joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011e00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x350
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov rbx, rcx
movsx ecx, byte [rcx]
mov ebp, r8d
mov rsi, rdx
call fcn.1800198b8
test eax, eax
je 0x180011e6d
cmp byte [rbx + 1], 0x3a
jne 0x180011e6d
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x180011e40
cmp ebp, edi
jle 0x180011e66
sub rsi, rbx
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rsi + rbx - 1], al
test al, al
jne 0x180011e50
mov al, 1
jmp 0x180011fdd
xor al, al
jmp 0x180011fdd
movzx ecx, byte [rbx]
call fcn.180012d10
test al, al
je 0x180011eb6
movzx ecx, byte [rbx + 1]
call fcn.180012d10
test al, al
je 0x180011eb6
or rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x180011e90
cmp ebp, edi
jle 0x180011e66
sub rsi, rbx
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rsi + rbx - 1], al
test al, al
jne 0x180011ea0
mov al, 1
jmp 0x180011fdd
movzx ecx, byte [rbx]
call fcn.180012d10
test al, al
je 0x180011ee5
lea rcx, [rsp + 0x130]
mov edx, pe_nt_image_headers64
call fcn.180012040
test al, al
je 0x180011e66
lea rcx, [rsp + 0x130]
jmp 0x180011fcf
lea rdx, [rsp + 0x20]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x106
jl 0x180011f07
mov ecx, MsiReinstallFeatureW
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x230]
mov r8d, 0x105
mov rcx, rbx
call fcn.180012b20
test al, al
je 0x180011fca
lea rdx, [0x1800335a8]
mov r8d, 1
mov rcx, rbx
call fcn.180018dd0
or rdi, 0xffffffffffffffff
test eax, eax
jne 0x180011f80
lea r8d, [rdi + 3]
lea rdx, [0x18003398c]
mov rcx, rbx
call fcn.180018dd0
test eax, eax
je 0x180011f80
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x180011f60
cmp eax, 2
jle 0x180011f74
add rbx, 2
jmp 0x180011f80
lea rbx, [0x180032234]
nop dword [rax + rax]
test rbx, rbx
je 0x180011fca
lea rdx, [0x18003398c]
mov r8d, 2
mov rcx, rbx
call fcn.180018dd0
test eax, eax
jne 0x180011fca
lea edx, [rax + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.1800194b4
test rax, rax
je 0x180011fca
mov byte [rax], 0
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x180011fb6
cmp eax, 3
jle 0x180011f74
add rbx, 3
jmp 0x180011f80
lea rcx, [rsp + 0x20]
mov r9d, ebp
mov r8, rsi
mov rdx, rbx
call fcn.180012920
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.180016e40
mov rbx, qword [rsp + 0x388]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret

Function at 0x180012000
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x180012026
cmp eax, ebx
jle 0x18001202e
mov ecx, MsiReinstallFeatureW
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180012040
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edi, edx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x18001208a
cmp eax, 0x105
jle 0x1800120ad
mov ecx, MsiReinstallFeatureW
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180016e40
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
movsx ecx, byte [rsp + 0x20]
call fcn.1800198b8
movzx ecx, byte [rsp + 0x21]
test eax, eax
je 0x180012116
cmp cl, 0x3a
jne 0x180012116
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.180017a4c
test rax, rax
je 0x1800120dc
mov byte [rax], 0
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1800120e5
cmp edi, eax
jle 0x18001208a
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
sub rbx, rax
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rbx + rcx - 1], al
test al, al
jne 0x180012100
mov al, 1
jmp 0x18001208c
cmp byte [rsp + 0x20], 0x5c
jne 0x18001208a
cmp cl, 0x5c
jne 0x18001208a
lea rcx, [rsp + 0x22]
mov edx, 0x5c
call fcn.180017a4c
test rax, rax
je 0x180012141
mov byte [rax], 0
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180012150
cmp edi, eax
jle 0x18001208a
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
sub rbx, rax
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rbx + rcx - 1], al
test al, al
jne 0x180012170
mov al, 1
jmp 0x18001208c
Function at 0x180012190
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx edi, dl
lea r8, [rsp + 0x160]
lea rdx, [0x180033988]
mov r9d, 0x105
xor ebx, ebx
call fcn.180012920
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180012295
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rsp + 0x4c]
movzx ecx, byte [rsp + 0x4d]
cmp dl, byte [0x1800335a8]
jne 0x18001221e
cmp cl, byte [0x1800335a9]
jne 0x18001221e
xor eax, eax
jmp 0x180012223
sbb eax, eax
or eax, 1
test eax, eax
jne 0x18001222c
test dil, dil
je 0x18001227f
cmp dl, byte [0x18003398c]
jne 0x18001224d
cmp cl, byte [0x18003398d]
jne 0x18001224d
movzx eax, byte [rsp + 0x4e]
cmp al, byte [0x18003398e]
jne 0x18001224d
xor eax, eax
jmp 0x180012252
sbb eax, eax
or eax, 1
test eax, eax
jne 0x18001225b
test dil, dil
je 0x18001227f
test rbx, rbx
jne 0x18001226a
xor ecx, ecx
call fcn.180015d30
mov rbx, rax
lea rcx, [rsp + 0x4c]
call fcn.1800110d0
mov rcx, rbx
mov rdx, rax
call fcn.180015cf0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180012200
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call fcn.180015d00
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180016e40
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180012590
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov rdx, rcx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1800125bd
cmp eax, ebx
jle 0x1800125ca
mov ecx, MsiReinstallFeatureW
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dl, 0x5c
mov rcx, rdi
call fcn.1800118c0
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1800125f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x30]
mov rbx, rdx
mov esi, r8d
mov edx, ecx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, eax
test eax, eax
jne 0x180012672
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180012643
cmp esi, eax
jle 0x18001269c
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub rbx, rcx
nop dword [rax]
movzx ecx, byte [rax]
inc rax
mov byte [rbx + rax - 1], cl
test cl, cl
jne 0x180012660
mov al, 1
jmp 0x18001269e
cmp eax, 0x80004005
je 0x18001267e
cmp eax, 1
jne 0x180012689
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x80070057
jne 0x18001269c
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180016e40
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800126d0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 8
mov edi, edx
call fcn.18001782c
mov rbx, rax
xor eax, eax
mov qword [rbx], rax
test rbx, rbx
je 0x180012737
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx], rax
test rax, rax
je 0x180012727
cmp edi, 1
jne 0x180012719
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1800177ec
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180015e50
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x18002cf8c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18002cfa2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18002cfa4
xor eax, eax
test eax, eax
je 0x18002cfb4
mov ecx, eax
call fcn.18001cd50
or eax, 0xffffffff
jmp 0x18002cfb6
xor eax, eax
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405490]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004054a0]
mov dword [rax], 1
mov rax, qword [0x004054b0]
mov dword [rax], 1
mov rax, qword [0x00405480]
mov dword [rax], 1
mov rax, qword [0x00405310]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00405470]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x004053d0]
mov qword [rdx], rax
mov rdx, qword [0x004053c0]
mov qword [rdx], rax
mov rax, qword [0x00405430]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004052c0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401cc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00408054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x401dda
mov rax, qword [0x00408058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x401d0e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401dc0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401cf2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401e12
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00408058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00408058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401df5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401db9
sub eax, 0x40
and eax, 0xffffffbf
je 0x401db9
mov r9, rbp
add r9, qword [0x00408058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401de1
add dword [0x00408054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x401d1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00408058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x4029f0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402a00
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402a10
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402a51
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402a48
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402a53
add rax, 0x28
cmp rax, r9
jne 0x402a34
xor eax, eax
repz ret

Function at 0x402b00
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00405310]
cmp word [rbx], 0x5a4d
je 0x402b20
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402b14
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x402d70
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004089c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004089a0]
test rbx, rbx
je 0x402dc4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402dbb
test rsi, rsi
je 0x402dbb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402da0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004089c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x14000c65c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014cb8], rbx
je 0x14000c6c3
cmp rax, rbx
jne 0x14000c6b6
mov ebx, 1
mov esi, ebx
jmp 0x14000c6c8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c69b
mov ebx, 1
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c6e0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c74c
mov eax, dword [0x140014cc0]
test eax, eax
jne 0x14000c741
mov dword [0x140014cc0], ebx
lea r15, [0x14000eb70]
lea rdi, [0x14000eb58]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c733
test eax, eax
jne 0x14000c737
cmp qword [rdi], r14
je 0x14000c728
mov rax, qword [rdi]
mov rcx, qword [0x14000eb00]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c70a
test eax, eax
je 0x14000c747
mov eax, 0xff
jmp 0x14000c8a0
mov dword [0x140014400], ebx
mov edi, 0x1f
mov eax, dword [0x140014cc0]
cmp eax, ebx
jne 0x14000c773
lea rdx, [0x14000eb50]
lea rcx, [0x14000eb18]
call sub.msvcrt.dll__initterm
mov dword [0x140014cc0], 2
test esi, esi
jne 0x14000c781
mov rax, r14
xchg qword [0x140014cb8], rax
cmp qword [0x140014cd8], r14
je 0x14000c7b4
lea rcx, [0x140014cd8]
call fcn.14000cc80
test eax, eax
je 0x14000c7b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014cd8]
mov r9, qword [0x14000eb00]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c7cd
mov eax, 0xff
jmp 0x14000c8a0
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000c851
cmp word [rcx], r14w
je 0x14000c7e6
test edx, edx
jne 0x14000c851
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x14000c7fc
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7e6
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400018e8
mov dword [0x1400143fc], eax
cmp dword [0x140014420], r14d
jne 0x14000c83a
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140014400], r14d
jne 0x14000c84f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143fc]
jmp 0x14000c8a0
cmp word [rcx], 0x22
jne 0x14000c865
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c7d6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140131000
add rsp, 0x28
jmp 0x14000c65c
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edx, 1
lea r9, [rsp + 0x30]
lea rcx, [0x1400179f0]
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, str.User_Agent
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
xor r9d, r9d
lea rdx, [0x1400179f0]
mov rcx, rax
mov r8d, 0xc00
mov rbx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400010a0
add rsp, 0x40
pop rbx
ret

Function at 0x140003bf4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003a20
Function at 0x14001a880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001aa0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x140384d80]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400387c0
xorps xmm15, xmm15
mov r14, qword [0x1408292e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001a8e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001a8f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001a913
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001a923
cmp rbx, 0x1000
jae 0x14001a8eb
jmp 0x14001a98d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001a935
xor edx, edx
jmp 0x14001a984
mov rcx, qword [0x140384d80]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400387c0
xorps xmm15, xmm15
mov r14, qword [0x1408292e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001a919
jmp 0x14001a908
call fcn.14006c980
xorps xmm15, xmm15
mov r14, qword [0x1408292e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003cf40
lea rax, [0x14046e3f3]
mov ebx, 0x18
nop dword [rax]
call fcn.14003d7c0
mov rax, qword [rsp + 0x38]
call fcn.14003d500
lea rax, [0x14046f01d]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003d7c0
mov rax, qword [rsp + 0x30]
call fcn.14003d500
call fcn.14003d180
call fcn.14003cfa0
lea rax, [0x1404740d0]
mov ebx, 0x21
call fcn.14003b5a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069220
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001a880
Function at 0x14001aa40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001ac66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x140384d78]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140038840
xorps xmm15, xmm15
mov r14, qword [0x1408292e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001aab3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001aac2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x14001aae5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001aaf5
cmp rbx, 0x1000
jae 0x14001aab9
nop
jmp 0x14001ab78
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001ab0d
xor esi, esi
jmp 0x14001ab6a
mov rax, qword [0x140384d78]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140038840
xorps xmm15, xmm15
mov r14, qword [0x1408292e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001aaeb
jmp 0x14001aad6
call fcn.14006c980
xorps xmm15, xmm15
mov r14, qword [0x1408292e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001ac00
nop dword [rax + rax]
call fcn.14003cf40
lea rax, [0x14046f036]
mov ebx, 0x19
call fcn.14003d7c0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003d500
lea rax, [0x14046f01d]
mov ebx, 0x19
call fcn.14003d7c0
mov eax, dword [rsp + 0x34]
call fcn.14003d500
nop
call fcn.14003d180
call fcn.14003cfa0
lea rax, [0x1404669bb]
mov ebx, 0xd
call fcn.14003b5a0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x14001aba0
call fcn.14003cf40
lea rax, [0x14046f036]
mov ebx, 0x19
call fcn.14003d7c0
mov rax, qword [rsp + 0x38]
call fcn.14003d500
lea rax, [0x14046f01d]
mov ebx, 0x19
call fcn.14003d7c0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003d500
call fcn.14003d180
call fcn.14003cfa0
lea rax, [0x140472d9a]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.14003b5a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069220
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001aa40