joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032790
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14005b230]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, r9
mov r13, r8
mov rbx, rdx
mov r14, rdx
mov rdx, qword [0x14005b2d0]
sub r14, rdx
mov rax, qword [0x14005b2d8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x1400329d6
lea r8, [rax + 1]
mov qword [rsp + 0x48], r8
mov rcx, qword [0x14005b2e0]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x1400329d0
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
cmp rsi, r9
ja 0x1400329d0
mov rcx, rsi
shl rcx, 4
mov qword [rsp + 0x38], rsi
cmp rcx, 0x1000
jb 0x140032874
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400329d0
mov rcx, rax
call fcn.140034668
test rax, rax
je 0x14003286d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140032894
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003288d
call fcn.140034668
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
jmp 0x140032899
xor edi, edi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
and r14, 0xfffffffffffffff0
lea r12, [r14 + rdi]
lea r14, [r12 + 0x10]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x30], r14
mov ecx, 0x10
call fcn.140034668
mov r9, rax
mov rax, qword [r15]
mov qword [r9], rax
mov qword [r9 + 8], r13
mov qword [rsp + 0x58], r9
lea r15, [r12 + 8]
mov qword [rsp + 0x28], r15
xor r13d, r13d
mov dword [rsp + 0x20], r13d
lea r8, [0x140032d60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r12], rax
test rax, rax
je 0x1400329c1
mov qword [rsp + 0x30], r12
mov rcx, qword [0x14005b2d8]
mov rax, qword [0x14005b2d0]
cmp rbx, rcx
jne 0x140032938
cmp rax, rcx
je 0x140032987
mov rdx, rdi
sub rdx, rax
nop
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx + rax], xmm1
add rax, 0x10
cmp rax, rcx
jne 0x140032920
jmp 0x140032987
cmp rax, rbx
je 0x140032960
mov rcx, rdi
sub rcx, rax
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rax, rbx
jne 0x140032943
mov rcx, qword [0x14005b2d8]
mov qword [rsp + 0x30], rdi
cmp rbx, rcx
je 0x140032987
sub r14, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [r14 + rbx], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140032970
mov r9, rsi
mov r8, qword [rsp + 0x48]
mov rdx, rdi
call fcn.140032bd0
mov rax, r12
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140034190
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [r15], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.1400300f0
int3
call fcn.140032bb0
int3
Function at 0x140032c90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14005b230]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov ecx, 8
call fcn.140034668
lea rcx, [0x140030440]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140032d90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140032d0a
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140034190
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140034d24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140034d6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140034d6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140034d6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140034d6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140034d6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140034d70
xor al, al
add rsp, 0x28
ret
Function at 0x14000247c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400024c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400024c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400024c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400024c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400024c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400024c8
xor al, al
add rsp, 0x28
ret
Function at 0x14001dd10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r9, rcx
test rcx, rcx
je 0x14001deb6
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [r9 + rcx], 0
jne 0x14001dd26
lea eax, [rcx - 1]
cmp eax, 0x102
ja 0x14001deb6
cmp byte [r9], 0xc5
mov qword [rsp + 0x38], rdi
jne 0x14001de8c
cmp byte [r9 + 1], 0xd3
jne 0x14001de8c
mov r10d, dword [0x140088080]
lea r8d, [rcx - 2]
add r10d, 0xfffffffe
lea rbx, [0x14008a150]
add r10d, ecx
mov eax, 0x88888889
imul r10d
add edx, r10d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1e
xor edx, edx
mov r11d, edx
sub r10d, eax
test r8d, r8d
jle 0x14001de4c
cmp r8d, 0x20
jb 0x14001de4c
lea ecx, [r8 - 1]
mov qword [rsp + 0x30], rsi
movsxd rdi, ecx
lea eax, [rcx + 2]
movsxd rcx, eax
lea rsi, [r9 + 2]
add rcx, r9
add rdi, rbx
cmp rbx, rcx
ja 0x14001ddce
cmp rdi, rsi
jae 0x14001de47
movsx eax, r10b
mov ecx, r8d
movd xmm2, eax
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
and ecx, 0x8000001f
jge 0x14001ddf5
dec ecx
or ecx, 0xffffffe0
inc ecx
movdqa xmm3, xmmword [0x140073470]
mov eax, r8d
sub eax, ecx
movsxd rcx, eax
mov rax, r9
sub rax, rbx
lea rdi, [rax + 2]
lea rsi, [rax + 0x12]
lea rax, [rdx + rbx]
add r11d, 0x20
movdqu xmm0, xmmword [rdi + rax]
add rdx, 0x20
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqu xmmword [rax], xmm0
movdqu xmm1, xmmword [rsi + rax]
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [rax + 0x10], xmm1
cmp rdx, rcx
jl 0x14001de13
mov rsi, qword [rsp + 0x30]
movsxd rdx, r11d
movsxd r8, r8d
cmp rdx, r8
jge 0x14001de79
sub r9, rbx
nop word [rax + rax]
lea rcx, [rdx + rbx]
inc rdx
movzx eax, byte [r9 + rcx + 2]
xor al, r10b
xor al, 1
mov byte [rcx], al
cmp rdx, r8
jl 0x14001de60
mov rdi, qword [rsp + 0x38]
mov rax, rbx
mov byte [r8 + rbx], 0
add rsp, 0x20
pop rbx
ret
movsxd rdi, ecx
lea rbx, [0x14008a150]
mov r8, rdi
mov rcx, rbx
mov rdx, r9
call fcn.1400604e8
mov byte [rdi + rbx], 0
mov rax, rbx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
lea rax, [0x14008a150]
mov byte [0x14008a150], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14001ded0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
mov r9, rcx
test rcx, rcx
jne 0x14001def2
mov byte [0x14008a150], 0
lea rax, [0x14008a150]
add rsp, 0x20
pop rdi
ret
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [r9 + rcx], 0
jne 0x14001def6
lea r11d, [rcx - 1]
cmp r11d, 0x102
ja 0x14001dede
cmp byte [r9], 0xc5
mov qword [rsp + 0x30], rbx
jne 0x14001df49
cmp byte [r9 + 1], 0xd3
jne 0x14001df49
movsxd rbx, ecx
lea rdi, [0x14008a150]
mov r8, rbx
mov rcx, rdi
mov rdx, r9
call fcn.1400604e8
mov byte [rbx + rdi], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x140089d94], 0
je 0x14001df74
mov eax, dword [0x140089fe4]
cmp eax, 1
jne 0x14001df66
cmp dword [0x140089ea4], 0
jmp 0x14001df72
cmp eax, 2
jne 0x14001df74
cmp dword [0x14008a144], 0
je 0x14001df1f
mov r10d, dword [0x140088080]
lea rdi, [0x14008a150]
add r10d, ecx
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov word [0x14008a150], 0xd3c5
mov eax, 0x88888889
lea rsi, [0x14008a152]
imul r10d
mov ebx, r8d
add edx, r10d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1e
sub r10d, eax
test ecx, ecx
jle 0x14001e066
cmp ecx, 0x20
jb 0x14001e066
lea eax, [r11 + 2]
movsxd rdx, eax
movsxd rax, r11d
add rdx, rdi
add rax, r9
lea r11, [0x14008a152]
cmp r11, rax
ja 0x14001dfed
cmp rdx, r9
jae 0x14001e066
movsx eax, r10b
mov edx, ecx
movd xmm2, eax
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
and edx, 0x8000001f
jge 0x14001e013
dec edx
or edx, 0xffffffe0
inc edx
movdqa xmm3, xmmword [0x140073470]
mov eax, ecx
sub eax, edx
mov rdx, r9
sub rdx, rsi
movsxd r11, eax
nop dword [rax + rax]
lea rax, [r8 + rdi]
add ebx, 0x20
movdqu xmm0, xmmword [rdx + rax + 2]
add r8, 0x20
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqu xmmword [rax + 2], xmm0
movdqu xmm1, xmmword [rdx + rax + 0x12]
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [rax + 0x12], xmm1
cmp r8, r11
jl 0x14001e030
movsxd r8, ebx
movsxd r11, ecx
cmp r8, r11
jge 0x14001e09a
sub r9, rsi
nop dword [rax]
nop dword [rax + rax]
lea rdx, [r8 + rdi]
inc r8
movzx eax, byte [r9 + rdx + 2]
xor al, r10b
xor al, 1
mov byte [rdx + 2], al
cmp r8, r11
jl 0x14001e080
mov rsi, qword [rsp + 0x38]
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x30]
movsxd rcx, eax
mov rax, rdi
mov byte [rcx + rdi], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140006ad4
Capabilities:
Receive http response
Set http header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor r12d, r12d
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r12w
lea ecx, [r12 + 0x30]
call fcn.14006b838
mov rbx, rax
mov qword [rbp - 0x20], 0x14
mov qword [rbp - 0x18], 0x17
lea r8d, [r12 + 2]
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.14006d270
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], r12
mov rbx, qword [r14 + 0x88]
mov rdi, qword [r14 + 0x90]
lea r15, [r14 + 0x10]
cmp rbx, rdi
je 0x140006c04
mov rsi, rbx
lea rax, [rbp - 0x30]
cmp rax, rsi
je 0x140006b90
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140006b83
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x30]
call fcn.140002c20
lea rcx, [0x1400f811c]
call fcn.14007e128
mov r8, rax
lea rdx, [0x1400f811c]
lea rcx, [rbp - 0x30]
call fcn.140007984
lea rdx, [rsi + 0x20]
cmp qword [rsi + 0x38], 8
jb 0x140006bbe
mov rdx, qword [rsi + 0x20]
mov r8, qword [rsi + 0x30]
lea rcx, [rbp - 0x30]
call fcn.140007984
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r9d, 0x20000000
or r8d, 0xffffffff
mov rcx, qword [r15]
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x140006c96
add rbx, 0x40
mov rsi, rbx
cmp rbx, rdi
jne 0x140006b6d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x140006c7e
xor edx, edx
mov rcx, qword [r15]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x140006c65
lea rcx, [rbp - 0x30]
call fcn.140002874
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006b990
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea r8, str.WinHttpReceiveResponse_failed
mov rcx, r14
call fcn.140006a9c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.WinHttpSendRequest_failed
mov rcx, r14
call fcn.140006a9c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.WinHttpAddRequestHeaders_failed
mov rcx, r14
call fcn.140006a9c
int3
Function at 0x140007860
Capabilities:
Receive http response

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and dword [rsp + 0x50], 0
lea rsi, [rcx + 0x140]
mov r8, qword [rsi]
mov rdi, rcx
mov rax, qword [rsi + 8]
sub rax, r8
mov r14d, edx
lea rcx, [rax + r14]
cmp rcx, rax
jae 0x14000789a
lea rax, [r8 + rcx]
mov qword [rsi + 8], rax
jmp 0x1400078ce
jbe 0x1400078ce
mov rax, qword [rsi + 0x10]
sub rax, r8
cmp rcx, rax
jbe 0x1400078ba
mov rdx, rcx
lea r8, [rsp + 0x58]
mov rcx, rsi
call fcn.140004e30
jmp 0x1400078ce
lea rbx, [r8 + rcx]
mov rcx, qword [rsi + 8]
mov rdx, rbx
call fcn.14000502c
mov qword [rsi + 8], rbx
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi + 0x10]
sub rdx, r14
mov r8d, r14d
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1400078fd
add qword [rdi + 0x20], r14
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.WinHttpReadData_failed
mov rcx, rdi
mov edx, eax
call fcn.140006a9c
int3

Function at 0x1400095f0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14000962e
call qword [sym.imp.WINHTTP.dll_WinHttpCheckPlatform]
test eax, eax
je 0x14000963c
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx], rax
test rax, rax
je 0x140009672
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call fcn.140003214
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.WinHttpCheckPlatform_failed__this_platform_is_not_supported_by_WinHTTP
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001c60
lea rdx, [0x140127908]
lea rcx, [rsp + 0x30]
call fcn.14006dab0
int3
call fcn.140003214
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.WinHttpOpen_failed_when_opening_session
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001c60
lea rdx, [0x140127908]
lea rcx, [rsp + 0x30]
call fcn.14006dab0
int3

Function at 0x14000d998
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14000d9a6
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d9b9
test al, 0x10
je 0x14000d9b9
mov al, 1
jmp 0x14000d9bb
xor al, al
add rsp, 0x28
ret

Function at 0x14000d9c0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14000d998
test al, al
jne 0x14000d9e7
cmp qword [rbx + 0x18], 8
jb 0x14000d9dc
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add rsp, 0x20
pop rbx
ret

Function at 0x14000da40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14000da4e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
Function at 0x14000db20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rdx, str.Forcing_service_stop..
call fcn.14000f9b0
lea rdx, str.AntiScam.Desktop.Service.exe
lea rcx, [rsp + 0x20]
call fcn.1400180a8
nop
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
cmp rbx, rdi
je 0x14000db79
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14000dba4
add rbx, 8
cmp rbx, rdi
jne 0x14000db57
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdi, rbx
cmp rdi, 8
jae 0x14000db8f
lea rcx, str.Service_was_not_found_while_trying_to_force_stop_it___it_might_already_be_stopped
call fcn.140003700
nop
lea rcx, [rsp + 0x20]
call fcn.140011648
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, str.Unable_to_force_stop_service:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_force_stop_service
lea rcx, [rsp + 0x38]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rsp + 0x38]
call fcn.14006dab0
int3

Function at 0x14000dbdc
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14000dc1e
lea rcx, str.Unable_to_CoInitializeEx
call fcn.14000366c
mov eax, 1
jmp 0x14000dd04
and qword [rsp + 0x40], 0
xor r9d, r9d
and dword [rsp + 0x38], 0
xor r8d, r8d
and qword [rsp + 0x30], 0
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], 6
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x14000dc5d
lea rcx, str.Unable_to_CoInitializeSecurity
jmp 0x14000dc0f
lea rcx, str.Getting_program_files_path
call fcn.14000369c
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x14000dcb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_get_Program_Files_path__error__d_
call fcn.14000366c
lea rdx, str.Unable_to_get_Program_Files_path_
mov rcx, rbx
call fcn.14000d9f0
jmp 0x14000dc14
lea rcx, [rsp + 0x50]
call fcn.14007e128
mov r8, rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140002c20
lea rcx, str.Bogasoft_Anti_Scam_
call fcn.14007e128
mov r8, rax
lea rdx, str.Bogasoft_Anti_Scam_
mov rcx, rbx
call fcn.140007984
cmp qword [rbx + 0x18], 8
jb 0x14000dcf3
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.Program_files_path:__S
call fcn.14000369c
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14006b990
add rsp, 0x270
pop rbx
ret
Function at 0x14000fa08
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
lea rdx, str.Stopping_client..
call fcn.14000f9b0
lea rdx, str.AntiScam.Desktop.exe
lea rcx, [rsp + 0x20]
call fcn.1400180a8
nop
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
cmp rbx, rdi
je 0x14000fa6d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14000fb02
add rbx, 8
cmp rbx, rdi
jne 0x14000fa47
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdi, rbx
cmp rdi, 8
jae 0x14000fa83
lea rcx, str.Client_was_not_found_while_trying_to_stop_it___it_might_already_be_stopped
call fcn.140003700
nop
lea rcx, [rsp + 0x20]
call fcn.140011648
lea rdx, str.Stopping_service..
mov rcx, rsi
call fcn.14000f9b0
lea rbx, str.AntiScam
mov rcx, rbx
call fcn.140015be0
test al, al
je 0x14000fae6
mov rcx, rbx
call fcn.140016134
test al, al
je 0x14000fadd
mov rcx, rbx
call fcn.1400164c8
test al, al
jne 0x14000faf2
lea rcx, str.Timed_out_while_stopping_service._Falling_back_to_unclean_force_termination.
call fcn.14000366c
mov rcx, rsi
call fcn.14000db20
jmp 0x14000faf2
lea rcx, str.Service_is_installed_but_not_running__so_it_could_not_be_stopped
jmp 0x14000faed
lea rcx, str.Service_was_not_installed__so_it_could_not_be_stopped
call fcn.140003700
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, str.Unable_to_stop_client:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_stop_client
lea rcx, [rsp + 0x38]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rsp + 0x38]
call fcn.14006dab0
int3

Function at 0x140011714
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
lea rdi, [rcx + 0x140]
mov r14d, edx
mov rax, qword [rdi + 8]
mov rbp, rcx
mov rcx, qword [rdi]
sub rax, rcx
cmp r14, rax
jae 0x14001174c
lea rax, [rcx + r14]
mov qword [rdi + 8], rax
jmp 0x140011780
jbe 0x140011780
mov rax, qword [rdi + 0x10]
sub rax, rcx
cmp r14, rax
jbe 0x14001176c
lea r8, [rsp + 0x48]
mov rdx, r14
mov rcx, rdi
call fcn.140004e30
jmp 0x140011780
lea rbx, [rcx + r14]
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.14000502c
mov qword [rdi + 8], rbx
mov rdx, qword [rdi]
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 0x10]
mov r8d, r14d
and dword [rsp + 0x48], 0
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1400117c9
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x138]
call fcn.140015130
add qword [rbp + 0x20], r14
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.WinHttpReadData_failed
mov rcx, rbp
mov edx, eax
call fcn.140006a9c
int3
Function at 0x1400153c8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400153f6
xor eax, eax
jmp 0x1400154dc
cmp qword [rcx + 0x68], 0
je 0x140015407
call fcn.140015500
jmp 0x1400154dc
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001541e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140015420
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140015452
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14006d270
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400154d6
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140015489
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400154b2
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400a8ac4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400154d6
cmp rsi, rbx
ja 0x140015490
test rsi, rsi
je 0x1400154d6
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400a8ac4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret