003a180]
nop dword [rax + rax]
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], rdi
lea rax, [rbp - 0x69]
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x69]
call fcn.1400372b0
test eax, eax
jne 0x14003c760
xor r14, r12
mov qword [r13], r14
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14003ebf0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x71], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14003ebd0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret

Function at 0x14003f824
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003f86e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003f86e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003f86e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003f86e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003f86e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003f870
xor al, al
add rsp, 0x28
ret
Function at 0x45d620
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45d701
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x004656a0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046b240
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.0046b3a0
jmp fcn.0045d620
Function at 0x4010cc
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
movabs rax, 6
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 6]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 5
mov byte [rbp - 1], al
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0
mov qword [rsp + 0x48], rax
mov eax, 0
mov qword [rsp + 0x40], rax
mov eax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
mov eax, 0x220
mov r9, rax
mov eax, 0x20
mov r8, rax
mov eax, 2
mov r11, rax
lea rax, [rbp - 6]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Advapi32.dll_AllocateAndInitializeSid
cmp eax, 0
jne 0x401188
mov eax, 0
jmp 0x4011e2
lea rax, [rbp - 0x14]
mov r8, rax
mov rax, qword [rbp - 0x10]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Advapi32.dll_CheckTokenMembership
cmp eax, 0
jne 0x4011d0
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.Advapi32.dll_FreeSid
mov eax, 0
jmp 0x4011e2
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.Advapi32.dll_FreeSid
mov eax, dword [rbp - 0x14]
leave
ret

Function at 0x4010d7
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
movabs rax, 6
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 6]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 5
mov byte [rbp - 1], al
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0
mov qword [rsp + 0x48], rax
mov eax, 0
mov qword [rsp + 0x40], rax
mov eax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
mov eax, 0x220
mov r9, rax
mov eax, 0x20
mov r8, rax
mov eax, 2
mov r11, rax
lea rax, [rbp - 6]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Advapi32.dll_AllocateAndInitializeSid
cmp eax, 0
jne 0x401188
mov eax, 0
jmp 0x4011e2
lea rax, [rbp - 0x14]
mov r8, rax
mov rax, qword [rbp - 0x10]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Advapi32.dll_CheckTokenMembership
cmp eax, 0
jne 0x4011d0
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.Advapi32.dll_FreeSid
mov eax, 0
jmp 0x4011e2
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.Advapi32.dll_FreeSid
mov eax, dword [rbp - 0x14]
leave
ret
Function at 0x4011ef
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov eax, 0x104
mov r8, rax
lea rax, [rbp - 0x104]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
cmp eax, 0
jne 0x401231
call fcn.00401000
mov eax, 0
jmp 0x4012be
movabs rax, 0x70
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x178]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x70
mov dword [rbp - 0x178], eax
lea rax, str.runas
mov qword [rbp - 0x168], rax
lea rax, [rbp - 0x104]
mov qword [rbp - 0x160], rax
lea rax, [0x00407d26]
mov qword [rbp - 0x158], rax
movabs rax, 0
mov qword [rbp - 0x170], rax
mov eax, 1
mov dword [rbp - 0x148], eax
lea rax, [rbp - 0x178]
mov r10, rax
mov rcx, r10
call sub.Shell32.dll_ShellExecuteExA
leave
ret

Function at 0x4014df
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
movabs rax, 0x104
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_malloc
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x401558
mov eax, 0x1010
mov r9, rax
lea rax, [0x00407d74]
mov r8, rax
lea rax, str.Memory_allocation_failed
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxW
movabs rax, 0
jmp 0x4015ee
mov rax, qword [rbp + 0x10]
mov r9, rax
lea rax, str.C:_RECYCLE.BIN_s
mov r8, rax
movabs rax, 0x104
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
call sub.kernel32.dll_GetLastError
mov dword [rbp - 0xc], eax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 0
jne 0x4015ea
mov eax, dword [rbp - 0xc]
cmp eax, 0xb7
je 0x4015ea
call fcn.00401000
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_free
movabs rax, 0
jmp 0x4015ee
mov rax, qword [rbp - 8]
leave
ret
Function at 0x4018da
Capabilities:
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x160
mov qword [rbp + 0x10], rcx
movabs rax, 0xa
mov r8, rax
movabs rax, 0x65
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_FindResourceA
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x401b15
mov rax, qword [rbp - 8]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LoadResource
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x401b15
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LockResource
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 8]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SizeofResource
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x10]
mov r9, rax
lea rax, [0x00407d93]
mov r8, rax
movabs rax, 0x104
mov r11, rax
lea rax, [rbp - 0x120]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
lea rax, [0x00407da5]
mov r11, rax
lea rax, [rbp - 0x120]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x128], rax
mov rax, qword [rbp - 0x128]
cmp rax, 0
je 0x401ae1
mov eax, dword [rbp - 0x1c]
mov rcx, qword [rbp - 0x128]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x128]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
mov eax, 0
mov qword [rsp + 0x28], rax
movabs rax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
lea rax, [rbp - 0x120]
mov r8, rax
lea rax, str.open
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Shell32.dll_ShellExecuteA
mov qword [rbp - 0x130], rax
mov rax, qword [rbp - 0x130]
cmp rax, 0x20
ja 0x401adc
mov eax, 0x1010
mov r9, rax
lea rax, [0x00407e06]
mov r8, rax
lea rax, str.Failed_to_import_data._Error_creating_file.
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxW
jmp 0x401b15
mov eax, 0x1010
mov r9, rax
lea rax, [0x00407e94]
mov r8, rax
lea rax, str.Failed_to_import_function_data._Error_creating_file.
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxW
leave
ret
Function at 0x4018e5
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x160
mov qword [rbp + 0x10], rcx
movabs rax, 0xa
mov r8, rax
movabs rax, 0x65
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_FindResourceA
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x401b15
mov rax, qword [rbp - 8]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_LoadResource
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x401b15
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LockResource
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 8]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SizeofResource
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x10]
mov r9, rax
lea rax, [0x00407d93]
mov r8, rax
movabs rax, 0x104
mov r11, rax
lea rax, [rbp - 0x120]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
lea rax, [0x00407da5]
mov r11, rax
lea rax, [rbp - 0x120]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x128], rax
mov rax, qword [rbp - 0x128]
cmp rax, 0
je 0x401ae1
mov eax, dword [rbp - 0x1c]
mov rcx, qword [rbp - 0x128]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x128]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
mov eax, 0
mov qword [rsp + 0x28], rax
movabs rax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
lea rax, [rbp - 0x120]
mov r8, rax
lea rax, str.open
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Shell32.dll_ShellExecuteA
mov qword [rbp - 0x130], rax
mov rax, qword [rbp - 0x130]
cmp rax, 0x20
ja 0x401adc
mov eax, 0x1010
mov r9, rax
lea rax, [0x00407e06]
mov r8, rax
lea rax, str.Failed_to_import_data._Error_creating_file.
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxW
jmp 0x401b15
mov eax, 0x1010
mov r9, rax
lea rax, [0x00407e94]
mov r8, rax
lea rax, str.Failed_to_import_function_data._Error_creating_file.
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxW
leave
ret
Function at 0x4020b1
Capabilities:
Get common file path
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x450
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov r9, rax
lea rax, str._swinpatch64.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
lea rax, [rbp - 0x104]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
mov eax, 6
mov r11, rax
lea rax, [rbp - 0x104]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 0
jne 0x40211e
call fcn.00401000
mov eax, 6
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 0
jne 0x402146
call fcn.00401000
lea rax, [0x004082ba]
mov r8, rax
movabs rax, 0x104
mov r11, rax
lea rax, [rbp - 0x208]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
mov eax, 6
mov r11, rax
lea rax, [rbp - 0x208]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 0
jne 0x40219d
call fcn.00401000
lea rax, [rbp - 0x410]
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0x18
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Shell32.dll_SHGetFolderPathW
mov dword [rbp - 0x414], eax
mov eax, dword [rbp - 0x414]
cmp eax, 0
jl 0x402257
lea rax, str.RunApi.lnk
mov r11, rax
lea rax, [rbp - 0x410]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Shlwapi.dll_PathAppendW
mov dword [rbp - 0x414], eax
mov eax, dword [rbp - 0x414]
cmp eax, 0
jl 0x402252
mov eax, 6
mov r11, rax
lea rax, [rbp - 0x410]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesW
cmp eax, 0
jne 0x402252
call fcn.00401000
jmp 0x40228b
mov eax, 0x1010
mov r9, rax
lea rax, [0x0040832c]
mov r8, rax
lea rax, str.Failed_to_retrieve_memory_addresses
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxW
leave
ret
Function at 0x4020bc
Capabilities:
Get common file path
Get startup folder
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x450
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov r9, rax
lea rax, str._swinpatch64.exe
mov r8, rax
movabs rax, 0x104
mov r11, rax
lea rax, [rbp - 0x104]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
mov eax, 6
mov r11, rax
lea rax, [rbp - 0x104]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 0
jne 0x40211e
call fcn.00401000
mov eax, 6
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 0
jne 0x402146
call fcn.00401000
lea rax, [0x004082ba]
mov r8, rax
movabs rax, 0x104
mov r11, rax
lea rax, [rbp - 0x208]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
mov eax, 6
mov r11, rax
lea rax, [rbp - 0x208]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 0
jne 0x40219d
call fcn.00401000
lea rax, [rbp - 0x410]
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0x18
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Shell32.dll_SHGetFolderPathW
mov dword [rbp - 0x414], eax
mov eax, dword [rbp - 0x414]
cmp eax, 0
jl 0x402257
lea rax, str.RunApi.lnk
mov r11, rax
lea rax, [rbp - 0x410]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.Shlwapi.dll_PathAppendW
mov dword [rbp - 0x414], eax
mov eax, dword [rbp - 0x414]
cmp eax, 0
jl 0x402252
mov eax, 6
mov r11, rax
lea rax, [rbp - 0x410]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFileAttributesW
cmp eax, 0
jne 0x402252
call fcn.00401000
jmp 0x40228b
mov eax, 0x1010
mov r9, rax
lea rax, [0x0040832c]
mov r8, rax
lea rax, str.Failed_to_retrieve_memory_addresses
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxW
leave
ret
Function at 0x4033cc
Capabilities:
Check http status code
Create http request

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1b0
lea rax, [0x0040a128]
mov r9, rax
lea rax, str.https:__discord.com_api_v10_entitlements_gift_codes__s
mov r8, rax
movabs rax, 0x100
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, str.MyApp
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.wininet.dll_InternetOpenA
mov qword [rbp - 0x108], rax
mov rax, qword [rbp - 0x108]
cmp rax, 0
jne 0x403475
call fcn.00401000
mov eax, 1
jmp 0x4036cd
movabs rax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
lea rax, [rbp - 0x100]
mov r11, rax
mov rax, qword [rbp - 0x108]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.wininet.dll_InternetOpenUrlA
mov qword [rbp - 0x110], rax
mov rax, qword [rbp - 0x110]
cmp rax, 0
jne 0x403550
call sub.kernel32.dll_GetLastError
mov dword [rbp - 0x114], eax
mov eax, dword [rbp - 0x114]
cmp eax, 0x194
jne 0x403501
mov eax, 1
jmp 0x4036cd
mov eax, dword [rbp - 0x114]
cmp eax, 0x2f0c
je 0x403525
mov eax, dword [rbp - 0x114]
cmp eax, 0x2f0d
jne 0x40352f
mov eax, 2
jmp 0x4036cd
call fcn.00401000
mov rax, qword [rbp - 0x108]
mov r10, rax
mov rcx, r10
call sub.wininet.dll_InternetCloseHandle
mov eax, 1
jmp 0x4036cd
mov eax, 0
mov dword [rbp - 0x118], eax
mov eax, 4
mov dword [rbp - 0x11c], eax
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x11c]
mov r9, rax
lea rax, [rbp - 0x118]
mov r8, rax
mov eax, 0x20000013
mov r11, rax
mov rax, qword [rbp - 0x110]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.wininet.dll_HttpQueryInfoA
cmp eax, 0
jne 0x4035e2
call fcn.00401000
mov rax, qword [rbp - 0x110]
mov r10, rax
mov rcx, r10
call sub.wininet.dll_InternetCloseHandle
mov rax, qword [rbp - 0x108]
mov r10, rax
mov rcx, r10
call sub.wininet.dll_InternetCloseHandle
mov eax, 1
jmp 0x4036cd
mov rax, qword [rbp - 0x110]
mov r10, rax
mov rcx, r10
call sub.wininet.dll_InternetCloseHandle
mov rax, qword [rbp - 0x108]
mov r10, rax
mov rcx, r10
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [rbp - 0x118]
cmp eax, 0xc8
jne 0x403622
mov eax, 0
jmp 0x4036cd
mov eax, dword [rbp - 0x118]
cmp eax, 0x194
jne 0x40363e
mov eax, 1
jmp 0x4036cd
mov eax, dword [rbp - 0x118]
cmp eax, 0x1ad
jne 0x40365a
mov eax, 2
jmp 0x4036cd
mov eax, dword [rbp - 0x118]
mov r9, rax
lea rax, str.Unexpected_HTTP_status_code:__lu
mov r8, rax
movabs rax, 0x64
mov r11, rax
lea rax, [rbp - 0x180]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
mov eax, 0x10
mov r9, rax
lea rax, str.Unexpected_Error
mov r8, rax
lea rax, [rbp - 0x180]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_MessageBoxA
mov eax, 1
jmp 0x4036cd
leave
ret