joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e330
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
cmp qword [rcx + 0x28], rdx
jae 0x14001e463
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x40], rbx
nop dword [rax]
mov ecx, 0x40
call fcn.14002e3a0
mov rdi, rax
test rax, rax
je 0x14001e454
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14001e44c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x14001e43e
mov edx, dword [rsi + 0x80]
lea rax, [rdi + 0x30]
lea r8, [0x14001e080]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x28], rax
test rax, rax
je 0x14001e430
mov rcx, rdi
call fcn.140018010
lea rcx, [rsi + 0x58]
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x34], 2
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsi + 0x18]
mov rdx, rdi
call fcn.140018140
lea rcx, [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp qword [rsi + 0x28], rbp
jb 0x14001e360
jmp 0x14001e454
mov rcx, qword [rdi + 0x20]
mov qword [rdi + 0x20], r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x18]
mov qword [rdi + 0x18], r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14002e3f0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x14001f1c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x140065be8], 0
jne 0x14001f385
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x140065be8], rax
test rax, rax
je 0x14001f385
lea rdx, str.CredDeleteA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001eec0]
lea rdx, str.CredDeleteW
test rax, rax
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x1400635f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001ef30]
test rax, rax
lea rdx, str.CredEnumerateA
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x1400635f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001efa0]
test rax, rax
lea rdx, str.CredEnumerateW
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x140063600], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001f010]
test rax, rax
lea rdx, str.CredFree
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x140063608], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001ec10]
test rax, rax
lea rdx, str.CredGetSessionTypes
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x140063610], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001ec50]
test rax, rax
lea rdx, str.CredReadA
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x140063618], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001f080]
test rax, rax
lea rdx, str.CredReadW
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x140063620], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001f0f0]
test rax, rax
lea rdx, str.CredWriteA
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x140063628], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001f160]
test rax, rax
lea rdx, str.CredWriteW
cmove rax, rcx
mov rcx, qword [0x140065be8]
mov qword [0x140063630], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14001ecb0]
test rax, rax
cmove rax, rcx
mov qword [0x140063638], rax
add rsp, 0x28
ret
Function at 0x14001f4f0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14001f5d1
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001f5eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x14001f5eb
lea edx, [rax + 0x59]
mov rcx, rsi
call fcn.14003ff50
mov rbx, rax
test rax, rax
je 0x14001f5eb
mov rdi, rax
xor ecx, ecx
sub rdi, rsi
lea rdx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x14001f5eb
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14003ef10
mov r11, rbp
xor edx, edx
sub r11, rsi
mov rcx, rbp
mov byte [r11 + rbx], 0
call fcn.14001f4f0
test eax, eax
jne 0x14001f5ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001f5ac
mov ebx, 1
jmp 0x14001f5ae
xor ebx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
jne 0x14001f5eb
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x14001f520
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x14001f5d6

Function at 0x14001f680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x20
mov rax, r8
mov r8, rdx
mov r12, r9
mov rdx, rax
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
test rax, rax
je 0x14001f721
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14001f704
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r11, rax
test rax, rax
je 0x14001f6fb
mov rax, qword [rsp + 0x50]
mov rdx, rbp
mov rcx, rsi
mov qword [rax], r11
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, 1
mov dword [r12], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov eax, ebx
jmp 0x14001f70b
Function at 0x14001f730
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x14001f81e
cmp dword [rbx], 0x40
jne 0x14001f81e
xor edx, edx
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0x38
lea r8d, [rdx + 0x34]
call fcn.14003e820
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001f7b4
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x60
pop rbx
ret
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rax, qword [rsp + 0x28]
mov r11d, dword [rsp + 0x24]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x30]
mov dword [rbx + 4], r11d
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x38], 0
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x30], rax
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x60
pop rbx
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x60
pop rbx
ret

Function at 0x14001f840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, r8
mov r12d, edx
mov r13, rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], 5
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x4c], 7
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f895
or r12d, eax
xor ebp, ebp
lea rsi, [rsp + 0x40]
mov edi, ebp
nop
mov r8d, dword [rsi]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001f8df
test rax, rax
jne 0x14001f8ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14001f8ee
inc edi
or rbx, 0xffffffffffffffff
add rsi, 4
cmp edi, 4
jb 0x14001f8a0
cmp rbx, 0xffffffffffffffff
mov qword [r14], rbx
setne bpl
mov eax, ebp
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x14001f840
Function at 0x14001fca0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
sub rsp, 0x200
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rdi, rdx
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
mov dword [rsp + 0x70], 0x68
call fcn.14003e820
lea rdx, [rsp + 0xe0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14001fd99
mov qword [rsp + 0x210], rbx
lea rbx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
test rdi, rdi
mov qword [rsp + 0x220], rsi
cmovne rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x48], rbx
xor esi, esi
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
lea rax, [rsp + 0x50]
cmp rbx, rax
mov rbx, qword [rsp + 0x210]
jne 0x14001fd8f
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x220]
mov eax, edi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x200
pop rdi
ret
mov rdx, rcx
xor ecx, ecx
jmp 0x14001fca0

Function at 0x14001fdc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1050
call fcn.14003e920
sub rsp, rax
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rbx, rcx
mov r9, r8
mov r8, rdx
lea rcx, [rsp + 0x40]
mov edx, 0x1000
call fcn.14003e6fc
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
mov byte [rsp + 0x103f], 0
repne scasb al, byte [rdi]
mov eax, 0xffffffff
not rcx
dec rcx
cmp rcx, rax
jbe 0x14001fe31
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14001fe58
mov r8d, ecx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14003e7f0
mov rbx, qword [rsp + 0x1078]
add rsp, 0x1050
pop rdi
ret
Function at 0x14001ffa0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, r8
mov r12d, edx
mov r13, rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], 5
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x4c], 7
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001f895
or r12d, eax
xor ebp, ebp
lea rsi, [rsp + 0x40]
mov edi, ebp
nop
mov r8d, dword [rsi]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001f8df
test rax, rax
jne 0x14001f8ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x14001f8ee
inc edi
or rbx, 0xffffffffffffffff
add rsi, 4
cmp edi, 4
jb 0x14001f8a0
cmp rbx, 0xffffffffffffffff
mov qword [r14], rbx
setne bpl
mov eax, ebp
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x14001f840

Function at 0x14001ffe0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140020006
cmp eax, ebx
jae 0x140020006
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140020010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002002d
test al, 0x10
jne 0x14002002d
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140020080
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push rdi
sub rsp, 0x200
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rdi, rdx
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
mov dword [rsp + 0x70], 0x68
call fcn.14003e820
lea rdx, [rsp + 0xe0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14001fd99
mov qword [rsp + 0x210], rbx
lea rbx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
test rdi, rdi
mov qword [rsp + 0x220], rsi
cmovne rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x48], rbx
xor esi, esi
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
lea rax, [rsp + 0x50]
cmp rbx, rax
mov rbx, qword [rsp + 0x210]
jne 0x14001fd8f
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x220]
mov eax, edi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x200
pop rdi
ret
mov rdx, rcx
xor ecx, ecx
jmp 0x14001fca0
Function at 0x140020540
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x140
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rbp, rdx
mov esi, 0x105
lea rcx, [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r11d, eax
test eax, eax
je 0x140020609
mov qword [rsp + 0x150], rdi
lea eax, [r11 - 1]
mov rdi, rbx
cmp byte [rsp + rax + 0x20], 0x5c
setne dl
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x150]
movzx r8d, dl
sub esi, r8d
not rcx
sub esi, r11d
dec rcx
mov eax, esi
cmp rcx, rax
jae 0x140020609
test dl, dl
je 0x1400205cf
mov byte [rsp + r11 + 0x20], 0x5c
lea ecx, [r8 + r11]
sub rcx, rbx
lea rdx, [rsp + rcx + 0x20]
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdx + rbx - 1], al
test al, al
jne 0x1400205e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
test rax, rax
mov qword [rbp], rax
setne cl
mov eax, ecx
jmp 0x14002060b
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003e7f0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
jmp 0x140020540

Function at 0x140020670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x140
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rbp, rdx
mov esi, 0x105
lea rcx, [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r11d, eax
test eax, eax
je 0x140020609
mov qword [rsp + 0x150], rdi
lea eax, [r11 - 1]
mov rdi, rbx
cmp byte [rsp + rax + 0x20], 0x5c
setne dl
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x150]
movzx r8d, dl
sub esi, r8d
not rcx
sub esi, r11d
dec rcx
mov eax, esi
cmp rcx, rax
jae 0x140020609
test dl, dl
je 0x1400205cf
mov byte [rsp + r11 + 0x20], 0x5c
lea ecx, [r8 + r11]
sub rcx, rbx
lea rdx, [rsp + rcx + 0x20]
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rdx + rbx - 1], al
test al, al
jne 0x1400205e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
test rax, rax
mov qword [rbp], rax
setne cl
mov eax, ecx
jmp 0x14002060b
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003e7f0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
jmp 0x140020540
Function at 0x140020680
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov ebx, r8d
lea r8, [rsp + 0x48]
mov r9d, 1
xor edx, edx
mov rdi, rcx
mov qword [rsp + 0x48], 0
call fcn.140020090
test eax, eax
je 0x140020722
mov rdx, qword [rsp + 0x38]
mov r9d, ebx
xor r8d, r8d
mov rcx, rdi
call fcn.140020090
test eax, eax
je 0x140020722
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400206ff
mov rdx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call fcn.140020090
test eax, eax
je 0x140020722
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov ebx, eax
call fcn.140020090
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140020730
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x180
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r12, qword [rsp + 0x1d0]
mov rsi, rdx
mov edx, 0x5c
mov edi, r9d
mov ebp, r8d
mov rbx, rcx
call fcn.14003ec64
test rax, rax
je 0x140020774
int3
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1400207e4
cmp eax, 0x104
jae 0x1400207e4
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1d8]
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
mov r8, rsi
mov rdx, rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x50], 0xffffffffffffffff
call fcn.1400202a0
test eax, eax
jne 0x1400207dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400207e4
mov rax, qword [rsp + 0x50]
jmp 0x1400207e8
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x180
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140020e60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rsi, rcx
lea rax, [rsp + 0x50]
mov edi, edx
lea rcx, str.afr
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call fcn.140020810
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140020f4b
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140020f42
cmp edi, dword [rsp + 0x40]
jne 0x140020f42
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140020c80
mov rbx, rax
test rax, rax
je 0x140020f4d
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 3
call fcn.14001fee0
mov qword [rbx + 8], rax
mov rax, rbx
jmp 0x140020f4d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14003e7f0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140020f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
sub rsp, 0x20
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
mov r12, rax
test rax, rax
je 0x140021017
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x140021012
mov rcx, rax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x140020feb
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rsi
mov edx, eax
call fcn.140020e60
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov rax, rbx
jmp 0x140020ffc
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret
Function at 0x1400210c0
Capabilities:
Check http status code
Get http content length

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x40
xor r13d, r13d
mov rsi, rdx
mov r12, r8
mov rbx, rcx
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x10]
lea edx, [r13 + 9]
mov rcx, rsi
xor dil, dil
mov dword [rbp + 0x48], r13d
mov dword [rbp - 0x10], r13d
mov dword [rbp + 0x40], 4
call qword [sym.imp.WININET.dll_InternetQueryOptionA]
test eax, eax
je 0x140021204
cmp dword [rbp + 0x40], 4
jne 0x140021204
mov eax, dword [rbp - 0x10]
cmp eax, 7
je 0x1400211c4
cmp eax, 0xd
jne 0x140021204
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x40]
mov edx, 0x20000013
mov rcx, rsi
mov dword [rbp + 0x40], r13d
mov dword [rbp - 0x10], 4
mov qword [rsp + 0x20], r13
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1400211b5
cmp dword [rbp - 0x10], 4
jne 0x1400211b5
cmp dword [rbp + 0x40], 0x190
jae 0x1400211b5
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x48]
mov edx, 0x20000005
mov rcx, rsi
mov dword [rbp - 0x10], 4
mov qword [rsp + 0x20], r13
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x140021192
cmp dword [rbp - 0x10], 4
je 0x14002119b
test byte [rbx], 4
je 0x1400211a6
or dword [rbx + 0x40], 1
mov eax, dword [rbp + 0x40]
mov dil, 1
mov dword [rbx + 0x3c], eax
jmp 0x140021204
mov eax, dword [rbp + 0x40]
mov dword [rbx + 0x38], 0xa0000004
mov dword [rbx + 0x3c], eax
jmp 0x140021204
mov eax, dword [rbp + 0x40]
mov dword [rbx + 0x38], 0xa0000003
mov dword [rbx + 0x3c], eax
jmp 0x140021204
lea rdx, [rbp + 0x44]
mov rcx, rsi
call qword [0x140063640]
mov dword [rbp + 0x40], eax
cmp eax, 0xffffffff
jne 0x1400211ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400211ec
mov dword [rbx + 0x38], 0xa0000004
jmp 0x140021204
mov eax, dword [rbp + 0x40]
cmp dword [rbp + 0x44], r13d
jne 0x1400211fd
mov dword [rbp + 0x48], eax
mov dil, 1
jmp 0x140021204
mov dword [rbx + 0x38], 0xa0000005
mov ecx, dword [rbp + 0x48]
mov rbx, qword [rsp + 0x70]
movzx eax, dil
mov dword [r12], ecx
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret