joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400106e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r14, rcx
mov edi, 1
mov rbx, qword [0x1401c34d0]
mov edx, 0x81
lea r8d, [rdx + 0x6f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14001089d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001089d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001089d
xor r15d, r15d
mov r13d, 0x403
mov r12d, 0x1234
nop dword [rax]
movzx esi, word [rbx]
cmp r15w, si
je 0x14001089d
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r13w, ax
jne 0x140010801
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140010ae0
nop
movzx edx, si
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x143
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x140010892
call fcn.1400cecbc
jmp 0x140010892
cmp r12w, ax
jne 0x140010892
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xffffffffffffffff
lea rax, [rsp + 0x188]
mov qword [rsp + 0x180], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x180]
call fcn.140010ae0
nop
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
cmp rcx, rax
je 0x14001086a
call fcn.1400cecbc
movzx edx, si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x40b
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
add rbx, rbp
test edi, edi
jne 0x140010780
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400ce2d0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400122a0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1401c4d60]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x6bca1af3
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 7
jne 0x1400122f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov al, 1
add rsp, 0x38
ret
Function at 0x14001b4e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14001b554
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001b576
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b576
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x14001b576
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14001b690
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x2c0], rbx
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rdx
mov rdi, rcx
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
mov r9d, dword [rdi + 8]
or r9d, 0x2001f
mov rax, qword [rdi]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001b714
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r9d
mov r8, rsi
mov rdx, rax
call fcn.14001b2e0
jmp 0x14001b72a
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14001b833
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b74f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x14001b833
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001b7f6
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14001b690
mov ebx, eax
test eax, eax
jne 0x14001b833
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14001b7a1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b80b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001b825
mov r8, rsi
mov rdx, qword [rdi]
call fcn.14001b4e0
jmp 0x14001b831
mov rdx, rsi
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b850
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
jmp 0x14001b858
mov dword [rsp + 0x50], 0
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400ce2d0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001fe90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov rbp, r9
mov rsi, r8
mov rbx, rdx
call fcn.14001fde0
mov r11, rax
test rdi, rdi
je 0x140020044
test rsi, rsi
je 0x140020044
cmp rax, rbp
ja 0x140020044
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea r14, [0x140000000]
mov ecx, r8d
test rbx, rbx
je 0x14001ff92
mov r10, rsi
cmp rcx, rbx
jae 0x14001ff02
movzx eax, byte [rcx + rdi]
inc rcx
jmp 0x14001ff05
mov eax, r8d
cmp rcx, rbx
jae 0x14001ff14
movzx r9d, byte [rcx + rdi]
inc rcx
jmp 0x14001ff17
mov r9d, r8d
cmp rcx, rbx
jae 0x14001ff25
movzx edx, byte [rcx + rdi]
inc rcx
jmp 0x14001ff28
mov edx, r8d
shl eax, 8
add r10, 4
add eax, r9d
shl eax, 8
add eax, edx
mov edx, eax
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r14 + 0x1bfd50]
mov byte [r10 - 4], al
mov eax, edx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r14 + 0x1bfd50]
mov byte [r10 - 3], al
mov eax, edx
and edx, 0x3f
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r14 + 0x1bfd50]
mov byte [r10 - 2], al
movzx eax, byte [rdx + r14 + 0x1bfd50]
mov byte [r10 - 1], al
cmp rcx, rbx
jb 0x14001fef9
lea rcx, [r14 + 0x150418]
mov r14, qword [rsp + 0x30]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
cmp dword [rcx + rbx*4], r8d
lea rcx, [rcx + rbx*4]
jle 0x14001ffdf
lea rax, [rsi - 1]
add rax, r11
nop word [rax + rax]
mov byte [rax], 0x3d
inc r8d
lea rax, [rax - 1]
cmp r8d, dword [rcx]
jl 0x14001ffd0
mov r9d, dword [0x1401c4d60]
mov eax, 0x66666667
mov r8d, r9d
imul r8d, r9d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
cmp eax, 0xb
jne 0x140020015
inc dword [0x1401c530c]
mov rax, qword [rsp + 0x50]
mov qword [rax], r11
and r8d, 0x8000000f
jge 0x140020030
dec r8d
or r8d, 0xfffffff0
inc r8d
cmp r8d, 5
jne 0x140020040
dec r9d
mov dword [0x1401c4d60], r9d
mov al, 1
jmp 0x140020046
xor al, al
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140022240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea rdx, str.verifier
call fcn.140002100
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x48]
call fcn.140024a00
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, rbx
call fcn.140010150
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400222a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x14002237a
mov ecx, edi
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edi
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc edi
cmp edi, 0x100
jl 0x1400222e0
mov dword [0x1401c4d60], r8d
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140022910
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rsp + 0x30], 0
mov r9d, dword [0x1401c4d60]
lea r8d, [r9 + 1]
imul r8d, r9d
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xe
jne 0x1400229fe
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
add r9d, eax
inc edx
cmp edx, 0x100
jl 0x140022964
mov dword [0x1401c4d60], r9d
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
call fcn.140025920
mov r8d, eax
lea rdx, str.curtime_d
mov rcx, rbx
call fcn.1400119e0
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xe
jne 0x140022a78
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140024a00
Capabilities:
Get disk size

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rsp + 0x30], 0
lea rax, [r11 + 0x20]
mov qword [r11 + 0x18], rax
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rbp, str.Verifier
mov rsi, rbp
shr rsi, 0x10
test rsi, rsi
jne 0x140024a7e
movzx ebx, bp
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140024a95
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400025a0
jmp 0x140024a95
mov r8d, 8
mov rdx, rbp
lea rcx, [rsp + 0x98]
call fcn.1400022b0
nop
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0xa8]
call fcn.140002100
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401bfd48]
lea r8, [0x1401c54b0]
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.1400491d0
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140024af1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x140024b30
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rcx, rdi
call fcn.14001fcb0
test al, al
je 0x140024c21
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rax
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
test rsi, rsi
jne 0x140024b90
movzx esi, bp
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x140024ba7
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.1400025a0
jmp 0x140024ba7
mov r8d, 8
mov rdx, rbp
lea rcx, [rsp + 0xa0]
call fcn.1400022b0
nop
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x38]
call fcn.140002100
nop
mov qword [rsp + 0x20], rax
mov r9, 0xffffffff80000002
lea r8, [0x1401c54b0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.1400491d0
nop
mov rdx, rax
mov rcx, rdi
call fcn.140002220
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140024c05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140024c21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400280f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x1401c4d60]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x78787879
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 0xf
jne 0x1400281c4
xor r8d, r8d
nop word [rax + rax]
mov edx, r8d
mov eax, r8d
inc r8d
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
add ecx, eax
cmp r8d, 0x100
jl 0x140028130
mov dword [0x1401c4d60], ecx
mov eax, 1
ret

Function at 0x140028210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov qword [rbp - 0x29], rcx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
mov dword [rbp - 0x19], 0x5f005f
mov dword [rbp - 0x15], 0x520043
mov dword [rbp - 0x11], 0x40005f
mov dword [rbp - 0xd], 0x410046
mov dword [rbp - 9], 0x4c0049
mov dword [rbp - 5], 0x440045
mov dword [rbp - 1], 0x44005f
mov dword [rbp + 3], 0x57004f
mov dword [rbp + 7], 0x4c004e
mov dword [rbp + 0xb], 0x41004f
mov dword [rbp + 0xf], 0x5f0044
mov dword [rbp + 0x13], 0x450052
mov dword [rbp + 0x17], 0x440041
mov dword [rbp + 0x1b], 0x5f0040
mov dword [rbp + 0x1f], 0x520043
mov dword [rbp + 0x23], 0x5f005f
mov word [rbp + 0x27], r15w
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rbp - 0x19]
lea rax, [rbp - 0x19]
test rax, 0xffffffffffff0000
jne 0x14002830f
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14002833a
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.1400025a0
jmp 0x14002833a
lea rax, [rbp - 0x19]
or rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140028320
mov r8d, ecx
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.1400022b0
nop
mov dword [rbp - 0x39], 1
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400ce2d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400296c0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rdx
mov qword [rax - 0x28], 0
mov dword [rax - 0x30], 0x80
mov dword [rax - 0x38], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140029734
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, eax
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14002972d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x1400297cd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x60], 0
mov rax, qword [rdi]
mov ebx, dword [rax - 0x10]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x14002976c
xor edx, edx
mov rcx, rdi
call fcn.1400023a0
lea r8d, [rbx + rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete bl
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1400297ca
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400297e0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor eax, eax
mov rdi, rdx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002982c
call fcn.140028d30
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, eax
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 5
jne 0x14002986e
inc dword [0x1401c59ac]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x14002a310
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rdi
push r15
sub rsp, 0x450
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r8d, dword [0x1401c4d60]
mov r15, rdx
mov eax, 0x88888889
mov r9d, r8d
mov qword [r11 + 0x20], r14
mov r14, rcx
imul r9d, r8d
imul r9d
add edx, r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r9d, edx
cmp r9d, 0xd
jne 0x14002a3e0
mov qword [r11 + 0x18], rsi
xor edi, edi
lea rsi, [rsp + 0x50]
nop word [rax + rax]
xor r9d, r9d
lea ecx, [rdi + 1]
mov eax, r8d
lea ebx, [r9 + 1]
cdq
idiv ecx
mov eax, r8d
sub eax, edi
mov ecx, edx
imul ecx, eax
mov eax, r8d
cdq
idiv ebx
add ecx, eax
sub ecx, r9d
mov edx, ecx
lea rcx, [0x14014d9a0]
call fcn.1400cf1dc
add rsi, 4
mov r9d, ebx
cmp ebx, 0x1c
jge 0x14002a3c8
mov r8d, dword [0x1401c4d60]
jmp 0x14002a383
inc edi
cmp edi, 9
jge 0x14002a3d8
mov r8d, dword [0x1401c4d60]
jmp 0x14002a380
mov rsi, qword [rsp + 0x480]
mov rcx, qword [r14]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 2]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
xor dil, dil
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, qword [rsp + 0x488]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002a4b6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
call fcn.140028de0
test al, al
jne 0x14002a46e
mov eax, 0x74
mov r8d, 0xb8
nop dword [rax + rax]
test r8d, r8d
je 0x14002a465
cdq
mov ecx, r8d
idiv r8d
mov eax, ecx
mov r8d, edx
test ecx, ecx
jne 0x14002a450
add eax, r8d
mov dword [0x1401c4d60], eax
mov rdx, qword [r15]
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rdx - 0x10]
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002a4ad
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x450
pop r15
pop rdi
pop rbx
ret
Function at 0x14002e050
Capabilities:
Get disk size

Disassembly:
push rbx
push rdi
sub rsp, 0x1c8
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
lea rcx, str.Wininet.dll
mov rdi, r9
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x14002e129
mov ebx, dword [0x1401c4d60]
mov eax, 0x92492493
mov ecx, ebx
imul ecx, ebx
imul ecx, ebx
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 2
jne 0x14002e125
mov qword [rsp + 0x1e8], rbp
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1b0], r15
xor r10d, r10d
lea rcx, [rsp + 0x31]
nop dword [rax + rax]
movzx r11d, bl
mov edi, 1
mov esi, 6
sub r11b, r10b
inc edi
add rcx, 4
dec rsi
jne 0x14002e0f1
inc r10d
cmp r10d, 0xf
jl 0x14002e0e0
mov r15, qword [rsp + 0x1b0]
mov r14, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1c0]
mov rbp, qword [rsp + 0x1e8]
xor eax, eax
jmp 0x14002e19a
lea rdx, str.HttpQueryInfoW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14002e183
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 8
jne 0x14002e125
xor r10d, r10d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
jmp 0x14002e19a
xor r10d, r10d
mov r9, rdi
xor r8d, r8d
lea edx, [r10 + 0x16]
mov rcx, rbx
mov qword [rsp + 0x20], r10
call rax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x1c8
pop rdi
pop rbx
ret