joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a940
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xb8]
sub rsp, 0x1b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
lea r8d, [rdi + 5]
lea rdx, str.Other
lea rcx, [rsp + 0x30]
call fcn.1400268f0
nop
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp - 0x80]
call fcn.1401f7750
mov dword [rbp - 0x80], 0x11c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14005aa21
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jae 0x14005aa07
mov r8, qword [rsp + 0x40]
inc r8
je 0x14005aa0f
add r8, r8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401f3130
mov rdx, qword [rsp + 0x48]
jmp 0x14005aa0f
mov rcx, qword [rsp + 0x30]
mov qword [rbx], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rdx
jmp 0x14005ab35
mov eax, dword [rbp - 0x78]
mov ecx, dword [rbp - 0x7c]
cmp ecx, 5
jne 0x14005aa6a
cmp eax, 1
jne 0x14005aa43
mov r8d, 0xa
lea rdx, str.Windows_XP
jmp 0x14005aadb
cmp eax, 2
jne 0x14005aa6a
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp byte [rbp + 0x9a], 1
jne 0x14005aae5
cmp word [rsp + 0x50], 9
jne 0x14005aae5
jmp 0x14005aa31
cmp byte [rbp + 0x9a], 1
jne 0x14005aace
cmp ecx, 6
jne 0x14005aac9
test eax, eax
je 0x14005aaba
cmp eax, 1
je 0x14005aaab
jbe 0x14005aae5
cmp eax, 3
jbe 0x14005aa9c
cmp eax, 4
jne 0x14005aae5
mov r8d, 0xa
lea rdx, str.Windows_10
jmp 0x14005aadb
mov r8d, 9
lea rdx, str.Windows_8
jmp 0x14005aadb
mov r8d, 9
lea rdx, str.Windows_7
jmp 0x14005aadb
mov r8d, SafeArrayDestroy
lea rdx, str.Windows_Vista
jmp 0x14005aadb
cmp ecx, 0xa
je 0x14005aa8d
mov r8d, 5
lea rdx, str.Other
lea rcx, [rsp + 0x30]
call fcn.1400268f0
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
mov rcx, qword [rsp + 0x48]
cmp rcx, 8
jae 0x14005ab20
mov r8, qword [rsp + 0x40]
inc r8
je 0x14005ab28
add r8, r8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401f3130
mov rcx, qword [rsp + 0x48]
jmp 0x14005ab28
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
mov rax, rbx
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1401f3080
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005ab60
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rax
mov word [rcx], ax
lea r8d, [rax + 3]
lea rdx, [0x14029ad98]
call fcn.1400268f0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x38]
cmp ax, 9
je 0x14005abcf
cmp ax, 6
jne 0x14005abe4
mov r8d, 3
lea rdx, [0x14029ad90]
mov rcx, rbx
call fcn.1400268f0
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401f3080
add rsp, 0x70
pop rbx
ret

Function at 0x14005ac00
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
lea r8d, [rsi + 5]
lea rdx, str.Other
lea rcx, [rsp + 0x48]
call fcn.1400268f0
nop
mov word [rsp + 0x70], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.1401f7750
mov dword [rsp + 0x68], 0x208
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClientsStartMenuInternet
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005acdf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREClientsStartMenuInternet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005ad4f
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140296e0c]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14005ad4f
test edi, edi
jne 0x14005ad4f
cmp word [rsp + 0x70], di
jne 0x14005ad2c
mov r8, rsi
jmp 0x14005ad40
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14005ad35
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400268f0
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rcx, qword [rsp + 0x60]
cmp rcx, 8
jae 0x14005ad8a
mov r8, qword [rsp + 0x58]
inc r8
je 0x14005ad92
add r8, r8
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1401f3130
mov rcx, qword [rsp + 0x60]
jmp 0x14005ad92
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1401f3080
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14005aea0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov rdi, rcx
lea ecx, [rbx + 0x10]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
lea rdx, [0x14029709c]
lea rcx, [rsp + 0x28]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rsp + 0x28], bx
je 0x14005af0a
lea rax, [rsp + 0x28]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14005af00
lea rdx, [rsp + 0x28]
mov r8, rbx
mov rcx, rdi
call fcn.1400268f0
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f3080
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14005af70
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rbx, rcx
mov qword [rbp - 0x48], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rsi
mov word [rcx], si
xor r8d, r8d
lea rdx, [0x140296e0c]
call fcn.1400268f0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], rsi
mov word [rbp], si
cmp word [rax], si
jne 0x14005aff4
mov r8d, esi
jmp 0x14005b00b
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14005b000
mov rdx, rax
lea rcx, [rbp]
call fcn.1400268f0
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
mov r8d, SafeArrayDestroy
lea rdx, str.passthrough
lea rcx, [rsp + 0x50]
call fcn.1400268f0
nop
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x70], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp - 0x70]
call fcn.140026ce0
nop
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.140059d30
nop
cmp qword [rbp - 0x10], 0
je 0x14005b09f
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1400594c0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
mov r8d, 8
lea rdx, str.passthro
lea rcx, [rsp + 0x30]
call fcn.1400268f0
nop
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x70], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rsp + 0x70]
call fcn.140026ce0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.140059d30
mov rdi, rax
lea rax, [rbp - 0x20]
cmp rax, rdi
je 0x14005b146
cmp qword [rbp - 8], 8
jb 0x14005b12a
mov rcx, qword [rbp - 0x20]
call fcn.1400681d4
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x20], si
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.140026790
cmp qword [rbp - 0x28], 8
jb 0x14005b156
mov rcx, qword [rbp - 0x40]
call fcn.1400681d4
cmp qword [rbp - 0x10], 0
je 0x14005b186
mov r8d, 1
lea rdx, [0x140299a94]
mov rcx, rbx
call fcn.140059180
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1400594c0
nop
cmp qword [rbp - 8], 8
jb 0x14005b196
mov rcx, qword [rbp - 0x20]
call fcn.1400681d4
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x20], si
cmp qword [rbp + 0x18], 8
jb 0x14005b1b6
mov rcx, qword [rbp]
call fcn.1400681d4
mov rax, rbx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1401f3080
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14005b1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, r8
mov r15, rdx
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x30], 0x101
mov dword [rsp + 0x34], 0x201
mov qword [rsp + 0x68], 7
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140026ce0
nop
lea rcx, [rsp + 0x50]
call fcn.140059fd0
mov r14, rax
xor sil, sil
mov edi, r12d
nop word [rax + rax]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + rdi*4 + 0x30]
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005b343
mov ecx, 0x200
call fcn.1400681dc
mov rbx, rax
mov rcx, r15
call fcn.140058620
mov rdx, rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005b326
mov sil, 1
cmp dword [rsp + 0x4c], 4
jne 0x14005b2ff
mov r8d, dword [rbx]
lea rdx, [0x14029709c]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
cmp word [rbx], 0
jne 0x14005b30a
mov r8, r12
jmp 0x14005b31b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x14005b310
mov rdx, rbx
mov rcx, rbp
call fcn.1400268f0
mov rcx, rbx
call fcn.1400681d4
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14005b33e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
jne 0x14005b350
inc rdi
cmp rdi, 2
jb 0x14005b270
cmp qword [rsp + 0x68], 8
jb 0x14005b362
mov rcx, qword [rsp + 0x50]
call fcn.1400681d4
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401f3080
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005b390
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r8
mov rdi, rdx
mov qword [r11 - 0x30], 7
xor ebp, ebp
mov qword [r11 - 0x38], rbp
mov word [rsp + 0x60], bp
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [r11 - 0x48]
call fcn.140026ce0
nop
lea rcx, [rsp + 0x60]
call fcn.140059fd0
mov rsi, rax
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf023f
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005b476
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xf023f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14005b476
xor bl, bl
jmp 0x14005b4d2
mov sil, 1
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x14005b487
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x14005b491
mov rdi, qword [rdi]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, sil
test eax, eax
cmovne ebx, ebp
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14005b4d2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x78], 8
jb 0x14005b4e4
mov rcx, qword [rsp + 0x60]
call fcn.1400681d4
movzx eax, bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401f3080
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005c1b0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movabs rax, 0x79baa6bb6398b6f7
mov rbx, r8
movzx r9d, cx
shr ecx, 0x10
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xc
imul rax, rax, 0x15b0
sub r8, rax
test r10, r10
jne 0x14005c1f8
lea eax, [r10 + 1]
mov rbx, qword [rsp + 8]
ret
test rbx, rbx
je 0x14005c2cc
xor edx, edx
cmp r8, 7
jbe 0x14005c27a
lea r11d, [rdx + 7]
nop dword [rax]
movzx eax, byte [r10]
add r11d, 8
add edx, 8
add r9d, eax
movzx eax, byte [r10 + 1]
add r10, 8
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add ecx, r9d
add r9d, eax
mov eax, r11d
add ecx, r9d
cmp rax, r8
jb 0x14005c210
mov eax, edx
cmp rax, r8
jae 0x14005c297
movzx eax, byte [r10]
inc edx
inc r10
add r9d, eax
mov eax, edx
add ecx, r9d
cmp rax, r8
jb 0x14005c281
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub rbx, r8
mov r8d, 0x15b0
jne 0x14005c201
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret

Function at 0x14005c2e0
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
mov r10, rdx
test rdx, rdx
jne 0x14005c2ee
xor eax, eax
ret
or eax, 0xffffffff
test r8, r8
je 0x14005c333
lea r11, [0x1402a11c0]
nop dword [rax]
movzx r8d, byte [r10]
mov ecx, eax
shr eax, 4
xor rcx, r8
shr r8, 4
lea r10, [r10 + 1]
and ecx, 0xf
mov edx, dword [r11 + rcx*4]
xor edx, eax
mov eax, edx
shr edx, 4
and eax, 0xf
xor rax, r8
mov eax, dword [r11 + rax*4]
xor eax, edx
dec r9
jne 0x14005c300
not eax
ret
Function at 0x140060aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x288
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp qword [rdx + 0x18], 8
mov rbx, rcx
jb 0x140060aca
mov rdx, qword [rdx]
xor r14d, r14d
lea rax, [rsp + 0x160]
mov r8, rdx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140060b08
xor al, al
jmp 0x140060c3c
cmp qword [rbx + 0x18], 8
jb 0x140060b14
mov rcx, qword [rbx]
jmp 0x140060b17
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rcx
xor ecx, ecx
or r9d, 0xffffffff
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140060b01
cmp qword [rbx + 0x18], 8
mov qword [rsp + 0x280], rdi
jb 0x140060b60
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], MsiSetExternalUIW
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140060b9a
xor al, al
jmp 0x140060c34
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x2b0], rbp
mov qword [rsp + 0x2b8], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov esi, eax
call fcn.1400681dc
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov dword [rsp + 0x40], r14d
mov rbx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140060c1a
cmp esi, dword [rsp + 0x40]
jne 0x140060c1a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x160]
mov r9d, esi
mov r8, rbx
call fcn.1400608e0
mov rcx, rbx
test eax, eax
je 0x140060c1d
call fcn.1400681d4
mov al, 1
jmp 0x140060c24
mov rcx, rbx
call fcn.1400681d4
xor al, al
mov rsi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401f3080
add rsp, 0x288
pop r14
pop rbx
ret
Function at 0x1400620a0
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x1400620ef
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x1400620ef
mov r9, qword [rsp + 0x48]
lea edx, [rbx + 3]
jmp 0x1400620f9
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Glority_Message_Client_1.0
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
test rcx, rcx
je 0x14006211d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14006212d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14006213d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f3080
add rsp, 0x60
pop rbx
ret

Function at 0x1400622f0
Capabilities:
Prepare http request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r15, r8
mov r14d, edx
mov r12, rcx
xor bl, bl
call fcn.1400620a0
mov rdi, rax
test rax, rax
je 0x1400623d3
mov rdx, qword [0x140311f58]
mov r8d, 0x50
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rsi, rax
test rax, rax
je 0x1400623c5
mov dword [rsp + 0x30], 0x100
xor r9d, r9d
mov r8, r15
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbp, rax
test rax, rax
je 0x1400623bc
mov qword [rsp + 0x30], 0
lea rdx, str.Content_Type:application_xml
mov r9, r12
mov r8d, MsiEnumClientsA
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov rcx, rbp
test eax, eax
setne bl
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1400623f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rbp, rdx
cmp qword [rcx + 0x18], 8
jb 0x14006242f
mov rcx, qword [rcx]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], MsiSetExternalUIW
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140062469
xor al, al
jmp 0x140062568
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov ecx, eax
call fcn.1400681dc
mov rdi, rax
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
lea rdx, str._v1_reportError
lea rcx, [rsp + 0x50]
call fcn.1400268f0
nop
mov r8d, 7
lea rdx, str._token
lea rcx, [rsp + 0x50]
call fcn.140059180
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
call fcn.1400594c0
mov r8d, SafeArrayDestroy
lea rdx, str.machineId
lea rcx, [rsp + 0x50]
call fcn.140059180
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
mov rcx, rax
call fcn.1400594c0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea r9, [0x1402a1f50]
mov edx, ebx
mov rcx, rdi
call fcn.1400622f0
movzx ebx, al
mov rcx, rdi
call fcn.1400681d4
nop
cmp qword [rsp + 0x68], 8
jb 0x140062565
mov rcx, qword [rsp + 0x50]
call fcn.1400681d4
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401f3080
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret