joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400184d0
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r14, r8
mov qword [rbp - 0x40], r8
mov r13, rdx
mov r15, rcx
xor ebx, ebx
mov esi, ebx
mov edi, ebx
jmp 0x14001851b
mov r14, qword [rbp - 0x40]
add esi, 0x200
test rdi, rdi
je 0x14001852e
mov rcx, rdi
call fcn.1400b41f8
mov ecx, esi
call fcn.1400b41f0
mov rdi, rax
test rax, rax
je 0x14001861c
mov byte [rax], bl
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x18], recv
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x30], bl
lea rdx, [r15 + 8]
cmp qword [rdx + 0x18], 8
jb 0x14001856a
mov rcx, qword [rdx]
jmp 0x14001856d
mov rcx, rdx
mov rax, qword [rdx + 0x10]
lea r8, [rcx + rax*2]
cmp qword [rdx + 0x18], 8
jb 0x14001857f
mov rdx, qword [rdx]
lea rcx, [rbp - 0x30]
call fcn.140018c78
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x1403cdce5]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r14d, eax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400185d4
inc rdx
mov r8d, 1
mov rcx, qword [rbp - 0x30]
call fcn.140009a30
mov qword [rbp - 0x18], recv
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x30], bl
lea eax, [rsi - 1]
cmp r14d, eax
jae 0x140018517
cmp byte [rdi], bl
jne 0x1400185f8
mov rax, rbx
jmp 0x140018600
mov rcx, rdi
call fcn.140258920
mov r8, rax
mov rdx, rdi
mov rcx, r12
call fcn.1400102a4
mov rcx, rdi
call fcn.1400b41f8
test r14d, r14d
setne al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024cd60
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b474
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebp, ebp
test eax, eax
jne 0x14001b4e3
mov rcx, qword [rbx + 0x238]
add rcx, 0x120
xor r8d, r8d
lea rdx, [0x1403ca788]
call fcn.140009144
jmp 0x14001b62f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x14001b62f
mov eax, 2
mul rdi
mov r14, 0xffffffffffffffff
cmovo rax, r14
mov rcx, rax
call fcn.1400b41f0
mov rsi, rax
mov r9, rax
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14001b60a
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [0x1403cdff8]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14001b60a
cmp dword [rsp + 0x30], ebp
je 0x14001b60a
call fcn.1400b482c
mov rcx, rax
test rax, rax
jne 0x14001b57a
mov ecx, 0x80004005
call fcn.14001cbdc
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x48]
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._u._u._u._u
lea rcx, [rsp + 0x38]
call fcn.14001c8a8
mov rcx, qword [rbx + 0x238]
add rcx, 0x120
mov rbx, qword [rsp + 0x38]
cmp word [rbx], bp
jne 0x14001b5d6
mov r8, rbp
jmp 0x14001b5e3
mov r8, r14
inc r8
cmp word [rbx + r8*2], bp
jne 0x14001b5d9
mov rdx, rbx
call fcn.140009144
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14001b627
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14001b627
mov rcx, qword [rbx + 0x238]
xor r8d, r8d
lea rdx, [0x1403ca788]
add rcx, 0x120
call fcn.140009144
mov rcx, rsi
call fcn.1400b41f8
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001c130
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r15, r8
mov r12d, edx
xor edi, edi
mov byte [rsp + 0x30], dil
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x30c
lea r9, str.NGDesktopSureSupply::CDesktopSureSupplyMediator::GetUserDefaultLocaleCode
lea r8, [0x1406e5660]
mov rdx, qword [0x1406e5688]
lea rcx, [rsp + 0x70]
call fcn.14000a0b4
nop
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14001c294
lea ebx, [rax + 1]
movsxd rcx, ebx
lea eax, [rdi + 2]
mul rcx
lea r14, [rdi - 1]
cmovo rax, r14
mov rcx, rax
call fcn.1400b41f0
mov rsi, rax
mov r9d, ebx
mov r8, rax
mov edx, r12d
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14001c267
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
cmp word [rsi], di
je 0x14001c220
inc r14
cmp word [rsi + r14*2], di
jne 0x14001c213
mov rdi, r14
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140009144
nop
lea rax, [rsp + 0x48]
cmp r15, rax
je 0x14001c256
xor r8d, r8d
mov dl, 1
mov rcx, r15
call fcn.140008e38
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.140009900
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140008e38
jmp 0x14001c28b
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
lea r9, str.GetLocaleInfo___for_failed_with__d
mov edx, 0x80
mov r8d, 0x31a
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
mov rcx, rsi
call fcn.1400b41f8
nop
lea rcx, [rsp + 0x70]
call fcn.14000a1fc
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14001e848
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push r14
sub rsp, 0x30
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov r14, rdx
mov rbx, rcx
lea rax, vtable.NGUtils::AFileVersionInfo.0
mov qword [rcx], rax
lea rax, vtable.NGUtils::CFileVersionInfo.0
mov qword [rcx], rax
and dword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
and qword [rcx + 8], 0
test rdx, rdx
je 0x14001e93e
and dword [rsp + 0x60], 0
lea rdx, [r11 + 0x18]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
mov dword [rsp + 0x68], esi
test eax, eax
je 0x14001e93e
mov ecx, esi
call fcn.1400b41f0
mov qword [rbx + 0x18], rax
jmp 0x14001e8d4
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14001e93e
mov r8d, esi
mov edx, dword [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14001e93e
and dword [rsp + 0x58], 0
and dword [rsp + 0x68], 0
lea r8, [rbx + 0x20]
lea r9, [rsp + 0x58]
lea rdx, str.VarFileInfoTranslation
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14001e923
mov eax, dword [rsp + 0x58]
shr eax, 2
mov dword [rbx + 0x10], eax
lea r8, [rbx + 8]
lea r9, [rsp + 0x68]
lea rdx, [0x1403cdff8]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop
mov rax, rbx
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140026010
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x38
call fcn.1400b419c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140026067
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140025dc8
mov rbx, rax
jmp 0x140026069
xor ebx, ebx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x286
lea r9, str.NGDeviceManager::CSearchDevice::FindDevice
lea r8, [0x1406e5e78]
mov rdx, qword [0x1406e5ad8]
lea rcx, [rsp + 0x50]
call fcn.14000a0b4
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400260cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.CreateEvent_failed__err_d
mov r8d, 0x28b
jmp 0x140026105
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140025c58]
xor edx, edx
xor ecx, ecx
call fcn.140265b2c
test rax, rax
jne 0x14002611a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str._beginthreadex_Failed__err_d
mov r8d, 0x292
mov edx, 0x80
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
jmp 0x14002614a
or edi, 0xffffffff
mov edx, edi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
jne 0x14002614a
lea r9, str.WaitForSingleObject_failed_
mov edx, 0x80
mov r8d, 0x299
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
nop
lea rcx, [rsp + 0x50]
call fcn.14000a1fc
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14024cd60
mov rbx, qword [rsp + 0x120]
add rsp, 0x100
pop rdi
ret
Function at 0x1400456d8
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x130
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov dil, dl
mov rbx, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x7c
lea r9, str.NGBusinessLogic::CMediator::Run
lea r8, [0x1406e64d8]
mov rdx, qword [0x1406e5630]
lea rcx, [r11 - 0xb8]
call fcn.14000a0b4
nop
lea rcx, [0x14001e624]
call fcn.140252368
mov qword [rsp + 0x48], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov dword [rsp + 0x88], eax
test eax, eax
je 0x1400457a5
lea rax, str.IEXESide::Initialize__
mov qword [rsp + 0x20], rax
lea r9, str._s_failed
mov edx, 0x80
lea r8d, [rdx + 3]
lea rcx, [rsp + 0x80]
call fcn.14000a4e0
mov ebx, dword [rsp + 0x88]
lea rcx, [rsp + 0x80]
call fcn.14000a1fc
mov eax, ebx
jmp 0x1400458dc
test dil, dil
je 0x14004585b
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140045600]
xor edx, edx
xor ecx, ecx
call fcn.140265b2c
mov qword [rbx + 0xb0], rax
mov rax, qword [rbx + 0xb0]
test rax, rax
je 0x14004582b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
mov dword [rsp + 0x88], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
or edx, 0xffffffff
mov rcx, qword [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xb0], 0
jmp 0x1400458a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x20], eax
lea r9, str._beginthreadex_..CMediator::CommandThreadStub...__returned__d
mov edx, 0x80
lea r8d, [rdx + 0x1d]
lea rcx, [rsp + 0x80]
call fcn.14000a4e0
jmp 0x1400458a5
mov rcx, qword [0x1406cb3c8]
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 2]
call qword [rax + reloc.WS2_32.dll_recv]
mov dword [rsp + 0x88], eax
test eax, eax
setns cl
movzx eax, ax
mov dword [rsp + 0x88], eax
test cl, cl
je 0x1400458a5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
mov dword [rsp + 0x88], eax
mov rcx, qword [0x1406cb3c8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rbx + 0x90]
mov rax, qword [rcx]
call qword [rax + 0x50]
nop
mov rcx, qword [rsp + 0x48]
call fcn.140252368
mov ebx, dword [rsp + 0x88]
lea rcx, [rsp + 0x80]
call fcn.14000a1fc
mov eax, ebx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14024cd60
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rdi
ret
Function at 0x1400469dc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x100
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
and dword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xf8
lea r9, str.NGBusinessLogic::CThreadedCommandReceiver::Initialize
lea r8, [0x1406e6500]
mov rdx, qword [0x1406e5630]
lea rcx, [rsp + 0x50]
call fcn.14000a0b4
nop
mov rcx, rbx
call fcn.14004626c
mov dword [rsp + 0x58], eax
test eax, eax
je 0x140046a72
lea rax, str.CCommandReceiver::Initialize__
mov qword [rsp + 0x20], rax
lea r9, str._s_failed
mov edx, 0x80
lea r8d, [rdx + 0x7b]
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
jmp 0x140046ac6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1400468dc]
xor edx, edx
xor ecx, ecx
call fcn.140265b2c
mov qword [rbx + 0x90], rax
test rax, rax
jne 0x140046ac6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
lea r9, str._beginthreadex_...TargetReceiverThreadStub...__
mov edx, 0x80
mov r8d, 0x103
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
mov ebx, dword [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000a1fc
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14024cd60
add rsp, 0x100
pop rbx
ret
Function at 0x14004a958
Capabilities:
Modify service

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x120
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xec
lea r9, str.NGUtils::CServiceControl::DoEnableSvc
lea r8, [0x1406e65f0]
mov rdx, qword [0x1406e5290]
lea rcx, [rsp + 0x70]
call fcn.14000a0b4
nop
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14004a9f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.OpenSCManager_failed___d__n
mov edx, 0x80
lea r8d, [rdx + 0x76]
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
jmp 0x14004aad7
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14004aa3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.OpenService_failed___d__n
mov edx, 0x80
mov r8d, 0x102
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
jmp 0x14004aacd
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r9d, edx
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14004aaa8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.ChangeServiceConfig_failed___d__n
mov edx, 0x80
mov r8d, 0x116
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
jmp 0x14004aac4
lea r9, str.Service_enabled_successfully._n
mov edx, reloc.WS2_32.dll_recv
mov r8d, 0x118
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x70]
call fcn.14000a1fc
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.14024cd60
mov rbx, qword [rsp + 0x138]
add rsp, 0x120
pop rdi
ret
Function at 0x14004cee8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r12d, r8d
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r15d, [r12 + rax]
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], VariantTimeToSystemTime
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
mov r9, rbx
lea r8, [0x1406e6a38]
mov rdx, qword [0x1406e6a30]
lea rcx, [rsp + 0x70]
call fcn.14000a0b4
nop
mov rcx, qword [r14 + 0x100]
test rcx, rcx
je 0x14004d0b7
mov rax, qword [rcx]
call qword [rax + 0x98]
test rax, rax
je 0x14004d02e
mov rcx, qword [r14 + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x98]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140008d98
nop
lea rcx, [rsp + 0x48]
call fcn.140016f54
test al, al
je 0x14004d024
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1405a4078]
lea rcx, [rsp + 0x48]
call fcn.140014860
cmp rax, 0xffffffffffffffff
je 0x14004d024
mov r9, qword [rsp + 0x58]
sub r9, rax
mov r8, rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140013440
mov rdi, rax
lea rbx, [r14 + 0x98]
cmp rbx, rax
je 0x14004d014
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140008e38
mov rdx, rdi
mov rcx, rbx
call fcn.140009900
nop
lea rcx, [rbp + 0x10]
call fcn.140008d78
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
lea rcx, [rsp + 0x48]
call fcn.140008d78
mov rcx, qword [r14 + 0x100]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x38]
mov edi, eax
test eax, eax
je 0x14004d0b1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, str._s_m_pIDeviceConnection__Open_returned_0x_08X
mov edx, 0x80
lea r8d, [rdx + 0x4a]
lea rcx, [rsp + 0x70]
call fcn.14000a4e0
cmp edi, 0x83e8f4fb
je 0x14004d0aa
cmp edi, 0x83e8f4fc
jne 0x14004d0df
mov dword [rsp + 0x78], 0x83e8f5f4
test r12d, r12d
je 0x14004d0cf
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14004d0b1
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
jne 0x14004d0b1
mov ebx, 0x83e8fffe
jmp 0x14004d0bc
mov ebx, 0x83e8f5f3
jmp 0x14004d0bc
mov ebx, dword [rsp + 0x78]
jmp 0x14004d0c0
mov ebx, 0x83e8f5fe
mov dword [rsp + 0x78], ebx
cmp ebx, 0x83e8f5f4
jne 0x14004d107
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, r15d
jae 0x14004d103
jmp 0x14004cf65
cmp edi, 0x83e8f4fd
je 0x14004d0fc
mov ebx, 0x83e8fff4
mov eax, 0x83e8f5fc
cmp edi, ebx
cmovne ebx, eax
mov dword [rsp + 0x78], ebx
jmp 0x14004d107
mov ebx, 0x83e8fffe
jmp 0x14004d0f6
mov ebx, dword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000a1fc
mov eax, ebx
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140061018
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x68], rbx
je 0x140061177
cmp byte [rcx + 0x71], bl
je 0x140061177
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
nop
cmp eax, 0xffffffff
jne 0x140061077
xor al, al
jmp 0x14006117c
lea rcx, [rbp - 0x30]
call fcn.1400098f0
mov qword [rbp - 0x18], recv
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x30], bl
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.140059df0
nop
mov esi, 1
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x30]
cmovae r8, r10
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
mov ecx, eax
test eax, eax
je 0x1400610ec
sub ecx, esi
jne 0x14006115a
jmp 0x1400610ef
mov byte [rdi + 0x71], bl
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov r14, qword [rbp - 0x40]
sub r14, rax
je 0x140061137
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x80]
mov r8, r14
mov rdx, rsi
call fcn.140268fd4
cmp r14, rax
jne 0x140061164
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp byte [rdi + 0x71], bl
je 0x140061161
test r14, r14
jne 0x1400610ad
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.140010a74
jmp 0x1400610a5
cmp ecx, 2
jne 0x14006116a
jmp 0x140061167
mov bl, sil
mov sil, bl
mov bl, sil
lea rcx, [rbp - 0x30]
call fcn.14000fea4
mov al, bl
jmp 0x14006117c
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024cd60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400805bc
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
cmp dword [rcx + 0x138], 0
mov r11, rcx
mov rax, qword [rsp + 0x70]
je 0x140080604
mov rcx, qword [str.pGn_]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, qword [r11 + 0x140]
mov r10, qword [rcx]
mov dword [rsp + 0x20], r8d
mov r8b, byte [r11 + 0x149]
call qword [r10 + 0x60]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x70], rax
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x140080618
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
cmp dword [rcx + 0x138], 0
mov r11, rcx
mov rax, qword [rsp + 0x70]
je 0x140080660
mov rcx, qword [str.pGn_]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, qword [r11 + 0x140]
mov r10, qword [rcx]
mov dword [rsp + 0x20], r8d
mov r8b, byte [r11 + 0x148]
call qword [r10 + 0x58]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x70], rax
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_ReadFile]

Function at 0x140084150
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r14, rdx
mov rsi, rcx
and dword [rax - 0x38], 0
call fcn.140009c0c
mov r15d, 1
mov dword [rsp + 0x20], r15d
mov rbx, qword [r14]
mov rax, qword [r14 + 8]
cmp rbx, rax
je 0x140084271
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edi, byte [rbx]
add rbx, r15
mov eax, edi
shr rax, 2
movzx r8d, word [r12 + rax*2]
mov rdx, r15
mov rcx, rsi
call fcn.140010190
nop
mov rax, qword [r14 + 8]
and edi, 3
mov rdx, r15
mov rcx, rsi
cmp rbx, rax
je 0x140084233
movzx ebp, byte [rbx]
add rbx, r15
mov eax, ebp
shr rax, 4
shl rdi, 4
or rax, rdi
movzx r8d, word [r12 + rax*2]
call fcn.140010190
nop
mov rax, qword [r14 + 8]
and ebp, 0xf
mov rdx, r15
mov rcx, rsi
cmp rbx, rax
je 0x14008422c
movzx edi, byte [rbx]
add rbx, r15
mov eax, edi
shr rax, 6
shl rbp, 2
or rax, rbp
movzx r8d, word [r12 + rax*2]
call fcn.140010190
mov eax, edi
and eax, 0x3f
movzx r8d, word [r12 + rax*2]
jmp 0x140084258
movzx r8d, word [r12 + rbp*8]
jmp 0x14008424d
shl rdi, 5
movzx r8d, word [rdi + r12]
call fcn.140010190
mov r8d, 0x3d
mov rdx, r15
mov rcx, rsi
call fcn.140010190
mov r8d, 0x3d
mov rdx, r15
mov rcx, rsi
call fcn.140010190
nop
mov rax, qword [r14 + 8]
cmp rbx, rax
jne 0x1400841a4
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret