Function at 0x180022790
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10d0]
mov eax, 0x11d0
call fcn.18003d470
sub rsp, rax
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rbp + 0x10c0], rax
xor eax, eax
xor r15d, r15d
mov qword [rsp + 0x70], r8
mov r14, rcx
mov qword [rsp + 0x58], rdx
lea r8d, [r15 + 0x50]
lea rcx, [rbp - 0x18]
xor edx, edx
mov dword [rsp + 0x68], r9d
mov dword [rsp + 0x54], r15d
mov qword [rsp + 0x78], 0xffffffffffffffff
mov r13d, r15d
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r15
call sub.MSVCR100.dll_memset
lea rcx, str.HOMEDRIVE
mov byte [rbp + 0x40], r13b
call qword [sym.imp.MSVCR100.dll_getenv]
or rcx, 0xffffffffffffffff
mov r12, rax
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
lea rbx, [rcx - 1]
lea rcx, str.HOMEPATH
call qword [sym.imp.MSVCR100.dll_getenv]
lea rsi, [0x1800480e8]
test rax, rax
cmovne rsi, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx - 1]
add eax, ebx
movsxd rcx, eax
add rcx, 0xa
call qword [sym.imp.MSVCR100.dll_malloc]
lea rdx, str._s_s.swfinfo
mov r9, rsi
mov rcx, rax
mov r8, r12
mov rbx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.MSVCR100.dll_sprintf]
lea rdx, [0x180048e88]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_fopen]
mov rsi, rax
test rax, rax
je 0x180022b96
lea edx, [r15 + 0x2f]
mov rcx, r14
call qword [sym.imp.MSVCR100.dll_strchr]
test rax, rax
je 0x180022b96
lea rcx, [rax + 2]
lea edx, [r15 + 0x2f]
call qword [sym.imp.MSVCR100.dll_strchr]
mov rbx, rax
test rax, rax
je 0x180022b9d
inc eax
lea edx, [r15 + 0x2f]
lea rcx, [rbx + 1]
sub eax, r14d
mov dword [rsp + 0x50], eax
call qword [sym.imp.MSVCR100.dll_strrchr]
test rax, rax
je 0x180022920
mov rbx, rax
nop dword [rax + rax]
lea rcx, [rbp + 0xc0]
mov r8, rsi
mov edx, 0x1000
call qword [sym.imp.MSVCR100.dll_fgets]
test rax, rax
je 0x180022b9d
lea rdx, str.url:
lea rcx, [rbp + 0xc0]
mov r8d, 5
mov r13d, r15d
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
jne 0x180022920
mov r8d, dword [rsp + 0x50]
lea rcx, [rbp + 0xc5]
mov rdx, r14
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
jne 0x180022920
lea edx, [rax + 0x2f]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCR100.dll_strrchr]
or rcx, 0xffffffffffffffff
mov rdx, rbx
mov r11, rax
xor eax, eax
mov rdi, r11
repne scasb al, byte [rdi]
not rcx
sub ecx, 2
movsxd r8, ecx
mov rcx, r11
mov byte [r8 + r11], al
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
jne 0x180022920
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_ftell]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x58]
mov dword [rsp + 0x54], eax
nop
lea rcx, [rbp + 0xc0]
mov r8, rsi
mov edx, 0x1000
call qword [sym.imp.MSVCR100.dll_fgets]
test rax, rax
je 0x180022ba2
lea rdx, str.size:
lea rcx, [rbp + 0xc0]
mov r8d, 6
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
jne 0x180022a2b
lea r8d, [rax + 0x10]
lea rcx, [rbp + 0xc6]
xor edx, edx
call qword [sym.imp.MSVCR100.dll_strtol]
inc r13d
mov dword [r12], eax
jmp 0x180022b8a
lea rdx, str.hash:
lea rcx, [rbp + 0xc0]
mov r8d, 6
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
jne 0x180022ac2
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0xc6]
repne scasb al, byte [rdi]
mov r8, rbx
mov rdx, r15
not rcx
sub ecx, 2
movsxd rdi, ecx
test ecx, ecx
jle 0x180022aba
nop dword [rax + rax]
movzx eax, byte [rbp + rdx + 0xc6]
test al, 0x40
movzx eax, al
je 0x180022a87
and eax, 0xf
add eax, 9
jmp 0x180022a8a
and eax, 0xf
movzx ecx, byte [rbp + rdx + 0xc7]
test cl, 0x40
movzx ecx, cl
je 0x180022aa2
and ecx, 0xf
add ecx, 9
jmp 0x180022aa5
and ecx, 0xf
shl al, 4
add rdx, 2
inc r8
or al, cl
mov byte [r8 - 1], al
cmp rdx, rdi
jl 0x180022a70
inc r13d
jmp 0x180022b8a
lea rdx, str.date:
lea rcx, [rbp + 0xc0]
mov r8d, 6
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
jne 0x180022b1a
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0xc0]
repne scasb al, byte [rdi]
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0xc6]
not rcx
mov r8d, 0x40
mov byte [rcx + rax - 2], r15b
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCR100.dll_strncpy]
inc r13d
jmp 0x180022b8a
lea rdx, str.ctim:
lea rcx, [rbp + 0xc0]
mov r8d, 6
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
jne 0x180022b6c
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0xc0]
repne scasb al, byte [rdi]
lea rax, [rbp + 0xc0]
not rcx
mov byte [rcx + rax - 2], r15b
lea rcx, [rbp + 0xc6]
call fcn.180022500
inc r13d
mov qword [rsp + 0x78], rax
jmp 0x180022b8a
lea rdx, str.url:
lea rcx, [rbp + 0xc0]
mov r8d, 5
call qword [sym.imp.MSVCR100.dll_strncmp]
test eax, eax
je 0x180022ba2
cmp r13d, 4
jl 0x1800229d0
jmp 0x180022ba2
mov r12, qword [rsp + 0x58]
jmp 0x180022ba7
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.MSVCR100.dll__time64]
movsxd rcx, dword [rsp + 0x68]
mov rdx, rax
mov qword [rbp - 0x48], rax
test ecx, ecx
je 0x180022bf0
mov rax, qword [rsp + 0x78]
test rax, rax
jle 0x180022bf0
sub rdx, rax
movabs rax, 0x1845c8a0ce512957
imul rdx
sar rdx, 0xd
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, rcx
jl 0x180022eb8
lea rcx, [rbp - 0x78]
mov dword [rbp - 0x58], 1
call qword [sym.imp.libcrypto_3.dll_HMAC_CTX_reset]
call qword [sym.imp.libcrypto_3.dll_EVP_sha256]
lea rdx, str.Genuine_Adobe_Flash_Player_001
lea rcx, [rbp - 0x78]
mov r9, rax
mov r8d, 0x1e
mov qword [rsp + 0x20], r15
call qword [sym.imp.libcrypto_3.dll_HMAC_Init_ex]
lea rdx, str.1.2.3
lea rcx, [rbp - 0x20]
mov r8d, 0x58
call qword [sym.imp.ca_core.dll_Ordinal_22]
lea rax, [rbp + 0x40]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x80], rdx
lea rcx, [rbp - 0x40]
mov rdx, r14
mov qword [rbp - 0x30], rax
call fcn.180021df0
lea rcx, [rbp - 0x20]
mov edi, eax
call qword [sym.imp.ca_core.dll_Ordinal_20]
test edi, edi
je 0x180022ccc
cmp edi, 1
je 0x180022ccc
or r15d, 0xffffffff
mov r9, r14
lea r8, str.RTMP_HashSWF
lea ecx, [r15 + 2]
cmp edi, 6
jne 0x180022c9e
lea rdx, str._s:_connection_lost_while_downloading_swfurl__s
call fcn.180022fd0
jmp 0x180022eae
cmp edi, 2
jne 0x180022cb4
lea rdx, str._s:_swfurl__s_not_found
call fcn.180022fd0
jmp 0x180022eae
mov eax, dword [rbp - 0x34]
lea rdx, str._s:_couldnt_contact_swfurl__s__HTTP_error__d_
mov dword [rsp + 0x20], eax
call fcn.180022fd0
jmp 0x180022eae
test r13d, r13d
je 0x180022cec
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x180022cec
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fseek]
jmp 0x180022d93
test rsi, rsi
jne 0x180022d44
lea rdx, [0x180048f68]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_fopen]
mov rsi, rax
test rax, rax
jne 0x180022d44
call qword [sym.imp.MSVCR100.dll__errno]
mov edi, dword [rax]
mov ecx, edi
call qword [sym.imp.MSVCR100.dll_strerror]
lea r8, str.RTMP_HashSWF
lea rdx, str._s:_couldnt_open__s_for_writing__errno__d___s_
mov qword [rsp + 0x28], rax
lea ecx, [rsi + 1]
mov r9, rbx
mov dword [rsp + 0x20], edi
call fcn.180022fd0
or r15d, 0xffffffff
jmp 0x180022eb8
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.MSVCR100.dll_fseek]
mov edx, 0x3f
mov rcx, r14
call qword [sym.imp.MSVCR100.dll_strchr]
mov rcx, rax
test rax, rax
je 0x180022d6e
sub ecx, r14d
jmp 0x180022d7d
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rdx, str.url:__.s_n
mov r9, r14
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
lea rcx, [rbp - 0x48]
call qword [sym.imp.MSVCR100.dll__gmtime64]
lea r10, sym.CACapture.dll_Ordinal_17
mov edx, dword [rax + 0x14]
movsxd rcx, dword [rax + 0x10]
movsxd r8, dword [rax + 0x18]
mov r8, qword [r10 + r8*8 + 0x5b660]
mov rdi, rax
mov eax, dword [rax]
mov r9d, dword [rdi + 0xc]
mov dword [rsp + 0x40], eax
mov eax, dword [rdi + 4]
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 8]
add edx, 0x76c
mov dword [rsp + 0x30], eax
mov rax, qword [r10 + rcx*8 + 0x5b600]
mov dword [rsp + 0x28], edx
lea rdx, str._s___02d__s__d__02d:_02d:_02d_GMT
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll_sprintf]
lea r8, [rbp + 0x80]
lea rdx, str.ctim:__s_n
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
cmp dword [rbp - 0x58], r15d
jne 0x180022eae
mov rbx, qword [rsp + 0x70]
lea r8, [rsp + 0x50]
lea rcx, [rbp - 0x78]
mov rdx, rbx
call qword [sym.imp.libcrypto_3.dll_HMAC_Final]
mov ecx, dword [rbp - 0x50]
lea r8, [rbp + 0x40]
mov dword [r12], ecx
lea rdx, str.date:__s_n
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
mov r8d, dword [rbp - 0x50]
lea rdx, str.size:__08x_n
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
lea rdx, str.hash:
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
mov rdi, r15
nop word [rax + rax]
movzx r8d, byte [rdi + rbx]
lea rdx, str._02x
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
inc rdi
cmp rdi, 0x20
jl 0x180022e80
lea rdx, [0x180041e5c]
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fprintf]
lea rcx, [rbp - 0x78]
call qword [sym.imp.libcrypto_3.dll_HMAC_CTX_reset]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCR100.dll_free]
test rsi, rsi
je 0x180022ed1
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fclose]
mov eax, r15d
mov rcx, qword [rbp + 0x10c0]
xor rcx, rsp
call fcn.18003c580
mov rbx, qword [rsp + 0x1228]
add rsp, 0x11d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret