joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180071970
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180071bc0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180071a8a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800719d4
mov rax, qword [0x1800b1008]
cmp qword [rsp + 0x20], rax
ja 0x1800719d4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180071996
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180071a05
jmp 0x180071a8a
cmp dword [rsp + 0x50], 0x10000
jne 0x180071a6d
cmp qword [rsp + 0x48], 0x10000
jb 0x180071a6d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180071a4b
mov rax, qword [rsp + 0x28]
jmp 0x180071a8c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180071a5b
xor eax, eax
jmp 0x180071a8c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180071a85
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180071bc0
mov qword [rsp + 0x20], rax
jmp 0x180071996
xor eax, eax
add rsp, 0x68
ret

Function at 0x180071aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180071c00
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180071bb6
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180071afb
mov rax, qword [0x1800b1008]
cmp qword [rsp + 0x20], rax
ja 0x180071afb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180071abd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180071b2c
jmp 0x180071bb6
cmp dword [rsp + 0x50], 0x10000
jne 0x180071b94
cmp qword [rsp + 0x48], 0x10000
jb 0x180071b94
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180071b72
mov rax, qword [rsp + 0x28]
jmp 0x180071bb8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180071b82
xor eax, eax
jmp 0x180071bb8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180071bb1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180071c00
mov qword [rsp + 0x20], rax
jmp 0x180071abd
xor eax, eax
add rsp, 0x68
ret
Function at 0x180071c50
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800721e0
mov qword [rsp + 0x28], 0
cmp qword [0x1800b3ad8], 0
jne 0x180071c98
cmp qword [0x1800b3ad0], 0
je 0x180071c98
mov rax, qword [0x1800b3ad0]
mov qword [0x1800b3ad8], rax
cmp qword [0x1800b3ad8], 0
je 0x180071d3e
mov rax, qword [0x1800b3ad8]
cmp qword [rax + 0x10], 0
je 0x180071d3e
mov rax, qword [0x1800b3ad8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180071d3e
mov rax, qword [0x1800b3ad8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180071d3e
mov rax, qword [0x1800b3ad8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180071d04
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180071d0b
xor eax, eax
jmp 0x180071eb9
mov rax, qword [0x1800b3ad8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180071eb9
mov rax, qword [0x1800b3ad0]
mov qword [0x1800b3ad8], rax
jmp 0x180071d60
mov rax, qword [0x1800b3ad8]
mov rax, qword [rax + 8]
mov qword [0x1800b3ad8], rax
cmp qword [0x1800b3ad8], 0
je 0x180071dad
cmp qword [0x1800b3ad8], 0
je 0x180071dab
mov rax, qword [0x1800b3ad8]
cmp qword [rax + 0x10], 0
je 0x180071dab
mov rax, qword [0x1800b3ad8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180071dab
mov rax, qword [0x1800b3ad8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180071dab
jmp 0x180071cdc
jmp 0x180071d4e
mov rcx, qword [rsp + 0x60]
call fcn.180073e30
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180071ec0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180071eb7
mov rax, qword [rsp + 0x48]
mov qword [0x1800b3ad8], rax
mov rax, qword [0x1800b3ad8]
mov dword [rax], 0x52727464
mov rax, qword [0x1800b3ad8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800b3ad8]
mov rcx, qword [0x1800b3ad0]
mov qword [rax + 8], rcx
mov rax, qword [0x1800b3ad8]
mov qword [0x1800b3ad0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800b3ad8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180071e68
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180071ea2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180071e5e
mov rax, qword [0x1800b3ad8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180071cdc
xor eax, eax
add rsp, 0x58
ret
Function at 0x180072bd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180072c17
xor al, al
jmp 0x180072cb9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180072c41
xor al, al
jmp 0x180072cb9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x180072cb1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x180072cb1
mov al, 1
jmp 0x180072cb9
jmp 0x180072cb7
xor al, al
add rsp, 0x78
ret

Function at 0x180072fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800b3ad0]
mov qword [rsp + 0x28], rax
jmp 0x180072fe0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007300f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18007300d
call sub.KERNEL32.dll_GetLastError
jmp 0x180073011
jmp 0x180072fd2
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800736d0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1800b3ae8], eax
je 0x1800736eb
mov eax, 0x10dd
jmp 0x180073810
mov rax, qword [0x1800b3b00]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180073795
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180073760
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180073760
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.180072320
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.180075510
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800736f7
mov qword [0x1800b3b00], 0
call fcn.180072d80
mov rax, qword [0x1800b3af8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800737f9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.180075510
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1800737b1
mov qword [0x1800b3af8], 0
mov dword [0x1800b3ae8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180073d40
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800b3aec], 0
je 0x180073d5d
mov eax, dword [0x1800b3aec]
jmp 0x180073e23
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x180073d70
xor eax, eax
jmp 0x180073e23
mov ecx, 0x10
call fcn.180075518
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180073dde
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180073dc3
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.180075510
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800b3aec], eax
mov qword [0x1800b3af0], 0
mov eax, dword [rsp + 0x20]
jmp 0x180073e23
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x180073df8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x180073d99
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1800b3af8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1800b3af8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400012d0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
xor r12d, r12d
mov r13, rdx
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov qword [rsp + 0x60], rcx
mov r15, qword [rcx]
cmp r15, rcx
je 0x1400014e6
mov edx, 0x20b
mov r9d, 0x5a4d
mov r8d, 0x40a86978
cmp qword [r15 + 0x60], 0
je 0x14000149e
mov rsi, qword [r15 + 0x30]
test rsi, rsi
je 0x14000149e
movsxd rax, dword [rsi + 0x3c]
mov r14d, dword [rax + rsi + 0x88]
add r14, rsi
cmp word [rsi], r9w
jne 0x1400014c3
cmp word [rax + rsi + 0x18], dx
jne 0x140001368
cmp dword [rax + rsi + 0x8c], 0
jbe 0x14000149e
mov ebp, dword [r14 + 0x18]
xor edi, edi
test ebp, ebp
je 0x140001499
mov ebx, dword [r14 + 0x20]
add rbx, rsi
nop dword [rax]
mov r11d, dword [rbx]
xor r10d, r10d
add r11, rsi
mov eax, r8d
movzx r9d, byte [r11]
test r9b, r9b
je 0x140001459
mov ebp, 0x40a86978
nop
movzx r8d, r9b
sub r9b, 0x41
cmp r9b, 0x19
lea ecx, [r8 + 0x20]
movzx edx, cl
cmova edx, r8d
movsx r8d, dl
cmp eax, r8d
jne 0x1400013c4
xor ecx, ecx
jmp 0x1400013e9
movd xmm0, r8d
movd xmm2, eax
movdqa xmm1, xmm0
pandn xmm1, xmmword [0x140006540]
pand xmm1, xmm2
pandn xmm2, xmm0
por xmm1, xmm2
movd ecx, xmm1
lea eax, [r10 + 0x40a86978]
imul eax, r8d
add eax, ecx
mov ecx, r10d
test r10d, r10d
cmove ecx, ebp
movd xmm0, eax
pshufd xmm0, xmm0, 0
movd eax, xmm0
cmp ecx, ebp
jne 0x140001414
xor ecx, ecx
jmp 0x140001438
movd xmm1, ecx
movd xmm2, ebp
movdqa xmm0, xmm1
pandn xmm0, xmmword [0x140006540]
pand xmm0, xmm2
pandn xmm2, xmm1
por xmm0, xmm2
movd ecx, xmm0
imul eax, ecx
inc r10d
movzx r9d, byte [r10 + r11]
add eax, r8d
test r9b, r9b
jne 0x1400013a0
mov ebp, dword [r14 + 0x18]
mov r8d, 0x40a86978
mov ecx, eax
cmp r13, rcx
je 0x140001470
inc edi
add rbx, 4
cmp edi, ebp
jb 0x140001380
jmp 0x140001489
mov eax, dword [r14 + 0x24]
mov ecx, dword [r14 + 0x1c]
add rax, rsi
add rcx, rsi
movzx edx, word [rax + rdi*2]
mov r12d, dword [rcx + rdx*4]
add r12, rsi
mov rcx, qword [rsp + 0x60]
mov r9d, 0x5a4d
mov edx, 0x20b
test r12, r12
jne 0x1400014ab
mov r15, qword [r15]
cmp r15, rcx
je 0x1400014e6
jmp 0x140001322
mov rbx, qword [rsp + 0x68]
mov rax, r12
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.DOS_header_e_magic_mismatch
lea rcx, [rsp + 0x70]
call fcn.1400012c0
lea rdx, [0x140007238]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.Cannot_find_desired_export.
lea rcx, [rsp + 0x70]
call fcn.1400012c0
lea rdx, [0x140007238]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140004964
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400049ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400049ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400049ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400049ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400049ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400049b0
xor al, al
add rsp, 0x28
ret
Function at 0x1400031f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000323e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000323e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000323e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000323e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000323e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003240
xor al, al
add rsp, 0x28
ret
Function at 0x401370
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x28
xor rcx, rcx
call sub.KERNEL32_GetModuleHandleA
mov qword [0x0045c0a0], rax
call fcn.0043ed80
call fcn.0043a940
call fcn.0043ed90
lea rax, [section..data]
lea rcx, [0x00402770]
mov qword [rax + 0x30], rcx
lea rcx, section..text
mov qword [rax], rcx
lea rcx, [0x0040130c]
mov qword [rax + 8], rcx
lea rcx, [0x0040130c]
mov qword [rax + 0x10], rcx
lea rcx, [0x0040136c]
mov qword [rax + 0x18], rcx
lea rcx, [0x0044ff50]
mov qword [rax + 0x68], rcx
lea rcx, [0x00450350]
mov qword [rax + 0x70], rcx
lea rcx, [0x00450380]
mov qword [rax + 0x78], rcx
lea rcx, [0x00450930]
mov qword [rax + 0x80], rcx
lea rcx, [0x0046a460]
mov qword [rax + 0x50], rcx
mov rcx, rax
push 0
jmp 0x451450
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, r9
mov r14d, r8d
mov ebx, edx
mov edi, ecx
call fcn.004513f0
test edi, edi
je 0x44fae5
test ebx, ebx
jne 0x44fafc
test edi, edi
jne 0x44fad6
call qword [0x0046b068]
call qword [0x0046b070]
call fcn.00451410
mov ecx, r14d
call fcn.004511a0
jmp 0x44fafc
mov rcx, rsi
call fcn.0044f890
call fcn.004512c0
call qword [0x0046b060]
test ebx, ebx
je 0x44fac6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.00451410
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [rsi + 0x20]
and eax, 1
mov dword [0x0046b0c0], eax
mov rcx, qword [rsi + 0x50]
call fcn.00441120
mov rcx, qword [rsi + 0x88]
call fcn.00441130
mov dword [0x0047e9d0], 1
lea rdi, [0x0047e9d0]
mov qword [0x0047e9d8], rsi
call sub.KERNEL32_GetEnvironmentStrings
mov qword [0x0047e970], rax
call sub.KERNEL32_GetCommandLineA
mov qword [0x0047e980], rax
mov rcx, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
call fcn.0044fd10
xor edx, edx
mov rcx, rdi
call fcn.004511c0
test byte [rsi + 0x20], 1
jne 0x451514
mov ecx, dword [0x0047e99c]
mov rdx, qword [0x0047e9a0]
mov r8, qword [0x0047e9a8]
call qword [rsi + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x44faa0
mov rax, qword [0x0047e980]
nop dword [rax + rax]
inc rax
mov cl, byte [rax - 1]
cmp cl, 9
je 0x451520
cmp cl, 0x20
je 0x451520
cmp cl, 0x22
jne 0x45153e
mov cl, byte [rax]
mov edx, 0x22
jmp 0x451546
dec rax
mov edx, 0x20
movsx edi, cl
cmp edx, edi
je 0x451564
nop dword [rax]
test cl, cl
je 0x451564
cmp cl, 9
je 0x451564
movsx ecx, byte [rax + 1]
inc rax
cmp edx, ecx
jne 0x451550
lea rdi, [rax + 1]
cmp cl, 0x22
cmovne rdi, rax
jmp 0x451583
inc rdi
movzx eax, byte [rdi]
cmp al, 0x20
je 0x451580
cmp al, 9
je 0x451580
mov rbx, qword [rsi + 0x30]
xor ecx, ecx
call sub.KERNEL32_GetModuleHandleA
mov rsi, rax
lea rcx, [rbp - 0x60]
call sub.KERNEL32_GetStartupInfoA
mov eax, dword [rbp - 0x24]
test al, 1
movzx eax, word [rbp - 0x20]
mov r9d, 0xa
cmovne r9d, eax
xor edx, edx
mov rcx, rsi
mov r8, rdi
call rbx
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
call 0x44faa0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x401db0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov rsi, rdx
mov rax, rcx
lea rdx, [0x004574e0]
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r8, rax
call fcn.00404d00
lea rdx, [0x0045750e]
mov r8d, 0x14
mov rcx, rdi
call fcn.0040a7b0
mov rdi, rax
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], 0
mov word [rbp + 0x38], 0
mov rcx, qword [rdi + 0x20]
cmp rcx, 7
ja 0x401e39
mov r8, qword [rdi + 0x18]
mov rbx, rdi
add rbx, 8
inc r8
je 0x401e50
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.0043f750
mov rcx, qword [rdi + 0x20]
jmp 0x401e50
mov rbx, rdi
add rbx, 8
mov rax, qword [rdi + 8]
mov qword [rbp + 0x38], rax
mov qword [rdi + 8], 0
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rcx
mov qword [rdi + 0x20], 7
mov qword [rdi + 0x18], 0
mov word [rbx], 0
lea rcx, [rbp - 0x20]
lea rdx, [rbp + 0x30]
mov r8, rsi
call fcn.00404be0
lea rdx, [0x00457538]
lea rcx, [rbp - 0x20]
mov r8d, 1
call fcn.0040a7b0
mov rdi, rax
mov qword [rbp + 0x28], 7
lea rsi, [rbp + 0x10]
mov qword [rbp + 0x20], 0
mov word [rbp + 0x10], 0
mov rcx, qword [rdi + 0x20]
cmp rcx, 7
ja 0x401edf
mov r8, qword [rdi + 0x18]
mov rbx, rdi
add rbx, 8
inc r8
je 0x401ef6
mov rcx, rsi
mov rdx, rbx
call fcn.0043f750
mov rcx, qword [rdi + 0x20]
jmp 0x401ef6
mov rbx, rdi
add rbx, 8
mov rax, qword [rdi + 8]
mov qword [rbp + 0x10], rax
mov qword [rdi + 8], 0
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rcx
mov qword [rdi + 0x20], 7
mov qword [rdi + 0x18], 0
mov word [rbx], 0
mov rax, qword [rbp]
cmp rax, 8
jb 0x401f3b
mov rcx, qword [rbp - 0x18]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x401f36
mov rcx, qword [rcx - 8]
call fcn.0040cc60
mov qword [rbp], 7
mov qword [rbp - 8], 0
mov word [rbp - 0x18], 0
mov rax, qword [rbp + 0x50]
cmp rax, 8
jb 0x401f75
mov rcx, qword [rbp + 0x38]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x401f70
mov rcx, qword [rcx - 8]
call fcn.0040cc60
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], 0
mov word [rbp + 0x38], 0
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x401faf
mov rcx, qword [rbp - 0x40]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x401faa
mov rcx, qword [rcx - 8]
call fcn.0040cc60
cmp qword [rbp + 0x28], 7
cmova rsi, qword [rbp + 0x10]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x0045753c]
lea r8, [0x00457546]
xor ecx, ecx
mov r9, rsi
call sub.SHELL32.DLL_ShellExecuteW
cmp eax, 0x20
jg 0x402024
lea rcx, [0x0046c718]
lea rdx, [0x004570f6]
call fcn.00404920
mov rsi, rax
mov rax, qword [rsi]
mov rcx, qword [rax - 0x18]
add rcx, rsi
mov edx, 0xa
call fcn.0040a710
movzx edx, al
mov rcx, rsi
call fcn.0040a5a0
mov rcx, rsi
call fcn.00406b80
mov rax, qword [rbp + 0x28]
cmp rax, 8
jb 0x402048
mov rcx, qword [rbp + 0x10]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x402043
mov rcx, qword [rcx - 8]
call fcn.0040cc60
nop
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x4023b0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov rsi, rdx
mov r12, rcx
mov dword [rsp + 0x20], 0
lea rcx, [0x00457060]
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.WININET_InternetOpenA
mov r15, rax
test r15, r15
je 0x402534
lea rdx, [rsi + 8]
cmp qword [rsi + 0x20], 0xf
cmova rdx, qword [rsi + 8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor r9d, r9d
mov rcx, r15
call sub.WININET_InternetOpenUrlA
mov rbx, rax
test rbx, rbx
je 0x402573
mov qword [rbp + 0x3d8], 0xf
mov qword [rbp + 0x3d0], 0
mov byte [rbp + 0x3c0], 0
mov dword [rbp + 0x3e4], 0
lea r14, [rbp - 0x51]
lea rdi, [rbp - 0x50]
lea rsi, [rbp + 0x3e4]
lea r13, [rbp + 0x3b8]
nop word cs:[rax + rax]
mov r8d, 0x400
mov rcx, rbx
mov rdx, rdi
mov r9, rsi
call sub.WININET_InternetReadFile
mov eax, dword [rbp + 0x3e4]
test rax, rax
je 0x4024d2
mov byte [rbp + rax - 0x50], 0
mov r8, r14
nop word [rax + rax]
cmp byte [r8 + 1], 0
lea r8, [r8 + 1]
jne 0x4024b0
sub r8, rdi
mov rcx, r13
mov rdx, rdi
call fcn.00407600
cmp dword [rbp + 0x3e4], 0
jne 0x402480
mov rcx, rbx
call sub.WININET_InternetCloseHandle
mov rcx, r15
call sub.WININET_InternetCloseHandle
mov qword [r12 + 0x20], 0xf
lea rcx, [r12 + 8]
mov qword [r12 + 0x18], 0
mov byte [r12 + 8], 0
mov rsi, qword [rbp + 0x3d8]
cmp rsi, 0xf
ja 0x4025e1
mov rdi, qword [rbp + 0x3d0]
mov r8, rdi
inc r8
je 0x4025ff
lea rdx, [rbp + 0x3c0]
call fcn.0043f170
jmp 0x402606
lea rcx, [0x0046c718]
lea rdx, [0x00457066]
call fcn.00404920
mov rsi, rax
mov rax, qword [rsi]
mov rcx, qword [rax - 0x18]
add rcx, rsi
mov edx, 0xa
call fcn.0040a710
movzx edx, al
mov rcx, rsi
call fcn.0040a5a0
mov rcx, rsi
call fcn.00406b80
jmp 0x4025b8
lea rcx, [0x0046c718]
lea rdx, [0x00457084]
call fcn.00404920
mov rsi, rax
mov rax, qword [rsi]
mov rcx, qword [rax - 0x18]
add rcx, rsi
mov edx, 0xa
call fcn.0040a710
movzx edx, al
mov rcx, rsi
call fcn.0040a5a0
mov rcx, rsi
call fcn.00406b80
mov rcx, r15
call sub.WININET_InternetCloseHandle
mov qword [r12 + 0x20], 0xf
mov qword [r12 + 0x18], 0
mov byte [r12 + 8], 0
lea rdx, [0x00457112]
mov rcx, r12
call fcn.00406600
jmp 0x402610
mov rax, qword [rbp + 0x3c0]
mov qword [rcx], rax
mov qword [rbp + 0x3c0], 0
mov rdi, qword [rbp + 0x3d0]
jmp 0x402606
mov rdi, 0xffffffffffffffff
mov qword [r12 + 0x18], rdi
mov qword [r12 + 0x20], rsi
mov rax, r12
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret