joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001323c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rdx, qword [0x18001a170]
test rdx, rdx
jne 0x1800132e4
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [str._fD_HY_LYEaDO_L_T]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017490]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800174a0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800174b0]
movaps xmmword [rdx + 0x2e], xmm0
movabs rcx, 0x4200440059004c
mov qword [rdx + 0x3e], rcx
mov dword [rdx + 0x46], 0x2d0043
mov word [rdx + 0x92], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x2d
inc rax
cmp rax, 0x4a
jne 0x1800132b8
mov word [rsp + 0xd4], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x18001a170], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x58], xmm0
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x68], rax
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x180013352
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret

Function at 0x180013374
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xe8
mov rdi, r8
mov rsi, rdx
mov rdx, qword [0x18001a178]
test rdx, rdx
jne 0x18001341e
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x1800174c0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800174d0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800174e0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800174f0]
movaps xmmword [rdx + 0x2e], xmm0
movabs rcx, 0x67004800690052
mov qword [rdx + 0x3e], rcx
mov dword [rdx + 0x46], 0x63006b
mov word [rdx + 0x4a], 6
mov word [rdx + 0x96], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 6
inc rax
cmp rax, 0x4c
jne 0x1800133f2
mov word [rsp + 0xd8], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x18001a178], rax
mov qword [rsp + 0x50], 0
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x180013470
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x40]
mov r8, rdi
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rdi + 0x10]
jmp 0x180013472
xor eax, eax
mov qword [rsi], rax
mov rax, rsi
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x180013482
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rdx, qword [0x18001a180]
test rdx, rdx
jne 0x18001351e
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180017500]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017510]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017520]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180017530]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0xc000a
mov word [rdx + 0x42], 0x7e
mov word [rdx + 0x86], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x7e
inc rax
cmp rax, 0x44
jne 0x1800134f2
mov word [rsp + 0xc8], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x18001a180], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x50], xmm0
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x18001356e
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.1800147b0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret

Function at 0x180013584
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, qword [rsp + 0x138]
mov ebp, dword [rsp + 0x130]
mov rdx, qword [0x18001a188]
test rdx, rdx
jne 0x18001363d
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180017540]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017550]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017560]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180017570]
movaps xmmword [rdx + 0x2e], xmm0
movabs rcx, 0x7b006100460050
mov qword [rdx + 0x3e], rcx
mov word [rdx + 0x46], 0xf
mov word [rdx + 0x8e], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0xf
inc rax
cmp rax, 0x48
jne 0x180013611
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x18001a188], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x68], xmm0
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x18001369a
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.1800147b0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1800136b4
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
mov bpl, byte [rsp + 0x100]
mov rdx, qword [0x18001a190]
test rdx, rdx
jne 0x180013753
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180017580]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017590]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800175a0]
movaps xmmword [rdx + 0x1e], xmm0
movabs rcx, 0x6d006a00620077
mov qword [rdx + 0x2e], rcx
mov dword [rdx + 0x36], 0x30070
mov word [rdx + 0x72], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 3
inc rax
cmp rax, 0x3a
jne 0x180013727
mov word [rsp + 0xb4], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x18001a190], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], bl
mov byte [rsp + 0x61], bpl
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x1800137b0
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
cmp byte [rsi + 0x22], 0
setne al
jmp 0x1800137b0
and al, 1
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x180013f15
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
xor esi, esi
mov r14, rbx
mov r14, qword [r14]
cmp r14, rbx
je 0x180013f5f
test rdi, rdi
je 0x180013f5b
mov rdx, qword [r14 + 0x50]
mov rcx, rdi
xor r8d, r8d
call fcn.180013ff6
test al, al
je 0x180013f3b
mov rsi, qword [r14 + 0x20]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x18001450c
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [0x180019ce8]
test rax, rax
jne 0x1800145ff
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x1800145c7
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x1800145c7
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rdi, [rcx + 1]
dec r10
mov ebx, r10d
mov r14d, dword [r11 + rbx*4]
mov r15b, byte [rcx + r14]
test r15b, r15b
je 0x1800145c2
add r14, rdi
mov ebp, 0x29071926
movsx r15d, r15b
lea r12d, [r15 - 0x41]
mov r13d, r15d
or r13d, 0x20
cmp r12b, 0x1a
cmovae r13d, r15d
xor r13d, ebp
imul ebp, r13d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x18001458e
cmp ebp, 0xafdc0f61
je 0x1800145de
test rbx, rbx
jne 0x180014573
mov r8, qword [r8]
cmp r8, rdx
je 0x1800145f8
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x18001454c
jmp 0x1800145f8
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + rbx*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x180019ce8], rax
mov edx, 8
mov rcx, rsi
call rax
test eax, eax
je 0x180014611
xor eax, eax
jmp 0x180014614
mov rax, qword [rsi]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140009188
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400091c2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400091c7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140009210
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000b490]
cmp byte [rcx + rax], 0
je 0x140009210
dec r8
sub rdx, 1
jne 0x1400091f6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14000a170
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a1ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a1ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a1ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a1ba
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a1ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a1bc
xor al, al
add rsp, 0x28
ret
Function at 0x140936058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409361df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140936089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14093606f
add dl, dl
jne 0x140936096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409360f6
xor eax, eax
add dl, dl
jne 0x1409360a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409361ad
add dl, dl
jne 0x1409360b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409360c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409360d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409360dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409360ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14093607e
mov eax, 1
add dl, dl
jne 0x140936106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140936113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409360fb
sub eax, ebx
mov ebx, 1
jne 0x14093614c
mov ecx, 1
add dl, dl
jne 0x14093612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14093613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140936123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14093607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140936168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140936175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14093615d
cmp eax, 0x7d00
jae 0x14093619b
cmp eax, 0x500
jb 0x140936196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14093607e
cmp eax, 0x7f
ja 0x14093619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14093607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409361d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14093607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003950
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x1400039f0
jmp 0x1400039df
jae 0x140003ab0
cmp r8, 0x201
jae 0x1400039f0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003a48
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x140003a1f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140018050
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003a71
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003b18
mov r8d, r14d
cmp r15, r8
jne 0x1400039d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003b45
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400039df
jmp 0x1400039f0
cmp rsi, r8
jb 0x140003b5f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140004cb0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140003b01
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.1400014d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140003ae9
jmp 0x140003b01
lea rcx, str.internal_error:_entered_unreachable_code_rustc_aedd173a2c086e558c2b66d3743b344f977621a7library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.1400188b0
jmp 0x140003b74
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140018d00
ud2
Function at 0x1400091f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001a908]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140009234
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000929a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400092d1
test eax, eax
js 0x1400092ab
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400092c4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140004b20
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140001d80
mov ecx, 7
int 0x29
ud2
Function at 0x140016490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001650a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140016500
cmp r11, r10
ja 0x140016595
cmp r10, rdx
ja 0x1400165a7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140016502
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400164e0
jmp 0x140016577
ja 0x14001650a
mov r11, r10
cmp rax, r8
jne 0x1400164b2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001657b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140016550
mov r8, r10
sub ecx, r9d
jns 0x14001656e
jmp 0x14001657d
cmp r10, rdx
je 0x140016589
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001657d
xor al, 1
cmp r8, rdx
jne 0x140016530
jmp 0x14001657d
xor eax, eax
jmp 0x14001657d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140018750
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140018d80
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140018d00
int3

Function at 0x140017ab8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017b02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017b02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017b02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017b02
cmp dword [rcx + 0x84], 0xe
jbe 0x140017b02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017b04
xor al, al
add rsp, 0x28
ret
Function at 0x1400018a0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
mov eax, 0x32040
call fcn.140010b00
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], sil
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 1]
lea rcx, str.HTTPGET
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
je 0x140001a09
cmp qword [rbx + 0x18], 0x10
jb 0x140001916
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbp, rax
test rax, rax
je 0x140001a00
mov dword [rsp + 0x32070], esi
lea r9, [rsp + 0x32070]
mov r8d, 0x32000
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400019f7
nop dword [rax]
mov eax, dword [rsp + 0x32070]
test eax, eax
je 0x1400019f7
mov esi, eax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1400019be
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400019a4
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140007780
mov byte [rbx + rsi], 0
jmp 0x1400019d3
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
call fcn.140001f90
lea r9, [rsp + 0x32070]
mov r8d, 0x32000
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140001970
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rdi
lea r11, [rsp + 0x32040]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140008a5c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140008858
Function at 0x14000c640
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000c6c7
mov rsi, rbx
cmp word [rax], bp
je 0x14000c686
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000c670
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000c66c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000b05c
mov rdi, rax
test rax, rax
je 0x14000c6b4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140007780
mov rbp, rdi
xor ecx, ecx
call fcn.14000a514
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret