joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a540
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x50]
call fcn.14000b050
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
je 0x14000a6c1
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000a5f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a74f
call fcn.140056f74
xor esi, esi
movdqa xmm0, xmmword [0x140098a80]
mov word [rsp + 0x50], si
movdqu xmmword [rsp + 0x60], xmm0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000a647
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14000a642
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a749
mov rcx, r8
call fcn.140056f74
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], recvfrom
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000a690
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000a68b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a755
mov rcx, r8
call fcn.140056f74
mov eax, ebp
mov byte [rbx], 0
mov qword [rbx + 0x18], recvfrom
mov qword [rbx + 0x10], rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140056cc0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x30], 4
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000a6d6
mov rdx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000a5f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a74f
jmp 0x14000a5f3
call fcn.140062080
nop
call fcn.140062080
nop
call fcn.140062080
int3
Function at 0x14000a760
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x50]
call fcn.14000b050
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
je 0x14000a8e1
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000a818
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a979
call fcn.140056f74
xor esi, esi
movdqa xmm0, xmmword [0x140098a80]
mov word [rsp + 0x50], si
movdqu xmmword [rsp + 0x60], xmm0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000a867
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14000a862
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a973
mov rcx, r8
call fcn.140056f74
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], recvfrom
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000a8b0
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000a8ab
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a97f
mov rcx, r8
call fcn.140056f74
mov eax, ebp
mov byte [rbx], 0
mov qword [rbx + 0x18], recvfrom
mov qword [rbx + 0x10], rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140056cc0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], 0x400
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000a8fe
mov rdx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000a818
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a979
jmp 0x14000a813
call fcn.140062080
nop
call fcn.140062080
nop
call fcn.140062080
int3
Function at 0x14000a990
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], r9d
lea rcx, [rsp + 0x50]
call fcn.14000b050
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
je 0x14000ab13
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000aa4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aa45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab9f
call fcn.140056f74
xor esi, esi
movdqa xmm0, xmmword [0x140098a80]
mov word [rsp + 0x50], si
movdqu xmmword [rsp + 0x60], xmm0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000aa99
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14000aa94
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ab99
mov rcx, r8
call fcn.140056f74
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], recvfrom
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000aae2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000aadd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000aba5
mov rcx, r8
call fcn.140056f74
mov eax, ebp
mov byte [rbx], 0
mov qword [rbx + 0x18], recvfrom
mov qword [rbx + 0x10], rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140056cc0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000ab20
mov rdx, qword [rbx]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000aa4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aa45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab9f
jmp 0x14000aa45
call fcn.140062080
nop
call fcn.140062080
nop
call fcn.140062080
int3
Function at 0x14000abb0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x50]
call fcn.14000b050
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
je 0x14000ad7b
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000ac6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ae0f
call fcn.140056f74
xor ebp, ebp
movdqa xmm0, xmmword [0x140098a80]
mov word [rsp + 0x50], bp
movdqu xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14000acbc
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14000acb7
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ae1b
mov rcx, r8
call fcn.140056f74
mov byte [rsi], 0
mov qword [rsi + 0x18], recvfrom
mov qword [rsi + 0x10], rbp
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000ad05
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14000ad00
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ae09
mov rcx, r8
call fcn.140056f74
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], recvfrom
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000ad4e
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000ad49
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ae15
mov rcx, r8
call fcn.140056f74
mov eax, r14d
mov byte [rbx], 0
mov qword [rbx + 0x18], recvfrom
mov qword [rbx + 0x10], rbp
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140056cc0
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [rbx + 0x10]
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000ad8b
mov rax, qword [rbx]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000ad98
mov rdx, qword [rdi]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r14d, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000ac6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ae0f
jmp 0x14000ac68
call fcn.140062080
nop
call fcn.140062080
nop
call fcn.140062080
nop
call fcn.140062080
int3
Function at 0x14000ae30
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x68]
call fcn.14000b050
nop
lea rdx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000b050
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000af0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b039
call fcn.140056f74
movdqa xmm0, xmmword [0x140098a80]
movdqu xmmword [rsp + 0x58], xmm0
xor ebp, ebp
mov word [rsp + 0x48], bp
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x14000af67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b03f
call fcn.140056f74
movdqa xmm0, xmmword [0x140098a80]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], bp
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000afb4
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000afaf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b02d
mov rcx, r8
call fcn.140056f74
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], recvfrom
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000aff9
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000aff4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b033
mov rcx, r8
call fcn.140056f74
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], recvfrom
mov byte [rbx], 0
mov eax, esi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140056cc0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.140062080
nop
call fcn.140062080
nop
call fcn.140062080
nop
call fcn.140062080
int3
Function at 0x14000d8a0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x190
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbp, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x38], rax
mov rbx, rdx
movabs rax, 0xbb67ae8584caa73b
mov dword [rsp + 0x78], ecx
mov qword [rsp + 0x40], rax
xor edx, edx
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x7c]
movabs rax, 0xa54ff53a5f1d36f1
mov r8d, 0x100
mov qword [rsp + 0x50], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x58], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x60], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x68], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x70], rax
call fcn.140058ad0
cmp qword [rbx + 0x18], 0x10
mov rsi, qword [rbx + 0x10]
jb 0x14000d970
mov rbx, qword [rbx]
mov edx, dword [rsp + 0x78]
mov ecx, 0x80
sub ecx, edx
mov eax, esi
cmp rsi, rcx
cmovae eax, ecx
lea rcx, [rsp + 0x7c]
add rcx, rdx
mov r8d, eax
mov rdx, rbx
mov r14d, eax
call fcn.140058e90
mov ecx, dword [rsp + 0x78]
lea rax, [rsi + rcx]
cmp rax, 0x80
jae 0x14000d9b1
add ecx, esi
mov dword [rsp + 0x78], ecx
jmp 0x14000da1b
mov qword [rsp + 0x1c0], rdi
lea rdx, [rsp + 0x7c]
sub esi, r14d
lea rcx, [rsp + 0x30]
mov edi, esi
mov r8d, 1
shr edi, 7
add rbx, r14
call fcn.14000e9e0
mov r8d, edi
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.14000e9e0
mov edx, edi
lea rcx, [rsp + 0x7c]
shl edx, 7
and esi, 0x7f
add rdx, rbx
mov r8d, esi
call fcn.140058e90
shl edi, 7
mov dword [rsp + 0x78], esi
lea ecx, [rdi + 0x80]
mov rdi, qword [rsp + 0x1c0]
add qword [rsp + 0x30], rcx
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.14000e520
mov rax, rbp
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140056cc0
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x190
pop r14
pop rsi
pop rbp
ret
Function at 0x140013440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x1400135d3
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x1400135d3
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x1400134d9
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x1400135f7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1400134ef
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x1400134ef
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140013502
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x14001354d
mov r9d, eax
cmp eax, 0x800
jae 0x14001351c
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x14001354d
cmp eax, 0x10000
jae 0x140013536
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x14001354d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x1400135d3
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x140013571
cmp r10d, 3
jae 0x14001357d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x1400135ae
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x140013590
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x14001348e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x1400135e2
Function at 0x140014990
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x880
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
xor r14d, r14d
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbp, rax
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400149f4
mov rdx, qword [rbx]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.140058ad0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov dword [rsp + 0x34], 1
lea r9, [rsp + 0x30]
mov r8d, 0x7ff
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140014af8
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140014af8
lea r8, [rsp + 0x70]
add r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140015b40
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140014a93
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call fcn.1400141a0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140014ae1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014adc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014b81
call fcn.140056f74
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.140058ad0
jmp 0x140014a40
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140014b46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140014b41
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014b87
mov rcx, r8
call fcn.140056f74
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rax, rdi
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140056cc0
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140062080
nop
call fcn.140062080
int3
Function at 0x140016260
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rdi, rcx
jb 0x140016278
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x140016282
mov rcx, qword [rcx]
mov r8d, 1
mov qword [rsp + 0x50], rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, qword [rdi + 0x18]
mov esi, eax
cmp rdx, 8
jb 0x1400162d0
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400162cb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001633a
mov rcx, r8
call fcn.140056f74
xor ebp, ebp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov word [rdi], bp
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001631c
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140016317
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001633a
mov rcx, r8
call fcn.140056f74
mov qword [rbx + 0x10], rbp
mov eax, esi
mov word [rbx], bp
mov rbp, qword [rsp + 0x50]
mov qword [rbx + 0x18], 7
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
call fcn.140062080
int3
Function at 0x140018570
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400a5028]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0x11c
call fcn.140062344
mov rdi, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400185e6
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400185dd
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400185ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, dword [rdi + 4]
mov rcx, rdi
cmp ebx, 0xa
jne 0x1400186d7
cmp dword [rdi + 0xc], 0x55f0
jb 0x1400186cd
mov ebx, inet_ntoa
call fcn.140061bd0
lea r9, [rsp + 0x65]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x140018620
lea r8, [rsp + 0x65]
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.140012080
nop
lea r8, [rsp + 0x30]
lea rdx, str.Windows
mov rcx, rsi
call fcn.14000a160
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400186ab
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400186a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018722
call fcn.140056f74
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140056cc0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ebx, 0xa
jmp 0x140018610
call fcn.140061bd0
test ebx, ebx
jns 0x140018615
lea r9, [rsp + 0x65]
neg ebx
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x1400186f0
dec r9
mov byte [r9], 0x2d
jmp 0x140018646
call fcn.140062080
int3