joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140234a80
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1402807a0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x140234b6f
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x140234b6f
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x140234b1e
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x140234ada
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x140234ada
cmp cl, 0xbb
jne 0x140234b0d
inc eax
cmp eax, ebx
jl 0x140234ac4
sub ebx, eax
test eax, eax
jne 0x140234b22
mov dword [rsp + 0x20], 0x83
lea r9, [0x1403b2fd0]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1401c3730
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x1403b2fb8]
jmp 0x140234aef
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x140234b58
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], 0x8b
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1401c3730
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.140282ac0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, [0x1403b2fa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1401c3730
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x140245de0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
mov r10, r8
mov rdi, rcx
mov r9, rcx
mov r8d, edx
mov ecx, 0x20
lea rax, [0x140318ac0]
movups xmm0, xmmword [rax]
lea r9, [r9 + 0x80]
lea rax, [rax + 0x80]
movups xmmword [r9 - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [r9 - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [r9 - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [r9 - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [r9 - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [r9 - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [r9 - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [r9 - 0x10], xmm1
dec rcx
jne 0x140245e10
movups xmm0, xmmword [rax]
movups xmmword [r9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r9 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r9 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r9 + 0x30], xmm1
mov rcx, qword [rax + 0x40]
mov eax, 0x48
cmp edx, eax
mov qword [r9 + 0x40], rcx
mov rdx, r10
cmovg r8d, eax
movsxd r8, r8d
add r8, r10
xor ebx, ebx
mov r9d, ebx
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x140245eb0
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1402469f0
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x140245f10
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1402469f0
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x140245f40
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140247040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402807a0
sub rsp, rax
mov rax, qword [0x1403b9868]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x140247206
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x1402471a3
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1402469f0
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x140247140
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x140247206
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402806f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140249ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402807a0
sub rsp, rax
mov rax, qword [0x1403b9868]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x140249c86
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140249c23
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1402493d0
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x140249bc0
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x140249c86
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402806f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14024bef0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14024c0e9
push rbx
mov eax, 0xd0
call fcn.1402807a0
sub rsp, rax
mov rax, qword [0x1403b9868]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea rbp, [r8 - 1]
mov qword [rsp + 0xc0], r15
shr rbp, 3
mov rbx, rdx
lea r14, [rcx + 0xc]
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
shl eax, 8
mov rcx, r14
lea rbx, [rbx + 8]
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
or esi, eax
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x24], esi
call fcn.1402007b0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140200500
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.1401fef80
mov rcx, r15
call fcn.1402007b0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140200500
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.1401fef80
mov r8d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r8d, edi
xor edi, dword [rsp + 0x20]
xor edx, esi
xor esi, dword [rsp + 0x24]
mov byte [r14], dil
mov eax, edi
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
mov byte [r14 + 2], al
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r14 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r14 + 6], al
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov eax, r8d
shr eax, 8
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
shr r8d, 0x18
mov byte [r15 + 2], al
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr esi, 0x18
shr eax, 0x10
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
dec rbp
jne 0x14024bf60
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402806f0
add rsp, 0xd0
pop rbx
ret
Function at 0x1402761ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1402619b2
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140261995
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140261980

Function at 0x140280f10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140280f5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140280f5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140280f5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140280f5a
cmp dword [rcx + 0x84], 0xe
jbe 0x140280f5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140280f5c
xor al, al
add rsp, 0x28
ret

Function at 0x1402926f4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140292520
Function at 0x1402b0040
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1402b0068
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1402b0068
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x107c4d0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x107c657
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x107c501
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x107c4e7
add dl, dl
jne 0x107c50e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x107c56e
xor eax, eax
add dl, dl
jne 0x107c51d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x107c625
add dl, dl
jne 0x107c52e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107c53b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107c548
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107c555
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x107c562
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x107c4f6
mov eax, 1
add dl, dl
jne 0x107c57e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107c58b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x107c573
sub eax, ebx
mov ebx, 1
jne 0x107c5c4
mov ecx, 1
add dl, dl
jne 0x107c5a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x107c5b3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x107c59b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x107c4f6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x107c5e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x107c5ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x107c5d5
cmp eax, 0x7d00
jae 0x107c613
cmp eax, 0x500
jb 0x107c60e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x107c4f6
cmp eax, 0x7f
ja 0x107c616
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x107c4f6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x107c64a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x107c4f6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14002ae80
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x14002aec7
test byte [rcx + 0x1c], 4
je 0x14002aec7
cmp byte [rcx + 0x19], 5
jb 0x14002aec7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140082b80]
mov edx, 0x14
call fcn.140001010
lea rcx, [0x14009a0f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x14002af0c
cmp dword [rbx + 0x2c], eax
jne case.default.0x14002b08d
lea rcx, [0x14009a008]
call fcn.14003388c
jmp case.default.0x14002b08d
cmp eax, 2
jne 0x14002af7b
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je case.default.0x14002b08d
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne case.default.0x14002b08d
mov rax, qword [str.___t_]
cmp rax, r14
je case.default.0x14002b08d
test byte [rax + 0x1c], 4
je case.default.0x14002b08d
cmp byte [rax + 0x19], 2
jb case.default.0x14002b08d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
call fcn.140001030
jmp case.default.0x14002b08d
cmp eax, 3
jne case.default.0x14002b08d
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14002afcf
mov rax, qword [str.___t_]
cmp rax, r14
je 0x14002afcf
test byte [rax + 0x1c], 4
je 0x14002afcf
cmp byte [rax + 0x19], 2
jb 0x14002afcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
call fcn.140001030
cmp dword [rbx + 0x660], 0
je 0x14002b02a
cmp dword [rbx + 0x65c], 0
je 0x14002b033
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002b02a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14002b02a
test byte [rcx + 0x1c], 4
je 0x14002b02a
cmp byte [rcx + 0x19], 2
jb 0x14002b02a
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
mov edx, 0x17
mov dword [rsp + 0x20], eax
lea r8, [0x140082b80]
call fcn.140001250
cmp dword [rbx + 0x65c], 0
jne case.default.0x14002b08d
cmp qword [rbx + 0x668], 0
je case.default.0x14002b08d
lea rcx, [0x14009a180]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.14003b73c
lea rcx, [0x14009a180]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.14006264c
lea rcx, [0x14009a0f0]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
adc dh, dh
cmp ch, byte [rdx - 0x34ee4bcf]
or ebx, ecx
xchg edi, ebx
invalid
lahf
stc
jmp 0x140115008
invalid
mov bh, 0x6f
jp 0x140115054
invalid
cld
invalid
Function at 0x14000ac50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1400ab4a4]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000b3b0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14000b476
lea rcx, [0x1400af440]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400ae018]
jmp 0x14000b43a
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000b437
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400ae018]
mov rdx, rsi
call fcn.140020ea8
jmp 0x14000b43a
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000b407
mov rdx, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x1400ae018]
mov rdi, rdx
inc rdx
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.140020ef0
lea rcx, [0x1400af440]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x14000bb18
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x14000bb8f
movsxd rdx, ecx
lea rcx, [0x14000ba74]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x1400ae258]
test rbx, rbx
je 0x14000bc02
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000bb85
cmp byte [rbx + 0x20], 0
je 0x14000bb85
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x14000bb4b
jmp 0x14000bc02
mov rbx, qword [0x1400ae258]
test rbx, rbx
je 0x14000bc02
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x14000bbfa
cmp byte [rbx + 0x21], 0
je 0x14000bbbe
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x14000bbea
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400ae258]
call fcn.140020ea8
mov rbx, rdi
test rdi, rdi
jne 0x14000bb9b
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000cda0
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12d, ecx
test rdx, rdx
je 0x14000ced0
mov rcx, qword [0x1400add8c]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ebp, [rbx + 1]
mov rcx, r15
or dword [rax + 4], 0xffffffff
mov dword [rax], ebp
mov rdi, rax
call sub.msvcrt.dll__wcsdup
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [0x1400ab470]
mov dword [rdi + 0x44], eax
mov eax, dword [0x1400ae2b0]
mov dword [rdi + 0x80], r12d
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x78], rax
test bpl, cl
je 0x14000cec1
test rsi, rsi
je 0x14000ce7a
mov rcx, qword [0x1400add8c]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x14000ce74
mov r8, rsi
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
cmp qword [rdi + 0x70], rbx
je 0x14000ceb7
lea rax, [rsp + 0x68]
lea r8, [0x14000ceec]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000ceaf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ceb3
mov ebp, dword [rsp + 0x68]
test ebp, ebp
jne 0x14000cecd
mov rcx, rdi
call fcn.14000d040
jmp 0x14000ced0
mov rcx, rdi
mov qword [rdi + 0x70], r14
call fcn.14000c8e8
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret