joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405d6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405d61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405d6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405d606f
add dl, dl
jne 0x1405d6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405d60f6
xor eax, eax
add dl, dl
jne 0x1405d60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405d61ad
add dl, dl
jne 0x1405d60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405d60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405d607e
mov eax, 1
add dl, dl
jne 0x1405d6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405d6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405d60fb
sub eax, ebx
mov ebx, 1
jne 0x1405d614c
mov ecx, 1
add dl, dl
jne 0x1405d612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405d613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405d6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405d607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405d6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405d6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405d615d
cmp eax, 0x7d00
jae 0x1405d619b
cmp eax, 0x500
jb 0x1405d6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405d607e
cmp eax, 0x7f
ja 0x1405d619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405d607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405d61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405d607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001234
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rcx + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
and qword [r11 - 0x20], 0
mov rsi, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x140001275
mov rsi, qword [rcx]
movabs rbx, 0x7fffffffffffffff
cmp rbp, rbx
ja 0x140001421
cmp rbp, 0xf
ja 0x1400012af
movups xmm0, xmmword [rsi]
mov ebx, 0xf
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbx
movups xmmword [rsp + 0x20], xmm0
movq rdi, xmm0
jmp 0x140001342
mov rax, rbp
or rax, 0xf
cmp rax, rbx
jbe 0x1400012e8
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001fb0
test rax, rax
je 0x1400013ed
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001324
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001313
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001427
jmp 0x1400012c9
test rcx, rcx
je 0x140001322
call fcn.140001fb0
mov rdi, rax
jmp 0x140001324
xor edi, edi
lea r8, [rbp + 1]
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov qword [rsp + 0x30], rbp
mov rcx, rdi
mov qword [rsp + 0x38], rbx
call sub.msvcrt.dll_memcpy_s
cmp byte [0x1400050c2], 0
lea r10, [0x1400050b8]
mov esi, 1
je 0x140001390
xor r8d, r8d
mov r9, r10
movsx eax, r8b
mov dl, r8b
imul ecx, eax, 0x5e
and dl, 0x3f
mov eax, r8d
and al, sil
sub dl, cl
add dl, 0x3a
neg al
sbb cl, cl
add r8d, esi
and cl, 0xce
add cl, 9
xor dl, cl
xor byte [r9], dl
add r9, rsi
cmp r8d, 0xb
jl 0x14000135d
or rax, 0xffffffffffffffff
inc rax
cmp byte [r10 + rax], 0
jne 0x140001394
cmp rbx, 0xf
lea rcx, [rsp + 0x20]
cmova rcx, rdi
cmp rbp, rax
jne 0x1400013bf
mov r8, rbp
mov rdx, r10
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400013c2
xor sil, sil
cmp rbx, 0xf
jbe 0x1400013fc
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400013f4
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140001ff4
mov al, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001f90
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.140001174
int3
call fcn.1400010d4
int3
Function at 0x1400016ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
movups xmm0, xmmword [0x140003478]
movzx eax, word [0x140003498]
xor ebx, ebx
movups xmm1, xmmword [0x140003488]
mov word [rbp - 0x20], ax
mov r9d, ebx
movups xmmword [rbp - 0x40], xmm0
lea r10, [rbp - 0x40]
movups xmmword [rbp - 0x30], xmm1
movsx eax, r9b
mov r8b, r9b
imul ecx, eax, 0x5e
and r8b, 0x3f
mov eax, r9d
and al, 1
sub r8b, cl
add r8b, 0x3a
neg al
sbb dl, dl
inc r9d
and dl, 0xce
add dl, 9
xor r8b, dl
xor byte [r10], r8b
inc r10
cmp r9d, 0x22
jl 0x1400016e3
lea rcx, [rbp - 0x40]
call sub.msvcrt.dll_printf_s
nop
nop
nop
nop
nop
nop
nop
movups xmm0, xmmword [0x1400034b8]
mov eax, dword [0x1400034e8]
lea r9, [rbp - 0x40]
movups xmm1, xmmword [0x1400034c8]
mov dword [rbp - 0x10], eax
movzx eax, word [0x1400034ec]
movups xmmword [rbp - 0x40], xmm0
mov word [rbp - 0xc], ax
movups xmm0, xmmword [0x1400034d8]
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
movsx eax, bl
mov r8b, bl
imul ecx, eax, 0x5e
and r8b, 0x3f
mov eax, ebx
and al, 1
sub r8b, cl
add r8b, 0x3a
neg al
sbb dl, dl
inc ebx
and dl, 0xce
add dl, 9
xor r8b, dl
xor byte [r9], r8b
inc r9
cmp ebx, 0x36
jl 0x140001762
lea rcx, [rbp - 0x40]
call sub.msvcrt.dll_printf_s
nop
nop
nop
nop
nop
nop
nop
call fcn.140001430
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x60
pop rbp
ret

Function at 0x140002910
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000295a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000295a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000295a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000295a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000295a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000295c
xor al, al
add rsp, 0x28
ret
Function at 0x14000af40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14000af78
xor eax, eax
jmp 0x14000b03f
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x14000af9a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x30], rax
jmp 0x14000afc4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x20], eax
mov r8d, 2
mov edx, 4
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostbyaddr]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14000afdb
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x14000b03f
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov eax, dword [rax]
mov dword [rsp + 0x3c], eax
mov eax, 2
mov word [rsp + 0x38], ax
movzx ecx, word [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14000b03a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x14000b03f
mov rax, qword [rsp + 0x28]
add rsp, 0x58
ret

Function at 0x14000bd80
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 1
lea rdx, [0x14038a5eb]
mov rcx, qword [rsp + 0x60]
call fcn.1400064f0
nop
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
lea rdx, [0x1404c6840]
mov cx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000be0f
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14000be05
and dword [rsp + 0x20], 0xfffffffe
mov rcx, qword [rsp + 0x60]
call fcn.1400067e0
mov rax, qword [rsp + 0x60]
jmp 0x14000be9d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
call fcn.14000beb0
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x24], 0
je 0x14000be70
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.14000a200
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov edx, 1
mov rcx, qword [rsp + 0x40]
call fcn.1403228c4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov edx, 1
mov rcx, qword [rsp + 0x48]
call fcn.1403228c4
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14000be98
and dword [rsp + 0x20], 0xfffffffe
mov rcx, qword [rsp + 0x60]
call fcn.1400067e0
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1400123f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140014210
nop
lea rax, [0x140011410]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.140008560
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001247f
lea rcx, [rsp + 0x30]
call fcn.140036aa0
jmp 0x140012496
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x30]
call fcn.140017e70
add rsp, 0x58
ret

Function at 0x14001a740
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, recv
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.140009980
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x14001a7c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
call fcn.1400074e0
lea rax, [rax + rax + 2]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
call fcn.14001eb50
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x28]
movzx ecx, word [rsp + 0x20]
mov word [rax], cx
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
add rax, 2
mov qword [rsp + 0x28], rax
cmp word [rsp + 0x20], 0
jne 0x14001a81b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, recv
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x58
ret
Function at 0x14001b980
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14001b9ab
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b9b2
mov al, 1
jmp 0x14001bb0c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14000b0e0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14000b0e0
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.14000b130
movzx eax, al
test eax, eax
je 0x14001ba09
xor al, al
jmp 0x14001bb0c
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001ba79
cmp dword [rsp + 0x30], 1
je 0x14001ba85
cmp dword [rsp + 0x30], 3
je 0x14001bafa
jmp 0x14001bb0a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14001bad1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14001bad1
xor al, al
jmp 0x14001bb0c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001baeb
mov dword [rsp + 0x34], 1
jmp 0x14001baf3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14001bb0c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001bb0c
xor al, al
add rsp, 0xa8
ret
Function at 0x14001bb20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x14001bb4b
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14001bb52
mov al, 1
jmp 0x14001bcb0
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
call fcn.140021290
mov word [rsp + 0x30], ax
movzx edx, word [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x48]
mov word [rsp + 0x32], ax
call fcn.140021290
mov word [rsp + 0x34], ax
lea rdx, [rsp + 0x32]
lea rcx, [rsp + 0x34]
call fcn.1400212a0
movzx eax, al
test eax, eax
je 0x14001bbad
xor al, al
jmp 0x14001bcb0
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x68]
mov rdx, rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14001bc1d
cmp dword [rsp + 0x38], 1
je 0x14001bc29
cmp dword [rsp + 0x38], 3
je 0x14001bc9e
jmp 0x14001bcae
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x72], 0
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x14001bc75
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x40], rax
je 0x14001bc75
xor al, al
jmp 0x14001bcb0
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14001bc8f
mov dword [rsp + 0x3c], 1
jmp 0x14001bc97
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
jmp 0x14001bcb0
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x14001bcb0
xor al, al
add rsp, 0x98
ret
Function at 0x1400211c0
Capabilities:
Enumerate threads

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x70]
call fcn.1400161c0
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x14002127e
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140021273
mov eax, dword [rsp + 0x38]
cmp rax, 0x10
jb 0x140021258
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x44], eax
jne 0x140021258
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.140036010
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140021235
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140021da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov rax, qword [rsp + 0x108]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
add rax, 4
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x30]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
cmp dword [rcx + rax + 0x74], 0
je 0x140021f55
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x70]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140014490
lea rcx, [rsp + 0x88]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
jmp 0x140021e87
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
cmp dword [rsp + 0x20], eax
jae 0x140021f55
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x20]
lea rax, [rax + rcx*4]
mov rcx, rax
call fcn.140014440
mov eax, eax
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x20]
lea rax, [rax + rcx*4]
mov rcx, rax
call fcn.140014440
mov eax, eax
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.1402d26e0
nop
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x68]
call fcn.14000e020
movzx eax, al
test eax, eax
je 0x140021f46
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
call fcn.1400067e0
mov rax, qword [rsp + 0x50]
jmp 0x140021f57
lea rcx, [rsp + 0x68]
call fcn.1400067e0
jmp 0x140021e7d
xor eax, eax
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x140022200
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1d8
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 8
jge 0x140022259
lea rdx, [0x14038ab59]
mov rcx, qword [rsp + 0x1e0]
call fcn.1400064f0
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x1e0]
jmp 0x140022406
mov r8d, 7
lea rdx, str.http:__
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400222c4
mov r8d, 8
lea rdx, str.https:__
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400222c4
lea rdx, [0x14038ab5a]
mov rcx, qword [rsp + 0x1e0]
call fcn.1400064f0
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x1e0]
jmp 0x140022406
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x1e8]
xor ecx, ecx
call sub.urlmon.dll_URLOpenBlockingStreamA
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140022325
lea rdx, [0x14038ab5b]
mov rcx, qword [rsp + 0x1e0]
call fcn.1400064f0
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x1e0]
jmp 0x140022406
mov dword [rsp + 0x34], 0
mov edx, 1
lea rcx, [rsp + 0xd0]
call fcn.140009a50
nop
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x64
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x48]
cmp dword [rsp + 0x34], 0
jbe 0x1400223c1
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x34]
mov r8d, eax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x34]
mov r8d, 0x64
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x58]
jmp 0x14002236a
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x38]
call qword [rax + reloc.WS2_32.dll_recv]
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0xd0]
call fcn.14000c940
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xd0]
call fcn.14000a230
mov rax, qword [rsp + 0x1e0]
add rsp, 0x1d8
ret