joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007340
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r13
push r14
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov rsi, r9
mov r14, rcx
mov r13, r8
mov r12d, edx
lea rcx, [rbp - 0x40]
lea r9d, [rdi + 0x18]
xor r8d, r8d
xor edx, edx
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], rdi
mov dword [rbp - 0x50], edi
mov ebx, edi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400074a2
mov rax, qword [r13]
mov rcx, qword [rbp - 0x40]
lea r8d, [rdi + 0x2c]
mov qword [rbp - 0x2c], rax
mov rax, qword [r13 + 8]
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x24], rax
mov rax, qword [r13 + 0x10]
xor r9d, r9d
mov qword [rbp - 0x1c], rax
mov rax, qword [r13 + 0x18]
mov dword [rbp - 0x38], 0x208
mov qword [rbp - 0x14], rax
lea rax, [rbp - 0x48]
mov dword [rbp - 0x34], 0x6610
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov dword [rbp - 0x30], 0x20
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1400074a2
mov rcx, qword [rbp - 0x48]
lea r8, [rbp - 0x4c]
lea edx, [rdi + 4]
xor r9d, r9d
mov dword [rbp - 0x4c], 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400074a2
mov rcx, qword [rbp - 0x48]
lea edx, [rdi + 1]
xor r9d, r9d
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400074a2
xor edx, edx
mov ecx, r12d
call fcn.14000e210
mov rbx, rax
test rax, rax
je 0x1400074a2
mov r8d, r12d
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x50], r12d
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000748a
mov edi, 1
jmp 0x1400074a2
mov rcx, qword [0x14001e780]
mov r8, rbx
mov edx, 8
call qword [0x14001e798]
mov rbx, rdi
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400074b1
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400074c2
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x38]
mov qword [rcx], rbx
mov ecx, dword [rbp - 0x50]
mov rbx, qword [r11 + 0x20]
mov eax, edi
mov rdi, qword [r11 + 0x30]
mov dword [rdx], ecx
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x1400090e0
Capabilities:
Delete file
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x700
xor ebx, ebx
lea rdx, [rax + 0x10]
mov qword [rax + 0x10], rbx
mov edi, ebx
mov qword [rax + 0x18], rbx
call fcn.140009380
mov rsi, qword [rsp + 0x718]
test eax, eax
je 0x14000921c
test rsi, rsi
je 0x140009250
lea rcx, [rsp + 0x720]
call fcn.14000bc60
mov rdi, qword [rsp + 0x720]
lea rax, [rsp + 0xf0]
mov rdx, rdi
mov r11d, 0x104
lea rcx, [rsp + 0xf0]
sub rdx, rax
lea rax, [r11 + 0x7ffffefa]
test rax, rax
je 0x140009175
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140009175
mov word [rcx], ax
add rcx, 2
dec r11
jne 0x140009152
jmp 0x14000917a
test r11, r11
jne 0x14000917e
sub rcx, 2
mov word [rcx], bx
mov rcx, qword [str.u1SqNP]
lea rdx, [rsp + 0x300]
call fcn.14000deb0
movzx eax, byte [rsp + 0x300]
lea r11, [rsp + 0x300]
lea rcx, [rsp + 0x20]
test al, al
je 0x1400091c6
nop
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x1400091b0
mov word [rcx], bx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0xf0]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [0x14001e6ac], 1
mov ebx, 1
test rsi, rsi
je 0x140009236
mov rcx, qword [0x14001e780]
mov r8, rsi
mov edx, 8
call qword [0x14001e798]
test rdi, rdi
je 0x140009250
mov rcx, qword [0x14001e780]
mov r8, rdi
mov edx, 8
call qword [0x14001e798]
lea r11, [rsp + 0x700]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140009270
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xe0
xor ebx, ebx
lea rdx, [rax + 0x10]
mov rsi, rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rax + 0x10], rbx
call fcn.140009380
mov rdi, qword [rsp + 0xf8]
test eax, eax
je 0x140009323
test rdi, rdi
je 0x140009323
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor r11d, r11d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x60], r11
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000931e
mov dword [rsi + 0x58], 6
jmp 0x140009323
mov ebx, 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140009333
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140009343
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14000935d
mov rcx, qword [0x14001e780]
mov r8, rdi
mov edx, 8
call qword [0x14001e798]
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000cb00
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xc0
xor ebx, ebx
mov word [rax + 0x14], 0x500
mov qword [rax + 0x20], rbx
mov dword [rax + 8], ebx
mov dword [rax + 0x10], ebx
mov qword [rax + 0x18], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xe8]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000cbc3
mov rcx, qword [rsp + 0xe8]
lea rax, [rsp + 0xd0]
lea r9d, [rbx + 0x54]
lea r8, [rsp + 0x60]
lea edx, [rbx + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000cbc3
lea rax, [rsp + 0xe0]
lea r8d, [rbx + 0x12]
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dl, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000cbc3
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov ebx, eax
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14000cbd6
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000cbe9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0xc0
pop rbx
ret

Function at 0x14000cc00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
mov qword [rsp + 0x30], rbx
mov r12d, 1
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, r12d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x78], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000cc7b
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
test eax, eax
cmovne ebx, r12d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14000cc90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov r12, rdx
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x68], ebx
mov edi, ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000cd70
lea r9d, [rbx + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r11d, dword [rsp + 0x68]
test r11d, r11d
jne 0x14000cd1c
mov ebx, 1
jmp 0x14000cd67
mov rcx, r11
xor edx, edx
call fcn.14000e210
mov rdi, rax
test rax, rax
je 0x14000cd67
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000cd15
mov rcx, qword [0x14001e780]
lea edx, [rax + 8]
mov r8, rdi
call qword [0x14001e798]
mov rdi, rbx
mov dword [rsp + 0x68], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov qword [rbp], rcx
mov rbp, qword [rsp + 0x70]
mov qword [r12], rdi
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14000d240
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x700
xor edi, edi
mov rbx, rcx
lea rdx, [rsp + 0x300]
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov dword [rcx + 0x20], edi
mov qword [rcx + 0x28], rdi
mov word [rcx + 0x30], di
mov rcx, qword [str.GEjD5EtXm7vRuBPfWc9CiJS09YrfGpfrGPHr6XfAnjL8BCZacINTtpAhAz7hpnuMxM8UbM8zPg7nyxGxIXZTtC5hxfShAB5hvCZa8gNJjq_7vR8UbIuBZFV6NHrGrMZc8y_JcU57vRrMNHrMm]
call fcn.14000deb0
movzx eax, byte [rsp + 0x300]
lea r11, [rsp + 0x300]
lea rdx, [rsp + 0x30]
test al, al
je 0x14000d2a8
movsx eax, al
inc r11
add rdx, 2
mov word [rdx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x14000d292
mov word [rdx], di
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
lea rcx, [0x14001e748]
mov edx, 0x800
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea rcx, [0x14001e748]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x14001e77c]
lea rcx, [0x14001e748]
inc r11d
mov dword [0x14001e77c], r11d
mov dword [rbx], r11d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
mov rbx, qword [rsp + 0x710]
add rsp, 0x700
pop rdi
ret
Function at 0x14000d430
Capabilities:
Prepare http request
Read http header
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x510
xor ebp, ebp
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [rax + 0x20], 4
mov dword [rax + 8], ebp
cmp dword [rcx + 0x10], ebp
je 0x14000d5b8
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14000d472
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [rbx + 0x18], rbp
mov rcx, qword [rbx + 8]
mov edx, 0x15f90
mov r9d, 0x2bf20
mov r8d, edx
mov dword [rsp + 0x20], 0x1b7740
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov rcx, qword [str.SnAx]
lea rdx, [rsp + 0x110]
call fcn.14000deb0
movzx eax, byte [rsp + 0x110]
lea r11, [rsp + 0x110]
lea rcx, [rsp + 0x40]
test al, al
je 0x14000d4d6
nop
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x14000d4c0
mov eax, dword [rbx + 0x20]
mov word [rcx], bp
lea rdx, [rsp + 0x40]
neg eax
mov r8, rsi
sbb ecx, ecx
xor r9d, r9d
and ecx, 0x800000
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14000d5b8
cmp dword [rbx + 0x20], ebp
je 0x14000d545
mov r9d, 4
lea r8, [rsp + 0x540]
mov rcx, rax
lea edx, [r9 + 0x1b]
mov dword [rsp + 0x540], 0x3300
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
je 0x14000d5b8
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14000d5b8
mov rcx, qword [rbx + 0x18]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x14000d5b8
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x548]
lea r9, [rsp + 0x530]
xor r8d, r8d
mov edx, 0x20000013
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x14000d5b8
mov eax, dword [rsp + 0x530]
mov dword [rdi], eax
mov eax, 1
jmp 0x14000d5cf
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000d5c7
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [rbx + 0x18], rbp
mov dword [rdi], ebp
mov eax, ebp
mov rbx, qword [rsp + 0x538]
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d5f0
Capabilities:
Prepare http request
Read http header
Receive http response

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x520
xor r12d, r12d
mov rbp, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x540], r12d
cmp dword [rcx + 0x10], r12d
je 0x14000d79c
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14000d641
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [rbx + 0x18], r12
mov rcx, qword [rbx + 8]
mov edx, 0x15f90
mov r9d, 0x2932e0
mov r8d, edx
mov dword [rsp + 0x20], 0x2bf20
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov rcx, qword [str.xajGAP]
lea rdx, [rsp + 0x120]
call fcn.14000deb0
movzx eax, byte [rsp + 0x120]
lea r11, [rsp + 0x120]
lea rcx, [rsp + 0x50]
test al, al
je 0x14000d6a6
nop
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x14000d690
mov eax, dword [rbx + 0x20]
mov word [rcx], r12w
lea rdx, [rsp + 0x50]
neg eax
mov r8, rsi
sbb ecx, ecx
xor r9d, r9d
and ecx, 0x800000
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14000d79c
cmp dword [rbx + 0x20], r12d
je 0x14000d715
mov r9d, 4
lea r8, [rsp + 0x44]
mov rcx, rax
lea edx, [r9 + 0x1b]
mov dword [rsp + 0x44], 0x3300
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
je 0x14000d79c
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], r12
mov rax, rdi
neg rax
mov rax, qword [rsp + 0x560]
mov r9, rbp
mov dword [rsp + 0x28], eax
sbb r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14000d79c
mov rcx, qword [rbx + 0x18]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x14000d79c
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x540]
xor r8d, r8d
mov edx, 0x20000013
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x14000d79c
mov eax, dword [rsp + 0x540]
mov rcx, qword [rsp + 0x568]
mov dword [rcx], eax
mov eax, 1
jmp 0x14000d7bd
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000d7ab
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x568]
mov qword [rbx + 0x18], r12
mov eax, r12d
mov dword [rcx], r12d
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14000d7e0
Capabilities:
Receive http response

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x98
xor edi, edi
mov qword [rax + 0x18], rbp
mov r14, r8
mov r15, rdx
mov r13, rcx
mov qword [rax - 0x38], r12
mov dword [rax + 0x10], edi
mov ebx, edi
mov esi, edi
nop dword [rax]
mov rcx, qword [r13 + 0x18]
lea rdx, [rsp + 0xd0]
mov dword [rsp + 0xd0], edi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x14000d9fb
mov eax, dword [rsp + 0xd0]
test eax, eax
je 0x14000d9f6
add esi, eax
test rbx, rbx
je 0x14000d9bc
mov rax, qword [0x14001e780]
mov r12d, esi
test rax, rax
jne 0x14000d993
mov rcx, qword [str.5hAUiJAXrMZH_TtX]
lea rdx, [rsp + 0x20]
call fcn.14000deb0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [str.7TAyNacXiTjB]
lea rdx, [rsp + 0x20]
mov rbp, rax
call fcn.14000deb0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e788], rax
test rax, rax
jne 0x14000d8c0
mov r8d, dword [rsp + 0xd0]
mov edx, esi
mov rbx, rdi
sub edx, r8d
add rdx, rbx
jmp 0x14000d9d3
mov rcx, qword [str.ShAnxeQ0mhAMNnypmLP]
lea rdx, [rsp + 0x20]
call fcn.14000deb0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e7a0], rax
test rax, rax
jne 0x14000d903
mov r8d, dword [rsp + 0xd0]
mov edx, esi
mov rbx, rdi
sub edx, r8d
add rdx, rbx
jmp 0x14000d9d3
mov rcx, qword [str.7TAyNa_U_Ex]
lea rdx, [rsp + 0x20]
call fcn.14000deb0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e798], rax
test rax, rax
jne 0x14000d946
mov r8d, dword [rsp + 0xd0]
mov edx, esi
mov rbx, rdi
sub edx, r8d
add rdx, rbx
jmp 0x14000d9d3
mov rcx, qword [str.7TAyNcQpEtXihr]
lea rdx, [rsp + 0x20]
call fcn.14000deb0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001e790], rax
test rax, rax
jne 0x14000d986
mov r8d, dword [rsp + 0xd0]
mov edx, esi
mov rbx, rdi
sub edx, r8d
add rdx, rbx
jmp 0x14000d9d3
call qword [0x14001e7a0]
mov qword [0x14001e780], rax
mov r9, r12
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [0x14001e790]
mov r8d, dword [rsp + 0xd0]
mov edx, esi
sub edx, r8d
mov rbx, rax
add rdx, rax
jmp 0x14000d9d3
mov ecx, esi
xor edx, edx
call fcn.14000e210
mov r8d, dword [rsp + 0xd0]
mov rbx, rax
mov rdx, rax
mov rcx, qword [r13 + 0x18]
lea r9, [rsp + 0xd8]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14000d9fb
cmp dword [rsp + 0xd0], edi
ja 0x14000d810
mov edi, 1
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xe0]
mov ecx, esi
mov qword [r15], rbx
mov eax, edi
mov qword [r14], rcx
add rsp, 0x98
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000f930
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
call fcn.14000fad0
test rax, rax
je 0x14000fa7f
mov r11d, dword [rbx + 0xb8]
cmp r11d, 0x40
jb 0x14000fa7f
mov r8, qword [rbx + 0xb0]
movsxd r10, dword [r8 + 0x3c]
lea rcx, [r10 + 0x108]
cmp r11, rcx
jb 0x14000fa7f
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14000fa7f
cmp r11d, dword [r10 + r8 + 0x54]
jb 0x14000fa7f
cmp dword [r10 + r8], 0x4550
jne 0x14000fa7f
movzx eax, word [r10 + r8 + 0x16]
test al, 2
je 0x14000fa7f
mov ecx, 0x2000
test cx, ax
je 0x14000fa7f
cmp word [r10 + r8 + 6], di
jbe 0x14000fa7f
mov eax, 0xf0
cmp word [r10 + r8 + 0x14], ax
jne 0x14000fa7f
mov eax, 0x20b
cmp word [r10 + r8 + 0x18], ax
jne 0x14000fa7f
mov ebx, dword [r10 + r8 + 0x84]
mov qword [rsp + 0x30], rbp
mov edx, edi
test ebx, ebx
je 0x14000fa45
lea r9, [r10 + r8 + 0x88]
lea rbp, [0x140000000]
nop dword [rax]
cmp edx, 0xe
ja case.0x14000fa21.1
mov eax, edx
mov ecx, dword [rbp + rax*4 + 0xfa8c]
add rcx, rbp
jmp rcx
cmp dword [r9 + 4], edi
jbe 0x14000fa7a
cmp dword [r9], edi
jbe 0x14000fa7a
jmp case.0x14000fa21.1
cmp dword [r9 + 4], edi
jne 0x14000fa7a
cmp dword [r9], edi
jne 0x14000fa7a
inc edx
add r9, 8
cmp edx, ebx
jb 0x14000fa10
movzx r9d, word [r10 + r8 + 6]
mov edx, edi
test r9d, r9d
jle 0x14000fa75
lea rcx, [r10 + r8 + 0x118]
nop word [rax + rax]
mov eax, dword [rcx + 4]
add eax, dword [rcx]
cmp eax, r11d
ja 0x14000fa7a
inc edx
add rcx, 0x28
cmp edx, r9d
jl 0x14000fa60
mov edi, 1
mov rbp, qword [rsp + 0x30]
mov eax, edi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140010d90
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x420
xor r12d, r12d
mov rbx, r8
mov rdi, rcx
mov esi, r12d
mov qword [rax + 8], r12
mov ebp, r12d
mov qword [rax + 0x20], r12
cmp dword [rcx + 0xac], esi
je 0x140010e0f
mov rcx, qword [str.GEjO9EtpZTyyNUoyieQpmESFZTQp_EbfiTjy_TAO]
lea rdx, [rsp + 0x20]
call fcn.14000deb0
movzx eax, byte [rsp + 0x20]
lea r11, [rsp + 0x20]
test al, al
je 0x140010e06
nop word [rax + rax]
movsx eax, al
inc r11
add rbx, 2
mov word [rbx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140010df0
mov word [rbx], r12w
jmp 0x140010eeb
test rdx, rdx
jne 0x140010e8d
cmp dword [rcx + 0x2c], esi
jne 0x140010e3e
call fcn.14000cb00
test eax, eax
je 0x140010e3e
lea r8, [rsp + 0x458]
lea rdx, [rsp + 0x440]
mov rcx, rdi
call fcn.140013e60
test eax, eax
jne 0x140010e71
lea r8, [rsp + 0x458]
lea rdx, [rsp + 0x440]
mov rcx, rdi
call fcn.140011f40
test eax, eax
jne 0x140010e71
mov edx, 0x86
mov rcx, rbx
call fcn.14000de40
mov rsi, qword [rsp + 0x440]
jmp 0x140010eeb
mov rbp, qword [rsp + 0x458]
mov rsi, qword [rsp + 0x440]
test rsi, rsi
jne 0x140010eb5
mov edx, 0x88
jmp 0x140010ee3
lea r8, [rsp + 0x440]
call fcn.140012140
test eax, eax
jne 0x140010e79
mov edx, 0x87
mov rcx, rbx
call fcn.14000de40
mov rsi, qword [rsp + 0x440]
jmp 0x140010eeb
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.140012220
test eax, eax
jne 0x140010ece
mov edx, 0x89
jmp 0x140010ee3
mov rdx, rsi
mov rcx, rdi
call fcn.140010f50
test rax, rax
jne 0x140010f2c
mov edx, 0x8a
mov rcx, rbx
call fcn.14000de40
cmp dword [rdi + 0xa4], r12d
je 0x140010f27
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rdi + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x90], r12
mov qword [rdi + 0x98], r12
mov eax, r12d
jmp 0x140010f31
mov eax, 1
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret