joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000eec4
Capabilities:
Get common file path
Get system information on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor ebx, ebx
mov edi, r8d
mov rsi, rcx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
lea r14d, [rbx + 0x26]
cmp dword [rsp + 0x20], ebx
je 0x14000ef7b
cmp edi, r14d
jne 0x14000ef7b
lea rdx, [rsp + 0x60]
lea rcx, [0x140003d20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x14000eff4
lea r8, [0x140003d68]
lea rcx, [rsp + 0x60]
call fcn.1400114e0
test eax, eax
js 0x14000eff4
lea r8, [rsp + 0x60]
mov edx, 0x104
mov rcx, rsi
call fcn.140009608
test eax, eax
js 0x14000eff4
lea ebx, [r14 - 0x25]
jmp 0x14000eff4
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x28], bx
jne 0x14000ef94
cmp edi, 0x2a
cmove edi, r14d
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000eff4
lea r8, [0x140003d88]
lea rcx, [rsp + 0x60]
call fcn.1400114e0
test eax, eax
js 0x14000eff4
lea r8, [0x140003d68]
lea rcx, [rsp + 0x60]
call fcn.1400114e0
test eax, eax
js 0x14000eff4
lea r8, [rsp + 0x60]
mov edx, 0x104
mov rcx, rsi
call fcn.140009608
movzx ebx, bl
mov edx, 1
test eax, eax
cmovns ebx, edx
mov al, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000f414
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov esi, r8d
mov rbp, rdx
cmp r14w, word [rcx + 4]
movzx ebx, r14w
mov rdi, rcx
jae 0x14000f4c9
lea r8, [rsp + 0x40]
movzx edx, bx
mov rcx, rdi
mov qword [rsp + 0x40], r14
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x14000f476
mov rcx, qword [rsp + 0x40]
cmp byte [rcx], r14b
jne 0x14000f476
add rcx, 8
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14000f47f
inc bx
cmp bx, word [rdi + 4]
jmp 0x14000f43b
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x60]
mov al, byte [rcx + 1]
test r14b, r14b
je 0x14000f49f
or al, 3
mov byte [r8], 1
mov byte [rcx + 1], al
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx + 4]
mov eax, edx
and eax, esi
cmp eax, esi
je 0x14000f4c5
or edx, esi
mov byte [r8], 1
mov dword [rcx + 4], edx
mov rcx, qword [rsp + 0x40]
and byte [rcx + 1], 0xef
mov rcx, qword [rsp + 0x40]
or byte [rcx + 1], 3
mov al, 1
jmp 0x14000f4cb
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000fd40
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov edi, dword [rsp + 0x60]
mov r14, r9
mov rbp, r8
mov rsi, rcx
test edi, edi
je 0x14000fd78
call fcn.14000fbf8
mov edx, edi
or edx, 1
cmp eax, edx
jne 0x14000fdb5
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000fec4
test eax, eax
js 0x14000fdb5
mov rdx, qword [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14000fdb5
xor ebx, ebx
jmp 0x14000fe9f
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, edi
mov rcx, rbp
call fcn.14000fb00
mov ebx, eax
test eax, eax
js 0x14000fe9f
mov rbp, qword [rsp + 0x20]
mov ecx, 0x40
movzx edx, word [rbp + 2]
add rdx, 0x28
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14000fe91
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x14000fe72
movzx edx, word [rbp + 2]
lea rcx, [rdi + 0x28]
mov r8, rbp
mov r9d, edx
call qword [sym.imp.msvcrt.dll_memcpy_s]
xor r9d, r9d
lea r8, [rdi + 0x28]
lea edx, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
test eax, eax
je 0x14000fe72
mov r8, rdi
mov edx, 0x10
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
je 0x14000fe4f
xor ebx, ebx
jmp 0x14000fe67
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000fe86
test r14, r14
je 0x14000fe86
mov byte [r14], 1
jmp 0x14000fe86
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000fe96
mov ebx, 0x8007000e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r14
ret
Function at 0x140011f04
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x378]
sub rsp, 0x460
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor r15d, r15d
mov dil, dl
mov ebx, r15d
mov eax, r15d
shl rax, 5
lea rcx, [0x14002e1c0]
mov r9b, dil
add rcx, rax
mov r8b, 1
call fcn.140011bd8
mov r13d, 0x80070000
test eax, eax
js 0x140012093
inc ebx
movsxd rax, ebx
cmp rax, 0xb
jb 0x140011f47
mov edi, r15d
lea rsi, [0x140005510]
mov r14, qword [rsi]
xor r9d, r9d
lea rax, [rsp + 0x30]
lea edx, [r9 + 0x21]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test eax, eax
jne 0x14001207c
lea edx, [rax + 0x5c]
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x140011fc2
mov word [rax], r15w
lea rcx, [rsp + 0x30]
mov r8, r14
mov edx, 0x104
call fcn.14000b1a0
mov ebx, eax
test eax, eax
jne 0x14001207c
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x140011ffb
cmp eax, 0x50
je 0x140011ffb
cmp eax, 0xb7
jne 0x140012071
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x2002
jne 0x14001201d
lea rcx, [rsp + 0x30]
mov edx, 0x2002
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [0x140005330]
lea rcx, [rsp + 0x30]
call fcn.1400114e0
test eax, eax
js 0x140012093
lea rcx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov dl, 1
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call fcn.140011b44
mov ebx, eax
test eax, eax
js 0x140012093
lea rcx, [rsp + 0x30]
mov edx, 0x2002
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14001207c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012093
inc edi
add rsi, 8
movsxd rax, edi
cmp rax, 4
jb 0x140011f83
lea rdx, [rbp + 0x140]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140012112
lea r8, [0x140005330]
lea rcx, [rbp + 0x140]
call fcn.1400114e0
mov ebx, eax
test eax, eax
js 0x140012123
lea rcx, [rbp + 0x140]
mov r9d, 3
xor r8d, r8d
mov dl, 1
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call fcn.140011b44
mov ebx, eax
test eax, eax
js 0x140012123
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012112
bts eax, 0xd
lea rcx, [rbp + 0x140]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140012123
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140012324
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x80
xor ebx, ebx
cmp byte [0x14002ec30], bl
jne 0x1400124e0
call fcn.14001259c
test al, al
je 0x1400123e2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x20], 5
je 0x1400123f5
call fcn.140012700
test al, al
jne 0x1400124a4
mov rcx, qword [0x14002e330]
test rcx, rcx
je 0x140012396
call qword [sym.imp.iertutil.dll_Ordinal_701]
mov edx, eax
test eax, eax
js 0x1400123a3
mov ecx, ebx
sete cl
mov dword [0x14002e338], ecx
mov qword [0x14002e330], rbx
mov eax, dword [0x14002e338]
mov edx, ebx
test eax, eax
sete dl
test edx, edx
jne 0x1400123ae
mov ecx, 0x218
jmp 0x1400123cd
call fcn.1400124f8
test al, al
jne 0x1400124a4
call fcn.1400125ec
mov ecx, 0x218
test al, al
jne 0x140012492
mov edx, 0x10
call qword [sym.imp.urlmon.dll_Ordinal_410]
mov ebx, 4
jmp 0x1400124b9
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x50], 5
jne 0x14001240a
mov edx, 2
mov ecx, 0x218
call qword [sym.imp.urlmon.dll_Ordinal_410]
jmp 0x1400124b9
call fcn.140012750
test al, al
jne 0x14001249d
mov rcx, qword [0x14002e370]
test rcx, rcx
je 0x140012441
call qword [sym.imp.iertutil.dll_Ordinal_701]
mov edx, eax
test eax, eax
js 0x14001244e
mov ecx, ebx
sete cl
mov dword [0x14002e378], ecx
mov qword [0x14002e370], rbx
mov eax, dword [0x14002e378]
mov edx, ebx
test eax, eax
sete dl
test edx, edx
jne 0x140012469
mov edx, 0x10
mov ecx, 0x218
call qword [sym.imp.urlmon.dll_Ordinal_410]
mov ebx, 3
jmp 0x1400124b9
call fcn.140012700
test al, al
jne 0x1400124a4
call fcn.1400124f8
test al, al
jne 0x1400124a4
call fcn.1400125ec
test al, al
jne 0x14001248d
call fcn.1400127a0
test al, al
jne 0x140012452
mov ecx, 0x218
mov edx, 4
call qword [sym.imp.urlmon.dll_Ordinal_410]
mov ebx, 1
jmp 0x1400124b9
mov edx, 0x20
mov ecx, 0x218
call qword [sym.imp.urlmon.dll_Ordinal_410]
mov ebx, 2
lea rcx, [0x14002ed50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x14002ed50]
mov byte [0x14002ec30], 1
mov dword [0x14002e320], ebx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x14002e320]
add rsp, 0x80
pop rbx
ret

Function at 0x14001432c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rcx], 0
lea rax, [rsp + 0x40]
mov rdi, rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
lea r8, [0x140005aa0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea rdx, [0x140005ab8]
mov r9d, 2
mov rcx, 0xffffffff80000001
mov ebx, 0x80004005
mov dword [rsp + 0x40], SHFlushSFCache
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400143b9
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x8007000e
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002ad70
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x14001d758
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r14, r8
mov r15, rdx
mov rbp, rcx
test rcx, rcx
je 0x14001d8ba
test rdx, rdx
je 0x14001d8ba
test r8, r8
je 0x14001d8ba
mov qword [rdx], rbx
mov edx, 0x2000
mov dword [r8], ebx
call qword [sym.imp.msvcrt.dll_strnlen]
mov rsi, rax
dec rax
cmp rax, 0x1ffe
ja 0x14001d8b1
mov edi, ebx
test rsi, rsi
je 0x14001d7f6
movzx r12d, byte [rdi + rbp]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll_isalnum]
test eax, eax
jne 0x14001d7ee
cmp r12b, 0x3d
ja 0x14001d885
movabs rcx, 0x2000880000000000
bt rcx, r12
jae 0x14001d885
inc rdi
cmp rdi, rsi
jb 0x14001d7be
xor r9d, r9d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rbx
lea r8d, [r9 + 1]
mov edx, esi
mov rcx, rbp
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x14001d89b
mov r12d, dword [rsp + 0x70]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x14001d894
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rbx
mov r9, rdi
mov r8d, 1
mov edx, esi
mov rcx, rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x14001d88c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
jmp 0x14001d8b6
mov ebx, 0x8007000d
jmp 0x14001d8b6
mov qword [r15], rdi
mov dword [r14], r12d
jmp 0x14001d8b6
mov ebx, 0x8007000e
jmp 0x14001d8b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14001d8b6
mov ebx, 0x80070057
mov eax, ebx
jmp 0x14001d8bf
mov eax, 0x80070057
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001d9bc
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov esi, edx
mov rbp, rcx
test edx, edx
jne 0x14001d9e6
mov eax, 0x80070057
jmp 0x14001da80
xor ebx, ebx
lea rax, [rsp + 0x48]
xor r9d, r9d
and qword [r8], rbx
and dword [rsp + 0x48], ebx
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x14001da6a
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov qword [rdi], rax
test rax, rax
je 0x14001da63
lea rcx, [rsp + 0x48]
mov r9, rax
mov r8d, 0x40000001
mov qword [rsp + 0x20], rcx
mov rcx, rbp
mov edx, esi
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x14001da7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
and qword [rdi], 0
jmp 0x14001da7e
mov ebx, 0x8007000e
jmp 0x14001da7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14001db1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
lea eax, [rdx + 4]
mov rdi, rcx
mov rbx, r8
mov ecx, eax
mov r14d, edx
xor ebp, ebp
mov dword [r9], eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rsi, rax
mov qword [rbx], rax
test rax, rax
je 0x14001dbf2
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_rand_s]
test eax, eax
jne 0x14001dbeb
mov ecx, dword [rsp + 0x50]
mov eax, r14d
mov r10d, 0x269ec3
shr eax, 2
mov dword [rsi], ecx
add rsi, 4
test eax, eax
je 0x14001dbb8
mov edx, eax
imul ecx, ecx, 0x343fd
lea r8, [rsp + 0x48]
mov r9d, 4
add ecx, r10d
sub r8, rsi
mov dword [rsp + 0x48], ecx
mov al, byte [r8 + rsi]
xor al, byte [rdi]
inc rdi
mov byte [rsi], al
inc rsi
dec r9
jne 0x14001dba0
dec rdx
jne 0x14001db85
imul eax, ecx, 0x343fd
add eax, r10d
mov dword [rsp + 0x48], eax
and r14d, 3
jbe 0x14001dbf7
lea rcx, [rsp + 0x48]
mov edx, r14d
sub rcx, rdi
sub rsi, rdi
mov al, byte [rcx + rdi]
xor al, byte [rdi]
mov byte [rsi + rdi], al
inc rdi
dec rdx
jne 0x14001dbd9
jmp 0x14001dbf7
mov ebp, 0x80004005
jmp 0x14001dbf7
mov ebp, 0x8007000e
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14001dc14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ecx, dword [r8]
mov rdi, r8
mov rsi, rdx
xor ebx, ebx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov qword [rsi], rax
test rax, rax
je 0x14001dcdb
mov r8d, dword [rdi]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rdi]
mov rdx, qword [rsi]
mov r8d, dword [r14]
shr eax, 2
lea rcx, [r14 + 4]
mov esi, 0x269ec3
test eax, eax
je 0x14001dca6
mov r9d, eax
imul r8d, r8d, 0x343fd
lea r10, [rsp + 0x38]
mov r11d, 4
add r8d, esi
sub r10, rdx
mov dword [rsp + 0x38], r8d
mov al, byte [r10 + rdx]
xor al, byte [rcx]
inc rcx
mov byte [rdx], al
inc rdx
dec r11
jne 0x14001dc8e
dec r9
jne 0x14001dc71
imul eax, r8d, 0x343fd
add eax, esi
mov dword [rsp + 0x38], eax
mov eax, dword [rdi]
and eax, 3
jbe 0x14001dce0
lea r8, [rsp + 0x38]
mov r9d, eax
sub r8, rcx
sub rdx, rcx
mov al, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
dec r9
jne 0x14001dcc8
jmp 0x14001dce0
mov ebx, 0x8007000e
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x14001edd0
Capabilities:
Connect to http server
Create http request
Parse url

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2270]
mov eax, 0x2370
call fcn.14002b5e0
sub rsp, rax
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0x2260], rax
mov r12, qword [rbp + 0x22d0]
mov rbx, r8
mov rcx, rdx
mov r15d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1210]
mov esi, 0x824
xor r9d, r9d
mov dword [rsp + 0x40], esi
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
xor r13d, r13d
test eax, eax
je 0x14001efaa
lea edi, [r13 + 0x68]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, edi
call sub.msvcrt.dll_memset
mov edx, dword [rsp + 0x40]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x1c0]
lea r9, [rsp + 0x50]
lea rcx, [rbp + 0x1210]
xor r8d, r8d
mov dword [rsp + 0x50], edi
mov qword [rbp - 0x68], rax
mov word [rbp - 0x40], r13w
mov dword [rsp + 0x70], 0x100
mov word [rbp + 0x1c0], r13w
mov dword [rbp - 0x60], esi
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x14001efaa
lea rcx, [0x140006870]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
test rax, rax
je 0x14001efaa
movzx r8d, word [rsp + 0x74]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x200
lea rdx, [rbp - 0x40]
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rsi, rax
test rax, rax
je 0x14001ef8b
cmp dword [rsp + 0x64], 4
mov qword [rsp + 0x38], r13
mov ecx, 0x680100
mov eax, 0xe80100
lea r8, [rbp + 0x1c0]
lea rdx, [0x140006880]
cmove ecx, eax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov r14, rax
test rax, rax
je 0x14001ef6c
mov r9d, r15d
mov r8, rbx
mov rdx, rax
mov qword [rsp + 0x20], r12
call fcn.14001eff0
mov rcx, r14
mov ebx, eax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14001ef80
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14001ef9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14001efbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x2260]
xor rcx, rsp
call fcn.14002ad70
mov rbx, qword [rsp + 0x23b0]
add rsp, 0x2370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001eff0
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
lea rcx, [0x140006890]
mov ebx, r9d
mov r15, r8
mov r14, rdx
mov esi, 0x80004005
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
je 0x14001f1e3
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r9, r15
mov rdx, rdi
mov rcx, r14
mov r8d, eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x14001f193
and dword [rbp - 0x20], 0
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x1c]
lea r8, [rbp - 0x20]
mov edx, 0x20000013
mov rcx, r14
mov dword [rbp - 0x1c], 4
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x14001f1be
cmp dword [rbp - 0x20], 0xc8
jne 0x14001f1be
and dword [rbp + 0x20], 0
and qword [rbp - 0x10], 0
mov ecx, 0x1001
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rbx, rax
test rax, rax
je 0x14001f12e
lea r9, [rbp + 0x20]
mov r8d, 0x1000
mov rdx, rax
mov rcx, r14
mov byte [rax + 0x1000], 0
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14001f0ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14001f123
mov edx, dword [rbp + 0x20]
test edx, edx
je 0x14001f123
and qword [rbp - 0x18], 0
lea r8, [rbp - 0x18]
mov rcx, rbx
call fcn.14001d654
mov esi, eax
test eax, eax
js 0x14001f123
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x10]
call fcn.14001a0a0
mov rcx, qword [rbp - 0x18]
mov esi, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
jmp 0x14001f133
mov esi, 0x8007000e
mov rbx, qword [rbp - 0x10]
test esi, esi
js 0x14001f188
cmp dword [rbp + 0x20], 0
jne 0x14001f0a2
mov rsi, qword [rbp + 0x40]
test rsi, rsi
jne 0x14001f155
mov esi, 0x80004003
jmp 0x14001f188
test rbx, rbx
jne 0x14001f15e
xor eax, eax
jmp 0x14001f172
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov rcx, rbx
mov edx, eax
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsi], rax
test rax, rax
jne 0x14001f186
test rbx, rbx
je 0x14001f186
mov esi, 0x8007000e
jmp 0x14001f188
xor esi, esi
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14001f1be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, esi
mov esi, ecx
mov ecx, SHLoadIndirectString
call qword [sym.imp.urlmon.dll_Ordinal_414]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400122d0
int3