joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a7cfc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov rax, qword [0x1401730f8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r8
mov rbx, rdx
mov qword [rbp - 0x49], rdx
and qword [rsp + 0x48], 0
and dword [rbp - 0x79], 0
and qword [rbp - 0x71], 0
lea r8, [rdx + 8]
cmp qword [r8 + 0x18], 8
jb 0x1400a7d4f
mov r8, qword [r8]
or r9d, 0x20019
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.1400148a0
mov edi, eax
test eax, eax
jne 0x1400a7e21
xor r14d, r14d
lea rax, [0x140102478]
mov qword [rbp - 0x39], rax
lea rax, [0x1401025f8]
mov qword [rbp + 7], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x39]
call fcn.1400047b0
nop
mov dword [rsp + 0x44], 0x105
mov r8d, 0x105
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x39]
call fcn.140009620
nop
mov byte [rax + 8], 1
mov rcx, qword [rax]
call fcn.140002ef0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8, qword [rax]
mov edx, r14d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov r12d, eax
lea rcx, [rbp - 0x61]
call fcn.140009c60
test r12d, r12d
jne 0x1400a7e0c
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.14000c7b0
nop
lea rcx, [rbp - 0x39]
call fcn.1400048d0
inc r14d
test r12d, r12d
je 0x1400a7d70
mov dword [0x14017a640], edi
test edi, edi
sete dil
cmp qword [rsp + 0x48], 0
je 0x1400a7e41
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rbx
call fcn.1400048d0
mov al, dil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400b31f0
add rsp, 0xf8
pop r15
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret

Function at 0x1400a7ecc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x20], 0
mov rsi, r8
and dword [rbp - 0x18], 0
lea r8, [rdx + 8]
and qword [rbp - 0x10], 0
mov edi, r9d
cmp qword [r8 + 0x18], 8
mov r14, rdx
jb 0x1400a7f01
mov r8, qword [r8]
mov r9d, dword [rbp + 0x40]
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.1400148a0
test eax, eax
jne 0x1400a7f60
lea rdx, [rsi + 8]
cmp qword [rdx + 0x18], 8
jb 0x1400a7f23
mov rdx, qword [rdx]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x2c]
and dword [rbp - 0x30], 0
lea r9, [rbp - 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x28]
mov dword [rbp - 0x2c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a7f60
cmp dword [rbp - 0x30], 4
je 0x1400a7f60
mov eax, SafeArrayGetDim
test eax, eax
mov dword [0x14017a640], eax
cmove edi, dword [rbp - 0x28]
cmp qword [rbp - 0x20], 0
je 0x1400a7f7d
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call fcn.1400048d0
mov rcx, rsi
call fcn.1400048d0
mov rsi, qword [rsp + 0x98]
mov eax, edi
add rsp, 0x60
pop r14
pop rdi
pop rbp
ret
Function at 0x1400a7fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xf0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1401730f8]
xor rax, rsp
mov qword [rbp + 7], rax
mov r15, r9
mov r13, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x61], r8
mov qword [rbp - 0x59], r9
mov r12, qword [rbp + 0x77]
mov qword [rbp - 0x51], r12
xor edi, edi
mov dword [rsp + 0x50], edi
lea rax, [0x140102478]
mov qword [rbp - 0x49], rax
lea rax, [0x1401025f8]
mov qword [rbp - 9], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x49]
call fcn.1400047b0
nop
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rdi
lea r8, [r13 + 8]
cmp qword [r8 + 0x18], 8
jb 0x1400a8035
mov r8, qword [r8]
mov r9d, dword [rbp + 0x7f]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400148a0
mov edi, eax
test eax, eax
jne 0x1400a80d5
lea rbx, [r15 + 8]
cmp qword [rbx + 0x18], 8
jb 0x1400a8060
mov rdx, qword [rbx]
jmp 0x1400a8063
mov rdx, rbx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400a80d5
mov r8d, dword [rsp + 0x34]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x49]
call fcn.140009620
nop
cmp qword [rbx + 0x18], 8
jb 0x1400a80a9
mov rbx, qword [rbx]
mov byte [rax + 8], 1
mov rcx, qword [rax]
call fcn.140002ef0
lea r9, [rsp + 0x34]
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x38]
call fcn.1400a19dc
mov edi, eax
lea rcx, [rbp - 0x79]
call fcn.140009c60
mov dword [0x14017a640], edi
lea rdx, [rbp - 0x49]
test edi, edi
cmovne rdx, r12
lea rax, [0x140102478]
mov qword [r14], rax
lea rax, [0x1401025f8]
mov qword [r14 + 0x40], rax
xor r8d, r8d
mov rcx, r14
call fcn.140006eb0
nop
cmp qword [rsp + 0x38], 0
je 0x1400a811a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x49]
call fcn.1400048d0
nop
mov rcx, r13
call fcn.1400048d0
nop
mov rcx, r15
call fcn.1400048d0
nop
mov rcx, r12
call fcn.1400048d0
mov rax, r14
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1400b31f0
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400a8160
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
and qword [rsp + 0x38], 0
mov rsi, r8
and dword [rsp + 0x40], 0
lea r8, [rdx + 8]
and qword [rsp + 0x48], 0
mov edi, r9d
cmp qword [r8 + 0x18], 8
mov rbp, rdx
jb 0x1400a8190
mov r8, qword [r8]
mov rdx, rcx
mov r9d, 0x2001f
lea rcx, [rsp + 0x38]
call fcn.1400148a0
test eax, eax
jne 0x1400a81dc
lea rdx, [rsi + 8]
cmp qword [rdx + 0x18], 8
jb 0x1400a81b5
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [0x14017a640], eax
sete dil
cmp qword [rsp + 0x38], 0
je 0x1400a81fb
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call fcn.1400048d0
mov rcx, rsi
call fcn.1400048d0
mov al, dil
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a8218
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x70
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov rax, qword [0x1401730f8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbp, r9
mov rsi, r8
mov r15, rdx
mov qword [r11 - 0x48], rdx
mov qword [r11 - 0x40], r8
mov qword [r11 - 0x38], r9
and qword [r11 - 0x68], 0
and dword [rsp + 0x38], 0
and qword [r11 - 0x58], 0
lea r8, [rdx + 8]
cmp qword [r8 + 0x18], 8
jb 0x1400a826e
mov r8, qword [r8]
mov r9d, 0x2001f
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1400148a0
test eax, eax
jne 0x1400a82de
lea rdi, [rsi + 8]
cmp qword [rdi + 0x18], 8
jb 0x1400a8293
mov rdi, qword [rdi]
lea rbx, [rbp + 8]
cmp qword [rbx + 0x18], 8
jb 0x1400a82a1
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400a82b1
mov ecx, 0x80004005
call fcn.14000b810
int3
mov rcx, rbx
call fcn.1400bbe50
mov r9d, 1
add eax, r9d
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [0x14017a640], eax
test eax, eax
sete bl
cmp qword [rsp + 0x30], 0
je 0x1400a82fd
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r15
call fcn.1400048d0
nop
mov rcx, rsi
call fcn.1400048d0
nop
mov rcx, rbp
call fcn.1400048d0
mov al, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400b31f0
add rsp, 0x70
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400a89dc
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
test rax, rax
jne 0x1400a8a16
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
pop rbx
jmp rax
Function at 0x1400a9644
Capabilities:
Create http request
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov rax, qword [0x1401730f8]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r15, qword [rbp + 0x800]
xor r13d, r13d
mov r12d, dword [rbp + 0x808]
mov r14, r9
mov esi, r8d
mov qword [rsp + 0x38], r13
mov rdi, rdx
mov dword [rsp + 0x30], 8
mov rbx, rcx
lea edx, [r13 + 0x28]
lea r9, [rsp + 0x30]
xor ecx, ecx
lea r8, [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
cmp dword [rsp + 0x3c], 1
jne 0x1400a9780
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], r13
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400a9767
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.ProxyEnable
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
lea rdx, str.AutoConfigURL
test eax, eax
mov dword [rsp + 0x40], 0x824
lea rax, [rsp + 0x40]
cmovne ecx, r13d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, byte [rsp + 0x50]
test eax, eax
cmovne ecx, r13d
mov byte [rsp + 0x50], cl
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a9780
cmp qword [sym.imp.ADVAPI32.dll_RegCloseKey], r13
je 0x1400a9780
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, r15
mov dword [rsp + 0x20], r12d
mov r8, r14
mov edx, esi
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenW]
test rax, rax
mov qword [rbx + 8], rax
setne al
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1400b31f0
add rsp, 0x898
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400a9820
Capabilities:
Check internet connectivity via wininet

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov bl, dl
mov rsi, rcx
xor r15d, r15d
lea rcx, [rax + 0x18]
xor edx, edx
mov dword [rax + 0x18], r15d
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x1400a987d
test byte [rsp + 0x70], 0x41
je 0x1400a987d
mov ecx, dword [rsi + 0xb8]
xor edx, edx
call qword [sym.imp.WININET.dll_InternetAutodial]
test eax, eax
jne 0x1400a987d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x10], eax
xor al, al
jmp 0x1400a99c1
mov rax, qword [rsi + 0x80]
mov word [rax], r15w
mov r8d, dword [rsi + 0x88]
test r8d, r8d
je 0x1400a98b5
lea rdx, str.Range:_bytes_d__r_n
mov rcx, qword [rsi + 0x80]
cmp qword [rsi + 0x78], r15
jne 0x1400a98af
lea rdx, str.Range:_bytes_d_
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsi + 0x78]
test rdx, rdx
je 0x1400a98cb
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp qword [rsi + 8], r15
jne 0x1400a997d
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsi + 0x80]
mov rbx, qword [rsi + 0x58]
mov rdi, qword [rsi]
call fcn.1400bbe50
mov ecx, dword [rsi + 0x90]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], ecx
jmp 0x1400a9940
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1400a9968
mov ebp, dword [rsi + 0x90]
bt ebp, 8
jae 0x1400a9968
btr ebp, 8
mov dword [rsi + 0x90], ebp
mov rcx, qword [rsi + 0x80]
mov rbx, qword [rsi + 0x58]
mov rdi, qword [rsi]
call fcn.1400bbe50
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], ebp
mov r9, qword [rsi + 0x80]
mov rdx, rbx
mov r8, qword [rsi + 0x70]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [rdi + 0x58]
test rax, rax
je 0x1400a9903
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
jmp 0x1400a99c1
mov rax, qword [rsi]
mov rcx, rsi
mov edx, dword [rsi + 0x48]
lea r8, [rsi + 0x18]
xor r9d, r9d
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x1400a99c1
test bl, bl
je 0x1400a99bf
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsi + 0x80]
call fcn.1400bbe50
mov rdx, qword [rsi + 0x80]
mov r8, rax
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
mov rcx, rsi
mov rax, qword [rsi]
jne 0x1400a9963
jmp 0x1400a996e
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400a9ad0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
and qword [rcx + 0x40], 0
mov rsi, r9
and dword [r9], 0
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
test r8d, r8d
je 0x1400a9cb6
cmp dword [rbx + 0x9c], 0x2710
jbe 0x1400a9b20
cmp dword [rbx + 0x94], 0
je 0x1400a9b20
mov rcx, rbx
call fcn.1400a9eac
imul ecx, eax, 0xf
jmp 0x1400a9b25
mov ecx, 0x5dc
test ecx, ecx
mov edi, 1
cmovne edi, ecx
cmp byte [rbx + 0xd8], 0
je 0x1400a9b45
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x1400a9b52
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
mov qword [rsp + 0x68], rax
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x60]
mov qword [rbx + 0x40], rax
lea r9, [rsp + 0x60]
mov edx, dword [rsi]
mov eax, ebp
sub eax, edx
cmp eax, edi
cmovb edi, eax
add rdx, r15
mov r8d, edi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400a9ba4
mov rax, qword [rbx]
lea r8, [rbx + 0x18]
mov edx, dword [rbx + 0x48]
xor r9d, r9d
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test al, al
je 0x1400a9cc9
cmp byte [rbx + 0xd8], 0
je 0x1400a9bbf
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rdx, qword [rsp + 0x50]
jmp 0x1400a9bcc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov qword [rsp + 0x50], rdx
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400a9cb6
add dword [rsi], eax
add dword [rbx + 0x8c], eax
add dword [rbx + 0x94], eax
add dword [rbx + 0xa0], eax
mov eax, 5
sub rdx, qword [rsp + 0x68]
mov rcx, qword [rbx + 0xd0]
cmove rdx, rax
imul rax, rdx, 0x3e8
cmp rax, rcx
jl 0x1400a9c39
cqo
idiv rcx
add dword [rbx + 0x9c], eax
add dword [rbx + 0xa8], eax
movabs rax, 0x20c49ba5e353f7cf
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cqo
idiv rcx
add dword [rbx + 0x98], eax
add dword [rbx + 0xa4], eax
mov r8d, dword [rbx + 0x98]
mov ecx, dword [rbx + 0xa4]
cmp r8d, 0x3e8
jbe 0x1400a9c88
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul eax, edx, 0x3e8
sub r8d, eax
add dword [rbx + 0x9c], edx
mov dword [rbx + 0x98], r8d
cmp ecx, 0x3e8
jbe 0x1400a9cae
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
sub ecx, eax
add dword [rbx + 0xa8], edx
mov dword [rbx + 0xa4], ecx
cmp dword [rsi], ebp
jb 0x1400a9afe
mov al, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x1400a9cb8
Function at 0x1400a9d24
Capabilities:
Parse url

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
xor edx, edx
call fcn.1400a9338
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
mov ebx, eax
test eax, eax
je 0x1400a9e0b
inc dword [rdi + 0x10]
mov esi, 2
mov ecx, dword [rdi + 0x10]
mov eax, esi
mul rcx
lea rbp, [rsi - 3]
cmovo rax, rbp
mov rcx, rax
call fcn.1400b321c
inc dword [rdi + 0x20]
mov ecx, dword [rdi + 0x20]
mov qword [rdi + 8], rax
mov eax, esi
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400b321c
inc dword [rdi + 0x30]
mov ecx, dword [rdi + 0x30]
mov qword [rdi + 0x18], rax
mov eax, esi
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400b321c
inc dword [rdi + 0x40]
mov ecx, dword [rdi + 0x40]
mov qword [rdi + 0x28], rax
mov eax, esi
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400b321c
inc dword [rdi + 0x50]
mov ecx, dword [rdi + 0x50]
mov qword [rdi + 0x38], rax
mov eax, esi
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400b321c
inc dword [rdi + 0x60]
mov ecx, dword [rdi + 0x60]
mov qword [rdi + 0x48], rax
mov eax, esi
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400b321c
mov qword [rdi + 0x58], rax
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a9e24
Capabilities:
Get http content length

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x50], 4
call fcn.1400a97c4
movzx edi, al
test al, al
je 0x1400a9e6b
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x48]
mov edx, 0x20000005
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
jne 0x1400a9e7e
or dword [rsp + 0x48], 0xffffffff
jmp 0x1400a9e88
mov eax, dword [rbx + 0x88]
add dword [rsp + 0x48], eax
mov rcx, rbx
call fcn.1400a9124
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a9eac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0xac]
cmp eax, 0x7530
jbe 0x1400a9f0d
mov eax, dword [rbx + 0xa0]
and dword [rbx + 0xa0], 0
mov dword [rbx + 0x94], eax
mov eax, dword [rbx + 0xa8]
and dword [rbx + 0xa8], 0
mov dword [rbx + 0x9c], eax
mov eax, dword [rbx + 0xa4]
and dword [rbx + 0xa4], 0
mov dword [rbx + 0x98], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xac], eax
mov ecx, dword [rbx + 0x9c]
test ecx, ecx
jne 0x1400a9f1f
mov eax, dword [rbx + 0x94]
jmp 0x1400a9f81
xor eax, eax
xor r10d, r10d
lea r9d, [rax + 0xa]
test eax, eax
jne 0x1400a9f81
mov r8d, dword [rbx + 0x94]
xor edx, edx
or eax, 0xffffffff
div r9d
cmp r8d, eax
jbe 0x1400a9f52
shr r8d, 1
shr ecx, 1
mov dword [rbx + 0x9c], ecx
mov dword [rbx + 0x94], r8d
mov eax, dword [rbx + 0x94]
xor edx, edx
mov ecx, dword [rbx + 0x9c]
inc r10d
imul eax, r9d
div ecx
xor edx, edx
imul eax, eax, 0x3e8
div r9d
lea r9d, [r9 + r9*4]
add r9d, r9d
cmp r10d, 3
jb 0x1400a9f28
add rsp, 0x20
pop rbx
ret
Function at 0x1400afc5c
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jbe 0x1400afc4c
mov al, 1
add rsp, 0x28
ret
mov dl, 1
mov cl, dl
add rsp, 0x28
jmp 0x1400afc5c
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1401730f8]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov word [rbp + 0x33], 0x500
mov dword [rbp + 0x2f], edi
mov r14b, dl
mov sil, cl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ebx, [rdi + 8]
xor r8d, r8d
mov rcx, rax
lea r9, [rbp + 0x17]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1400afcf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x1400afcdc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x17]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1400afcf1
mov dl, 1
mov rcx, qword [rbp + 0x17]
call fcn.1400afe2c
jmp 0x1400afe07
test eax, eax
jne 0x1400afcf9
xor edx, edx
jmp 0x1400afce3
mov rcx, qword [rbp + 0x17]
lea rax, [rbp + 0x1f]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 2]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400afcf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400afcf5
mov ecx, dword [rbp + 0x1f]
call fcn.1400b3630
mov r9d, dword [rbp + 0x1f]
mov rbx, rax
mov rcx, qword [rbp + 0x17]
lea rax, [rbp + 0x1f]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400afd5a
xor edx, edx
jmp 0x1400afdeb
lea rax, [rbp + 0x27]
neg sil
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x2f]
mov dword [rsp + 0x48], edi
sbb r9d, r9d
mov dword [rsp + 0x40], edi
and r9d, 0xfffffffd
mov dword [rsp + 0x38], edi
add r9d, 0x223
mov dword [rsp + 0x30], edi
mov r8d, 0x20
mov dword [rsp + 0x28], edi
mov dl, 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400afd53
mov esi, edi
cmp dword [rbx], edi
jbe 0x1400afdde
mov rdx, qword [rbp + 0x27]
mov ecx, esi
add rcx, rcx
mov rcx, qword [rbx + rcx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400afdc8
inc esi
cmp esi, dword [rbx]
jb 0x1400afda8
jmp 0x1400afdde
test r14b, r14b
je 0x1400afddb
mov eax, esi
inc rax
add rax, rax
test byte [rbx + rax*8], 0x10
jne 0x1400afdde
mov dil, 1
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov dl, dil
mov rcx, qword [rbp + 0x17]
call fcn.1400afe2c
mov edx, SafeArrayPutElement
mov rcx, rbx
mov dil, al
call fcn.1400b3214
mov al, dil
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400b31f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400b0b58
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rcx, rsi
lea rdx, [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoSizeW
xor ebx, ebx
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400b0b8b
xor al, al
jmp 0x1400b0c53
mov ecx, eax
call fcn.1400b321c
mov r8d, dword [rsp + 0x50]
mov r9, rax
mov edx, dword [rsp + 0x58]
mov rcx, rsi
mov qword [rdi + 0x50], rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400b0b84
mov rcx, qword [rdi + 0x50]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x20]
lea rdx, [0x140102600]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400b0b84
mov rax, qword [rsp + 0x20]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
movups xmm0, xmmword [rax]
movups xmmword [rdi + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x18], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdi + 0x28], xmm0
mov eax, dword [rax + 0x30]
mov dword [rdi + 0x38], eax
mov rcx, qword [rdi + 0x50]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400b0c51
mov ecx, dword [rsp + 0x50]
mov eax, 4
shr ecx, 2
mul rcx
mov dword [rdi + 0x48], ecx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400b321c
mov qword [rdi + 0x40], rax
cmp dword [rdi + 0x48], ebx
jbe 0x1400b0c51
mov rcx, qword [rsp + 0x28]
mov r8, qword [rdi + 0x40]
mov edx, dword [rcx + rbx*4]
mov dword [r8 + rbx*4], edx
inc ebx
cmp ebx, dword [rdi + 0x48]
jb 0x1400b0c3a
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret