joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000fe98
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000ff3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 2
je 0x18000ff41
cmp eax, 0xe7
je 0x18000fefb
cmp eax, 0x490
jne 0x18000ff14
test eax, eax
je 0x18000ff0f
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x18000ff27
mov rcx, rsi
jmp 0x18000feb3
mov r8, rsi
lea rdx, str._Unable_to_connect_to_named_pipe_server:__s.
mov ecx, eax
call fcn.18002bd3c
jmp 0x18000ff41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str._Error_after_waiting_for_named_pipe_server.
mov ebx, eax
call fcn.18002bd3c
jmp 0x18000ff41
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
je 0x18000ff6c
and dword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x18000ff6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r14, r14
je 0x18000ff74
mov dword [r14], ebx
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret

Function at 0x18000ff90
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
and dword [rsp + 0x70], 0
xor edi, edi
and dword [rsp + 0x68], 0
mov r15, r8
mov r14, rdx
mov rbp, rcx
test rdx, rdx
je 0x18000ffbd
and qword [rdx], rdi
and qword [rsp + 0x28], rdi
xor r9d, r9d
and qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x18000ffed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str._NamedPipe_client:_No_data_available_for_reading.
call fcn.18002bd3c
xor ebx, ebx
lea r9, [rsp + 0x68]
and qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x70]
mov rcx, rbp
lea r8d, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180010027
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str._NamedPipe_client_read_failed.
mov ebx, eax
call fcn.18002bd3c
jmp 0x18001007e
mov ecx, dword [rsp + 0x70]
call fcn.180053730
mov qword [r14], rax
test rax, rax
je 0x18001007e
mov esi, dword [rsp + 0x70]
mov rdx, qword [r14]
lea r9, [rsp + 0x68]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180010064
add edi, dword [rsp + 0x68]
sub esi, dword [rsp + 0x68]
jmp 0x18001006c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xea
jne 0x18001007e
test esi, esi
je 0x18001007e
cmp edi, dword [rsp + 0x70]
jb 0x18001003c
test r15, r15
je 0x180010086
mov dword [r15], edi
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001009c
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1060
call fcn.180043900
sub rsp, rax
mov rax, qword [0x1800d4ad8]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor edi, edi
mov dword [rsp + 0x30], r8d
and dword [rsp + 0x38], edi
lea esi, [r8 + 4]
lea rbx, [rsp + 0x40]
mov r14, rdx
mov rbp, rcx
cmp esi, 0x1004
jbe 0x1800100f3
mov ecx, esi
call fcn.180053730
mov rbx, rax
test rax, rax
je 0x18001013c
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180045f30
mov r8d, dword [rsp + 0x30]
lea rcx, [rbx + 4]
mov rdx, r14
call fcn.180045f30
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x38]
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001013c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rsp + 0x40]
cmp rbx, rax
je 0x180010153
test rbx, rbx
je 0x180010153
mov rcx, rbx
call fcn.180053728
mov eax, edi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.180043830
add rsp, 0x1060
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800138c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
xor r9d, r9d
lea rbp, [0x1800d6b30]
mov rbx, rcx
mov qword [rax - 0x18], rbp
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdi, [0x1800d6710]
mov rcx, rdi
lea rdx, [0x1800abcc4]
call fcn.18006bbf8
mov esi, 0x104
test eax, eax
jne 0x180013931
mov r8, rbp
mov edx, esi
mov rcx, rdi
call fcn.1800537a4
lea r8, str.SecureAge_TechnologySecureAgeSecureAPlus
mov edx, esi
mov rcx, rdi
call fcn.18006bcb8
lea rdx, [0x1800abcc4]
mov rcx, rdi
call fcn.18006bbf8
test eax, eax
je 0x180013958
mov rcx, rdi
call fcn.18002630c
test al, al
jne 0x180013958
mov rcx, rdi
call fcn.18002747c
mov rcx, rdi
call fcn.18005380c
lea rcx, [0x1800abc00]
mov qword [rsp + 0x20], rbx
lea r8, [0x1800abe60]
mov r9, rdi
mov rdx, rsi
cmp word [rdi + rax*2 - 2], 0x5c
cmovne r8, rcx
lea rcx, [0x1800d6920]
call fcn.180012aa8
mov rbx, qword [rsp + 0x40]
lea rax, [0x1800d6920]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180013ee8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r9d, r9d
lea rsi, [0x1800d6500]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rbx, [0x1800d60e0]
mov rcx, rbx
lea rdx, [0x1800abcc4]
call fcn.18006bbf8
mov edi, 0x104
test eax, eax
jne 0x180013f52
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800537a4
lea r8, str.SecureAge_TechnologySecureAgeSecureAPlus
mov edx, edi
mov rcx, rbx
call fcn.18006bcb8
lea rdx, [0x1800abcc4]
mov rcx, rbx
call fcn.18006bbf8
test eax, eax
je 0x180013f79
mov rcx, rbx
call fcn.18002630c
test al, al
jne 0x180013f79
mov rcx, rbx
call fcn.18002747c
mov rcx, rbx
call fcn.18005380c
lea rcx, [0x1800abc00]
mov r9, rbx
lea r8, [0x1800abe60]
mov rdx, rdi
cmp word [rbx + rax*2 - 2], 0x5c
lea rax, [0x1800abe58]
mov qword [rsp + 0x20], rax
cmovne r8, rcx
lea rcx, [0x1800d62f0]
call fcn.180012aa8
mov rbx, qword [rsp + 0x40]
lea rax, [0x1800d62f0]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180016008
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
cmp ecx, 0x1c
je 0x1800160bf
cmp ecx, 0x30
je 0x18001607e
cmp ecx, 0x40
je 0x18001603d
cmp ecx, 0xe0
je 0x1800160bf
cmp ecx, 0x180
je 0x18001607e
cmp ecx, 0x200
je 0x18001603d
mov eax, 1
ret
and qword [rdx + 8], 0
and qword [rdx], 0
movaps xmm0, xmmword [0x1800ac780]
movups xmmword [rdx + 0x10], xmm0
movaps xmm1, xmmword [0x1800ac790]
movups xmmword [rdx + 0x20], xmm1
movaps xmm0, xmmword [0x1800ac7a0]
movups xmmword [rdx + 0x30], xmm0
movaps xmm1, xmmword [0x1800ac7b0]
movups xmmword [rdx + 0x40], xmm1
mov dword [rdx + 0xd0], 0x40
jmp 0x1800160e6
and qword [rdx + 8], 0
and qword [rdx], 0
movaps xmm0, xmmword [0x1800ac500]
movups xmmword [rdx + 0x10], xmm0
movaps xmm1, xmmword [0x1800ac510]
movups xmmword [rdx + 0x20], xmm1
movaps xmm0, xmmword [0x1800ac520]
movups xmmword [rdx + 0x30], xmm0
movaps xmm1, xmmword [0x1800ac530]
movups xmmword [rdx + 0x40], xmm1
mov dword [rdx + 0xd0], 0x30
jmp 0x1800160e6
and dword [rdx + 4], 0
and dword [rdx], 0
movups xmm0, xmmword [0x1800ac4e0]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [0x1800ac4f0]
mov dword [rdx + 0xd0], 0x1c
movups xmmword [rdx + 0x18], xmm1
xor eax, eax
ret

Function at 0x1800177f8
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1800d4ad8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov al, byte [0x1800d4834]
cmp al, 0x63
jne 0x180017879
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.winhttp.dll
mov edx, 0x105
lea rcx, [rsp + 0x20]
call fcn.18006bcb8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [0x1800d8a18], rax
xor eax, eax
test rcx, rcx
je 0x180017873
lea rdx, str.WinHttpWebSocketClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800d8a10], rax
mov al, 1
mov byte [0x1800d4834], al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180043830
add rsp, 0x248
ret
Function at 0x1800179ac
Capabilities:
Read http header
Receive http response

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
lea rax, [rbp - 8]
mov qword [r11 - 0x30], rax
lea rax, [rbp - 0x18]
mov qword [r11 - 0x38], rax
lea rax, [rbp - 0x10]
mov qword [r11 - 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [r11 - 0x48], rax
mov rax, qword [rbp + 0x38]
mov qword [r11 - 0x50], rax
mov rax, qword [rbp + 0x30]
mov qword [r11 - 0x58], rax
mov dword [rbp - 0x1c], ebx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 8], rbx
mov dword [rbp - 0x20], ebx
call fcn.18001a434
mov rdi, qword [rbp - 8]
mov r14d, eax
test eax, eax
jne 0x180017af2
mov ecx, dword [rbp + 0x68]
mov r9, qword [rbp + 0x60]
mov r8d, dword [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x180017a83
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x180017a83
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x1c], 4
mov edx, 0x20000013
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
jmp 0x180017a8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test r14d, r14d
jne 0x180017af2
mov rsi, qword [rbp + 0x88]
test rsi, rsi
je 0x180017ac5
lea ecx, [r14 + 0x14]
call fcn.180053730
mov qword [rsi], rax
test rax, rax
je 0x180017ac5
mov r9d, dword [rbp - 0x20]
lea r8, [0x1800acf68]
lea edx, [r14 + 0xa]
mov rcx, rax
call fcn.180012aa8
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x180017ae8
mov r9d, dword [rbp - 0x20]
lea r8, [0x1800acf68]
mov rdx, qword [rbp + 0x98]
call fcn.180012aa8
mov rbx, qword [rbp - 0x10]
mov rsi, qword [rbp - 0x18]
jmp 0x180017b51
test rdi, rdi
je 0x180017aff
mov rcx, rdi
call fcn.18001793c
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180017b0e
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x180017b1d
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rax, qword [rbp + 0x88]
mov rsi, rbx
mov rdi, rbx
test rax, rax
je 0x180017b32
mov qword [rax], rbx
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x180017b51
mov rdx, qword [rbp + 0x98]
lea r8, [0x1800abcc4]
call fcn.1800537a4
mov rax, qword [rbp + 0x70]
lea r11, [rsp + 0x70]
mov qword [rax], rbx
mov rax, qword [rbp + 0x78]
mov rbx, qword [r11 + 0x10]
mov qword [rax], rsi
mov rax, qword [rbp + 0x80]
mov rsi, qword [r11 + 0x18]
mov qword [rax], rdi
mov eax, r14d
mov r14, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180018b68
Capabilities:
Receive http response
Set http header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
mov rax, qword [0x1800d4ad8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x240]
xor r13d, r13d
mov rsi, qword [rbp + 0x220]
mov r15b, dl
mov rdi, qword [rbp + 0x228]
movzx r14d, cx
mov rbx, qword [rbp + 0x230]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x78], rax
xor edx, edx
mov rax, qword [rbp + 0x250]
mov r12, r9
mov qword [rsp + 0x70], rax
mov rax, qword [rbp + 0x268]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x278]
mov qword [rsp + 0x68], r8
mov r8d, 0x200
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
call fcn.180046390
lea rax, [rsp + 0x60]
mov r9, r12
mov qword [rsp + 0x48], rax
mov dl, r15b
lea rax, [rsp + 0x58]
movzx ecx, r14w
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
mov rsi, qword [rsp + 0x68]
mov r8, rsi
call fcn.18001a434
mov r8, qword [rbp + 0x260]
lea rdx, str.Range:_bytes_I64u_
lea rcx, [rbp - 0x60]
mov ebx, eax
call fcn.180014cf4
lea rcx, [rbp - 0x60]
call fcn.18005380c
mov rdi, qword [rsp + 0x60]
lea rdx, [rbp - 0x60]
mov rcx, rdi
mov r8, rax
mov r9d, 0x10000000
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x180018ccf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x2f0d
mov r8, rsi
mov ebx, eax
cmp eax, ecx
jne 0x180018cbc
lea rdx, str.Server_CA_is_not_trusted._Unable_to_establish_secure_connection_to__S.
call fcn.180022938
jmp 0x180018d1b
mov r9d, eax
lea rdx, str.Unable_to_send_request_header_to_the_server___S_._Error_code:__lu.
mov ecx, eax
call fcn.180022938
jmp 0x180018d17
mov eax, dword [rbp + 0x258]
mov rcx, rdi
mov r9, qword [rsp + 0x70]
mov r8d, dword [rbp + 0x248]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test al, al
je 0x180018d0f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test al, al
jne 0x180018d17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x180018d51
test rdi, rdi
je 0x180018d29
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180018d39
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180018d49
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rax, r13
mov rdi, r13
jmp 0x180018d5b
mov r13, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x80]
mov qword [rcx], r13
mov rcx, qword [rbp - 0x78]
mov qword [rcx], rax
mov rax, qword [rbp - 0x70]
mov qword [rax], rdi
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180043830
add rsp, 0x2b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180019f48
Capabilities:
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xc0
and qword [rax - 0x38], 0
and qword [rax - 0x30], 0
and qword [rax - 0x48], 0
xor ebx, ebx
mov qword [rax - 0x50], rbx
and dword [rax - 0x58], ebx
mov r15, qword [rsp + 0x120]
test r15, r15
je 0x180019f8c
and qword [r15], rbx
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
call fcn.1800186a8
mov r14d, eax
mov dword [rsp + 0x84], eax
test eax, eax
jne 0x18001a142
mov esi, 0x400
mov dword [rsp + 0x98], esi
mov ecx, esi
call fcn.180053730
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x18001a142
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.180046390
xor edi, edi
mov qword [rsp + 0xb0], rdi
and dword [rsp + 0x80], 0
mov r8d, esi
sub r8d, edi
dec r8d
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x18001a0b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [rsp + 0x84], eax
jmp 0x18001a12b
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x18001a12b
add rdi, rax
mov qword [rsp + 0xb0], rdi
lea eax, [rsi - 1]
mov ecx, eax
cmp rdi, rcx
jb 0x18001a12b
lea eax, [rsi + 0x2800]
mov r12d, eax
mov qword [rsp + 0xb8], r12
mov edx, eax
mov rcx, rbx
call fcn.18006bb38
test rax, rax
jne 0x18001a104
lea r14d, [rax + 8]
mov dword [rsp + 0x84], r14d
jmp 0x18001a12b
mov rbx, rax
mov qword [rsp + 0x88], rax
mov esi, r12d
mov dword [rsp + 0x98], r12d
mov r8, r12
sub r8, rdi
lea rcx, [rdi + rax]
xor edx, edx
call fcn.180046390
cmp dword [rsp + 0x80], 0
je 0x18001a13e
test r14d, r14d
je 0x18001a075
mov byte [rdi + rbx], 0
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x18001a155
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18001a168
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x18001a17a
call fcn.18001793c
test r15, r15
je 0x18001a184
mov qword [r15], rbx
jmp 0x18001a191
test rbx, rbx
je 0x18001a191
mov rcx, rbx
call fcn.180053728
mov eax, r14d
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18001ab70
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
xor esi, esi
xor ebx, ebx
mov r15, rdx
xor r14d, r14d
mov rbp, rcx
and dword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x18001ac46
mov ecx, dword [rsp + 0x58]
mov rax, r14
sub rax, rsi
lea edx, [rcx + 1]
cmp rax, rdx
jae 0x18001abf7
test r14, r14
jne 0x18001abcd
mov ecx, edx
mov r14d, edx
call fcn.180053730
jmp 0x18001abf0
cmp ecx, 0x2800
jae 0x18001abdc
mov eax, 0x2800
jmp 0x18001abe2
lea eax, [rcx + 0x2800]
add r14, rax
mov rcx, rbx
mov rdx, r14
call fcn.18006bb38
mov ecx, dword [rsp + 0x58]
mov rbx, rax
test rbx, rbx
jne 0x18001ac01
lea edi, [rbx + 8]
jmp 0x18001ac39
mov r8d, r14d
lea rdx, [rbx + rsi]
sub r8d, esi
lea r9, [rsp + 0x60]
dec r8d
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x18001ac2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18001ac31
mov eax, dword [rsp + 0x60]
add rsi, rax
mov byte [rbx + rsi], 0
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x18001ac4e
test edi, edi
jne 0x18001ac52
jmp 0x18001ab8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x18001ac61
test rbx, rbx
je 0x18001ac5f
mov rcx, rbx
call fcn.180053728
xor ebx, ebx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r15, r15
je 0x18001ac71
mov qword [r15], rsi
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001ac88
Capabilities:
Read http header
Receive http response

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r12, qword [rbp + 0x80]
lea rax, [rbp - 0x18]
xor ebx, ebx
mov qword [r11 - 0x40], rax
lea rax, [rbp - 0x10]
mov dword [rbp - 0x1c], ebx
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x20], ebx
mov qword [r11 - 0x48], rax
cmp qword [r12], rbx
jne 0x18001adaf
lea rax, [rbp - 8]
mov qword [r12], rbx
mov qword [r11 - 0x50], rax
mov rax, qword [rbp + 0x50]
mov qword [r11 - 0x58], rax
mov rax, qword [rbp + 0x48]
mov qword [r11 - 0x60], rax
mov rax, qword [rbp + 0x40]
mov qword [r11 - 0x68], rax
call fcn.18001a434
mov rsi, qword [rbp - 8]
mov r14d, eax
test eax, eax
je 0x18001addd
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x18001ad25
mov rcx, rdi
call fcn.18001793c
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18001ad34
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rsi, rsi
je 0x18001ad42
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rax, qword [rbp + 0x98]
mov rsi, rbx
mov rdi, rbx
test rax, rax
je 0x18001ad57
mov qword [rax], rbx
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x18001ad76
mov rdx, qword [rbp + 0xa8]
lea r8, [0x1800abcc4]
call fcn.1800537a4
mov rax, qword [rbp + 0x88]
lea r11, [rsp + 0x70]
mov qword [r12], rsi
mov rsi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x38]
mov qword [rax], rbx
mov rax, qword [rbp + 0x90]
mov rbx, qword [r11 + 0x20]
mov qword [rax], rdi
mov eax, r14d
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.18001a7c0
mov rsi, qword [r12]
jmp 0x18001ad09
mov eax, dword [rbp + 0x78]
mov rdi, qword [rbp - 0x18]
mov r9, qword [rbp + 0x70]
mov rcx, rdi
mov r8d, dword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x18001ae45
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x18001ae45
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rbx
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x1c], 4
mov edx, 0x20000013
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
jmp 0x18001ae4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test r14d, r14d
jne 0x18001ad18
mov r15, qword [rbp + 0x98]
test r15, r15
je 0x18001ae8b
lea ecx, [r14 + 0x14]
call fcn.180053730
mov qword [r15], rax
test rax, rax
je 0x18001ae8b
mov r9d, dword [rbp - 0x20]
lea r8, [0x1800acf68]
lea edx, [r14 + 0xa]
mov rcx, rax
call fcn.180012aa8
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x18001aeae
mov r9d, dword [rbp - 0x20]
lea r8, [0x1800acf68]
mov rdx, qword [rbp + 0xa8]
call fcn.180012aa8
mov rbx, qword [rbp - 0x10]
jmp 0x18001ad76