joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400105d0
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x1400105dc
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
ret 0x8b4c
int1
mov ebx, r13d
test rdx, rdx
je 0x1400107e1
cmp word [rdx], r13w
je 0x1400107e1
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400107dc
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x1400107d3
mov ecx, ebp
call fcn.1400123f0
mov rdi, rax
test rax, rax
je 0x1400107d3
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x14001068a
mov edx, ebp
call fcn.1400109c4
mov rbx, rax
test rax, rax
je 0x1400107cb
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x140166998]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400106f4
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x1400106fd
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.14005b130
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x1400107c7
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x140010727
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.14005a480
mov r15, rax
test rax, rax
je 0x1400107b5
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x1400107a1
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140010773
mov rcx, r15
call fcn.1400124cc
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140010782
mov r8d, 1
jmp 0x140010785
xor r8d, r8d
call fcn.14005a970
test eax, eax
je 0x140010794
cmp ebp, esi
jl 0x140010719
jmp 0x1400107c7
mov rcx, rdi
call fcn.14005a7b0
mov dword [rbx + 0x24], eax
jmp 0x1400107bc
lea rax, str.file_read_error
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x1400107c7
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.1400125c8
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.14005ab00
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x1400107e3
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400105dc
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x1400105dc
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
ret 0x8b4c
int1
mov ebx, r13d
test rdx, rdx
je 0x1400107e1
cmp word [rdx], r13w
je 0x1400107e1
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400107dc
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x1400107d3
mov ecx, ebp
call fcn.1400123f0
mov rdi, rax
test rax, rax
je 0x1400107d3
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x14001068a
mov edx, ebp
call fcn.1400109c4
mov rbx, rax
test rax, rax
je 0x1400107cb
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x140166998]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400106f4
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x1400106fd
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.14005b130
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x1400107c7
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x140010727
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.14005a480
mov r15, rax
test rax, rax
je 0x1400107b5
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x1400107a1
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140010773
mov rcx, r15
call fcn.1400124cc
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140010782
mov r8d, 1
jmp 0x140010785
xor r8d, r8d
call fcn.14005a970
test eax, eax
je 0x140010794
cmp ebp, esi
jl 0x140010719
jmp 0x1400107c7
mov rcx, rdi
call fcn.14005a7b0
mov dword [rbx + 0x24], eax
jmp 0x1400107bc
lea rax, str.file_read_error
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x1400107c7
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.1400125c8
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.14005ab00
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x1400107e3
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140011e68
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [rcx + 0x20]
and qword [rsp + 0x20], 0
mov r8d, 0x1000
sub r8d, dword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 0x1000
sub eax, dword [rbx + 8]
cmp dword [rsp + 0x40], eax
jne 0x140011eb7
mov rax, qword [rbx + 0x20]
mov dword [rbx + 8], 0x1000
mov qword [rbx], rax
mov eax, 1
jmp 0x140011eb9
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140013a04
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140013aca
lea rcx, [0x140168840]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140166e08]
jmp 0x140013a8e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140013a8b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140166e08]
mov rdx, rsi
call fcn.1400525b8
jmp 0x140013a8e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140013a5b
mov rdx, qword [reloc.WS2_32.dll_accept]
lea rcx, [0x140166e08]
mov rdi, rdx
inc rdx
mov qword [reloc.WS2_32.dll_accept], rdx
lea edx, [rbx + 0x20]
call fcn.140052600
lea rcx, [0x140168840]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140017354
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x1400173cb
movsxd rdx, ecx
lea rcx, [0x1400172b0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140166e18]
test rbx, rbx
je 0x14001743e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400173c1
cmp byte [rbx + 0x20], 0
je 0x1400173c1
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140017387
jmp 0x14001743e
mov rbx, qword [0x140166e18]
test rbx, rbx
je 0x14001743e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140017436
cmp byte [rbx + 0x21], 0
je 0x1400173fa
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140017426
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140166e18]
call fcn.1400525b8
mov rbx, rdi
test rdi, rdi
jne 0x1400173d7
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140017af0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1401688a0]
call fcn.14005219c
test rax, rax
je 0x140017b2d
cmp dword [rax + 0x28], 0
je 0x140017b2d
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140017710
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400530c0
Function at 0x140034d54
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140168920]
call fcn.14005198c
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x140034e51
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x140034dab
add rax, 2
cmp word [rax], 0x20
je 0x140034da1
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x140034de9
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x140034e29
cmp cx, r9w
je 0x140034ddb
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140034dc9
cmp word [rax], bp
je 0x140034e29
mov rcx, rax
add rax, 2
jmp 0x140034e31
test dx, dx
je 0x140034e2e
mov rbx, rax
cmp dx, 0x20
je 0x140034ddb
add rax, 2
cmp word [rax], r9w
jne 0x140034e1f
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x140034e29
cmp cx, r9w
je 0x140034e1f
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140034e0d
movzx edx, word [rax]
test dx, dx
jne 0x140034df1
jmp 0x140034ddb
mov rcx, rax
jmp 0x140034e31
mov r8d, ebp
cmp dword [r14], esi
jne 0x140034e3b
test rdi, rdi
jne 0x140034e5b
test r8d, r8d
je 0x140034e42
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x140034d9b
test rdi, rdi
jne 0x140034e70
movsxd rax, esi
jmp 0x140034e72
test rbx, rbx
je 0x140034e70
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x140034e72
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140034ea4
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
lea rcx, [rax + 0x10]
xor ebp, ebp
mov dword [rax + 0x10], ebp
call fcn.140034d54
mov esi, dword [rsp + 0x38]
mov ecx, esi
mov edx, ebx
mov rdi, rax
call fcn.140052c60
mov ecx, ebp
jmp 0x140034efa
test esi, esi
je 0x140034eff
movzx edx, word [rdi]
cmp dx, 0x22
jne 0x140034eed
inc ecx
jmp 0x140034ef4
mov word [rax], dx
add rax, 2
add rdi, 2
dec esi
cmp word [rdi], bp
jne 0x140034edc
mov word [rax], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.140052da0
Function at 0x140036ad0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [rcx], 1
jne 0x140036ae2
mov rcx, qword [rcx + 8]
test rcx, rcx
jne fcn.1400533b0
mov ecx, edx
jmp fcn.1400530c0

Function at 0x140038a44
Capabilities:
Reference http user-agent string

Disassembly:
lea r9, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
xor r8d, r8d
jmp 0x140038a60

Function at 0x140038a54
Capabilities:
Reference http user-agent string

Disassembly:
lea r9, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
jmp 0x140038a60
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [0x140168a40]
mov r12, r9
mov r14d, r8d
mov rsi, rdx
xor ebx, ebx
call fcn.14005198c
mov r15, rax
test rbp, rbp
je 0x140038b4a
test rsi, rsi
je 0x140038b4a
mov rcx, qword [0x140166998]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
or dword [rax + 4], 0xffffffff
mov dword [rax], ebx
mov rdi, rax
call sub.msvcrt.dll__wcsdup
mov rcx, rsi
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov rcx, r12
mov qword [rdi + 0x10], rax
call sub.msvcrt.dll__wcsdup
mov qword [rdi + 0x60], rax
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x40], r14d
mov dword [rdi + 0x48], eax
test r14b, 1
je 0x140038b37
lea rax, [rsp + 0x60]
lea r8, [0x140038d50]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140038b42
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
jmp 0x140038b4a
mov rcx, rdi
call fcn.140038b64
movsxd rbx, eax
mov rcx, rdi
call fcn.140038df0
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140038a60
Capabilities:
Create thread

Disassembly:
lea r9, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
jmp 0x140038a60
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [0x140168a40]
mov r12, r9
mov r14d, r8d
mov rsi, rdx
xor ebx, ebx
call fcn.14005198c
mov r15, rax
test rbp, rbp
je 0x140038b4a
test rsi, rsi
je 0x140038b4a
mov rcx, qword [0x140166998]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
or dword [rax + 4], 0xffffffff
mov dword [rax], ebx
mov rdi, rax
call sub.msvcrt.dll__wcsdup
mov rcx, rsi
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov rcx, r12
mov qword [rdi + 0x10], rax
call sub.msvcrt.dll__wcsdup
mov qword [rdi + 0x60], rax
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x40], r14d
mov dword [rdi + 0x48], eax
test r14b, 1
je 0x140038b37
lea rax, [rsp + 0x60]
lea r8, [0x140038d50]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140038b42
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
jmp 0x140038b4a
mov rcx, rdi
call fcn.140038b64
movsxd rbx, eax
mov rcx, rdi
call fcn.140038df0
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140038b64
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rcx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 8]
xor ebx, ebx
mov esi, ebx
call fcn.1400f3fe0
mov rcx, qword [rdi + 0x60]
mov r12, rax
call fcn.1400f3fe0
mov r13, rax
call fcn.1400b7ee0
mov rbp, rax
test rax, rax
je 0x140038d12
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140038cf8
test byte [rdi + 0x40], 2
mov qword [rdi + 0x18], rax
jne 0x140038c04
lea edx, [rbx + 0x34]
lea r8d, [rbx + 1]
mov rcx, rbp
call fcn.1400baa50
mov r8, qword [0x140166eb0]
test r8, r8
je 0x140038c1d
mov edx, 0x2714
mov rcx, rbp
call fcn.1400baa50
mov r8, qword [0x140166eb8]
test r8, r8
je 0x140038c53
cmp qword [0x140166ec0], rbx
je 0x140038c53
mov edx, 0x27bf
mov rcx, rbp
call fcn.1400baa50
mov r8, qword [0x140166ec0]
mov edx, 0x27c0
mov rcx, rbp
call fcn.1400baa50
mov r8, r12
mov edx, 0x2712
mov rcx, rbp
call fcn.1400baa50
mov r8, r13
mov edx, 0x2722
mov rcx, rbp
call fcn.1400baa50
lea r8, [0x140038d60]
mov edx, 0x4e2b
mov rcx, rbp
call fcn.1400baa50
mov r8, rdi
mov edx, 0x2711
mov rcx, rbp
call fcn.1400baa50
mov r8d, dword [rdi + 0x44]
mov edx, 0x9c
mov rcx, rbp
call fcn.1400baa50
mov r8d, dword [rdi + 0x48]
mov edx, 0x9b
mov rcx, rbp
call fcn.1400baa50
mov edx, 0x63
mov rcx, rbp
lea r8d, [rdx - 0x62]
call fcn.1400baa50
mov rcx, rbp
call fcn.1400b8110
test eax, eax
jne 0x140038ce2
cmp dword [rdi + 4], 0xfffffffb
mov eax, 1
cmovne esi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140038cf8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call fcn.1400b7c70
mov eax, 1
cmp esi, eax
jne 0x140038d12
mov dword [rdi + 4], 0xfffffffe
jmp 0x140038d1f
cmp dword [rdi + 4], 0xfffffffb
setne bl
add ebx, 0xfffffffc
mov dword [rdi + 4], ebx
mov rcx, r12
call fcn.1400f3fd0
mov rcx, r13
call fcn.1400f3fd0
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140039d70
Capabilities:
Reference http user-agent string

Disassembly:
lea r8, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
xor edx, edx
jmp 0x140039d80
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [0x140168a40]
mov r12, r8
mov r14d, edx
xor ebx, ebx
call fcn.14005198c
mov r15, rax
test rbp, rbp
je 0x140039e64
mov rcx, qword [0x140166998]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea esi, [rbx + 1]
mov rcx, rbp
or dword [rax + 4], 0xffffffff
mov dword [rax], esi
mov rdi, rax
call sub.msvcrt.dll__wcsdup
mov rcx, r12
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov dword [rdi + 0x40], r14d
mov qword [rdi + 0x60], rax
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x90], esi
mov dword [rdi + 0x48], eax
test sil, r14b
je 0x140039e51
lea rax, [rsp + 0x60]
lea r8, [0x14003a054]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140039e44
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140039e48
mov esi, dword [rsp + 0x60]
test esi, esi
je 0x140039e5c
mov rbx, rdi
jmp 0x140039e64
mov rcx, rdi
call fcn.140039e80
mov rbx, rax
mov rcx, rdi
call fcn.140038df0
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140039d80
Capabilities:
Create thread

Disassembly:
lea r8, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
xor edx, edx
jmp 0x140039d80
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [0x140168a40]
mov r12, r8
mov r14d, edx
xor ebx, ebx
call fcn.14005198c
mov r15, rax
test rbp, rbp
je 0x140039e64
mov rcx, qword [0x140166998]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea esi, [rbx + 1]
mov rcx, rbp
or dword [rax + 4], 0xffffffff
mov dword [rax], esi
mov rdi, rax
call sub.msvcrt.dll__wcsdup
mov rcx, r12
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov dword [rdi + 0x40], r14d
mov qword [rdi + 0x60], rax
mov eax, dword [r15]
mov dword [rdi + 0x44], eax
mov eax, dword [r15 + 4]
mov dword [rdi + 0x90], esi
mov dword [rdi + 0x48], eax
test sil, r14b
je 0x140039e51
lea rax, [rsp + 0x60]
lea r8, [0x14003a054]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140039e44
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140039e48
mov esi, dword [rsp + 0x60]
test esi, esi
je 0x140039e5c
mov rbx, rdi
jmp 0x140039e64
mov rcx, rdi
call fcn.140039e80
mov rbx, rax
mov rcx, rdi
call fcn.140038df0
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14003a5c8
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, ecx
mov rcx, qword [0x140168a40]
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.14005198c
mov r12, rax
test r15, r15
je 0x14003a70a
mov rcx, qword [0x140166998]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ebp, [rbx + 1]
mov rcx, r15
or dword [rax + 4], 0xffffffff
mov dword [rax], ebp
mov rdi, rax
call sub.msvcrt.dll__wcsdup
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r12]
mov dword [rdi + 0x44], eax
mov eax, dword [r12 + 4]
mov dword [rdi + 0x80], r13d
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x78], rax
test bpl, cl
je 0x14003a6fb
test rsi, rsi
je 0x14003a6b4
mov rcx, qword [0x140166998]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x14003a6ae
mov r8, rsi
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
cmp qword [rdi + 0x70], rbx
je 0x14003a6f1
lea rax, [rsp + 0x68]
lea r8, [0x14003a72c]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14003a6e9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003a6ed
mov ebp, dword [rsp + 0x68]
test ebp, ebp
jne 0x14003a707
mov rcx, rdi
call fcn.140038df0
jmp 0x14003a70a
mov rcx, rdi
mov qword [rdi + 0x70], r14
call fcn.14003a0f0
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret