joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d4b20
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140289490
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.HaloDesktopData
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d4bb5
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea r8, [rbx + 0x50]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d5480
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, 0xffffffffffffffff
test rax, rax
jne 0x1400d4be2
xor ecx, ecx
jmp 0x1400d4bef
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400d4be5
mov r8d, ecx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140010860
movss xmm0, dword [rbx + 0xa0]
mulss xmm0, dword [0x1402ecd08]
cvttss2si ebx, xmm0
cmp ebx, 0x64
je 0x1400d4c81
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d4d5b
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, ebx
lea rdx, str._v2__x_d.png
lea rcx, [rsp + 0x38]
call fcn.14000b080
mov rbx, qword [rsp + 0x38]
mov r8, rbx
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d4c99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400d4c99
lea r8, str._v2.png
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d4d50
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsi], rax
lea rax, [rsp + 0x50]
cmp rax, 0x10000
jae 0x1400d4ce6
lea rax, [rsp + 0x50]
movzx edx, ax
mov rcx, rsi
call fcn.14000b690
jmp 0x1400d4d0b
lea rcx, [rsp + 0x50]
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d4cf0
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010860
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400d4d28
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x1400d4d70
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140289490
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.HaloDesktopData
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d4e05
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea r8, [rbx + 0x98]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d5480
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, 0xffffffffffffffff
test rax, rax
jne 0x1400d4e35
xor ecx, ecx
jmp 0x1400d4e4a
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400d4e40
mov r8d, ecx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140010860
movss xmm0, dword [rbx + 0xa0]
mulss xmm0, dword [0x1402ecd08]
cvttss2si ebx, xmm0
cmp ebx, 0x64
je 0x1400d4edc
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d4fbb
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, ebx
lea rdx, str._v2_after__x_d.png
lea rcx, [rsp + 0x38]
call fcn.14000b080
mov rbx, qword [rsp + 0x38]
mov r8, rbx
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d4ef4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400d4ef4
lea r8, str._v2_after.png
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d4fb0
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsi], rax
lea rax, [rsp + 0x50]
cmp rax, 0x10000
jae 0x1400d4f41
lea rax, [rsp + 0x50]
movzx edx, ax
mov rcx, rsi
call fcn.14000b690
jmp 0x1400d4f6b
lea rcx, [rsp + 0x50]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d4f50
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010860
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400d4f88
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x1400d4fd0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140289490
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.HaloDesktopData
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d5065
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea r8, [rbx + 0x68]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d5480
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, 0xffffffffffffffff
test rax, rax
jne 0x1400d5092
xor ecx, ecx
jmp 0x1400d509f
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400d5095
mov r8d, ecx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140010860
movss xmm0, dword [rbx + 0xa0]
mulss xmm0, dword [0x1402ecd08]
cvttss2si ebx, xmm0
cmp ebx, 0x64
je 0x1400d5131
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d520b
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, ebx
lea rdx, str._v2_now__x_d.png
lea rcx, [rsp + 0x38]
call fcn.14000b080
mov rbx, qword [rsp + 0x38]
mov r8, rbx
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d5149
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400d5149
lea r8, str._v2_now.png
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d5200
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsi], rax
lea rax, [rsp + 0x50]
cmp rax, 0x10000
jae 0x1400d5196
lea rax, [rsp + 0x50]
movzx edx, ax
mov rcx, rsi
call fcn.14000b690
jmp 0x1400d51bb
lea rcx, [rsp + 0x50]
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d51a0
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010860
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400d51d8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x1400d5220
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140289490
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.HaloDesktopData
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d52b5
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea r8, [rbx + 0x80]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d5480
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, 0xffffffffffffffff
test rax, rax
jne 0x1400d52e5
xor ecx, ecx
jmp 0x1400d52fa
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400d52f0
mov r8d, ecx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140010860
movss xmm0, dword [rbx + 0xa0]
mulss xmm0, dword [0x1402ecd08]
cvttss2si ebx, xmm0
cmp ebx, 0x64
je 0x1400d538c
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d546b
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, ebx
lea rdx, str._v2_tomor__x_d.png
lea rcx, [rsp + 0x38]
call fcn.14000b080
mov rbx, qword [rsp + 0x38]
mov r8, rbx
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d53a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400d53a4
lea r8, str._v2_tomor.png
lea rdx, str..png
lea rcx, [rsp + 0x30]
call fcn.14007f8c0
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d5460
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsi], rax
lea rax, [rsp + 0x50]
cmp rax, 0x10000
jae 0x1400d53f1
lea rax, [rsp + 0x50]
movzx edx, ax
mov rcx, rsi
call fcn.14000b690
jmp 0x1400d541b
lea rcx, [rsp + 0x50]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d5400
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140010860
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400d5438
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x1400d5480
Capabilities:
Parse url

Disassembly:
push rdi
sub rsp, 0x4d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x4e0], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140289490
mov dword [rsp + 0x30], WSAGetLastError
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xa0]
call fcn.140289490
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x2b0]
call fcn.140289490
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x80], 0x104
mov dword [rsp + 0x90], 0x104
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x1400d559d
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d5630
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rdx, [0x1402ec198]
cmp rdx, 0x10000
jae 0x1400d557e
movzx edx, dx
mov rcx, rdi
call fcn.14000b690
jmp 0x1400d559b
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x1400d5585
mov r8d, ecx
mov rcx, rdi
call fcn.140010860
nop
jmp 0x1400d5601
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d5625
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0xa0]
cmp rax, 0x10000
lea rax, [rsp + 0xa0]
jae 0x1400d55dc
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x1400d5601
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400d55e3
mov r8d, ecx
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4d0
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x1400d8fb0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1400d901a
cmp qword [rcx + 0x20], 0
jne 0x1400d901a
cmp qword [rcx + 0x28], 0
jne 0x1400d901a
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x28], rax
mov r9, rbx
xor eax, eax
lea r8, [0x1400d9410]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1402967ac
mov qword [rbx + 0x18], rax
add rsp, 0x30
pop rbx
ret

Function at 0x1400dbed0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x38]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareLDSGameCenterDebug
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400dbf5c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.CtxMenu
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400dbf51
cmp dword [rsp + 0x30], 1
mov eax, 0x80004005
cmove ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x1400e41a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
push r12
push r14
sub rsp, 0xe0
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edi, edi
mov r12, rdx
mov rbx, rcx
mov ebp, edi
mov r14d, edi
test rcx, rcx
je 0x1400e43d2
test rdx, rdx
je 0x1400e43d2
cmp r8d, 0x20
jl 0x1400e43d2
mov qword [r11 - 0x30], r13
xor edx, edx
movsxd r13, r8d
mov rcx, r12
mov r8, r13
mov qword [r11 - 0x38], r15
mov qword [rsp + 0x48], r13
call fcn.140289490
mov edx, 1
mov qword [rsp + 0x30], rdi
mov r8d, edx
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
test rax, rax
je 0x1400e43a1
cmp rax, 0xffffffffffffffff
je 0x1400e4398
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400e4c50
xor eax, eax
lea rdx, [rsp + 0x40]
mov rcx, r15
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400e4398
mov qword [rsp + 0x128], rsi
cmp qword [rsp + 0x40], rdi
je 0x1400e4320
mov qword [rsp + 0x28], rdi
lea r8d, [rdi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
je 0x1400e4390
mov rsi, qword [rsp + 0x40]
xor ebx, ebx
cmp rbx, rsi
jge 0x1400e4320
mov r13d, 0x400000
nop dword [rax]
sub rsi, rbx
mov r8, rbx
cmp rsi, r13
mov r9d, ebx
mov edx, 4
mov rcx, r14
cmovge esi, r13d
shr r8, 0x20
movsxd rax, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
je 0x1400e431b
mov r8d, esi
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.1400e4c90
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rsi, qword [rsp + 0x40]
add rbx, r13
mov rbp, rdi
cmp rbx, rsi
jl 0x1400e42c0
mov r13, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.1400e4970
lea rbx, [rsp + 0xa8]
mov rdi, r12
mov esi, InitCommonControls
nop word [rax + rax]
movzx r9d, byte [rbx]
lea r8, [0x14030c2e0]
mov edx, 3
mov rcx, rdi
call fcn.140015100
add rdi, 2
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x1400e4340
mov rdx, r13
mov rcx, r12
call fcn.1402a5c24
lea edi, [rsi + 1]
test rbp, rbp
je 0x1400e4382
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r14, r14
je 0x1400e4390
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x128]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0xd8]
mov eax, edi
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140172190
add rsp, 0xe0
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, edi
jmp 0x1400e43b3
Function at 0x1400e7370
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x480
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], r9
xor r14d, r14d
mov esi, r14d
test rdx, rdx
je 0x1400e741d
cmp word [rdx], r14w
je 0x1400e741d
test r8, r8
je 0x1400e73d8
cmp word [r8], r14w
je 0x1400e73d8
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x1400e741d
jmp 0x1400e7418
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x60]
call fcn.140289490
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov rdx, rbx
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x1400e741d
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 1
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400e7482
mov eax, dword [rbp + 0x40]
test eax, eax
js 0x1400e7482
lea rcx, vtable._BaseModule::CAutoLocker.0
mov qword [rsp + 0x48], rcx
lea rbx, [rbp + 0x58]
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x1400e7452
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, dword [rbp + 0x40]
test eax, eax
js 0x1400e746f
mov dword [rsp + 0x30], esi
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400e74b7
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + InitCommonControls]
nop
test rbx, rbx
je 0x1400e747e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400e7497
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], r14
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140172190
add rsp, 0x480
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400dcd44
nop
int3
Function at 0x1400e86a0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r13d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
lea rax, vtable.LogUtils::LogAppender.0
mov qword [rcx], rax
xor edi, edi
mov qword [rcx + 8], rdi
mov dword [rcx + 0x10], edi
mov byte [rcx + 0x14], 1
mov dword [rcx + 0x18], edi
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400e8875
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rbx + 0x20], rax
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400e8880
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rbx + 0x28], rax
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400e886a
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rbx + 0x30], rax
mov r14, 0xffffffffffffffff
mov dword [rbx + 0x38], r14d
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov qword [rbx + 0x78], rdi
mov dword [rbx + 0x18], r13d
test rsi, rsi
jne 0x1400e877c
mov eax, edi
jmp 0x1400e878a
mov rax, r14
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400e8780
mov r8d, eax
mov rdx, rsi
lea rcx, [rbx + 0x20]
call fcn.140010860
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x28]
call fcn.1400153c0
test rbp, rbp
je 0x1400e87bd
mov rax, r14
nop
inc rax
cmp word [rbp + rax*2], 0
jne 0x1400e87b0
mov edi, eax
mov r8d, edi
mov rdx, rbp
lea rcx, [rbx + 0x30]
call fcn.140010860
lea r8, [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400e9420
nop
mov rdx, rax
lea rcx, [rbx + 0x28]
call fcn.1400153c0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400e8809
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rbx + 0x28]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
test rax, rax
je 0x1400e884a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400e884a
cmp dword [rbx + 0x18], 0
je 0x1400e883f
mov rcx, qword [rbx + 0x20]
call fcn.1402a5ce4
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
int3