joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406da48e
Capabilities:
Authenticate hmac

Disassembly:
jo 0x140d3d402
xor bpl, bpl
and bp, 0x180b
xor ebp, 0x5ae82ac5
add bp, 0x4a77
add qword [rsp + 0x18], 0xffffffffbf26a0c7
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffe96526b8
call fcn.140cbe630
not r9d
movsxd r14, r14d
setg r13b
and r14w, 0x1045
add r14w, r13w
mov r13b, 8
neg r14w
bswap r14
test r13d, 0x21cf6a58
mov r14w, 0x30
mov r13d, 0xa4a58ba
call fcn.140cc77d3

Function at 0x1406dc561
Capabilities:
Check http status code

Disassembly:
lea rbx, [rsi*4 + 0x7a8476b0]
jge 0x1406da543
mov qword [rsp + 0x30], 0x15f26b3d
not word [rsp + 0x28]
mov qword [rsp + 0x28], rsi
setb r9b
not dword [rsp + 0x30]
jne 0x140d095b6
not word [rsp + 0x28]
call 0x1406dc56f
or byte [rbx - 0x30f7ff8e], bl
invalid
jo 0x140cbb33f
or bx, 0x2ffe
mov rsi, qword [rsp + 0x50]
add bl, byte [rsp + 0x2f]
test bl, r9b
movzx r9, word [rsp + 0x10]
setae byte [rsp + 0x10]
neg r9d
cmp dword [rsp + 0x10], 0x5dbe0b07
not bl
jl 0x140cf3925
clc
ret 0xec3b

Function at 0x1406e6105
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
mov rcx, qword [rsp + 8]
setg byte [rsp + 0x18]
test qword [rsp + 0x18], 0x1c076dd0
mov dword [rsp + 0x18], 0x8543ebd
mov byte [rsp + 0x18], 0xaf
setg byte [rsp + 0x18]
sub byte [rsp + 0x18], 0xcd
neg word [rsp + 0x18]
or dword [rsp + 0x18], 0xeae4fd6
xor qword [rsp + 0x18], 0x1f5a4239
test qword [rsp + 0x18], 0x480a5a10
mov byte [rsp + 0x18], 0x35
mov dword [rsp + 0x18], 0x6cdf2d34
mov byte [rsp + 0x18], 0xdd
jl 0x1406e6127
call fcn.140671e42

Function at 0x1406ece8e
Capabilities:
Authenticate hmac

Disassembly:
push 0xb770497
call fcn.140685b77

Function at 0x1406ece9d
Capabilities:
Authenticate hmac

Disassembly:
movsx r8d, r8w
movabs r8, 0x345819ff0a364740
bswap r8

Function at 0x1406f5212
Capabilities:
Authenticate hmac

Disassembly:
not bx
movzx si, byte [rsp + 0x2b]
setle cl
add qword [rsp], 0xfffffffffffeed9b
cmp ebx, dword [rsp + 0x2b]
call fcn.140d585ab

Function at 0x1407147f2
Capabilities:
Check http status code

Disassembly:
setge bl
cmp bl, 0x42
mov rbx, qword [rsp + 0x38]
jge fcn.140d77848
jns 0x1406bc596
jb 0x140d6a2c3

Function at 0x14071480f
Capabilities:
Check http status code

Disassembly:
movzx r13w, r13b
mov r9, r13
call fcn.140d165ab

Function at 0x14071482b
Capabilities:
Check http status code

Disassembly:
add qword [rsp + 8], 0xffffffffbf269982
add r9w, r9w
mov r9, qword [rsp + 0x10]
call fcn.140d8d6a0
call fcn.140d96214
mov dword [rsp], 0x130b2219
add qword [rsp + 0x10], 0x6d933
or ecx, esi
jge 0x140cdd644
jle 0x140daae3b
and r12d, 0x2913014a
sub r12, r12
call fcn.140d629d6
cmp dl, dh
not dl
push r9
mov dx, 0x7a81
movabs r9, 0x3800015320447821
push 0x3f3e2f5e
mov rdx, qword [rsp + 0x18]
push qword [rsp + 0x10]
popfq
mov r9, qword [rsp + 8]
lea rsp, [rsp + 0x20]
ret
not r9b
jge 0x1406a2387
push rbp
push rbx
push r10
xor esi, dword [rdx]
insb byte [rdi], dx
insb byte [rdi], dx
invalid

Function at 0x140717c71
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r9
push r12
mov r9, qword [rsp + 0x38]
call fcn.140727423
Function at 0x140725af5
Capabilities:
Encode data using xor

Disassembly:
movsx r13d, r13b
bswap r13
movzx bx, word [rsp + 0x29]
lea rbx, [rbx + rbx*4 + 0x355d741a]
setl bl
mov r13, qword [rsp + 0x50]
mov byte [rsp + 0x28], bl
xor qword [rsp + 0x28], 0x74454e07
not byte [rsp + 0x28]
je 0x140725afc
cmova rbx, qword [rsp + 0x28]
add dword [rsp + 0x28], 0x152c6eb4
movsx ebx, bx
or dword [rsp + 0x28], 0xf9f4e9f
xor ebx, dword [rsp + 0x28]
not byte [rsp + 0x28]
mov bl, 0x1a
ja 0x140cc224b
setne bl

Function at 0x1407306bb
Capabilities:
Authenticate hmac

Disassembly:
not dil
jbe 0x140d06256
push r14
call fcn.140d9478c
Function at 0x1407307b9
Capabilities:
Authenticate hmac

Disassembly:
mov dl, byte [rsp + 0x3d]
jge 0x140ca3051
or r14, r14
setae byte [rsp + 0x38]
mov dx, word [rsp + 0xb]
test word [rsp + 8], 0x7fa9
lea r14, [r14*4 + 0xaea111d]
call fcn.140cc710d

Function at 0x1407307c3
Capabilities:
Authenticate hmac

Disassembly:
add qword [rsp + 0x18], 0xffffffffbf26916b
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.140e99d59
jg 0x14066f266
pcmpgtb mm5, qword [rax + 0x6f]
outsb dx, byte [rsi]
jmp 0x18eb37fe9

Function at 0x140cbc650
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x140671dd0
lea rbx, [rdx + rdx*8 + 0x60944da2]
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0x4b3d196d
js 0x14066f2f7
xchg ecx, eax
cld
shr dword [rdi - 0x18], cl
or byte [rdi + 0x33], bh
invalid

Function at 0x140cc83ff
Capabilities:
Check http status code

Disassembly:
jns fcn.1406dc561
call fcn.1406eb5e3
out 0x5a, eax
cmp edx, dword [rsi - 0x61f81bda]
push rsi
invalid

Function at 0x140cc8b4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jge 0x140da116c
add byte [rax], al
add byte [rdi + rbp*2 + 0x61], cl
imul r12, qword fs:[rdx + 0x72], 0x41797261
add byte [rsi + 0x44], ah
movsx esp, word [rsp + 0x3b]

Function at 0x140ce7f0b
Capabilities:
Encode data using xor

Disassembly:
xor word [rsp + 0x28], 0x1e44
neg r14d
movabs r13, 0x35472869421f7197
neg dword [rsp + 0x60]
mov r8, r14
jl 0x140695e12
setl byte [rsp + 0x60]
or r8, 0x28017c62
movabs rbx, 0x15ed41806db15295
add qword [rsp], 0xa7a5e
not qword [rsp + 0x18]
xor rcx, 0x6e1e5d46
or edx, r10d
sub cl, 0x47
lea rcx, [rcx + rbx*4 + 0x30a503fb]
cmp rcx, rdx
not bl
mov r8, qword [rsp + 0x20]
ret
or r8d, 0x575a0610
mov r14w, 0x71e4
and r14b, r8b
jo 0x140d7c7dc
not r14w
push rbp
cmp r8, 0x5805711
mov rbp, r8
call fcn.140cd309a
jp 0x140ce7f55
lahf
pushfq
xchg esp, eax
fidiv word [rax]
invalid
mov edi, 0xd26348d2
mov r8, qword [rsp + 0x30]
mov qword [rsp + 0x18], 0x655c75e7
js 0x140713b64
neg r8
and bpl, 0xad
movabs r8, 0x11391d62d12520
or bpl, r8b
not bpl
or r8, 0x12af67c9
sets bpl
setle r8b
mov r8, qword [rsp + 0x18]
not rbp
not ebp
add qword [rsp + 0x28], 0xffffffffbf31c3c7
or bp, bp
add qword [rsp + 0x30], 0xfffffffffff31bfe
sub ebp, 0x1f343d55
sub bpl, 1
test bpl, bpl
movsx bp, bp
movabs rbp, 0x662371a341cc1443
mov bp, 0x29c1
call fcn.14073118f
xor byte [rsp + 8], 0x66
jbe 0x140d7c845
and qword [rsp + 8], 0x2d664557
Function at 0x140cece12
Capabilities:
Encode data using xor

Disassembly:
jo 0x140ce5b6d
add rdi, qword [rsp]
or r14w, word [rsp + 2]
add rdi, 0x7c337b0e
jb 0x140cece64
mov r9b, 0x88
mov dil, byte [rsp + 2]
bswap r14d
xor edi, 0x58253a9c
test qword [rsp], r9
mov r10, qword [rsp]
mov r10, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x18]
mov r9, qword [rsp + 0x10]
lea rsp, [rsp + 0x58]
ret
mov rdx, r12
push r10
push r8
call fcn.140cd9621
lea r15, [r15*8 + 0x60765d5a]
mov r15b, 0x85
lea r15, [r15 + r15*2 + 0x5bac69e4]
mov r15, qword [rsp]
call fcn.140cb87aa
mov r12, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0xffffffffbf268305
not r15w
movzx rdi, r15w
push r14
mov dil, 0xf9
not rdi
movabs r14, 0x9a129d47231f54
push r9
call fcn.140d249bf
jl 0x140698c0d
push r9
pushfq
movabs r9, 0x2de775005f3f1ed1
bswap r9
movsx r9, r9w
add r9w, r9w
xor r9, 0x4b657fb4
push rcx
push rbp
movabs rcx, 0x1a24199778287828
lea r9, [rcx + 0x7d927db4]
jb 0x140cece2c
mov rbp, rcx
test cl, 0xac
call fcn.140cc3ce6
and r10w, 0x4908
neg rdi
lea rdi, [rdi + rdi*4 + 0x6f045218]
setno r14b
not r10b
test r10b, dil
mov r9, rdi
push rdi
not r9b
mov r15, qword [rsp + 0x40]
not r9d
jae 0x1406a06af
push r9
pushfq
movabs r9, 0x669e59f17abe067a
push r10
xor r9d, 0x5a4532f7
lea r9, [r9*8 + 0x23f23220]
movabs r10, 0xa3f3f39024d51f8
not r9b
push r11
or r9d, r10d
js 0x1406cd29c
mov r11, r10
bswap r9d
bswap r10d

Function at 0x140cf002c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
call fcn.140dd7765

Function at 0x140d0403b
Capabilities:
Authenticate hmac

Disassembly:
setle byte [rsp + 0x20]
add r13w, r13w
setge r13b
push r13
neg dword [rsp + 0x28]
not dword [rsp]
jne 0x140d9cdf9
jb 0x14073077f
and eax, dword [rdi + 0x5fd2404e]
adc byte [rcx - 0x1ab44146], bh
cwde
invalid

Function at 0x140d078b1
Capabilities:
Check http status code

Disassembly:
mov dword [rsp + 8], 0x16bd56f3
or r11w, 0x1a6
push 0x40966159
bswap rbp
add r11w, cx
test r11w, cx
push r11
movabs rcx, 0x2733190f2d544767
setle byte [rsp + 8]
add byte [rsp], 0x8a
not qword [rsp + 0x18]
push r14
movabs r14, 0x324d563442096e5a
cmp byte [rsp + 0x20], r11b
not r11
jns 0x140daae18
and r9b, 0x4b
call fcn.140d56e1c
cmp byte [rsp + 0x28], 0x5c
je fcn.140cfd756
xor r8d, dword [rsp + 0x28]
je 0x140ce0a94
test qword [rsp + 0x40], 0xd6f6efa
lea r8, [r8 + r8*4 + 0x43712865]
lea rsp, [rsp + 0x18]
ret 0x18
jge 0x1406ea493
pop rcx
in eax, dx
cld
pop rdx
sub al, 0x31
mov dl, 0xe7
invalid
or bpl, r11b
call fcn.140cf7826
jp 0x140daae40
invalid
Function at 0x140d3d437
Capabilities:
Authenticate hmac

Disassembly:
popfq
not word [rsp + 0x20]
call fcn.140d50469
setbe bl
and bx, 0x3982
cmp dil, sil
mov r13, qword [rsp + 0x28]
call fcn.140cdd5a7
je 0x1406aac6a
adc eax, 0x98e09ff0
sar dword [rsi + 0x3907cd83], 0xf
iretd
invalid
jns 0x14072fa6d
add r8d, r8d
add qword [rsp], 0xffffffffbf90d669
and r8b, 0xe7
call fcn.1406cc77f
neg ecx
sub cx, 0x4936
test r15d, 0x4d482491
push r8
movzx rdx, dl
movzx dx, cl
je 0x1406eceae
ja 0x140d7e07a
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x70]
call fcn.140dd7765
fimul dword [rdi + 0x44a3888]
invalid
xor r8w, r8w
and dl, 0x65
jle fcn.140cd2800
cmp r8w, 0xf5b
mov r15d, 0x73260e1
push r11
not edx
call fcn.140d453bc
pop r15
lea rbp, [rbp + rbp*2 + 0x1b624ce2]
call fcn.140cc092a
seto r13b
js 0x1406aabd0
movabs r9, 0x225463a328c3d55
jle 0x140ce7ffe
mov r13w, bx
push qword [rsp + 0x38]
popfq
mov qword [rsp + 0x38], 0x1f8f664d
pushfq
add qword [rsp + 8], 0x6d3a16
add qword [rsp + 0x10], 0xffffffffbf253155
call fcn.140d576c2
ret
sub r15d, 0x3bca610c
or r15, 0x4e4e0acf
xor r8w, 0x44d
not r8w
call fcn.140d4fa3e
sub dword [rdi + 0x65768b74], edx
cmp dword [rax - 0x55], esi
jbe 0x14072faa7
invalid
mov edi, 0xb480f994
imul esp, dword [rsi - 0x5194832b], 0x8b7cc582
xchg dword [rax - 0x3e8b4e12], ebx
out 0x69, eax
pushfq
invalid
add qword [rsp], 0xffffffffff9c2edb
cmp ebx, r10d
lea r14, [rbx*2 + 0x97c180a]
and al, 0
fld xword [rsi]
pushfq
inc dword [rcx + 0x3b]
fimul dword [rbp + rcx*4 + 0x34]
pop rbp
or bl, byte [rax]
jl 0x140ce801b
not qword [rsp + 0x40]
cmovle ebx, dword [rsp + 0x40]
add rdx, 0x70f27acc
add rdx, 0x70f27acc
not r13b
not r10w
or r14w, dx
sub r10w, bx
lea r14, [r13 + r13 + 0x2727eb9]
and dl, byte [rsp + 0x41]
mov r13, qword [rsp + 0x48]
sub r14d, ebx
call fcn.140d5764c
pop rax
add ebx, dword [rdi - 0x38b72868]
invalid
invalid
test byte [rax + rax*8], ah
add byte [rax], al
add dh, bh
ja 0x140ce8000
invalid
push r13
not qword [rsp + 0x10]
setle byte [rsp + 0x48]
add bl, bpl
push r10
neg bx
mov rbx, qword [rsp + 0x30]
add qword [rsp + 0x10], 0xfffffffffffb9bcf
sub qword [rsp + 0x48], 0x3a1521cd
test r8w, 0x7b63
call fcn.1406eca7e
pushfq
push rcx
movabs rcx, 0x27ac2d890cd13651
not ecx
push r15
movabs r15, 0x571437632da14514
not r15
lea r15, [r15*8 + 0x2a0d4b21]
push rdx
movabs rdx, 0x208670ef2fca20e5
test r15b, 0x1f
lea rcx, [r15 + 0x7d5c4831]
push qword [rsp + 0x18]
popfq
mov qword [rsp + 0x18], 0x2584f86d
pushfq
xor rcx, 0x2347f45
not edx
xor cl, 0x6d
lea rcx, [rcx*4 + 0x318c3200]
js 0x1406f5267
mov r8, r15
sub cx, 0x198e
jno 0x1406f9211
Function at 0x140d5cf1a
Capabilities:
Encode data using xor

Disassembly:
add r15b, r12b
setns byte [rsp + 0x40]
bswap ebx
test byte [rsp + 8], 0x9c
mov word [rsp + 0x48], dx
mov dword [rsp + 0x20], 0x70887cc6
lea r12, [rdx + rdx*4 + 0x1ba11294]
call fcn.14071a4cd
push r9
movabs r9, 0x1f473f66540775d4
pushfq
and r9w, r9w
add r9w, r9w
xor r9d, 0x4cc35f99
or r9d, r9d
sub r9w, 0x7000
xor r9d, r9d
bswap r9
push rdx
sub r9w, 0x1bb
movabs rdx, 0x7e89531100e3031b
or r9, r9
push rbp
sub r9w, 0x155a
movabs rbp, 0x56b231475d5e46c4
cmp bpl, 0x39
not r9d
not dx
push r15
jo 0x1406ab45e
mov r9, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffdd0f1bfe
push rsi
or rbp, 0x3e05e31
call fcn.1406ab43d
push rbx
pushfq
movabs rbx, 0x5aa2be12ae52a90
not bl
push rdx
movabs rdx, 0x7c673d28040b6fe0
not rbx
test dh, dl
push r10
movabs r10, 0x79313d152cb31aa6
jg 0x140d18c15
jrcxz 0x140d5d01b
shl byte [r11], 0x51
invalid
invalid

Function at 0x140d95d54
Capabilities:
Encode data using xor

Disassembly:
add dword [rsp + 8], esi
mov r13, rdx
sub sil, byte [rsp + 0xd]
mov r15, rsi
mov rcx, r12
or r13d, 0x6f207ffb
sub r13w, word [rsp + 0x30]
add sil, 0x1e
neg dl
cmp rdx, 0x451a324f
bswap rdx
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
push qword [rsp + 0x40]
popfq
mov r15, qword [rsp + 0x38]
mov r12, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov r13, qword [rsp + 0x10]
lea rsp, [rsp + 0x58]
ret
neg byte [rsp + 0x10]
push r10
push r13
mov r12, qword [rsp + 0x20]
push rdx
mov r10, rsi
lea r12, [rdx + 0x728831eb]
and dword [rsp], esi
not qword [rsp]
or esi, r10d
jno 0x140d94567
loopne 0x140d59f7d
call [rcx]
mov ebx, 0x13c2435d
sbb dword [rbx + 0x13c2435d], edi
mov ebx, 0xe8dca56f
adc r10b, byte [rdx]
and ecx, 0x7831aa44
sbb dword [rbx - 0x18e81fb9], edi
out dx, al
invalid
push r9
sub si, 0x145f
mov r10, qword [rsp + 0x18]
jns 0x1406dc620
push rdx
movabs rdx, 0x45d35d4a2f0c4ac0
mov edx, 0x5fe033a4
mov edx, 0x4e0e3048
xor dl, 0x57
not dl
push qword [rsp + 0x10]
popfq
mov qword [rsp + 0x10], 0xffffffffdd0f1bfe
push rsi
mov rsi, rdx
pushfq
and edx, 0x76f06ed3
xor rsi, 0x4c4b2f0f
add qword [rsp + 0x18], 0xffffffffff982600
push r15
push rsi
and dx, word [rsp]
movsx dx, sil
push r12
je 0x140d95d6c
xor sil, sil
lea rsi, [rsi*2 + 0x673c5160]
push rcx
jle 0x140d59f52
call fcn.140d7c57a

Function at 0x140d9725f
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
or r15d, 0x62894c3c
lea r15, [r8 + r8*8 + 0x34134143]
test r8, 0x227364fb
sets r15b
call fcn.1406f2979
jo 0x140d972a8
movabs al, byte [0x6ae36996619d87af]
push 0x448148fe
add qword [rsp], 0x6dbd42
movabs r9, 0x73281fa202f5506b
or ebp, 0x71fe7213
invalid
invalid
add byte [rax], al
not dl

Function at 0x140da110c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setg byte [rsp + 0xd0]
neg qword [rsp + 0xd0]
sub byte [rsp + 0xc8], 0x7a
setbe byte [rsp + 0xc0]
add qword [rsp + 0x10], 0xffffffffbf29be81
mov word [rsp + 0xc0], 0x4b74
push qword [rsp + 0x100]
popfq
lea rsp, [rsp + 0x118]
call fcn.140e99d59
Function at 0x140daa953
Capabilities:
Encode data using xor

Disassembly:
mov r11, qword [rsp + 8]
add qword [rsp], 0xffffffffbf2ad04e
test r9d, r9d
setg r9b
cmp dword [rsp + 0x18], 0x73f82d40
mov dword [rsp + 0x18], 0x452424bc
setbe byte [rsp + 0x18]
xor word [rsp + 0x18], 0x1edc
setg r9b
not byte [rsp + 0x18]
test byte [rsp + 0x18], 0x3c
mov r9, qword [rsp + 0x10]
lea rsp, [rsp + 0x28]
ret
mov r11, qword [rsp + 0x18]
mov r9, qword [rsp + 0x18]
cmp dil, byte [rsp + 0x19]
setns r11b
add qword [rsp + 0x28], 0x5eb5ad
not word [rsp + 0x18]
or word [rsp + 0x18], r9w
add di, 0x2756
test r9b, r9b
lea rdi, [rdi + r11*8 + 0x6a310da]
je 0x140d9cda2
not dil
mov rdi, qword [rsp + 0x20]
and byte [rsp + 0x18], 0x9d
add byte [rsp + 0x18], r11b
or r11, r11
bswap r11d
setg byte [rsp + 0x18]
sub r11w, 0x562e
bswap r11d
not r11
not r9b
add r11b, byte [rsp + 0x1a]
sub r9, r9
cmovle r11w, word [rsp + 0x19]
or r9, 0x2ac8312b
cmovne r11, r9
lea r11, [r11*4 + 0xe341790]
xor al, 0xe
test byte [rsp + 0x18], 0x66
jae 0x140d0e4f2
wait
fdivr dword [rdi]
cmc
outsd dx, dword [rsi]
jle 0x140daa9dc
nop
invalid

Function at 0x140daae46
Capabilities:
Check http status code

Disassembly:
cmp word [rsp + 0x28], 0x49e
not qword [rsp + 0x30]
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
call fcn.140e281b0
neg qword [rsp + 0x28]
or dword [rsp + 0x28], 0x39c11fba
xor dword [rsp + 0x30], 0x62762263
setg byte [rsp + 0x28]
add qword [rsp + 0x30], 0x79132d5e
xor qword [rsp + 0x28], 0xd4b60be
or word [rsp + 0x28], 0x24e7
sub qword [rsp + 0x30], 0x442b2321
sub byte [rsp + 0x30], 0x77
xor word [rsp + 0x28], 0x590e
neg dword [rsp + 0x30]
neg dword [rsp + 0x28]
and qword [rsp + 0x28], 0x526b0841
xor word [rsp + 0x28], 0x268f
jae 0x140cd191c

Function at 0x140daaeac
Capabilities:
Check http status code

Disassembly:
seto dil
and word [rsp + 0x20], bp
call fcn.140d4f3e6

Function at 0x140daaeba
Capabilities:
Check http status code

Disassembly:
mov dword [rsp + 0x20], 0x538b16e8
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
call fcn.140e281b0
push rbx
pushfq
movabs rbx, 0x7a9b727f5db51920
call fcn.140ce0ace
Function at 0x140daaee2
Capabilities:
Check http status code

Disassembly:
cmp byte [rsp + 0x20], bh
not word [rsp + 0x20]
setle byte [rsp + 0x18]
add qword [rsp], 0x5b2c19
xor dword [rsp + 0x20], 0x44e66805
not qword [rsp + 0x20]
sub qword [rsp + 0x10], rbx
ret 0x18
neg word [rsp]
xor dword [rsp], 0x1a233e0e
neg rbx
call fcn.14070bbbd
invalid
lea r13, [rbx*4 + 0x4a1b37ef]
setns r13b
jo 0x140dadad9
movsx r13d, word [rsp + 0x10]
cmp r13w, bx
not rbx
not qword [rsp + 0x20]
mov qword [rsp + 0x18], 0x75832c3f
js 0x140dada47
bswap r13
xor byte [rsp + 0x18], bh
neg word [rsp + 0x20]
mov r13, qword [rsp + 0x38]
sete bl
jge 0x14067551a
cmp r12, 0xbf1985
mov r12w, 0x108
setg r12b
or r12, 0x3dad05b7
not r12d
mov r12b, 0x3e
push r13
setb r12b
movabs r13, 0x57c51f0616c851e0
push rbx
movabs rbx, 0x50d115fc183674c6
jb 0x140daaf26
setge r12b
cmp r12b, r13b
mov r12, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffffcf508a16
not r13b
push r8
mov r13w, bx
setb bl
neg rbx
push 0x490f0065
not r13d
add bl, byte [rsp]
mov r8, rbx
and qword [rsp], r13
xor dword [rsp], 0x174143cc
sub r13, r13
setle r8b
movabs rbx, 0x12296927266b0b13
push rbx
push r13
jle 0x140701b1d
rcl byte [rcx + rbp*8 + 0x71], cl
ret 7
Function at 0x180001b34
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword gs:[0x60]
mov edi, edx
mov ebx, ecx
xor esi, esi
mov r8, qword [rax + 0x18]
mov r11, qword [r8 + 0x20]
mov r8, r11
mov r9, qword [r8 + 0x50]
test r9, r9
je 0x180001b98
movzx r10d, word [r8 + 0x48]
mov edx, esi
jmp 0x180001b8e
movsx ecx, byte [r9]
mov eax, 0xffff
add r10w, ax
ror edx, 0xd
cmp byte [r9], 0x61
lea eax, [rcx - 0x20]
cmovl eax, ecx
add edx, eax
inc r9
test r10w, r10w
jne 0x180001b6f
cmp edx, ebx
je 0x180001bb2
mov r8, qword [r8]
cmp r8, r11
jne 0x180001b5d
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov r9, qword [r8 + 0x20]
mov ebx, esi
movsxd rax, dword [r9 + 0x3c]
mov r8d, dword [rax + r9 + 0x88]
add r8, r9
mov edx, dword [r8 + 0x20]
mov ecx, dword [r8 + 0x24]
add rdx, r9
add rcx, r9
cmp dword [r8 + 0x18], esi
jbe 0x180001ba0
mov r10d, dword [rdx]
mov r11d, esi
add r10, r9
jmp 0x180001bf3
ror r11d, 0xd
movsx eax, al
add r11d, eax
inc r10
mov al, byte [r10]
test al, al
jne 0x180001be6
cmp r11d, edi
je 0x180001c11
inc ebx
add rdx, 4
add rcx, 2
cmp ebx, dword [r8 + 0x18]
jb 0x180001bdb
jmp 0x180001ba0
movzx edx, word [rcx]
mov ecx, dword [r8 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x180001ba2

Function at 0x180003458
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x240
mov rbx, rcx
cmp edx, 1
jne 0x1800034ef
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
js 0x1800034eb
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
call fcn.180003930
test eax, eax
jne 0x1800034eb
call fcn.180003878
test eax, eax
je 0x1800034eb
cmp dword [0x180022d00], 0
jne 0x1800034f8
and qword [rsp + 0x28], 0
lea r8, [0x180001c28]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov dword [0x180022d00], 1
xor ecx, ecx
mov qword [0x180022cf8], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180022ca0], rax
call fcn.180001eb4
jmp 0x1800034f8
xor eax, eax
jmp 0x1800034fd
test edx, edx
jne 0x1800034f8
call fcn.1800037ac
mov eax, 1
add rsp, 0x240
pop rbx
ret
Function at 0x1800037ac
Capabilities:
Allocate or change rwx memory
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [0x180022d00], 0
je 0x180003854
and dword [0x180022d00], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180003840
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180003840
mov eax, 0x1f0e
mov word [rbx + 0x40], ax
movabs rax, 0xb821cd09b4000eba
mov qword [rbx + 0x42], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0x40]
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x180022ca0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.18000200c
add rsp, 0x30
pop rbx
ret

Function at 0x180003878
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor ecx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180003920
movzx eax, word [rax + 0x40]
mov ecx, 0x7268
sub ax, cx
cmp ax, 0xf
ja 0x1800038b4
mov ecx, 0x8801
bt ecx, eax
jb 0x180003920
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180003920
mov eax, 0x7277
mov word [rbx + 0x40], ax
lea rax, [0x18000385c]
mov qword [rbx + 0x42], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0x40]
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, 1
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret