joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c25a4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401784a8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r14d, edx
mov rsi, rcx
mov r12d, 1
mov ebx, r12d
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
nop dword [rax + rax]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c2617
mov rcx, rsi
call fcn.1400c2360
mov eax, r12d
jmp 0x1400c27ed
test byte [rsp + 0x50], 0x10
jne 0x1400c2662
test r14d, r14d
je 0x1400c2637
mov edx, 0x80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
test ebx, ebx
jne 0x1400c260f
test r14d, r14d
je 0x1400c260f
jmp 0x1400c2607
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
mov r13d, 0x250
mov r8d, r13d
xor edx, edx
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor edi, edi
test r14d, r14d
je 0x1400c27d2
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], di
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14000954c
nop
lea rdx, [0x140129888]
lea rcx, [rsp + 0x28]
call fcn.14000f338
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
nop dword [rax + rax]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400c2798
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14000954c
lea rdx, [0x14010c9f0]
lea rcx, [rsp + 0x28]
call fcn.14000f338
cmp word [rsp + 0x7c], 0x2e
jne 0x1400c2735
cmp word [rsp + 0x7e], di
je 0x1400c276d
cmp word [rsp + 0x7c], 0x2e
jne 0x1400c2735
cmp word [rsp + 0x7e], 0x2e
jne 0x1400c2735
cmp word [rbp - 0x80], di
je 0x1400c276d
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.14000f338
test ebx, ebx
je 0x1400c276b
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov r8d, r12d
mov edx, r14d
call fcn.1400c25a4
test eax, eax
mov ebx, r12d
jne 0x1400c276d
mov ebx, edi
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400c26f2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14000954c
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400c27d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
call fcn.14000c220
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x1400c27ed
mov rcx, rsi
call fcn.1400c2360
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400d24e0
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c2920
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401784a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rdx
mov rsi, rcx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400c2967
mov rax, qword [rdx]
xor r12d, r12d
mov qword [rdx + 0x10], r12
mov word [rax], r12w
mov r15d, 0x208
mov ecx, r15d
call fcn.14000c1bc
mov r14, rax
mov qword [rbp - 0x31], rax
lea rdi, [rax + 0x208]
mov qword [rbp - 0x21], rdi
mov r8d, r15d
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rbp - 0x29], rdi
mov rdx, r14
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
test eax, eax
jne 0x1400c2a1b
lea edx, [rax + 0x5c]
lea rcx, str.admin_appman_appv_shared_system_file.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x1400c29db
inc rax
jmp 0x1400c29e2
lea rax, str.admin_appman_appv_shared_system_file.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
or rsi, rbx
movabs rax, 0x7c2500000000
or rsi, rax
jmp 0x1400c2ab4
mov qword [rbp - 9], r12
mov r15d, 7
mov qword [rbp - 1], r15
mov word [rbp - 0x19], r12w
mov rdx, r14
lea rcx, [rbp - 0x19]
call fcn.14000954c
nop
mov r8, rsi
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140011a3c
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400c2b00
mov rsi, rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1400c2a75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
call fcn.14000c220
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x1f], r15
mov word [rbp + 7], r12w
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x1400c2a9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
call fcn.14000c220
mov rax, rsi
shr rax, 0x27
not eax
test al, 1
jne 0x1400c2ab4
movabs rsi, 0x8000000000
test r14, r14
je 0x1400c2acb
sub rdi, r14
sar rdi, 1
lea rdx, [rdi + rdi]
mov rcx, r14
call fcn.14000c220
mov rax, rsi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400d24e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400c2dd0
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401784a8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov r11, rcx
xor esi, esi
cmp qword [rcx + 0x10], rsi
je 0x1400c2f2a
cmp qword [rdx + 0x10], rsi
je 0x1400c2f2a
call fcn.140011a8c
test al, al
jne 0x1400c2f2a
mov rdx, r11
lea rcx, [rbp - 0x28]
call fcn.1400c3168
nop
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.1400c3168
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400c2ed5
lea edx, [rsi + 0x5c]
lea rcx, str.admin_appman_appv_shared_system_file.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x1400c2e98
inc rax
jmp 0x1400c2e9f
lea rax, str.admin_appman_appv_shared_system_file.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
or rdi, rbx
movabs rax, 0x962500000000
or rdi, rax
jmp 0x1400c2edf
movabs rdi, 0x8000000000
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1400c2efa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
call fcn.14000c220
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400c2f25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
call fcn.14000c220
mov rax, rdi
jmp 0x1400c2f73
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appv_shared_system_file.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x1400c2f4c
inc rax
jmp 0x1400c2f53
lea rax, str.admin_appman_appv_shared_system_file.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
shl rax, 0x34
movabs rcx, 0x952500000057
or rax, rcx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d24e0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405500]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405510]
mov dword [rax], 1
mov rax, qword [0x00405520]
mov dword [rax], 1
mov rax, qword [0x004054f0]
mov dword [rax], 1
mov rax, qword [0x004053b0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x004054e0]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x00405440]
mov qword [rdx], rax
mov rdx, qword [0x00405430]
mov qword [rdx], rax
mov rax, qword [0x004054a0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00405360]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401684
Capabilities:
Resolve dns

Disassembly:
push rbp
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x60], rcx
lea rax, [rbp - 0x10]
mov r8d, 0x30
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0xc], 0
mov dword [rbp - 8], 1
lea rdx, [rbp - 0x18]
lea rax, [rbp - 0x10]
mov r9, rdx
mov r8, rax
mov edx, 0
mov rcx, qword [rbp + 0x60]
mov rax, qword [sym.imp.WS2_32.dll_getaddrinfo]
call rax
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
je 0x40171c
mov eax, dword [rbp + 0x34]
mov ecx, eax
call dbg.gai_strerrorA
mov rbx, rax
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rbx
mov r8, qword [rbp + 0x60]
lea rdx, str.Error_resolving_domain__s:__s_n
mov rcx, rax
call sym.fprintf
jmp 0x4017da
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
je 0x4017c9
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 4]
cmp eax, 2
jne 0x40176b
mov rax, qword [rbp + 0x38]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
add rax, 4
lea rdx, [rbp - 0x60]
mov r9d, 0x41
mov r8, rdx
mov rdx, rax
mov ecx, 2
call sym.inet_ntop_win_int__void_const__char__unsigned_long_long_
jmp 0x4017a5
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 4]
cmp eax, 0x17
jne 0x4017a5
mov rax, qword [rbp + 0x38]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
add rax, 8
lea rdx, [rbp - 0x60]
mov r9d, 0x41
mov r8, rdx
mov rdx, rax
mov ecx, 0x17
call sym.inet_ntop_win_int__void_const__char__unsigned_long_long_
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, str.Resolved_IP:__s_n
call sym.printf
mov rax, qword [rbp + 0x38]
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x38], rax
jmp 0x401724
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_freeaddrinfo]
call rax
nop
add rsp, 0xc8
pop rbx
pop rbp
ret

Function at 0x4017e4
Capabilities:
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
setne al
test al, al
je 0x401835
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error__d_n
call sym.printf
mov eax, 1
jmp 0x401860
lea rax, str.dsadsadasdsadasdsadsadsadasdagijqwgqwgwqjgnqjnjak.com.gr
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rcx, rax
call sym.resolve_domain_char_const_
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x1c0
pop rbp
ret
Function at 0x402bd0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004053b0]
cmp word [rbx], 0x5a4d
je 0x402bf0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402be4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x14001ce70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14001ce7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14001ce8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14001ce75
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14001cea5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14001ce92
sub eax, 3
jb 0x14001cebf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14001cef6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14001cee6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14001cee4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14001ced3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14001ce32
jmp 0x14001ce7d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3600
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14001cf42
cmp rsi, rcx
jae 0x14001cf4a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14001cf29
cmp al, 0x8f
ja 0x14001cf29
cmp byte [rsi - 2], 0xf
je 0x14001cf2f
sub al, 0xe8
cmp al, 1
ja 0x14001cf13
cmp rsi, rcx
jae 0x14001cf4a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14001cf19
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14001cf4a
lodsb al, byte [rsi]
jmp 0x14001cf29
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1a000]
mov eax, dword [rdi]
or eax, eax
je 0x14001cfa7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2f380]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14001cf57
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14001cfa1
mov qword [rbx], rax
add rbx, 8
jmp 0x14001cf77
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14001cfff
sub rsp, 0xffffffffffffff80
jmp section.UPX0
Function at 0x140011109
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001dbe0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400370f5]
call fcn.140011933
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001dc38
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001dd4a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001dce3
cmp qword [rbp + 0x28], 0
jle 0x14001dce3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001dc81
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400118b6
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14001dd39
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001dd39
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011537
Capabilities:
Terminate process

Disassembly:
jmp 0x140020e00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400115c8
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
jmp 0x14001b550
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1828
call fcn.1400111bd
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x47e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1848]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x17e8], rax
lea rcx, [0x1400370f8]
call fcn.140011933
nop
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.WinINet_Downloader
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001b5d7
xor al, al
jmp 0x14001b715
mov rcx, qword [rbp + 0x1810]
call fcn.1400110ff
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x84000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14001b624
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
xor al, al
jmp 0x14001b715
mov edx, 0x108
lea rcx, [rbp + 0x50]
call fcn.1400113b1
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
mov rdx, qword [rbp + 0x1818]
lea rcx, [rbp + 0x50]
call fcn.14001196a
nop
lea rcx, [rbp + 0x50]
call fcn.140011672
movzx eax, al
test eax, eax
jne 0x14001b696
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov byte [rbp + 0x17b4], 0
lea rcx, [rbp + 0x50]
call fcn.140011262
movzx eax, byte [rbp + 0x17b4]
jmp 0x14001b715
lea r9, [rbp + 0x1194]
mov r8d, 0x1000
lea rdx, [rbp + 0x180]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14001b6de
cmp dword [rbp + 0x1194], 0
jbe 0x14001b6de
mov eax, dword [rbp + 0x1194]
mov r8d, eax
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
jmp 0x14001b696
lea rcx, [rbp + 0x50]
call fcn.1400114ce
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov byte [rbp + 0x17d4], 1
lea rcx, [rbp + 0x50]
call fcn.140011262
movzx eax, byte [rbp + 0x17d4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140029540]
call fcn.1400117b2
mov rax, rdi
mov rcx, qword [rbp + 0x17e8]
xor rcx, rbp
call fcn.140011479
lea rsp, [rbp + 0x17f8]
pop rdi
pop rbp
ret
Function at 0x140011677
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021930
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140021950
xor al, al
jmp 0x1400219d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140021963
xor al, al
jmp 0x1400219d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002198d
xor al, al
jmp 0x1400219d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400219a1
xor al, al
jmp 0x1400219d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400219b3
xor al, al
jmp 0x1400219d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400219cf
xor al, al
jmp 0x1400219d1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001191a
Capabilities:
Write file on windows

Disassembly:
jmp 0x140019750
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400370f5]
call fcn.140011933
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x1400197b7
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400197be
mov al, 1
jmp 0x14001990e
call fcn.1400112a8
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.1400112a8
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.140011758
movzx eax, al
test eax, eax
je 0x14001980f
xor al, al
jmp 0x14001990e
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140019874
cmp dword [rbp + 0x154], 1
je 0x14001987f
cmp dword [rbp + 0x154], 3
je 0x1400198fd
jmp 0x14001990c
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400198cf
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400198cf
xor al, al
jmp 0x14001990e
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400198ea
mov dword [rbp + 0x154], 1
jmp 0x1400198f4
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001990e
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001990e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140029c30]
call fcn.1400117b2
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011479
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret