joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f43e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov dword [rax - 0x18], 4
mov qword [rax - 0x10], rbp
cmp rdx, rbp
je 0x1000f4539
cmp word [rdx], bp
je 0x1000f4539
cmp r8, rbp
je 0x1000f4519
cmp word [r8], bp
je 0x1000f4519
cmp r9, rbp
jne 0x1000f4461
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f4567
test byte [rcx + 0x1c], 1
je 0x1000f4567
lea edx, [rbp + 0x16]
jmp 0x1000f4557
mov eax, dword [0x100157a34]
neg eax
lea rax, [rsp + 0x38]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f4505
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
je 0x1000f4505
mov r8d, dword [rsp + 0x58]
cmp r8d, 4
je 0x1000f4505
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f4500
test byte [rcx + 0x1c], 1
je 0x1000f4500
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x10001dbe8]
mov edx, 0x17
mov r9, rdi
call fcn.10009b2f4
mov ebx, 0xd
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1000f4515
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f456c
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f4567
test byte [rcx + 0x1c], 1
je 0x1000f4567
mov edx, 0x15
jmp 0x1000f4557
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f4567
test byte [rcx + 0x1c], 1
je 0x1000f4567
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034764
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1000f4588
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
mov rsi, rdx
mov r10, rcx
mov qword [r11 + 0x10], rbp
cmp rdx, rbp
je 0x1000f46cc
cmp word [rdx], bp
je 0x1000f46cc
cmp rbx, rbp
je 0x1000f46ac
cmp word [r9], bp
je 0x1000f46ac
mov eax, dword [0x100157a34]
mov qword [r11 - 0x18], rbp
neg eax
lea rax, [r11 + 0x10]
sbb ecx, ecx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbp
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebp
je 0x1000f4634
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f4698
test byte [rcx + 0x1c], 1
je 0x1000f4698
lea edx, [rbp + 0x1a]
mov r9, rsi
jmp 0x1000f4684
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
je 0x1000f4698
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f4698
test byte [rcx + 0x1c], 1
je 0x1000f4698
mov edx, 0x1b
mov r9, rbx
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov dword [rsp + 0x20], eax
call fcn.10009b2f4
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x1000f46a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000f46ff
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f46fa
test byte [rcx + 0x1c], 1
je 0x1000f46fa
mov edx, 0x19
jmp 0x1000f46ea
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f46fa
test byte [rcx + 0x1c], 1
je 0x1000f46fa
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034764
mov eax, 0x57
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1000f471c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov dword [rax - 0x18], 8
mov qword [rax - 0x10], rbp
cmp rdx, rbp
je 0x1000f4870
cmp word [rdx], bp
je 0x1000f4870
cmp r8, rbp
je 0x1000f4850
cmp word [r8], bp
je 0x1000f4850
cmp r9, rbp
jne 0x1000f4799
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f489e
test byte [rcx + 0x1c], 1
je 0x1000f489e
lea edx, [rbp + 0x1e]
jmp 0x1000f488e
mov eax, dword [0x100157a34]
neg eax
lea rax, [rsp + 0x38]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f483c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f483c
mov r8d, dword [rsp + 0x58]
cmp r8d, 0xb
je 0x1000f483c
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f4837
test byte [rcx + 0x1c], 1
je 0x1000f4837
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x10001dbe8]
mov edx, 0x1f
mov r9, rdi
call fcn.10009b2f4
mov ebx, 0xd
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1000f484c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f48a3
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f489e
test byte [rcx + 0x1c], 1
je 0x1000f489e
mov edx, 0x1d
jmp 0x1000f488e
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f489e
test byte [rcx + 0x1c], 1
je 0x1000f489e
mov edx, 0x1c
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034764
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1000f48c0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
mov rsi, rdx
mov r10, rcx
mov qword [r11 + 0x10], rbp
cmp rdx, rbp
je 0x1000f4a07
cmp word [rdx], bp
je 0x1000f4a07
cmp rbx, rbp
je 0x1000f49e7
cmp word [r9], bp
je 0x1000f49e7
mov eax, dword [0x100157a34]
mov qword [r11 - 0x18], rbp
neg eax
lea rax, [r11 + 0x10]
sbb ecx, ecx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbp
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebp
je 0x1000f496c
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f49d3
test byte [rcx + 0x1c], 1
je 0x1000f49d3
lea edx, [rbp + 0x22]
mov r9, rsi
jmp 0x1000f49bf
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
mov r9d, 0xb
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
je 0x1000f49d3
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f49d3
test byte [rcx + 0x1c], 1
je 0x1000f49d3
mov edx, 0x23
mov r9, rbx
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov dword [rsp + 0x20], eax
call fcn.10009b2f4
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x1000f49e3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000f4a3a
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f4a35
test byte [rcx + 0x1c], 1
je 0x1000f4a35
mov edx, 0x21
jmp 0x1000f4a25
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f4a35
test byte [rcx + 0x1c], 1
je 0x1000f4a35
mov edx, 0x20
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034764
mov eax, 0x57
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1000f4a58
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, r8
mov qword [r11 + 0x10], rsi
cmp rdx, rsi
je 0x1000f4afe
cmp word [rdx], si
je 0x1000f4afe
cmp rbx, rsi
je 0x1000f4ade
cmp word [r8], si
je 0x1000f4ade
mov eax, dword [0x100157a34]
neg eax
lea rax, [r11 + 0x10]
sbb r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x18], rax
and r9d, 0x100
add r9d, 0x20006
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, esi
jne 0x1000f4aca
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, rsi
je 0x1000f4ada
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000f4b31
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f4b2c
test byte [rcx + 0x1c], 1
je 0x1000f4b2c
mov edx, 0x25
jmp 0x1000f4b1c
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f4b2c
test byte [rcx + 0x1c], 1
je 0x1000f4b2c
mov edx, 0x24
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034764
mov eax, 0x57
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1000f5490
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x270
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r13d, r13d
mov r12, rcx
xor eax, eax
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov rsi, r9
mov ebp, r13d
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x24], eax
mov word [rsp + 0x50], r13w
call sub.msvcrt.dll_memset
lea edi, [r13 + 0x57]
cmp rsi, r13
jne 0x1000f552c
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f568d
test byte [rcx + 0x1c], 1
je 0x1000f568d
mov rcx, qword [rcx + 0x10]
lea edx, [rdi - 0x16]
lea r8, [0x10001dbe8]
call fcn.100034764
jmp 0x1000f568d
lea rax, [rsp + 0x50]
mov r14d, 0x104
mov r8, r12
lea rcx, [rsp + 0x50]
mov r9d, r13d
sub r8, rax
mov rdx, r14
lea rax, [rdx + 0x7ffffefa]
cmp rax, r13
je 0x1000f556c
movzx eax, word [r8 + rcx]
cmp ax, r13w
je 0x1000f556c
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000f5548
cmp rdx, r13
jne 0x1000f557b
sub rcx, 2
mov r9d, 0x8007007a
cmp r9d, r13d
mov word [rcx], r13w
jge 0x1000f55af
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f568d
test byte [rcx + 0x1c], 1
je 0x1000f568d
mov edx, 0x46
jmp 0x1000f567d
mov ebx, r13d
lea r8, [rsp + 0x50]
mov r9d, ebx
mov rdx, r14
mov rcx, rsi
call fcn.1000f1884
cmp eax, r13d
mov r9d, eax
jl 0x1000f565f
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, r13d
je 0x1000f565a
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
cmp eax, r13d
je 0x1000f561a
cmp ebx, r13d
je 0x1000f560e
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, r13d
jle 0x1000f561a
mov rax, qword [rsp + 0x3c]
mov ebp, ebx
mov qword [rsp + 0x20], rax
inc ebx
cmp ebx, 0xa
jb 0x1000f55b2
mov r9d, ebp
mov r8, r12
mov rdx, r14
mov rcx, rsi
call fcn.1000f1884
cmp eax, r13d
mov r9d, eax
jge 0x1000f565a
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f568d
test byte [rcx + 0x1c], 1
je 0x1000f568d
mov edx, 0x48
jmp 0x1000f567d
mov edi, r13d
jmp 0x1000f568d
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f568d
test byte [rcx + 0x1c], 1
je 0x1000f568d
mov edx, 0x47
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100036328
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10011b980
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000f5a80
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xa0]
mov r15, r8
mov r13d, edx
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp dword [rsp + 0xa0], 0xffffffff
je 0x1000f5ad5
cmp dword [rsp + 0xa0], 0
je 0x1000f5ad5
mov ebp, dword [rsp + 0xa0]
sub ebp, ebx
mov r9d, ebp
xor r8d, r8d
mov rdx, r15
mov ecx, r13d
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp eax, r13d
jne 0x1000f5b2e
mov ebx, 1
jmp 0x1000f5b13
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1000f5afd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, r12d
cmp r12d, eax
jbe 0x1000f5b40
dec ebx
cmp edi, r13d
je 0x1000f5ab8
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f5b7e
test byte [rcx + 0x1c], 4
je 0x1000f5b7e
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x54
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.10009b2f4
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1000f5ba8
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x4a0
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r12, rcx
xor r13d, r13d
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x24c
mov edi, r13d
mov dword [rsp + 0x30], r13d
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x280], r13w
call sub.msvcrt.dll_memset
cmp r12, r13
jne 0x1000f5c55
lea edi, [r13 + 0x57]
mov rcx, qword [0x100152eb8]
lea rbx, [0x100152eb8]
cmp rcx, rbx
je 0x1000f5e0b
test byte [rcx + 0x1c], 1
je 0x1000f5e0b
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xc]
lea r8, [0x10001dbe8]
call fcn.100034764
jmp 0x1000f5e0b
lea rax, [0x1000270f0]
lea r8, [0x100026f80]
lea rcx, [rsp + 0x280]
mov r9, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1000f1884
cmp eax, r13d
jge 0x1000f5cc8
mov edi, eax
and edi, 0x1000ffff
mov rcx, qword [0x100152eb8]
lea rbx, [0x100152eb8]
cmp rcx, rbx
je 0x1000f5e0b
test byte [rcx + 0x1c], 1
je 0x1000f5e0b
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x64
mov r9d, eax
call fcn.100036328
jmp 0x1000f5e0b
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000f5d25
mov rcx, qword [0x100152eb8]
lea rbx, [0x100152eb8]
cmp rcx, rbx
je 0x1000f5dfc
test byte [rcx + 0x1c], 4
je 0x1000f5dfc
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x66]
lea r9, [rsp + 0x280]
lea r8, [0x10001dbe8]
call fcn.100034788
jmp 0x1000f5dfc
lea rbx, [0x100152eb8]
cmp dword [rsp + 0x30], 0x10
je 0x1000f5de5
lea rax, [rsp + 0x5c]
lea r8, [0x100026f80]
lea rcx, [rsp + 0x280]
mov r9, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1000f1884
cmp eax, r13d
mov ebp, eax
jl 0x1000f5db3
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x1000f5de5
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x1000f5de5
test byte [rcx + 0x1c], 1
je 0x1000f5de5
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x280]
lea r8, [0x10001dbe8]
mov edx, 0x66
mov dword [rsp + 0x20], eax
call fcn.10009b2f4
jmp 0x1000f5de5
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x1000f5ddd
test byte [rcx + 0x1c], 1
je 0x1000f5ddd
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x67
mov r9d, eax
call fcn.100036328
mov edi, ebp
and edi, 0x1000ffff
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
jne 0x1000f5d2c
cmp rsi, 0xffffffffffffffff
je 0x1000f5e0b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10011b980
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1000f7030
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
lea rax, [rcx + 0x48]
xor ebx, ebx
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
lea rax, [rcx + 0x88]
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
lea rax, [rcx + 0xc8]
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
mov qword [rcx + 0x108], rbx
mov dword [rcx + 0x114], ebx
mov dword [rcx + 0x110], ebx
mov qword [rcx + 0x128], rbx
mov dword [rcx + 0x134], ebx
mov dword [rcx + 0x130], ebx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x30], rbx
mov qword [rcx + 0x348], rbx
mov dword [rcx + 0x350], ebx
mov dword [rcx + 0x354], ebx
mov qword [rcx + 0x358], rbx
mov dword [rcx + 0x44], ebx
mov qword [rcx + 0x118], rbx
mov dword [rcx + 0x120], ebx
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x34]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
jne 0x1000f716e
lea rcx, [0x100152eb8]
mov rax, qword [0x100152eb8]
cmp rax, rcx
je 0x1000f7176
test byte [rax + 0x1c], 1
je 0x1000f7176
call sub.KERNEL32.dll_GetLastError
mov r9d, eax
lea edx, [rbx + 0x3e]
lea r8, [0x10001dba8]
mov rcx, qword [0x100152eb8]
mov rcx, qword [rcx + 0x10]
call fcn.100036328
jmp 0x1000f7176
cmp dword [rsp + 0x34], 6
setae bl
mov dword [rdi + 0x40], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10011b980
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x1000f8898
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x830
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x348]
mov ebx, edx
mov byte [rsp + 0x20], 0
test rcx, rcx
je 0x1000f88da
call fcn.10011b7a0
and qword [rdi + 0x348], 0
and dword [rdi + 0x354], 0
and dword [rdi + 0x350], 0
mov edx, ebx
mov rcx, rdi
call fcn.1000f8a48
mov ebx, eax
test eax, eax
jns 0x1000f895c
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f89d8
test byte [rcx + 0x1c], 1
je 0x1000f89d8
mov edx, 0x3a
jmp 0x1000f89c5
mov rcx, rdi
call fcn.1000f7514
mov ebx, eax
test eax, eax
js 0x1000f8a1f
mov r8d, dword [rdi + 0x368]
test r8d, r8d
je 0x1000f8a1b
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1000f99e8
mov ebx, eax
test eax, eax
js 0x1000f89fb
mov rcx, rdi
call fcn.1000f71a4
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x800
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rcx, rdi
mov ebx, eax
call fcn.1000f71f4
test ebx, ebx
jne 0x1000f8923
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f89d8
test byte [rcx + 0x1c], 1
je 0x1000f89d8
mov edx, 0x3b
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov r9d, ebx
call fcn.100036328
mov eax, ebx
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.10011b980
mov rbx, qword [rsp + 0x850]
add rsp, 0x830
pop rdi
ret
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f89d8
test byte [rcx + 0x1c], 1
je 0x1000f89d8
mov edx, 0x3d
jmp 0x1000f89c5
xor ebx, ebx
jmp 0x1000f89d8
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f89d8
test byte [rcx + 0x1c], 1
je 0x1000f89d8
mov edx, 0x3c
jmp 0x1000f89c5
Function at 0x1000f8a48
Capabilities:
Read http header
Receive http response

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x60], 0
mov ebp, edx
mov rdi, rcx
call fcn.1000f71a4
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rdi
mov ebx, eax
call fcn.1000f71f4
test ebx, ebx
jne 0x1000f8ac5
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x1000f8c98
test byte [rcx + 0x1c], 1
je 0x1000f8c98
mov edx, 0x3e
mov r9d, ebx
jmp 0x1000f8afc
mov rcx, rdi
call fcn.1000f7514
mov ebx, eax
test eax, eax
jns 0x1000f8b11
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x1000f8c98
test byte [rcx + 0x1c], 1
je 0x1000f8c98
mov edx, 0x3f
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
call fcn.100036328
jmp 0x1000f8c98
mov rcx, rdi
mov dword [rsp + 0x60], 4
call fcn.1000f71a4
mov rcx, qword [rdi + 0x10]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
lea r9, [rdi + 0x340]
xor r8d, r8d
mov edx, 0x20000013
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea rsi, [0x100152eb8]
mov ebx, eax
test eax, eax
je 0x1000f8c39
test ebp, ebp
je 0x1000f8c39
mov rcx, qword [rdi + 0x10]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x4000000b
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x10
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ebx, eax
test eax, eax
jne 0x1000f8bd3
mov rax, qword [0x100152eb8]
cmp rax, rsi
je 0x1000f8bcc
test byte [rax + 0x1c], 1
je 0x1000f8bcc
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100152eb8]
lea edx, [rbx + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov r9d, eax
call fcn.100036328
mov ebx, 1
jmp 0x1000f8c39
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x1000f8c1d
mov rax, qword [0x100152eb8]
cmp rax, rsi
je 0x1000f8c1d
test byte [rax + 0x1c], 1
je 0x1000f8c1d
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100152eb8]
lea r8, [0x10001db30]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x41
call fcn.100036328
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x358], rax
mov rcx, rdi
call fcn.1000f71f4
test ebx, ebx
jne 0x1000f8c96
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000f8c98
test byte [rcx + 0x1c], 1
je 0x1000f8c98
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x42
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10003b338
jmp 0x1000f8c98
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret