joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e21b9
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14014c9a0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x140350ac6]
call fcn.1400e271d
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1402b2e50]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x14014ca1f
mov dword [rbp + 0x120], 1
jmp 0x14014ca29
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x14014ca72
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14014c9ea
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400e2240
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140112b70
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x818]
mov rax, qword [0x14032be28]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x508], 0
lea rcx, [0x140350583]
call fcn.1400e271d
mov dword [rbp + 0x10], 0x438
mov rax, qword [rbp + 0x7f0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call fcn.1400e01a7
mov qword [rbp + 0x468], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400e0c10
mov dword [rbp + 0x484], 0
call fcn.1400e1ca5
mov dword [rbp + 0x4a4], eax
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400de68b
mov qword [rbp + 0x798], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x140112c5e
mov qword [rbp + 0x7a0], 0
jmp 0x140112d49
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x3fffffff
jle 0x140112c8f
mov qword [rbp + 0x7a8], 0
jmp 0x140112d3b
movsxd rax, dword [rbp + 0x484]
shl rax, 1
mov qword [rbp + 0x7b0], rax
movsxd rcx, dword [rbp + 0x484]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x7b8], rcx
mov rcx, qword [rbp + 0x7b8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x7b8]
ja 0x140112cd3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400decda
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x7c0], rax
lea r8, [rbp + 0x508]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400e2db2
add qword [rbp + 0x7c0], 0x20
mov r9d, dword [rbp + 0x4a4]
mov rax, qword [rbp + 0x7b0]
mov r8d, eax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400df8e2
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7a0], rax
mov rdx, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x7a0]
call fcn.1400e2e0c
test eax, eax
jne 0x140112d8d
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.1400ded11
mov rax, qword [rbp + 0x768]
jmp 0x140112dd0
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400dea91
test eax, eax
jne 0x140112c26
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x788], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400ded11
mov rax, qword [rbp + 0x788]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402b1430]
mov r8, qword [rbp + 0x508]
call fcn.1400e0e27
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400e0251
lea rsp, [rbp + 0x7d8]
pop rdi
pop rbp
ret
Function at 0x1400e2637
Capabilities:
Write file on windows

Disassembly:
jmp 0x140277ca0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14032be28]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x140351652]
call fcn.1400e271d
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140277d06
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140277d0d
mov al, 1
jmp 0x140277e7f
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x198], rax
call fcn.1400df347
mov dword [rbp + 0x1a0], eax
mov edx, dword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1d0]
call qword [rbp + 0x198]
mov dword [rbp + 0x164], eax
call fcn.1400df347
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400e1bc4
movzx eax, al
test eax, eax
je 0x140277d72
xor al, al
jmp 0x140277e7f
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x1a0], eax
cmp dword [rbp + 0x1a0], 0
je 0x140277de5
cmp dword [rbp + 0x1a0], 1
je 0x140277df0
cmp dword [rbp + 0x1a0], 3
je 0x140277e6e
jmp 0x140277e7d
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140277e40
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140277e40
xor al, al
jmp 0x140277e7f
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140277e5b
mov dword [rbp + 0x194], 1
jmp 0x140277e65
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140277e7f
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140277e7f
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1403028a0]
call fcn.1400e1b24
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1400e0251
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140005ff0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x140007f90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140008010
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x140007fb4
call fcn.140007f20
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140007fc7
call fcn.140007f20
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140008c20
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x14000f750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x140034010]
xor rax, rsp
mov qword [rsp + 8], rax
xor r8d, r8d
lea r15, [0x1400215a0]
mov dword [rsp], r8d
mov r9, rcx
movzx edi, byte [rsp + 3]
xor eax, eax
movzx esi, byte [rsp + 2]
movzx ebx, r8b
movzx ebp, byte [rsp + 1]
movzx r14d, r8b
mov word [rsp + 4], r8w
movzx r11d, byte [rsp + 5]
nop dword [rax]
movzx edx, byte [r9 + rax]
movzx ecx, byte [rax + r15]
movzx r10d, byte [rax + r15 + 0xc0]
xor cl, dl
or cl, r14b
xor r10b, dl
movzx r14d, cl
or r10b, r8b
movzx ecx, byte [rax + r15 + 0x20]
movzx r8d, r10b
xor cl, dl
or cl, bpl
movzx ebp, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or cl, sil
movzx esi, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or cl, dil
movzx edi, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or cl, bl
movzx ebx, cl
movzx ecx, byte [rax + r15 + 0xa0]
inc rax
xor cl, dl
or cl, r11b
movzx r11d, cl
cmp rax, 0x1f
jb 0x14000f7b0
movzx ecx, byte [rax + r9]
movzx r9d, byte [rax + r15 + 0xc0]
and cl, 0x7f
movzx edx, byte [rax + r15 + 0xa0]
movzx r8d, cl
xor edx, r8d
movzx ecx, r10b
or edx, r11d
xor r9d, r8d
dec edx
or r9d, ecx
dec r9d
or r9d, edx
movzx edx, byte [rax + r15 + 0x80]
xor edx, r8d
or edx, ebx
dec edx
or r9d, edx
movzx edx, byte [rax + r15]
xor edx, r8d
or edx, r14d
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x20]
xor edx, r8d
or edx, ebp
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x40]
movzx eax, byte [rax + r15 + 0x60]
xor edx, r8d
xor eax, r8d
or edx, esi
or eax, edi
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140003700
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret

Function at 0x140011ba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, edx
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x140011bb0
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x140017b20
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001794c
Function at 0x180004180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800030f0
nop
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.180015170
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000420b
cmp qword [rsp + 0x48], 8
jb 0x180004207
mov rcx, qword [rsp + 0x30]
call fcn.180098980
mov al, 1
jmp 0x18000421f
cmp qword [rsp + 0x48], 8
jb 0x18000421d
mov rcx, qword [rsp + 0x30]
call fcn.180098980
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099050
add rsp, 0x68
ret

Function at 0x180004260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800030f0
nop
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.180015170
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800042ef
test al, 0x10
jne 0x1800042ef
cmp qword [rsp + 0x48], 8
jb 0x1800042eb
mov rcx, qword [rsp + 0x30]
call fcn.180098980
mov al, 1
jmp 0x180004303
cmp qword [rsp + 0x48], 8
jb 0x180004301
mov rcx, qword [rsp + 0x30]
call fcn.180098980
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099050
add rsp, 0x68
ret

Function at 0x180004340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800030f0
nop
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.180015170
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800043cf
test al, 0x10
je 0x1800043cf
cmp qword [rsp + 0x48], 8
jb 0x1800043cb
mov rcx, qword [rsp + 0x30]
call fcn.180098980
mov al, 1
jmp 0x1800043e3
cmp qword [rsp + 0x48], 8
jb 0x1800043e1
mov rcx, qword [rsp + 0x30]
call fcn.180098980
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099050
add rsp, 0x68
ret
Function at 0x180004420
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x20], 8
mov rdi, rcx
lea rbx, [rcx + 8]
jb 0x18000443d
mov rcx, qword [rbx]
jmp 0x180004440
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x180004464
and eax, 0xfffffffe
cmp qword [rdi + 0x20], 8
jb 0x180004459
mov rcx, qword [rbx]
jmp 0x18000445c
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp qword [rdi + 0x20], 8
jb 0x18000446e
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x30]
cmp eax, 1
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x180006510
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x2060
call fcn.1800bfef0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rbx, r9
mov r13, r8
mov rsi, rdx
mov rdi, rcx
mov rbp, qword [rsp + 0x20c0]
mov qword [rsp + 0x40], rbp
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x50], r14w
xor edx, edx
mov r8d, 0x1ffe
lea rcx, [rsp + 0x52]
call fcn.180099ff0
cmp qword [rdi + 0x20], 8
jb 0x180006589
mov rdi, qword [rdi + 8]
jmp 0x18000658d
add rdi, 8
cmp qword [rbp + 0x20], 8
jb 0x18000659e
lea r12, [rbp + 8]
mov r8, qword [r12]
jmp 0x1800065a5
lea r12, [rbp + 8]
mov r8, r12
cmp qword [rbx + 0x20], 8
jb 0x1800065b2
mov rdx, qword [rbx + 8]
jmp 0x1800065b6
lea rdx, [rbx + 8]
cmp qword [r13 + 0x20], 8
jb 0x1800065c3
mov rcx, qword [r13 + 8]
jmp 0x1800065c7
lea rcx, [r13 + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], r14
lea rbx, [rsi + 8]
mov word [rbx], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x180006618
mov rax, qword [rbx]
jmp 0x18000661b
mov rax, rbx
lea rcx, [rsp + 0x50]
cmp rcx, rax
jb 0x18000666c
cmp rdx, 8
jb 0x180006630
mov rcx, qword [rbx]
jmp 0x180006633
mov rcx, rbx
mov rax, qword [rsi + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x50]
cmp rcx, rax
jbe 0x18000666c
cmp rdx, 8
jb 0x18000664e
mov rbx, qword [rbx]
lea r8, [rsp + 0x50]
sub r8, rbx
sar r8, 1
mov r9, rdi
mov rdx, rsi
mov rcx, rsi
call fcn.1800030f0
jmp 0x1800066f4
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
jbe 0x180006680
call fcn.180097730
mov rax, qword [rsi + 0x20]
cmp rax, rdi
jae 0x18000669a
mov r8, qword [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.180003d30
jmp 0x1800066b3
test rdi, rdi
jne 0x1800066b3
mov qword [rsi + 0x18], r14
cmp rax, 8
jb 0x1800066ac
mov rbx, qword [rbx]
mov word [rbx], 0
jmp 0x1800066f4
test rdi, rdi
je 0x1800066f4
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x1800066c7
mov rcx, qword [rbx]
jmp 0x1800066ca
mov rcx, rbx
lea r13, [rdi + rdi]
add rdx, rdx
mov r9, r13
lea r8, [rsp + 0x50]
call fcn.180098b20
mov qword [rsi + 0x18], rdi
cmp qword [rsi + 0x20], 8
jb 0x1800066ec
mov rbx, qword [rbx]
mov word [r13 + rbx], 0
cmp qword [rbp + 0x20], 8
jb 0x180006704
mov rcx, qword [r12]
call fcn.180098980
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r14
mov word [r12], 0
mov rax, rsi
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.180099050
add rsp, 0x2060
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180007b10
Capabilities:
Create http request

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov r12d, ecx
mov r13, qword [rsp + 0x108]
mov r14, qword [rsp + 0x110]
mov qword [r11 - 0x58], 7
xor r15d, r15d
mov qword [r11 - 0x60], r15
mov word [r11 - 0x70], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [r11 - 0x78]
call fcn.1800030f0
nop
lea rcx, [fcn.18005fac0]
mov qword [0x1800f6e40], rcx
lea rax, [0x1800605e0]
mov qword [0x1800f6e48], rax
lea rax, [fcn.18005f7e0]
mov qword [0x1800f6e50], rax
lea rax, [fcn.18005f510]
mov qword [0x1800f6e58], rax
test rcx, rcx
je 0x180007d37
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], r15d
cmp qword [rbx + 0x20], 8
jb 0x180007bda
mov rcx, qword [rbx + 8]
jmp 0x180007bde
lea rcx, [rbx + 8]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov edx, r12d
call fcn.18005fac0
test al, al
je 0x180007d37
lea rcx, [rsp + 0x60]
call fcn.180002c90
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.1800053c0
mov rcx, qword [rsp + 0x48]
call fcn.180099070
mov edi, dword [rsp + 0x100]
bts edi, 0x1a
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x7d0
mov r9d, 4
lea r8, [rsp + 0x40]
lea edx, [r9 - 2]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov dword [rsp + 0x48], 3
mov r9d, 4
lea r8, [rsp + 0x48]
lea edx, [r9 - 1]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edi
mov r9, rbp
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.180019680
movzx r13d, al
test rbx, rbx
je 0x180007cd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r13b, r13b
jne 0x180007cf0
cmp qword [rsp + 0x80], 8
jb 0x180007cec
mov rcx, qword [rsp + 0x68]
call fcn.180098980
xor al, al
jmp 0x180007d4e
mov ecx, dword [rbp]
mov rax, qword [rsi + 8]
cmp rcx, rax
cmova rcx, rax
mov qword [rsi + 0x18], rcx
cmp dword [rbp], 0
jbe 0x180007d1e
mov r8, rsi
mov edx, r12d
mov rcx, rsi
call fcn.180007a30
mov r11, qword [rsi + 0x18]
mov dword [rbp], r11d
cmp qword [rsp + 0x80], 8
jb 0x180007d33
mov rcx, qword [rsp + 0x68]
call fcn.180098980
mov al, 1
jmp 0x180007d4e
cmp qword [rsp + 0x80], 8
jb 0x180007d4c
mov rcx, qword [rsp + 0x68]
call fcn.180098980
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180099050
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000c3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, r9
mov rbp, r8
mov rsi, rdx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x38], 0
mov qword [rdx + 0x20], 7
mov qword [rdx + 0x18], 0
lea rbx, [rdx + 8]
mov word [rbx], 0
mov dword [rsp + 0x38], 1
mov word [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x52]
call fcn.180099ff0
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x34], 1
cmp qword [rdi + 0x20], 8
jb 0x18000c47b
mov rdx, qword [rdi + 8]
jmp 0x18000c47f
lea rdx, [rdi + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000c5d8
mov eax, dword [rsp + 0x30]
cmp eax, 0x104
ja 0x18000c4c0
mov word [rsp + rax*2 + 0x50], 0
jmp 0x18000c4ca
mov word [rsp + 0x258], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x18000c4ee
mov rax, qword [rbx]
jmp 0x18000c4f1
mov rax, rbx
lea rcx, [rsp + 0x50]
cmp rcx, rax
jb 0x18000c545
cmp rdx, 8
jb 0x18000c506
mov rcx, qword [rbx]
jmp 0x18000c509
mov rcx, rbx
mov rax, qword [rsi + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x50]
cmp rcx, rax
jbe 0x18000c545
cmp rdx, 8
jb 0x18000c524
mov rbx, qword [rbx]
lea r8, [rsp + 0x50]
sub r8, rbx
sar r8, 1
mov r9, rdi
mov rdx, rsi
mov rcx, rsi
call fcn.1800030f0
mov rax, rsi
jmp 0x18000c5db
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
jbe 0x18000c559
call fcn.180097730
mov rax, qword [rsi + 0x20]
cmp rax, rdi
jae 0x18000c573
mov r8, qword [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.180003d30
jmp 0x18000c58f
test rdi, rdi
jne 0x18000c58f
mov qword [rsi + 0x18], rdi
cmp rax, 8
jb 0x18000c585
mov rbx, qword [rbx]
mov word [rbx], 0
mov rax, rsi
jmp 0x18000c5db
test rdi, rdi
je 0x18000c5d3
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x18000c5a3
mov rcx, qword [rbx]
jmp 0x18000c5a6
mov rcx, rbx
lea rbp, [rdi + rdi]
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0x50]
call fcn.180098b20
mov qword [rsi + 0x18], rdi
cmp qword [rsi + 0x20], 8
jb 0x18000c5c8
mov rbx, qword [rbx]
mov word [rbx + rbp], 0
mov rax, rsi
jmp 0x18000c5db
mov rax, rsi
jmp 0x18000c5db
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180099050
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret