joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c160
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov r14, r8
mov rcx, r8
mov r15, rdx
xor ebx, ebx
call fcn.14000e1e0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x10], rbx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x18], rbx
lea rdx, [0x1400693d8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x14001c292
test rdi, rdi
je 0x14001c1fb
mov rcx, rdi
call fcn.14002adf0
test rax, rax
je 0x14001c1fb
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
jmp 0x14001c203
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
test esi, esi
jne 0x14001c292
mov esi, 0x1388
mov dword [rbp - 0x20], 1
mov ecx, esi
call fcn.14002647c
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
mov rdi, rax
mov dword [rbp + 0x38], esi
lea rax, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c26c
test rdi, rdi
je 0x14001c259
mov rcx, rdi
call fcn.14002adf0
mov ebx, eax
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
call fcn.14000e3b0
mov ebx, 1
mov rcx, qword [rbp - 0x10]
cmp qword [rbp - 0x18], rcx
je 0x14001c284
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.140025ee0
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001c2b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
lea rax, [rbp - 0x10]
mov dword [r8], ebx
mov r14, r8
mov r15, rdx
mov qword [rbp - 0x10], rbx
mov rdi, rcx
mov qword [rbp - 0x18], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [0x1400693d8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x14001c3a5
test rdi, rdi
je 0x14001c342
mov rcx, rdi
call fcn.14002adf0
test rax, rax
je 0x14001c342
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x18]
mov esi, eax
jmp 0x14001c34a
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x18], rcx
test esi, esi
jne 0x14001c3a5
lea rax, [rbp + 0x48]
mov dword [rbp + 0x40], ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rax, [rbp + 0x40]
mov dword [rbp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c387
mov eax, dword [rbp + 0x40]
lea ebx, [rsi + 1]
mov dword [r14], eax
mov rcx, qword [rbp - 0x10]
cmp qword [rbp - 0x18], rcx
je 0x14001c39f
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c3bc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
and qword [rbp - 0x20], 0
mov rdi, r8
and qword [rbp - 0x18], 0
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov r15d, 0x2001f
lea rdx, str.Software
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c506
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BugSplat
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c47f
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, str.BugSplat
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001c506
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c4d8
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rdx, rbx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001c506
mov rcx, rdi
call fcn.14002adf0
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 0x18]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001c515
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14001c524
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14001c533
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x14001c548
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140076088]
xor rax, rsp
mov qword [rbp + 0x170], rax
and dword [rsp + 0x40], 0
lea r8, str.SYSTEMCurrentControlSetServicesEventLogApplication_ls
and qword [rsp + 0x30], 0
mov r9, rcx
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.14000dbe8
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14001c6c4
mov rcx, qword [0x140078210]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x60]
call fcn.14002adf0
mov r9d, 2
lea rdx, str.EventMessageFile
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001c6c4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea rdx, str.TypesSupported
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001c6c4
cmp dword [rsp + 0x40], eax
jbe 0x14001c6b9
lea rcx, [rsp + 0x60]
call fcn.14002adf0
mov r9d, 2
lea rdx, str.CategoryMessageFile
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001c6c4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.CategoryCount
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001c6c4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140025e90
add rsp, 0x280
pop rbp
ret
Function at 0x14001e918
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd r14, edx
mov rsi, r8
lea r8, str.bad_pack_level
mov rbx, rcx
lea eax, [r14 - 1]
cmp eax, 7
setbe dl
call fcn.14001d160
xor edi, edi
mov dword [rcx + 0x6afc0], edi
cmp dword [rcx + 0x6afb8], edi
jne 0x14001e974
mov dword [rcx + 0x6afc0], 1
mov dword [rcx + 0x6afb8], 0x10000
mov dword [rcx + 0x6afb4], edi
xor edx, edx
add rcx, 0x4afb8
mov r8d, 0x1fffc
call fcn.140027e00
lea rdx, [0x140069da0]
mov ebp, 2
movzx eax, word [rdx + r14*8 + 2]
mov dword [rbx + 0x6afe0], eax
movzx eax, word [rdx + r14*8]
mov dword [rbx + 0x6afe4], eax
movzx eax, word [rdx + r14*8 + 4]
mov dword [rbx + 0x6afe8], eax
movzx eax, word [rdx + r14*8 + 6]
mov dword [rbx + 0x6afdc], eax
cmp r14d, ebp
jg 0x14001e9d4
or word [rsi], 4
jmp 0x14001e9dd
cmp r14d, 8
jl 0x14001e9dd
or word [rsi], bp
lea rsi, [rbx + 0x1afb8]
mov dword [rbx + 0x6afcc], edi
mov rdx, rsi
mov dword [rbx + 0x6afbc], edi
mov r8d, 0x10000
mov rcx, rbx
call qword [rbx + 0x10]
mov dword [rbx + 0x6afd8], eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x14001ea47
mov dword [rbx + 0x6afd4], edi
cmp eax, 0x106
jae 0x14001ea22
mov rcx, rbx
call fcn.14001ec90
mov dword [rbx + 0x6afc4], edi
movzx eax, byte [rsi]
inc rsi
shl edi, 5
xor edi, eax
and edi, 0x7fff
mov dword [rbx + 0x6afc4], edi
sub rbp, 1
jne 0x14001ea28
jmp 0x14001ea52
mov qword [rbx + 0x6afd4], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001ff14
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14001ff2d
xor eax, eax
jmp 0x14001ffa1
lea rdi, [0x1400699a0]
not r9d
cmp r8, 8
jb 0x14001ff76
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
mov ebx, 8
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
inc r11
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x14001ff50
sub r10, 1
jne 0x14001ff4b
test r8, r8
je 0x14001ff9b
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
inc r11
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub r8, 1
jne 0x14001ff7b
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14002015c
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x88
mov rax, qword [0x140076088]
xor rax, rsp
mov qword [rbp + 7], rax
mov r12, qword [rbp + 0x7f]
mov rsi, r9
mov r15, r8
mov r13, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x1400201a8
mov eax, 0x1000000
jmp 0x14002035c
lea rdx, [rbp - 0x31]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1400201c3
mov eax, 0x200
jmp 0x14002035c
mov r8d, dword [rbp - 0x31]
mov eax, r8d
mov r9d, r8d
and r9d, 1
mov ecx, r9d
or ecx, 2
and al, 2
mov eax, r8d
cmove ecx, r9d
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov ecx, r8d
mov eax, edx
or eax, 0x10
and ecx, 0x10
cmove eax, edx
mov edi, eax
or edi, 0x20
and r8b, 0x20
cmove edi, eax
neg ecx
sbb eax, eax
and eax, 0xc0000000
add eax, 0x81000000
or edi, eax
test r9d, r9d
jne 0x14002021d
bts edi, 0x17
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0x28
jbe 0x1400202f6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x39]
mov r8d, 2
lea rdx, [rbp - 0x41]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x24]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x39]
mov r8d, 4
lea rdx, [rbp - 0x3d]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [rbp - 0x41], ax
jne 0x1400202f6
mov edx, dword [rbp - 0x3d]
lea eax, [rdx + 0x34]
cmp r14d, eax
jbe 0x1400202f6
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x39]
mov r8d, 4
lea rdx, [rbp - 0x35]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x35]
cmp eax, 0x5a4d
je 0x1400202f2
add eax, 0xffffbab4
cmp eax, 4
ja 0x1400202f6
mov ecx, 0x15
bt ecx, eax
jae 0x1400202f6
bts edi, 0x16
test r13, r13
je 0x1400202ff
mov dword [r13], edi
test r15, r15
je 0x140020307
mov dword [r15], r14d
test rsi, rsi
je 0x140020332
mov rcx, qword [rbp - 0x25]
call fcn.14002008c
mov rcx, qword [rbp - 0x1d]
mov qword [rsi], rax
call fcn.14002008c
mov rcx, qword [rbp - 0x2d]
mov qword [rsi + 8], rax
call fcn.14002008c
mov qword [rsi + 0x10], rax
test r12, r12
je 0x14002035a
lea r8, [rbp - 0x3d]
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x1d]
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx ecx, word [rbp - 0x41]
movzx eax, word [rbp - 0x3d]
shl ecx, 0x10
or ecx, eax
mov dword [r12], ecx
xor eax, eax
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140025e90
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14002042c
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
jne 0x140020434
xor eax, eax
ret
jmp fcn.14002043c
Function at 0x14002043c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rbx, rcx
mov edi, r8d
je 0x14002047a
mov ecx, dword [rcx + 0x28]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x2c]
jb 0x140020467
mov dword [rbx + 0x14], 0x30000
jmp 0x1400204a3
add rcx, qword [rbx + 0x20]
mov r8, rdi
call fcn.140027990
add dword [rbx + 0x28], edi
mov eax, edi
jmp 0x1400204a5
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002049c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
jmp 0x1400204a5
mov dword [rbx + 0x14], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140020788
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx + 0x88]
test rcx, rcx
je 0x1400207f4
mov eax, dword [rdi + 0x94]
mov esi, dword [rdi + 0x90]
cmp eax, esi
jae 0x140020835
sub esi, eax
lea rdx, [rcx + rax]
cmp esi, r8d
mov rcx, rbp
cmova esi, r8d
mov r8d, esi
call fcn.140027990
mov ecx, dword [rdi + 0x70]
mov rdx, rbp
add dword [rdi + 0x94], esi
add dword [rdi + 0x6c], esi
mov r8d, esi
call fcn.14001ff14
mov dword [rdi + 0x70], eax
mov eax, esi
jmp 0x140020837
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x14002082e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140020835
mov ebx, dword [rsp + 0x40]
mov rdx, rbp
add dword [rdi + 0x6c], ebx
mov r8d, ebx
mov ecx, dword [rdi + 0x70]
call fcn.14001ff14
mov dword [rdi + 0x70], eax
mov eax, ebx
jmp 0x140020837
mov dword [rdi + 0x14], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140021124
Capabilities:
Get file size

Disassembly:
mov rcx, qword [rcx]
test rcx, rcx
je 0x140020589
xor edx, edx
jmp qword [sym.imp.KERNEL32.dll_GetFileSize]
xor eax, eax
ret
cmp dword [rcx], 2
je 0x14002112c
xor eax, eax
ret
mov rcx, qword [rcx + 8]
jmp 0x140020578
Function at 0x140022540
Capabilities:
Send data
Send http request

Disassembly:
push rbx
mov eax, 0x6060
call fcn.140026b20
sub rsp, rax
mov rax, qword [0x140076088]
xor rax, rsp
mov qword [rsp + 0x6050], rax
mov qword [rsp + 0x38], 0
lea rax, [0x1400673a8]
mov dword [rsp + 0x30], 0x84c01000
mov rbx, rcx
mov rcx, qword [rcx + 0x71ab0]
mov r8, rdx
mov qword [rsp + 0x28], 0
lea rdx, str.POST
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x84c01000
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov qword [rbx + 0x71ab8], rax
test rax, rax
jne 0x1400225cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x71ac0], eax
xor eax, eax
jmp 0x140022662
lea r9, [rsp + 0x44]
mov dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], 4
mov edx, 0x1f
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
test eax, eax
je 0x1400225b8
mov rcx, qword [rbx + 0x71ab8]
lea r8, [rsp + 0x40]
or dword [rsp + 0x40], 0x80
mov r9d, 4
lea edx, [r9 + 0x1b]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
test eax, eax
je 0x1400225b8
mov r8d, 0x2000
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140021c40
mov rcx, qword [rbx + 0x71ab8]
lea r9, [rsp + 0x50]
mov r8d, gethostbyname
mov dword [rsp + 0x20], eax
lea rdx, str.Content_Type:_application_x_www_form_urlencoded_r_n
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x1400225b8
mov eax, 1
mov rcx, qword [rsp + 0x6050]
xor rcx, rsp
call fcn.140025e90
add rsp, 0x6060
pop rbx
ret
Function at 0x140022680
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
push rdi
push r12
push r13
push r14
mov eax, 0x2078
call fcn.140026b20
sub rsp, rax
mov rax, qword [0x140076088]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov r14, qword [rsp + 0x20c8]
mov r13, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2000
mov r12, r9
call fcn.140027e00
cmp qword [rdi + 0x71ab8], 0
jne 0x1400226ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x71ac0], eax
xor eax, eax
jmp 0x140022879
mov qword [rsp + 0x2070], rbx
xor edx, edx
mov qword [rsp + 0x2068], rbp
mov rcx, r12
mov qword [rsp + 0x2058], r15
mov r15d, dword [rsp + 0x20c0]
mov r8d, r15d
add r8, r8
call fcn.140027e00
xor ebp, ebp
mov qword [rsp + 0x2060], rsi
mov dword [r14], ebp
nop dword [rax]
mov rbx, qword [rdi + 0x71ab8]
test rbx, rbx
je 0x1400227cd
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2000
call fcn.140027e00
lea r9, [0x140077bb4]
mov r8d, 0x2000
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400227cd
mov esi, dword [0x140077bb4]
test esi, esi
je 0x1400227d9
cmp dword [r14], r15d
jae 0x1400227d9
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x40]
mov r9d, esi
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [r14]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov r9d, esi
mov ebx, eax
lea rdx, [r12 + rcx*2]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add dword [r14], ebx
jmp 0x140022730
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x71ac0], eax
mov r8d, dword [rsp + 0x30]
xor edx, edx
add r8, r8
mov rcx, r13
call fcn.140027e00
mov rcx, qword [rdi + 0x71ab8]
lea r9, [rsp + 0x30]
mov r8, r13
mov qword [rsp + 0x20], rbp
mov edx, 0x16
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
mov r15, qword [rsp + 0x2058]
mov rsi, qword [rsp + 0x2060]
mov rbx, qword [rsp + 0x2070]
test eax, eax
jne 0x140022836
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x71ac0], eax
xor eax, eax
jmp 0x140022871
mov rcx, qword [rdi + 0x71ab8]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], ebp
mov edx, 0x20000013
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
cmp dword [rsp + 0x38], 0xc8
sete bpl
mov eax, ebp
mov rbp, qword [rsp + 0x2068]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140025e90
add rsp, 0x2078
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400317a4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14003179c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14002b23c
or eax, 0xffffffff
jmp 0x14003179e
xor eax, eax
add rsp, 0x28
ret
jmp 0x14003177c
Function at 0x140045940
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140045666
call fcn.14002b2ac
mov dword [rax], 0x16
call fcn.14002a6ac
jmp 0x1400457b1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400457b1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400457b1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140045695
lock or dword [rcx + 0x14], 0x10
jmp 0x1400457b1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400456a9
call fcn.140045948
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400456b9
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400456bc
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140041560
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14004eb70
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14004579f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14004574d
mov rcx, rbx
call fcn.140041560
cmp eax, 0xffffffff
je 0x140045738
mov rcx, rbx
call fcn.140041560
cmp eax, 0xfffffffe
je 0x140045738
mov rcx, rbx
call fcn.140041560
movsxd rdi, eax
lea r14, [0x140078f30]
mov rcx, rbx
sar rdi, 6
call fcn.140041560
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14004573f
lea rdx, [0x140076450]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14004574d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140045771
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140045771
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140045771
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14004578f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14004579a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400457b6
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140045630
Function at 0x1491b02c0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1491b0447
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1491b02f1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1491b02d7
add dl, dl
jne 0x1491b02fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1491b035e
xor eax, eax
add dl, dl
jne 0x1491b030d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1491b0415
add dl, dl
jne 0x1491b031e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1491b032b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1491b0338
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1491b0345
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1491b0352
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1491b02e6
mov eax, 1
add dl, dl
jne 0x1491b036e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1491b037b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1491b0363
sub eax, ebx
mov ebx, 1
jne 0x1491b03b4
mov ecx, 1
add dl, dl
jne 0x1491b0396
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1491b03a3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1491b038b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1491b02e6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1491b03d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1491b03dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1491b03c5
cmp eax, 0x7d00
jae 0x1491b0403
cmp eax, 0x500
jb 0x1491b03fe
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1491b02e6
cmp eax, 0x7f
ja 0x1491b0406
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1491b02e6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1491b043a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1491b02e6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20