joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001364c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdx, rcx
lea r8, [0x14002e970]
mov rcx, qword [0x140060218]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400137ca
mov rcx, qword [0x140060218]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
je 0x1400137ca
mov rcx, qword [0x140060218]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400137ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400137ca
and qword [rsp + 0x58], 0
mov edx, edi
mov ecx, 2
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400137c3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400137ba
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call fcn.14001a370
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1400137b1
mov rsi, qword [rsp + 0x48]
lea ecx, [rax + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
test rax, rax
je 0x14001375e
and qword [rsp + 0x50], 0
lea rax, [0x14002e940]
lea rdx, [rsp + 0x50]
mov qword [rbx], rax
mov rcx, rsi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [rbx + 0x10], eax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 8], rax
jmp 0x140013760
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14002d478]
test rbx, rbx
je 0x1400137b1
mov eax, dword [rbx + 0x10]
and dword [rbx + 0x10], 0
test eax, eax
jne 0x14001379d
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x58]
mov r8d, 0xffffff
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x14001379d
mov dword [rbx + 0x10], eax
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax]
call qword [0x14002d478]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [rsp + 0x58]
jmp 0x1400137cc
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140013c44
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x140013f90
Capabilities:
Delete file

Disassembly:
push rbx
mov eax, 0x1070
call fcn.1400189c0
sub rsp, rax
xor ebx, ebx
cmp word [0x140061232], bx
je 0x140014038
lea rcx, [0x140061232]
call fcn.1400040f0
mov rdx, qword [str.RarSFX]
lea r8d, [rbx + 6]
mov rcx, rax
call fcn.140009148
test eax, eax
jne 0x140014038
lea rcx, [0x140060230]
call fcn.140013c44
mov r8d, 0x800
lea rdx, [0x140061232]
lea rcx, [rsp + 0x60]
call fcn.140007ac4
lea rcx, [rsp + 0x60]
call fcn.14001d558
xor edx, edx
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
call fcn.1400196c0
lea eax, [rbx + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
add rsp, 0x1070
pop rbx
ret
Function at 0x1400140a0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x170
xor ebp, ebp
mov rdi, r8
cmp qword [0x14003d7d0], rbp
mov rbx, rdx
mov rsi, rcx
jne 0x140014108
lea r9d, [rbp + 0x64]
mov ecx, 0x400
lea r8, [rax - 0xd8]
lea edx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx eax, word [rsp + 0xa0]
mov word [0x140070978], ax
lea rax, [0x140070978]
mov qword [0x14003d7d0], rax
mov word [0x14007097a], bp
mov r8d, 0x32
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140007928
lea r9, [0x14003d7b8]
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x30]
mov word [rbx], bp
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
lea r11, [rsp + 0x170]
mov word [rbx + rdi*2 - 2], bp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140014264
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1f40]
mov eax, 0x2040
call fcn.1400189c0
sub rsp, rax
xor esi, esi
mov rdi, rdx
cmp byte [0x140062238], sil
mov rbx, rcx
je 0x14001434b
mov r8d, 0x800
lea rdx, [rbp + 0xf40]
call fcn.140015ab8
lea rax, [rsp + 0x30]
xor r8d, r8d
lea r9d, [rsi + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareWinRAR_SFX
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001434b
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x1f70]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1f78]
lea rax, [rsp + 0x40]
mov dword [rbp + 0x1f70], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xf40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140014340
mov eax, dword [rbp + 0x1f70]
lea rdx, [rsp + 0x40]
shr eax, 1
mov r8, rdi
mov ecx, eax
mov dword [rbp + 0x1f70], eax
mov eax, 0x7ff
cmp ecx, eax
cmovb eax, ecx
mov rcx, rbx
mov word [rsp + rax*2 + 0x40], si
call fcn.140007ac4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x2060]
add rsp, 0x2040
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001443c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x2020
call fcn.1400189c0
sub rsp, rax
xor r14d, r14d
mov rsi, r8
mov rbx, rcx
test r9, r9
je 0x14001446f
mov byte [r9], r14b
mov rcx, qword [rsp + 0x2050]
test rcx, rcx
je 0x14001447f
mov byte [rcx], r14b
test rbx, rbx
je 0x140014534
movzx eax, word [rbx]
test ax, ax
je 0x140014534
movsxd rbp, dword [rsp + 0x2058]
mov rdi, r14
mov r8d, r14d
add rbx, 2
cmp ax, 0x3d
jne 0x1400144c4
test rsi, rsi
je 0x1400144d0
test rdi, rdi
jne 0x1400144d0
test r9, r9
je 0x1400144bf
mov byte [r9], 1
mov rdi, rdx
jmp 0x1400144df
cmp ax, 0xd
je 0x1400144f1
cmp ax, 0xa
je 0x1400144f5
mov word [rdx], ax
add rdx, 2
lea eax, [rbp - 2]
cmp r8d, eax
jge 0x1400144ec
movzx eax, word [rbx]
inc r8d
test ax, ax
jne 0x1400144a2
jmp 0x1400144f5
mov byte [rcx], 1
jmp 0x1400144f5
add rbx, 2
mov word [rdx], r14w
test rsi, rsi
je 0x14001452f
mov word [rsi], r14w
test rdi, rdi
je 0x14001452f
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140007ac4
mov word [rdi], r14w
mov rax, rbx
jmp 0x140014536
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x140014554
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
xor ecx, ecx
test eax, eax
sete bl
test eax, eax
jne 0x1400145c0
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x58]
cmp eax, 1
mov rdx, qword [rsp + 0x50]
sete bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x14002d478]
jmp 0x1400145c3
mov word [rdi], cx
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140017134
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [0x140060228], 0
mov edx, 1
mov rbx, rcx
mov byte [0x140058de9], 1
mov byte [0x140058dea], 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.1400011d4
cmp qword [0x140070958], 0
jne 0x14001717f
cmp byte [0x140058dfb], 0
je 0x140017188
cmp dword [0x140058dec], 0
jne 0x14001719d
xor r9d, r9d
mov edx, 0x111
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret

Function at 0x140017240
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1050
call fcn.1400189c0
sub rsp, rax
xor edi, edi
mov rbx, rcx
cmp byte [0x140062238], dil
je 0x140017312
cmp word [0x14006223a], di
je 0x140017312
mov r8d, 0x800
lea rdx, [rsp + 0x50]
lea rcx, [0x14006223a]
call fcn.140015ab8
lea rax, [rsp + 0x1068]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareWinRAR_SFX
lea rax, [rsp + 0x1070]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140017312
mov rcx, rbx
call fcn.14001d558
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x1070]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x1070]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1050
pop rdi
ret

Function at 0x140017324
Capabilities:
Set environment variable

Disassembly:
push rbx
mov eax, 0x2020
call fcn.1400189c0
sub rsp, rax
mov rbx, rcx
mov rdx, rcx
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400077a0
mov rbx, rax
test rax, rax
je 0x140017386
movzx ecx, word [rax]
jmp 0x14001736d
add rbx, 2
movzx ecx, word [rbx]
call fcn.1400078c8
test al, al
jne 0x140017366
mov rdx, rbx
lea rcx, str.sfxpar
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x2020
pop rbx
ret
Function at 0x1400182c8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140018340
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140018340
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140018340
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140018334
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140018352
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140018322
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140018342

Function at 0x1400192c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019312
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019312
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019312
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019312
cmp dword [rcx + 0x84], 0xe
jbe 0x140019312
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140019314
xor al, al
add rsp, 0x28
ret

Function at 0x140021ee0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140021c44
Function at 0x140b6c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b6c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b6c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b6c06f
add dl, dl
jne 0x140b6c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b6c0f6
xor eax, eax
add dl, dl
jne 0x140b6c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b6c1ad
add dl, dl
jne 0x140b6c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b6c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b6c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b6c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b6c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b6c07e
mov eax, 1
add dl, dl
jne 0x140b6c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b6c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b6c0fb
sub eax, ebx
mov ebx, 1
jne 0x140b6c14c
mov ecx, 1
add dl, dl
jne 0x140b6c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b6c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b6c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b6c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b6c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b6c15d
cmp eax, 0x7d00
jae 0x140b6c19b
cmp eax, 0x500
jb 0x140b6c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6c07e
cmp eax, 0x7f
ja 0x140b6c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b6c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b6c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001290
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0x104
lea rdx, [rsp + 0x30]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x1400012f0
movabs rbp, 0x7ffffffffffffffe
cmp rbx, rbp
ja 0x140001425
mov qword [rsp + 0x278], rsi
mov qword [rdi + 0x18], 7
cmp rbx, 7
ja 0x140001344
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r14w
jmp 0x1400013f6
mov rax, rbx
or rax, 7
cmp rax, rbp
jbe 0x140001360
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140001392
mov ecx, 0xa
mov rbp, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, rax
ja 0x14000142b
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400013c1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000142b
mov rcx, rax
call fcn.140003d40
test rax, rax
je 0x1400013ba
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400013d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400013d0
call fcn.140003d40
mov rsi, rax
jmp 0x1400013d3
mov rsi, r14
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov qword [rdi], rsi
mov r8, rbx
mov qword [rdi + 0x18], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
mov rsi, qword [rsp + 0x278]
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140003d20
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rbp
ret
call fcn.1400011b0
int3
call fcn.140001110
int3
Function at 0x140001440
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
lea rcx, [rsp + 0x50]
call fcn.140001290
nop
lea r8, str.temp.html
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002e40
nop
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r8, qword [rsp + 0x30]
xor ebp, ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea rdx, str.http:__example.com
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001518
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x140001514
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rax, qword [rbx + 0x18]
cmp rdi, rax
ja 0x140001509
mov rsi, rbx
cmp rax, 7
jbe 0x1400014ee
mov rsi, qword [rbx]
mov qword [rbx + 0x10], rdi
lea r8, [rdi + rdi]
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rdi*2], bp
mov bl, 1
jmp 0x14000153d
mov rdx, rdi
mov rcx, rbx
call fcn.140003300
mov bl, 1
jmp 0x14000153d
lea rdx, str.Failed_to_download_HTML_content.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140002fd0
mov rcx, rax
lea rdx, [0x1400031b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor bl, bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140001582
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000157d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000157d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d7c
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400015da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d7c
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140003d20
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002700
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140002731
xor eax, eax
jmp 0x14000287b
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000276e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14000276e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14000287b
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140002870
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400027b5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400027c3
movzx ecx, di
jmp 0x140002817
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002830
sub eax, 1
je 0x140002830
cmp eax, 2
jne 0x140002870
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140002873
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14000285e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140002870
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003d20
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002b70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002c45
cmp byte [rcx + 0x72], 0
je 0x140002c45
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140002c41
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002c06
sub eax, 1
je 0x140002c0a
cmp eax, 2
jne 0x140002c41
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003d20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002c38
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002c41
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140002bee
xor al, al
jmp 0x140002bee
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003d20
add rsp, 0x60
pop rbx
ret

Function at 0x1400046a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400046ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400046ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400046ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400046ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400046ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400046ec
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140048c00]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140048c10]
mov dword [rax], 1
mov rax, qword [0x140048c20]
mov dword [rax], 1
mov rax, qword [0x140048ba0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140048bf0]
mov dword [0x14004c020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140048cd0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140048cb0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140048b50]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a