joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a4d0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, cl
movzx ebx, dl
lea rsi, sym.MZ_b_4ix__UH3tlIju_n3bu_bRSDz8e8_6O__LTLn_u_28Wnitpw
lea eax, [rdi - 0x13]
cmp eax, 0x92
ja case.0x14001a50e.45
cdqe
movzx eax, byte [rsi + rax + 0x1a6e0]
mov ecx, dword [rsi + rax*4 + 0x1a674]
add rcx, rsi
jmp rcx
mov eax, 0x2a
jmp 0x14001a5d9
mov eax, 0x136
jmp 0x14001a5d9
mov eax, 0x1d
jmp 0x14001a5d9
mov eax, 0x11d
jmp 0x14001a5d9
mov eax, gethostname
jmp 0x14001a5d9
mov eax, 0x138
jmp 0x14001a5d9
mov eax, 0x15b
jmp 0x14001a5d9
mov eax, 0x15c
jmp 0x14001a5d9
mov eax, 0x45
jmp 0x14001a5d9
mov eax, 0x52
jmp 0x14001a5d9
mov eax, 0x4f
jmp 0x14001a5d9
mov eax, 0x50
jmp 0x14001a5d9
mov eax, 0x51
jmp 0x14001a5d9
mov eax, 0x4b
jmp 0x14001a5d9
mov eax, 0x4c
jmp 0x14001a5d9
mov eax, 0x4d
jmp 0x14001a5d9
mov eax, 0x47
jmp 0x14001a5d9
mov eax, 0x48
jmp 0x14001a5d9
mov eax, 0x49
jmp 0x14001a5d9
mov eax, 0x53
jmp 0x14001a5d9
mov eax, 0x145
jmp 0x14001a5d9
mov eax, 0x135
jmp 0x14001a5d9
mov eax, gethostname
jmp 0x14001a5d9
mov eax, 0x4a
jmp 0x14001a5d9
mov eax, 0x4e
jmp 0x14001a5d9
mov eax, 0x137
test bl, bl
jne 0x14001a62f
movzx eax, ax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r11d, eax
test ax, ax
je 0x14001a62f
lea eax, [rdi - 3]
cmp eax, 0xb4
ja case.0x14001a620.5
cdqe
movzx eax, byte [rsi + rax + 0x1a780]
mov ecx, dword [rsi + rax*4 + 0x1a774]
add rcx, rsi
jmp rcx
mov ecx, 0x100
or r11w, cx
test bl, bl
je 0x14001a660
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, r11w
test bl, bl
je 0x14001a664
mov ecx, 0x100
or eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, r11w
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a840
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov r8d, ebx
mov eax, ebx
cmp ebx, 0x11c
jg 0x14001a926
cmp eax, 0x11c
je 0x14001a91e
sub eax, 0x1d
cmp eax, 0x36
ja case.0x14001a94b.286
lea rdx, sym.MZ_b_4ix__UH3tlIju_n3bu_bRSDz8e8_6O__LTLn_u_28Wnitpw
cdqe
movzx eax, byte [rdx + rax + 0x1aa18]
mov ecx, dword [rdx + rax*4 + 0x1a9cc]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayGetLBound
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x14001a94b.286
lea rdx, sym.MZ_b_4ix__UH3tlIju_n3bu_bRSDz8e8_6O__LTLn_u_28Wnitpw
cdqe
movzx eax, byte [rdx + rax + 0x1aa78]
mov ecx, dword [rdx + rax*4 + 0x1aa50]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, 0x6f
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
mov eax, 0x100
test ax, bx
je 0x14001a9b8
movzx ecx, r8b
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x14001a9c6
movzx ecx, bl
mov edx, 1
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret

Function at 0x14001aac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x14016e6e0], ecx
mov edx, 1
lea r8, [0x14016e6e4]
nop word [rax + rax]
mov eax, dword [r8 - 4]
add r8, 4
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
inc edx
mov dword [r8 - 4], ecx
cmp edx, 0x270
jl 0x14001aae0
mov dword [0x140169a24], 1
mov dword [0x140170488], 1
ret
Function at 0x140023100
Capabilities:
Write clipboard data

Disassembly:
sub rsp, 0x38
movzx eax, byte [rcx + 0x23]
test al, al
jne 0x140023128
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
or r8, 0xffffffffffffffff
xor edx, edx
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
add rsp, 0x38
ret
cmp al, 2
jne 0x14002313e
lea rcx, [0x1401295d4]
xor edx, edx
add rsp, 0x38
jmp fcn.140005910
cmp qword [0x140169b08], 2
jae 0x140023175
cmp qword [rcx + 0x18], 2
jae 0x140023175
lea rcx, [0x14014bd60]
call fcn.1400dd2e0
lea r8, [0x1401295d4]
lea rcx, [0x1401712e0]
mov rdx, rax
add rsp, 0x38
jmp fcn.1400a5580
xor r8d, r8d
lea edx, [r8 + 3]
call fcn.1400ea290
mov eax, 1
add rsp, 0x38
ret

Function at 0x140023690
Capabilities:
Write clipboard data

Disassembly:
cmp byte [rcx + 0x23], 0
jne 0x14002369a
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x23], 2
jne 0x1400236b6
cmp qword [0x140171f48], 0
je 0x1400236b6
lea rcx, [0x140171f30]
jmp fcn.140005a80
and byte [rcx + 0x21], 0x86
movzx eax, byte [rcx + 0x21]
test dl, dl
je 0x1400236c7
or al, 1
mov byte [rcx + 0x21], al
mov eax, 1
ret
Function at 0x14005f250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rdi, rcx
mov rcx, qword [0x14016f6f0]
mov rbx, rdx
call fcn.140023100
test rbx, rbx
je 0x14005f2ec
cmp word [rbx], 0
je 0x14005f2ec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14005f29c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140169c00]
mov dword [rcx + 0x40], eax
jmp 0x14005f2fa
mov rax, qword [0x140169c00]
xor edx, edx
mov rcx, rdi
mov dword [rax + 0x40], 0
call fcn.14003ca30
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.1400e73c0
mov rcx, qword [0x14016f6f0]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov rdx, rax
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
mov rax, qword [0x140169c00]
mov dword [rax + 0x40], 0x57
mov dl, 1
mov rcx, rdi
call fcn.14003ca30
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret

Function at 0x14005f320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor esi, esi
mov rdi, rdx
or r10d, 0xffffffff
mov edx, esi
mov ebp, r9d
mov r12, r8
mov r13, rcx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x6c], edx
cmp word [rdi], dx
je 0x14005f427
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r14
lea r14, sym.MZ_b_4ix__UH3tlIju_n3bu_bRSDz8e8_6O__LTLn_u_28Wnitpw
movzx ebx, word [rdi]
test ebx, 0xffffff80
jne 0x14005f38a
mov edx, 2
mov ecx, ebx
call fcn.140109968
mov edx, dword [rsp + 0x6c]
mov r10d, dword [rsp + 0x68]
test eax, eax
je 0x14005f38a
and ebx, 0xffffffdf
movzx eax, bx
add eax, 0xffffffd5
cmp eax, 0x33
ja case.0x14005f3ab.51
cdqe
movzx eax, byte [r14 + rax + 0x5f484]
mov ecx, dword [r14 + rax*4 + 0x5f460]
add rcx, r14
jmp rcx
movzx esi, word [rdi]
jmp case.0x14005f3ab.51
mov ecx, 1
jmp 0x14005f3e1
mov ecx, SafeArrayAllocDescriptor
jmp 0x14005f3e1
mov ecx, 4
jmp 0x14005f3e1
mov ecx, 2
jmp 0x14005f3e1
mov ecx, pe_nt_image_headers64
jmp 0x14005f3e1
mov ecx, 0x1000
jmp 0x14005f3e1
mov ecx, 0x100
cmp esi, 0x2b
je 0x14005f3fd
cmp esi, 0x2d
je 0x14005f3f4
cmp esi, 0x5e
jne case.0x14005f3ab.51
xor edx, ecx
jmp 0x14005f40b
not ecx
and r10d, ecx
and edx, ecx
jmp 0x14005f406
mov eax, ecx
not eax
and r10d, eax
or edx, ecx
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x6c], edx
add rdi, 2
cmp word [rdi], 0
jne 0x14005f363
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
movzx r9d, byte [rsp + 0x80]
lea rax, [rsp + 0x68]
mov r8d, ebp
mov qword [rsp + 0x28], rax
lea rax, [0x14005f4c0]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.14005f500
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005fdd0
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rsi, rcx
mov rcx, qword [0x14016f6f0]
mov rbp, r8
mov rdi, rdx
call fcn.140023100
test rdi, rdi
je 0x14005ff71
cmp word [rdi], 0
je 0x14005ff71
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, pe_nt_image_headers64
lea r8d, [r9 + 7]
mov rcx, rdi
mov qword [rsp + 0x2b0], rbx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x2c0], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14005fe6a
lea rdx, [rsp + 0x2b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14005fed4
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14005feb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140169c00]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, rsi
call fcn.14003ca30
mov rbx, qword [rsp + 0x2b0]
mov r12, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r11d, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
shl r11, 0x20
or r11, rax
mov qword [rsp + 0x2b8], r11
movzx ebx, word [rbp]
test ebx, 0xffffff80
jne 0x14005fef3
mov edx, 2
mov ecx, ebx
call fcn.140109968
test eax, eax
je 0x14005fef3
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x4b
je 0x14005ff19
cmp eax, 0x4d
jne 0x14005ff38
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
jmp 0x14005ff30
mov rax, qword [rsp + 0x2b8]
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rsp + 0x2b8], rax
mov rax, qword [0x140169c00]
xor edx, edx
mov rcx, rsi
mov dword [rax + 0x40], 0
call fcn.14003ca30
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [0x14016f6f0]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140001370
mov eax, 1
jmp 0x14005fe98
mov rax, qword [0x140169c00]
mov dl, 1
mov rcx, rsi
mov dword [rax + 0x40], 0x57
call fcn.14003ca30
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret

Function at 0x140071680
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
jne 0x140071695
xor al, al
add rsp, 0x20
pop rbx
ret
dec edx
je 0x1400716c0
dec edx
movzx ecx, bl
je 0x1400716a8
call qword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1400716e6
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r11d, ax
and r11d, 1
movzx eax, r11b
add rsp, 0x20
pop rbx
ret
lea eax, [rbx - 1]
cmp al, 5
ja 0x1400716cc
cmp bl, 3
jne 0x1400716d3
lea eax, [rbx + 0x66]
cmp al, 5
ja 0x1400716fc
cmp qword [0x14016f9b8], 0
jne 0x14007171e
movzx ecx, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r11d, ax
shr r11d, 0xf
and r11b, 1
movzx eax, r11b
add rsp, 0x20
pop rbx
ret
cmp qword [0x14016f9b0], 0
je 0x1400716dd
xor edx, edx
xor r8d, r8d
movzx ecx, bl
call fcn.140019370
test al, al
je 0x14007171e
mov cl, 1
call fcn.140019140
lea rcx, [0x14016f8b0]
movzx eax, bl
movzx eax, byte [rax + rcx]
shr al, 7
add rsp, 0x20
pop rbx
ret
Function at 0x14007d800
Capabilities:
Check http status code
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1b78
call fcn.1401110b0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x88], 0xfffffffffffffffe
movaps xmmword [rbp + 0x1b20], xmm6
movaps xmmword [rbp + 0x1b10], xmm7
movaps xmmword [rbp + 0x1b00], xmm8
movaps xmmword [rbp + 0x1af0], xmm9
movaps xmmword [rbp + 0x1ae0], xmm10
movaps xmmword [rbp + 0x1ad0], xmm11
mov rbx, rcx
mov rax, qword [rbp + 0x1ba0]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
xor r14d, r14d
mov dword [rbp], r14d
lea rdi, [0x1401295d4]
mov qword [rbp + 8], rdi
mov eax, r14d
cmp word [rcx], 2
cmove rax, qword [0x14016f6f0]
mov qword [rbp + 0x60], rax
mov r13d, r14d
mov dword [rbp + 4], r14d
mov r12d, r14d
mov dword [rbp + 0x1c], r14d
movsxd rcx, edx
shl rcx, 5
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x50], r14
mov rsi, qword [rcx + rax + 0x18]
movabs r8, 0xffffffffffffff0
lea rdx, [0x140062fb0]
lea r9, [0x140063950]
lea r10, sym.MZ_b_4ix__UH3tlIju_n3bu_bRSDz8e8_6O__LTLn_u_28Wnitpw
lea ebx, [r14 + 0x10]
movsd xmm9, qword [0x1401537f0]
movsd xmm11, qword [0x140153ba0]
xorpd xmm8, xmm8
movsd xmm10, qword [0x140152fd0]
Function at 0x1400935c0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, word [rcx]
xor bl, bl
mov rdi, rcx
test ax, ax
je 0x14009360c
nop dword [rax]
movzx eax, ax
cmp eax, 0x21
je 0x1400935fc
cmp eax, 0x2b
je 0x1400935f7
cmp eax, 0x5e
jne 0x14009360c
or bl, 2
jmp 0x1400935ff
or bl, 1
jmp 0x1400935ff
or bl, 4
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x1400935e0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov r9, rax
mov rcx, rdi
call fcn.140019df0
movzx esi, al
test al, al
jne 0x14009363d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140019cf0
test ax, ax
jne 0x140093655
xor edx, edx
movzx ecx, sil
call fcn.14001a4d0
mov ecx, 0x100
test cx, ax
je 0x140093662
or bl, 8
movzx eax, bl
mov rbx, qword [rsp + 0x30]
movzx ecx, sil
mov rsi, qword [rsp + 0x38]
shl eax, 8
or eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1400e4b50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
sub rsp, 0x20
cmp qword [rcx], 0
mov ebp, r8d
mov r12, rdx
mov rbx, rcx
jne 0x1400e4c2e
cmp dword [rcx + 8], 0xffffffff
jne 0x1400e4c2e
lea rdx, [rcx + 0x250]
mov ecx, 0x104
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x250]
repne scasw ax, word [rdi]
not rcx
movzx eax, word [rbx + rcx*2 + 0x24c]
cmp ax, 0x5c
je 0x1400e4bd9
cmp ax, 0x2f
je 0x1400e4bd9
xor eax, eax
lea rdi, [rbx + 0x250]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x14012fb84]
mov dword [rdi - 2], eax
mov ecx, gethostbyname
call fcn.140109b60
xor edi, edi
mov rcx, rax
mov word [rax], 0x100
mov byte [rax + 0x18], 0
mov qword [rax + 0x20], r12
mov dword [rax + 0x28], ebp
mov dword [rax + 0x2c], edi
mov dword [rax + 0x14], edi
call fcn.1400e3760
mov rsi, qword [rsp + 0x30]
test rax, rax
mov ecx, 0x200
mov qword [rbx], rax
cmove edi, ecx
mov eax, edi
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov eax, 0x1000000
add rsp, 0x20
pop r12
ret

Function at 0x1400e7050
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400e7138
cmp word [rcx], 0
je 0x1400e7138
lea rdx, [0x140152580]
mov r8d, 4
call fcn.14010a798
mov r8, rbx
test eax, eax
jne 0x1400e7093
lea r8, [rbx + 8]
test r8, r8
je 0x1400e70d0
movzx edx, word [r8]
test dx, dx
je 0x1400e70d0
lea rcx, [0x1401380a4]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x1400e70fd
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400e70b0
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x1400e70a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r11d, eax
test rdi, rdi
je 0x1400e70e3
mov dword [rdi], eax
xor eax, eax
cmp r11d, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e7138
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x1400e7125
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x1400e7930
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1401110b0
sub rsp, rax
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x1400e7984
lea r8d, [rax + 1]
lea rdx, [rsp + 0x20]
mov rcx, rdi
add r8, r8
call fcn.140109100
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x1401088c4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140108734

Function at 0x140112ff8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401692b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14010cb90
xor ebx, ebx
cmp qword [0x14016db58], rbx
mov rdi, rax
jne 0x14011310b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1401131e2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401131e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14016db58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14016db60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14016db68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14016db78], rax
test rax, rax
je 0x140113102
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14016db70], rax
jmp 0x140113112
mov rax, qword [0x14016db70]
jmp 0x140113119
mov rax, qword [0x14016db70]
mov r11, qword [0x14016db78]
cmp rax, rdi
je 0x140113180
cmp r11, rdi
je 0x140113180
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14016db78]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140113180
test rax, rax
je 0x140113180
call rsi
test rax, rax
je 0x14011317a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14011317a
test byte [rsp + 0x40], 1
jne 0x140113180
bts ebp, 0x15
jmp 0x1401131c0
mov rcx, qword [0x14016db60]
cmp rcx, rdi
je 0x1401131c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1401131c0
call rax
mov rbx, rax
test rax, rax
je 0x1401131c0
mov rcx, qword [0x14016db68]
cmp rcx, rdi
je 0x1401131c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1401131c0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14016db58]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1401131e2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1401131e4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140110310
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401946e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14019470d
xor al, al
jmp 0x14019486f
mov rax, qword [0x1401b56c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401b56c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401b56d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401b56d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401b56e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401b56e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401b56f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401b56f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1401b5700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140194861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401947b9
mov r11d, 2
jmp 0x1401947dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401947d3
mov r11d, 1
jmp 0x1401947dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140194885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140194822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14019483a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14019484a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140194858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1401947a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14019486a
Function at 0x1402aea1c
Capabilities:
Check http status code

Disassembly:
bswap r9d
dec r9d
stc
cmc
bswap r9d
clc
jmp 0x140268e80
ror r9d, 1
sub r9d, 0x51fe5521
cmp r14, 0x69e626ee
test r10b, 0xc8
push r11
test dl, r12b
mov r11w, di
sar r11, 0x68
xor dword [rsp], r9d
pop r11
movsxd r9, r9d
test ebp, 0x5dea2050
clc
add rdi, r9
jmp 0x140275f82
push rsi
cmovne si, cx
movsx rsi, dx
push rcx
movsx esi, r9w
movzx si, dl
push rbx
push r12
movzx rcx, r9w
mov cl, dil
push rax
movsx ecx, r15w
movzx bx, dh
not ecx
push r14
movzx bx, r11b
push r9
movsx cx, r14b
movsx r9, sp
jmp 0x140298383
jmp rdi
push r11
movzx rbx, r15w
mov si, r11w
movsxd rcx, r12d
push r13
movsx r11, r8w
push r8
movsx esi, ax
pushfq
or r11b, 0xb7
push rdx
test r8d, r9d
sbb bx, 0x46f6
push rdi
sal r9b, cl
cmovno cx, cx
push r10
movabs r10, 0
neg cl
inc bx
push r10
adc sil, 0x13
mov rbx, qword [rsp + 0x90]
xor sil, 0xe6
shr dil, cl
bswap ebx
btc si, 0x66
xor ebx, 0x5b1e7702
movzx r9w, cl
ror ebx, 2
neg si
add ebx, 0x467c0199
shld di, cx, 0x56
not cl
rcl dil, cl
lea rbx, [rbx + r10]
movabs r10, 0x100000000
add rbx, r10
mov rsi, rsp
clc
and r11w, r12w
cmovns di, r14w
sub rsp, 0x180
add r11d, 0x9621b7
and rsp, 0xfffffffffffffff0
movzx r11, ax
rcl r9b, 0x6a
mov r11, rbx
movabs rcx, 0
sub r11, rcx
lea rdi, [0x14029844a]
adc r9w, ax
movsxd r9, r8d
mov r9d, dword [rbx]
test spl, al
add rbx, 4
cmc
test ax, 0x1329
clc
xor r9d, r11d
jmp 0x140204c7c
push r15
jmp 0x1402e7ec7
push rbp
jmp 0x140272660