joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a530
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x18000a569
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18000a657
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x18000a5ff
cmp qword [rsp + 0x20], 0
jle 0x18000a5ff
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x18000a5a9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.18000cd90
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x18000a647
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x18000a647
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x18000a660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x18000a694
xor eax, eax
jmp 0x18000a846
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x18000a6bd
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x18000a846
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x18000a75c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.18000a860
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.18000cd90
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x18000a836
mov rcx, qword [rsp + 0x70]
call fcn.18000bfd0
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x18000a7fd
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x18000a7fb
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x18000a846
jmp 0x18000a782
cmp qword [rsp + 0x40], 0
jbe 0x18000a836
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18000f230
add rsp, 0x68
ret
Function at 0x18000c090
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x18000c0cd
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18000c0d4
mov al, 1
jmp 0x18000c218
call fcn.180001100
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + 0x18]
mov dword [rsp + 0x38], eax
call fcn.180001100
mov ecx, dword [rsp + 0x38]
mov edx, ecx
mov ecx, eax
call fcn.180001110
movzx eax, al
test eax, eax
je 0x18000c11f
xor al, al
jmp 0x18000c218
mov qword [rsp + 0x50], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x18000c185
cmp dword [rsp + 0x30], 1
je 0x18000c191
cmp dword [rsp + 0x30], 3
je 0x18000c206
jmp 0x18000c216
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x18000c1dd
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x40], rax
je 0x18000c1dd
xor al, al
jmp 0x18000c218
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18000c1f7
mov dword [rsp + 0x34], 1
jmp 0x18000c1ff
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x18000c218
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x18000c218
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18000f230
add rsp, 0x98
ret
Function at 0x1400011a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rdx, [0x1400056a0]
lea rcx, str.C:UsersuserDesktoppayload_x64.bin
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400011de
lea rcx, str.Failed_to_open_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, 1
jmp 0x14000123f
mov r9, qword [rsp + 0x20]
mov r8d, 0x4ccb6
mov edx, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001234
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne 0x140001234
lea rcx, str.Failed_to_read_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 1
jmp 0x14000123f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add rsp, 0x38
ret
Function at 0x140001780
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
and rax, 0xfffffffffff70000
sub rax, 0x70000000
mov qword [rsp + 0x38], rax
jmp 0x1400017cd
mov rax, qword [rsp + 0x38]
add rax, 0x10000
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0x70000000
cmp qword [rsp + 0x38], rax
jae 0x140001820
movsxd rax, dword [rsp + 0x70]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140001814
jmp 0x1400017bd
mov dword [rsp + 0x30], 1
jmp 0x140001820
cmp dword [rsp + 0x30], 1
jne 0x14000183f
mov rdx, qword [rsp + 0x38]
lea rcx, str._____Found_Memory_Hole:__p_n
call fcn.140001060
mov rax, qword [rsp + 0x38]
jmp 0x140001841
xor eax, eax
add rsp, 0x58
ret

Function at 0x140002150
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000219a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000219a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000219a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000219a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000219a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000219c
xor al, al
add rsp, 0x28
ret
Function at 0x140058340
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140200260]
xor rax, rsp
mov qword [rbp], rax
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x50], r8
xor esi, esi
mov qword [rbp - 8], rsi
mov rcx, qword [rdx + 0x38]
test rcx, rcx
je 0x140058389
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax]
mov qword [rbp - 8], rax
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14005a390
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x48], rsi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400583ba
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
call qword [rax]
mov qword [rbp - 0x48], rax
mov ecx, 0x60
call fcn.140113680
mov rbx, rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], SafeArrayGetLBound
mov byte [rsp + 0x60], 0
lea rcx, [rax + 0x20]
mov qword [rcx + 0x38], rsi
lea rdx, [rbp - 0x80]
call fcn.14005b850
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x14005d5d0]
xor edx, edx
xor ecx, ecx
call fcn.140118ef0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400584cc
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14005844d
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp - 0x48], rsi
lea rcx, [rsp + 0x60]
call fcn.140056cb0
cmp dword [rsp + 0x38], 0
je 0x1400584db
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1400f5b0c
test eax, eax
jne 0x1400584c4
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14005849d
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp - 8], rsi
mov rcx, rdi
call fcn.140056cb0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140113660
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.1400f4eec
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call fcn.1400f4f28
nop
mov ecx, 1
call fcn.1400f4f28
int3
Function at 0x140065160
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140200260]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140065234
cmp byte [rcx + 0x72], 0
je 0x140065234
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140065230
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400651f6
sub eax, 1
je 0x1400651fa
cmp eax, 2
jne 0x140065230
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140113660
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140065227
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1401198a0
cmp rdi, rax
jne 0x140065230
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1400651de
xor al, al
jmp 0x1400651de
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140113660
add rsp, 0x60
pop rbx
ret
Function at 0x14006c090
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140200260]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14006c0c1
xor eax, eax
jmp 0x14006c20f
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14006c0fe
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14006c0fe
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14006c20f
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14006c204
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14006c145
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14006c16e
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140120088
cmp ax, di
je 0x14006c204
movzx edi, si
jmp 0x14006c204
lea r8, [rsp + 0x48]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x14006c1c4
sub eax, 1
je 0x14006c1c4
cmp eax, 2
jne 0x14006c204
movzx ecx, word [rsp + 0x40]
jmp 0x14006c151
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14006c1f1
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.1401198a0
cmp rbp, rax
jne 0x14006c204
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, si
jne 0x14006c207
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140113660
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006d190
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140200260]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
movdqa xmm0, xmmword [0x1401e06f0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], bl
xor r8d, r8d
lea rdx, [0x140188b29]
lea rcx, [rsp + 0x40]
call fcn.140056d30
nop
lea rcx, [rsp + 0x40]
call fcn.1400c3710
test eax, eax
jne 0x14006d321
lea r8d, [rbx + 0x10]
lea rdx, str.OperatingConfigs
lea rcx, [rsp + 0x40]
call fcn.14005b2d0
mov qword [rsp + 0x20], rbx
movdqa xmm0, xmmword [0x1401e06e0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x20]
call fcn.14006dc90
test al, al
je 0x14006d317
mov qword [rsp + 0x60], rbx
movdqa xmm0, xmmword [0x1401e06e0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], bx
lea r8d, [rbx + 0x17]
lea rdx, str.EnableUrlLogging.CONFIG
lea rcx, [rsp + 0x60]
call fcn.140056b80
nop
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r8, qword [rsp + 0x20]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.14012b328
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x14006d30c
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14006d2c0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x20]
call fcn.140056b80
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
lea rcx, [rsp + 0x60]
call fcn.140056af0
nop
lea rcx, [rsp + 0x20]
call fcn.140056af0
jmp 0x14006d323
lea rcx, [rsp + 0x60]
call fcn.140056af0
nop
lea rcx, [rsp + 0x20]
call fcn.140056af0
xor bl, bl
lea rcx, [rsp + 0x40]
call fcn.140056cb0
movzx eax, bl
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140113660
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rbp
ret
Function at 0x14006e5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x14006e754
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x14006e754
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x14006e65b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x14006e77b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14006e672
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x14006e672
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14006e685
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x14006e6d2
mov r8d, eax
cmp eax, 0x800
jae 0x14006e69f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x14006e6d2
cmp eax, 0x10000
jae 0x14006e6b9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x14006e6d2
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x14006e754
add qword [r14], 2
test sil, sil
jne 0x14006e6f3
cmp r10d, 3
jae 0x14006e6ff
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x14006e731
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x14006e710
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14006e60f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14006e762
Function at 0x1400770d0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x140200260]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r9
mov rsi, r8
mov rbx, rcx
mov qword [rbp - 0x58], rcx
lea rcx, [rbp - 0x50]
call fcn.14005a390
nop
mov r8d, 1
lea rdx, [0x14018f1f0]
lea rcx, [rbp - 0x50]
call fcn.14005b2d0
mov r8d, 2
lea rdx, [0x14018fe68]
lea rcx, [rbp - 0x50]
call fcn.14005b2d0
mov r8d, 1
lea rdx, [0x14018f1f0]
lea rcx, [rbp - 0x50]
call fcn.14005b2d0
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140077150
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rbp - 0x50]
call fcn.14005b2d0
mov r8d, 1
lea rdx, [0x14018e25c]
lea rcx, [rbp - 0x50]
call fcn.14005b2d0
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140077180
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x50]
call fcn.14005b2d0
xor edi, edi
mov qword [rbp - 0x30], rdi
movdqa xmm0, xmmword [0x1401e06e0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x30]
call fcn.14006dc90
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400771f8
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], SafeArrayGetLBound
mov byte [rbx], al
xor r8d, r8d
lea rdx, [0x140188b29]
mov rcx, rbx
call fcn.140056d30
jmp 0x140077218
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
movdqa xmm0, xmmword [0x1401e06f0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
lea rcx, [rbp - 0x30]
call fcn.140056af0
nop
lea rcx, [rbp - 0x50]
call fcn.140056cb0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140113660
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14007b3f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov rdi, r8
mov rbx, rdx
mov rdx, qword [r9 + 8]
test rdx, rdx
je 0x14007b489
cmp qword [rdx + 8], 0
je 0x14007b489
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
mov qword [rax - 0x28], 0
mov qword [rax - 0x18], 0
mov qword [rax - 0x10], 7
lea rcx, [rax - 0x28]
call fcn.140056b80
cmp qword [rsp + 0x40], 0
je 0x14007b47e
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.140056af0
nop
mov rdx, qword [rbx]
test rdx, rdx
je 0x14007b4a7
mov rax, qword [rdx + 8]
movsxd rcx, dword [rax + 4]
add rdx, 8
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
test rdx, rdx
je 0x14007b4c5
mov rax, qword [rdx + 8]
movsxd rcx, dword [rax + 4]
add rdx, 8
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret