joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004cba0
Capabilities:
Prepare http request
Receive http response

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx + 0xe0]
test rcx, rcx
je 0x14004ccfe
mov rdx, qword [rdx + 0x20]
cmp dword [rdx - 0x10], edi
jne 0x14004cbdc
mov rdx, qword [rbx + 0xe8]
mov r8d, 0x1bb
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rbp, rax
test rax, rax
je 0x14004ccfe
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004cd7d
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r11, rax
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi + 8]
mov r9, qword [rbx + 8]
mov r10, qword [rsi + 0x28]
cmp dword [r10 - 0x10], 0
jne 0x14004cc45
mov r10, qword [rbx + 0xf0]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
mov r9, qword [rbx]
mov r8, r10
mov rdx, qword [rbx + 0xf8]
lea rcx, [rsp + 0x60]
call fcn.140025c80
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov rbx, qword [rsp + 0x60]
mov r8, rbx
lea rdx, [0x1401e54a0]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x14004cd15
mov dword [rsp + 0x20], 0x2710
mov edx, 0x2710
mov r9d, edx
mov r8d, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x14004cd15
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ccfe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004cd31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rsi, rsi
je 0x14004cd70
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov edi, eax
test eax, eax
je 0x14004cd67
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, edi
jmp 0x14004cd00
mov ecx, 0x80004005
call fcn.140032160
int3
Function at 0x14004e1a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x420
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.14004b0f0
mov rbx, qword [rsi]
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004e2be
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x438], rax
mov rdx, rbx
lea rcx, [rsp + 0x438]
call fcn.14005a480
test al, al
jne 0x14004e20f
mov rdx, rbx
lea rcx, [rsp + 0x438]
call fcn.14005a5c0
nop
mov rax, qword [rsp + 0x438]
movsxd rdx, dword [rax - 0x10]
mov rdi, rdx
cmp dword [rax - 8], 1
jle 0x14004e239
lea rcx, [rsp + 0x438]
call fcn.14005a700
mov rax, qword [rsp + 0x438]
mov ebx, 0xffffffff
mov r8, rax
test rdi, rdi
je 0x14004e26b
nop word [rax + rax]
movzx edx, bl
movzx ecx, byte [r8]
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rsp + rdx*4 + 0x20]
lea r8, [r8 + 1]
sub rdi, 1
jne 0x14004e250
not ebx
lea rdx, [rax - 0x18]
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e28c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004e2a7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140032160
int3
Function at 0x14004f5f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebp, ebp
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f7d6
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
mov rdi, rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0xa8], 0x1000
lea r8, [rsp + 0x40]
mov rdx, qword [r15]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14004f713
mov edx, dword [rsp + 0xa8]
test edx, edx
js 0x14004f7e1
mov ecx, 1
sub ecx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, edx
or eax, ecx
jge 0x14004f695
lea rcx, [rsp + 0x38]
call fcn.1400320e0
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdi, [rbx - 0x18]
test rbx, rbx
jne 0x14004f6ca
mov eax, ebp
jmp 0x14004f6de
movsxd rdx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.140189f5c
test eax, eax
js 0x14004f7e1
cmp eax, dword [rdi + 0xc]
jg 0x14004f7e1
mov dword [rdi + 8], eax
mov eax, eax
mov word [rbx + rax*2], bp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1400318c0
add rax, 0x18
mov qword [rsi], rax
mov rbx, 0xffffffffffffffff
jmp 0x14004f76b
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14004f7cb
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsi], rax
lea rbp, [0x1401e3cf8]
mov rdx, rbp
mov rcx, rsi
call fcn.140031e00
mov rbx, 0xffffffffffffffff
test al, al
jne 0x14004f76b
mov rax, rbx
inc rax
cmp word [rbp + rax*2], 0
jne 0x14004f751
mov r8d, eax
mov rdx, rbp
mov rcx, rsi
call fcn.140032190
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14004f784
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f7a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004f7bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80070057
call fcn.140032160
int3
Function at 0x14004f7f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea r8, [rsp + 0x78]
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14004f8e6
mov rax, qword [rdi]
mov edx, dword [rax - 0x10]
lea ebp, [rdx + rdx]
cmp dword [rax - 8], 1
jle 0x14004f849
mov rcx, rdi
call fcn.140031f90
mov rax, qword [rdi]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x14004f8df
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f89d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f8ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004f8d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbx]
mov ebx, 0xffffffff
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f908
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f925
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004f93f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004f950
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x30
mov rdi, r8
mov dword [rsp + 0x58], 4
mov rsi, rdx
lea r8, [rsp + 0x50]
mov rbx, rcx
mov rcx, 0xffffffff80000001
mov rdx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rdx, qword [rbx]
test eax, eax
jne 0x14004fa20
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x14004f9cd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
sub rdx, 0x18
jmp 0x14004fa24
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
mov ebx, 0xffffffff
mov eax, ebx
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f9f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004fa0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
add rdx, 0xffffffffffffffe8
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fa3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004fa58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14004fa70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rcx
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000001
mov rdx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rdx, qword [rbx]
test eax, eax
jne 0x14004fb1e
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
mov ebx, 0xffffffff
mov eax, ebx
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004faf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004fb11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ebx, 0xffffffff
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fb3c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14004fb56
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140053170
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov esi, r9d
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [r8]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], esi
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [0x140050d50]
call fcn.140192844
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005326a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053288
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400532a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400532c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400532e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140059bf0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
sub rsp, 0x238
mov rcx, qword [rcx]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140059c1c
mov eax, 0xffffffff
add rsp, 0x238
ret
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140059c3c
shr eax, 4
not eax
and eax, 1
add rsp, 0x238
ret
xor eax, eax
add rsp, 0x238
ret
Function at 0x140062150
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov r8, qword [rcx]
mov esi, dword [r8 - 0x10]
test esi, esi
je 0x1400622da
mov rax, qword [rdx]
cmp dword [rax - 0x10], r15d
je 0x1400622da
lea edi, [rsi + 1]
test edi, edi
js 0x14006226f
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400621b0
mov edx, edi
mov rcx, rbx
call fcn.1400320e0
mov rcx, qword [rbx]
mov edx, 0x2f
mov word [rcx + rsi*2], dx
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x1400622d0
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbx]
mov word [rax + rcx*2], r15w
mov rdx, qword [r14]
mov r8d, dword [rdx - 0x10]
mov rcx, rbx
call fcn.140030960
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140062203
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xb7
jne 0x140062279
mov rdx, qword [rbx]
sub rdx, 0x18
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140062223
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070057
call fcn.140032160
lea rdx, str.QXBjX3JjQmdwY2FybXB3XWRfZ2pjYg
lea rcx, [rsp + 0x20]
call fcn.1400322d0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140031970
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14004beb0
nop
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14004d1c0
lea rdx, [0x140216618]
lea rcx, [rsp + 0x90]
call fcn.140185e78
nop
mov ecx, 0x80070057
call fcn.140032160
lea rdx, str.Z2x0X2pnYl1uX3Bfa2NyY3Bx
lea rcx, [rsp + 0x28]
call fcn.1400322d0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.140031970
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14004beb0
nop
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14004d1c0
lea rdx, [0x140216618]
lea rcx, [rsp + 0xa0]
call fcn.140185e78
int3
Function at 0x14006e570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
lea r8, [0x1401e7a08]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rbx, eax
mov ecx, 2
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140185440
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, SafeArrayPutElement
call qword [sym.imp.gdiplus.dll_GdipAlloc]
xor edi, edi
lea rsi, vtable.Gdiplus::Bitmap.0
mov rbx, rax
test rax, rax
je 0x14006e63b
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rax], rsi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStreamICM]
mov dword [rbx + 0x10], eax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, SafeArrayPutElement
call qword [sym.imp.gdiplus.dll_GdipAlloc]
mov rbx, rax
test rax, rax
je 0x14006e68b
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rax], rsi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStreamICM]
mov rcx, qword [rsp + 0x30]
mov dword [rbx + 0x10], eax
mov rax, rbx
mov qword [rbx + 8], rcx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c7630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov r15, rdx
mov rdi, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0xb0
jne 0x1400c764e
movzx eax, byte [r15 + 2]
cmp al, 0xb1
jne 0x1400c7658
mov rax, qword [r15 + 0x20]
jmp 0x1400c7668
cmp al, 0x8a
jne 0x1400c77e7
mov rax, qword [r15 + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1400c77e7
mov dword [r8], 0
cmp dl, 0x8a
jne 0x1400c7692
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.1400c5290
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1400c77d2
mov qword [rsp + 0x80], rbx
lea rcx, [0x1400c3430]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r14
lea r13, [fcn.1400c35e0]
xor r14d, r14d
mov qword [rsp + 0x98], rsi
lea edx, [r14 + 2]
cmp byte [rdi + 0x23], 0
mov rax, qword [r15 + 0x20]
mov rbx, qword [r14 + rax + 8]
je 0x1400c7740
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x1400c7730
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400bc670
cmp word [rsp + 0x44], 0
je 0x1400c7740
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1400ca4a0
jmp 0x1400c7780
mov rsi, qword [rdi]
test rbx, rbx
je 0x1400c775c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1400c1e40
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x1400c7770
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1400ca7f0
test rbx, rbx
je 0x1400c7780
mov rdx, rbx
mov rcx, rsi
call fcn.1400c1b70
inc ebp
lea rcx, [0x1400c3430]
add r14, 0x20
mov edx, 2
sub r12, 1
jne 0x1400c76f0
mov eax, dword [rsp + 0x88]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.1400ca6c0
Function at 0x1401633cc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140163450
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1401c99d0]
cmp byte [rcx + rax], 0
je 0x140163450
dec r8
sub rdx, 1
jne 0x140163436
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1401796fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140165776
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140165759
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140165744

Function at 0x140183b6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140183bb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140183bb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140183bb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140183bb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140183bb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140183bb8
xor al, al
add rsp, 0x28
ret

Function at 0x140191d14
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140191d34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140189ce4
or eax, 0xffffffff
jmp 0x140191d36
xor eax, eax
add rsp, 0x28
ret