joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180018060
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
lea rcx, [0x180032906]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
movzx ecx, word [rdx + 0x14]
lea r8, [rcx + rdx + 0x18]
movzx ecx, word [rdx + 6]
test ecx, ecx
je 0x1800180a5
bt dword [r8 + 0x24], 0x1f
jb 0x1800180a8
add r8, 0x28
add ecx, 0xffffffff
jne 0x180018094
xor r8d, r8d
xor edi, edi
test r8, r8
je 0x180018170
mov ebx, dword [r8 + 0xc]
xor ecx, ecx
add rbx, rax
mov eax, dword [r8 + 8]
mov dword [rsp + 0x50], ecx
lea rsi, [rax + rbx - 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rax, [0x180018058]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x20], rax
cmp rbx, rsi
ja 0x180018170
mov rax, qword [rbx]
cmp rax, rbx
jne 0x180018168
cmp rax, qword [rbx + 8]
jne 0x180018168
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x20]
mov qword [rax + 8], rcx
lea rax, [rsp + 0x20]
lea rcx, [0x180032be6]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18001814d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov ecx, dword [rsp + 0x50]
test ecx, ecx
cmovne rdi, rbx
add rbx, 0x10
test ecx, ecx
je 0x180018104
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x180018184
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1800181e5
lea rcx, [0x180032906]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x180033068]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180018253
lea rdx, [0x1800159cc]
mov r9, rdi
mov r8, rsi
xor ecx, ecx
call rax
test eax, eax
jne 0x180018253
jmp 0x18001824a
cmp qword [0x18002fac8], 0
jne 0x180018200
call fcn.180018060
test rax, rax
mov qword [0x18002fac8], rax
je 0x180018253
mov rcx, qword [0x18002f7f8]
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18001824e
mov rdx, qword [0x18002fac8]
mov qword [rax + 8], rax
mov qword [rax], rax
mov qword [rax + 0x18], rsi
lea rcx, [0x1800159cc]
mov qword [rax + 0x10], rcx
mov qword [rdi], rax
mov rcx, qword [rdx + 8]
mov qword [rax + 8], rcx
mov qword [rax], rdx
mov qword [rcx], rax
mov qword [rdx + 8], rax
xor ebx, ebx
jmp 0x180018253
mov ebx, 8
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180018bb0
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
and dword [rax + 0x20], 0
mov rsi, rcx
mov rcx, qword [0x18002f7f8]
mov rbp, rdx
mov edi, 8
xor edx, edx
lea r8d, [rdi + 0x49]
mov dword [rax - 0x20], 1
mov dword [rax - 0x1c], 0x2710
mov dword [rax - 0x18], 0x3e8
mov dword [rax - 0x28], 0x493e0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180018d2f
lea r8d, [rdi + 0x49]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
or rax, 0xffffffffffffffff
lea r9d, [rdi + 4]
lea r8, [rsp + 0x58]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, 0x98000004
mov rcx, rbp
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x18], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x180018d27
cmp dword [rsi + 0x54], eax
je 0x180018ca4
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x180018d27
mov rdx, rbp
mov rcx, rbx
call qword [rsi + 0x40]
test eax, eax
mov edi, eax
jne 0x180018d27
lea rcx, [rsi + 0x10]
mov qword [rbx + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov qword [rax], rbx
lea rcx, [rsi + 0x10]
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r8d, [rdi + 0x10]
lea rcx, [0x180018784]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x180018d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsi + 0x10]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov r11, qword [rbx]
lea rcx, [rsi + 0x10]
mov qword [rax], r11
mov qword [r11 + 8], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180018d23
xor edi, edi
test edi, edi
je 0x180018d2f
mov rcx, rbx
call fcn.180018720
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180018f98
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x180018ffd
cmp eax, 0xffffffff
jne 0x180018ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
mov ebx, eax
jne 0x180019002
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
jmp 0x180018ff7
sub edi, eax
cdqe
add rsi, rax
test edi, edi
je 0x180019002
jmp 0x180018fb7
mov ebx, 0x4d4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001901c
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
xor esi, esi
test r9, r9
mov r12, r9
mov rbp, r8
mov r13, rdx
jne 0x18001904f
lea edi, [rsi + 0x57]
jmp 0x1800191b1
lea rdx, [rsp + 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
mov edi, eax
jne 0x180019186
mov rcx, qword [0x18002f7f8]
mov edi, 0x8c
xor edx, edx
mov r8, rdi
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
jne 0x180019092
lea edi, [rsi + 7]
jmp 0x1800191a3
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rcx, [rbx + 0x50]
mov r8d, 0x10
mov rdx, r13
call sub.ntdll.dll_memcpy
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or qword [rbx + 0x60], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0x68], rax
je 0x180019193
test rbp, rbp
mov qword [rbx + 0x70], rbp
jne 0x18001910b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x70], rax
je 0x180019193
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrDupA]
mov r8d, 6
mov edx, esi
mov qword [rbx + 0x38], rax
lea rax, [fcn.180018530]
lea ecx, [r8 - 4]
mov qword [rbx + 0x40], rax
lea rax, [0x180018578]
mov qword [rbx + 0x48], rax
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x60], rax
je 0x180019193
lea rax, [rbx + 0x88]
lea r8, [0x180018d48]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x80], rax
je 0x180019193
mov qword [0x18002f808], rbx
xor edi, edi
jmp 0x18001918e
mov rbx, qword [rsp + 0x208]
cmp edi, 0xffffffff
jne 0x18001919b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x1800191b1
test esi, esi
je 0x1800191b1
mov rcx, rbx
call fcn.1800191d0
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1d0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x180019758
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x18001979e
test rdx, rdx
je 0x18001979e
test ebx, ebx
je 0x18001979e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001978f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800197a3
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1d
jmp 0x1800197a3
mov eax, 0x57
add rsp, 0x30
pop rbx
ret
Function at 0x1800197ac
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x1800197f2
test rdx, rdx
je 0x1800197f2
test ebx, ebx
je 0x1800197f2
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800197e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800197f7
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1e
jmp 0x1800197f7
mov eax, 0x57
add rsp, 0x30
pop rbx
ret
Function at 0x18001db80
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x90
mov rdi, r8
mov rsi, rcx
mov rbx, rdx
xor ebp, ebp
lea rcx, [rax - 0x68]
xor edx, edx
lea r8d, [rbp + 0x60]
call sub.ntdll.dll_memset
test rsi, rsi
je 0x18001dbc9
test rbx, rbx
je 0x18001dbc9
test rdi, rdi
je 0x18001dbc9
mov al, byte [rbx]
mov rcx, rbx
cmp al, 0x2f
jne 0x18001dbf2
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp al, 0x5c
je 0x18001dbc9
cmp al, 0x3a
je 0x18001dbc9
add rcx, 1
mov al, byte [rcx]
test al, al
jne 0x18001dbe4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, rsi
lea rcx, [rsp + 0x30]
cmp eax, 0xffffffff
je 0x18001dc38
mov r8d, 0x809
call fcn.18001c8e4
mov rdx, rsi
lea rcx, [rsp + 0x30]
test eax, eax
je 0x18001dc38
call fcn.18001cd44
test eax, eax
jne 0x18001dc49
lea rcx, [rsp + 0x30]
call fcn.18001c9b0
jmp 0x18001dbc9
xor r8d, r8d
call fcn.18001ccd0
test eax, eax
je 0x18001dbc9
mov ebp, 1
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x28], 9
and word [rsp + 0x20], 0
call fcn.18001d3a4
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.18001d900
lea rcx, [rsp + 0x30]
neg eax
sbb edi, edi
and edi, ebx
call fcn.18001da6c
neg eax
sbb ebx, ebx
and ebx, edi
jne 0x18001dca5
test ebp, ebp
je 0x18001dca5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18001dca5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
jmp 0x18001dbcb

Function at 0x18001e30c
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [0x18002f7f8]
xor edx, edx
mov r8d, 0x1000
xor edi, edi
mov dword [rax + 0x10], 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18001e3ba
lea r8, [rsp + 0x38]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
test rax, rax
mov rsi, rax
je 0x18001e3a8
mov edi, 1
mov rcx, qword [rbx + 8]
mov rdx, rbp
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18001e382
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x38], 0x1000
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x18001e366
mov rcx, rsi
call qword [sym.imp.WININET.dll_FindCloseUrlCache]
mov rcx, qword [0x18002f7f8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x18001eb90
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x18002fa24]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov rdi, rcx
call fcn.180016a60
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edx, dword [rsp + 0x40]
test edx, edx
je 0x18001ec1c
mov rcx, qword [0x18002f7f8]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18001ec1c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x18001ec0a
mov edx, dword [rsp + 0x40]
mov rcx, rbx
add edx, edx
call fcn.180022cd4
xor dword [rdi], eax
mov rcx, qword [0x18002f7f8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edx, dword [rsp + 0x40]
test edx, edx
je 0x18001ec88
mov rcx, qword [0x18002f7f8]
mov r8, rdx
xor edx, edx
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18001ec88
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x18001ec76
mov edx, dword [rsp + 0x40]
mov rcx, rbx
add edx, edx
call fcn.180022cd4
xor dword [rdi + 0xc], eax
mov rcx, qword [0x18002f7f8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
cpuid
mov r8d, eax
mov eax, dword [rdi + 4]
mov dword [rsp + 0x24], ebx
mov rbx, qword [rsp + 0x50]
xor eax, edx
xor eax, ecx
xor eax, r8d
mov dword [rdi + 4], eax
add rsp, 0x30
pop rdi
ret
Function at 0x18001ef64
Capabilities:
Connect to http server
Create http request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rbx, rcx
mov rcx, r8
mov r12, r9
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x18002f7f8]
add eax, eax
xor edx, edx
lea r8d, [rax + 1]
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x18001efc6
lea r8, [rsp + 0x60]
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
cmovne rsi, rdi
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
mov qword [rbx + 0x18], rax
je 0x18001f0e3
lea rdx, [0x18001ee38]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetStatusCallback]
cmp rax, 0xffffffffffffffff
je 0x18001f0e3
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x38], rbx
and dword [rsp + 0x30], 0
xor r9d, r9d
mov r8w, 0x50
mov rdx, rbp
mov dword [rsp + 0x28], 3
and qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetConnectA]
test rax, rax
mov qword [rbx + 0x20], rax
jne 0x18001f06e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18001f0e3
mov rcx, qword [rbx + 0x30]
mov edx, 0xea60
call fcn.18001ecb0
test eax, eax
jne 0x18001f0e3
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x84404000
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rsi
mov rdx, r12
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
test rax, rax
mov qword [rbx + 0x28], rax
je 0x18001f0e3
mov esi, 4
lea r8, [rsp + 0x88]
mov rcx, rax
lea edx, [rsi + 2]
mov r9d, esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x18001f0e3
mov rcx, qword [rbx + 0x28]
lea r8, [rsp + 0x88]
lea edx, [rsi + 1]
mov r9d, esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x18001f0e3
xor ebx, ebx
jmp 0x18001f0eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x18001f102
mov rcx, qword [0x18002f7f8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x18001f334
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0xa0
and dword [rax + 8], 0
mov rdi, rcx
mov rcx, qword [rcx + 0x30]
mov esi, edx
mov edx, 0xea60
call fcn.18001ecb0
test eax, eax
mov ebx, eax
jne 0x18001f56f
mov ebx, dword [rdi + 0x40]
test ebx, ebx
jne 0x18001f565
cmp qword [rdi], 0
jne 0x18001f565
test esi, esi
je 0x18001f388
mov rcx, qword [rdi + 0x28]
call fcn.18001eed4
mov qword [rdi + 8], rax
mov ebx, 8
lea r8, [rsp + 0x38]
xor ecx, ecx
lea edx, [rbx - 7]
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x18001f565
mov rcx, qword [0x18002f7f8]
xor edx, edx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x18001f55a
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0xc0]
mov r8d, 0x1000
mov rdx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18001f417
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov ebx, eax
jne 0x18001f439
mov rcx, qword [rdi + 0x30]
or edx, 0xffffffff
call fcn.18001ecb0
test eax, eax
mov ebx, eax
jne 0x18001f439
mov ebx, dword [rdi + 0x40]
test ebx, ebx
jne 0x18001f439
mov r8d, dword [rsp + 0xc0]
test r8d, r8d
je 0x18001f437
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x18001f3c6
xor ebx, ebx
mov rcx, qword [0x18002f7f8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x18001f55a
mov rcx, qword [rdi + 0x28]
and dword [rsp + 0xd0], ebx
and dword [rsp + 0xd8], ebx
lea rax, [rsp + 0xd8]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xd0]
mov edx, 0x20000013
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x18001f555
cmp dword [rsp + 0xd0], 0xc8
jne 0x18001f555
mov rcx, qword [rsp + 0x38]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov r11d, dword [rsp + 0x60]
test r11d, r11d
mov dword [rsp + 0xc0], r11d
je 0x18001f54e
mov rcx, qword [rsp + 0x38]
and dword [rsp + 0x40], ebx
and dword [rsp + 0x44], ebx
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x28]
movsxd r8, dword [rsp + 0xc0]
mov rcx, qword [0x18002f7f8]
add r8, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x18001f547
mov rcx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0xc0]
xor r9d, r9d
mov r10, qword [rcx]
mov rdx, rax
call qword [r10 + 0x18]
movsxd r11, dword [rsp + 0xc0]
mov byte [r11 + rsi], bl
mov eax, dword [rsp + 0xc0]
mov qword [rdi], rsi
mov dword [rdi + 0x44], eax
jmp 0x18001f55a
mov ebx, 8
jmp 0x18001f55a
mov ebx, 0x10d2
jmp 0x18001f55a
mov ebx, 0xe8
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, ebx
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001f980
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov eax, dword [0x18002e130]
mov r9, qword [0x18002fad0]
mov ebp, r8d
shr ebp, 0x14
mov r13d, r8d
mov r14, rdx
mov r15, rcx
mov ebx, 8
lea r12, [0x18003246f]
imul ebp, eax
test ebp, ebp
jne 0x18001f9d1
mov ebp, dword [0x18002e130]
mov rcx, qword [0x18002f7f8]
test r9, r9
cmovne r12, r9
xor edx, edx
lea r8d, [rdx + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x18001fafe
mov rcx, rax
call fcn.18001ecec
test eax, eax
je 0x18001fade
cmp dword [rsp + 0xa8], 0
jne 0x18001fa15
or dword [rdi + 0x48], 1
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x30], ebp
mov r9d, r13d
mov qword [rsp + 0x28], rax
mov r8, r14
mov rdx, r15
mov rcx, rdi
mov qword [rsp + 0x20], r12
call fcn.18001f804
test eax, eax
mov ebx, eax
jne 0x18001fad6
cmp dword [rsp + 0xa8], eax
je 0x18001fafe
mov rcx, qword [rdi + 0x30]
mov edx, ebp
call fcn.18001ecb0
test eax, eax
mov ebx, eax
jne 0x18001fac5
mov ebx, dword [rdi + 0x40]
test ebx, ebx
jne 0x18001fad6
mov rcx, qword [rdi + 0x28]
and dword [rsp + 0x90], ebx
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x40]
mov edx, 0x20000013
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], 4
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x18001fabb
cmp dword [rsp + 0x40], 0xc8
je 0x18001fad6
mov ebx, 0xe8
jmp 0x18001fad6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18001fad6
cmp eax, 0x102
jne 0x18001fad6
add dword [0x18002e130], 0xea60
mov rcx, rdi
call fcn.18001ed58
cmp dword [rsp + 0xa8], 0
jne 0x18001faec
test ebx, ebx
je 0x18001fafe
mov rcx, qword [0x18002f7f8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800217d8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [0x18002f7f8]
mov rbp, rdx
xor edx, edx
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
xor eax, eax
cmp rbx, rax
mov qword [rsp + 0x78], rax
jne 0x180021818
mov eax, 8
jmp 0x180021900
mov esi, eax
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
mov r8, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x18002188d
test eax, eax
jne 0x180021879
lea rcx, [0x1800336f8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x1800336f8]
mov rcx, rbx
lea r8d, [rax + 1]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x180021882
add esi, 1
xor eax, eax
mov edx, esi
jmp 0x18002181c
mov rdx, rbp
mov rcx, rdi
call fcn.18002131c
xor esi, esi
xor edx, edx
jmp 0x1800218d3
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800218c3
mov rcx, qword [rsp + 0x78]
mov rdx, rbp
call fcn.1800217d8
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 1
mov edx, esi
mov r9d, 0x104
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x180021893
mov rcx, qword [0x18002f7f8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret