joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c51a0
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0xa0
mov edi, r8d
mov r12, rdx
mov rbp, rcx
lea rdx, str.CSASSOMD5::CalculateMD5
mov r8d, 0x2000
lea rcx, [rsp + 0x20]
mov r9d, 1
call fcn.1400b30a0
test edi, edi
je 0x1400c531d
xor eax, eax
mov qword [rsp + 0xc0], rbx
mov qword [rbp + 0x20], rax
lea rbx, [rbp + 0x20]
mov qword [rbx + 8], rax
lea rdx, [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov r9d, edi
mov qword [rbp + 0x38], rax
mov r8, r12
mov qword [rbp + 0x40], rax
mov rcx, rbp
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], al
mov qword [rbp + 0x52], rax
mov qword [rbp + 0x5a], rax
mov qword [rsp + 0xc8], rsi
xor esi, esi
mov qword [rbp + 0x62], rax
mov qword [rsp + 0xd0], r14
lea r14, [rbp + 0x30]
mov qword [rbp + 0x6a], rax
mov byte [rbp + 0x72], al
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 0x67452301
mov dword [rsp + 0x4c], 0xefcdab89
mov dword [rsp + 0x50], 0x98badcfe
mov dword [rsp + 0x54], 0x10325476
call fcn.1400390f0
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1400c5340
nop dword [rax]
movzx r8d, byte [rbx]
lea eax, [rsi + rsi]
lea rcx, [rax + r14]
mov edi, eax
lea rdx, [0x14028a478]
call fcn.140006bc0
movzx r8d, byte [rbx]
lea rcx, [rbp + 0x52]
lea rcx, [rcx + rdi*2]
lea rdx, [0x140287fd8]
call fcn.140006b50
inc esi
lea rbx, [rbx + 1]
cmp esi, 0x10
jb 0x1400c52b0
mov rcx, r14
call fcn.140250f2c
lea rcx, [rbp + 0x52]
call fcn.14025f5f8
mov r15, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.1400b3190
add rsp, 0xa0
pop r12
pop rdi
pop rbp
ret
Function at 0x1400d91a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140337dd0]
cmp ecx, 0xffffffff
jne 0x1400d91bf
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400d92a3
mov ecx, dword [0x140337dd0]
cmp ecx, 0xffffffff
jne 0x1400d91e4
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [rax + 8], 0
je 0x1400d92a3
test rsi, rsi
je 0x1400d92a3
mov ecx, dword [0x140337dd0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
cmp ecx, 0xffffffff
jne 0x1400d921d
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov edi, 1
cmp dword [rax + 8], 0
je 0x1400d9291
cmp qword [rax + 0x10], 0
je 0x1400d9291
mov rax, qword [rsi]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400d9291
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d9291
call fcn.1400bb9c0
mov rdx, rax
mov rcx, rbx
call fcn.1400d90a0
test eax, eax
jne 0x1400d928f
mov rcx, qword [rsp + 0x38]
call fcn.1400bb9c0
mov rdx, rax
mov rcx, rbx
call fcn.1400d8f70
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
xor edi, edi
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400d92b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140337dd0]
cmp ecx, 0xffffffff
jne 0x1400d92cf
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400d9384
mov ecx, dword [0x140337dd0]
cmp ecx, 0xffffffff
jne 0x1400d92f4
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [rax + 8], 0
je 0x1400d9384
test rsi, rsi
je 0x1400d9384
mov ecx, dword [0x140337dd0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
cmp ecx, 0xffffffff
jne 0x1400d9329
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov edi, 1
cmp dword [rax + 8], 0
je 0x1400d9372
cmp qword [rax + 0x10], 0
je 0x1400d9372
mov rdx, rsi
mov rcx, rax
call fcn.1400d90a0
test eax, eax
jne 0x1400d9370
mov rdx, rsi
mov rcx, rbx
call fcn.1400d8f70
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor edi, edi
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1400d9390
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140337dd0]
cmp ecx, 0xffffffff
jne 0x1400d93aa
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400d9420
mov ecx, dword [0x140337dd0]
mov qword [rsp + 0x20], rbx
cmp ecx, 0xffffffff
jne 0x1400d93d0
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov dword [rax + 8], 0
test rcx, rcx
je 0x1400d93fb
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x10], 0
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov ecx, dword [0x140337dd0]
mov rbx, qword [rsp + 0x20]
cmp ecx, 0xffffffff
je 0x1400d9420
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
jmp fcn.1400d9430

Function at 0x1400d9430
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov eax, dword [0x140337dd0]
cmp eax, 0xffffffff
jne 0x1400d946d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140337dd0], eax
cmp eax, 0xffffffff
jne 0x1400d946d
call fcn.1400d9430
mov ecx, dword [0x140337dd0]
jmp 0x1400d946f
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400d94f3
lea ecx, [rax + 0x18]
call fcn.14018ef40
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edi, edi
test rax, rax
je 0x1400d94a4
lea rax, vtable.CSASSOBase::CRedundantFileCache.0
mov qword [rbx], rax
mov dword [rbx + 8], edi
mov qword [rbx + 0x10], rdi
jmp 0x1400d94a7
mov rbx, rdi
mov ecx, dword [0x140337dd0]
cmp ecx, 0xffffffff
je 0x1400d94bb
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [rbx + 8], 1
cmp qword [rbx + 0x10], 0
jne 0x1400d94f3
add dword [0x14034e620], 0x38
mov ecx, 0x38
call fcn.140250fe4
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400d94ef
mov rcx, rax
call fcn.1400c5ba0
mov rdi, rax
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400d9500
Capabilities:
Create shortcut via ishelllink
Query environment variable

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x70
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov esi, r9d
mov rbp, r8
mov r14d, edx
mov rdi, qword [0x14034e628]
test rdi, rdi
jne 0x1400d964e
mov ecx, 0x438
call fcn.14018ef40
mov rdi, rax
mov qword [rsp + 0x58], rax
xor ebx, ebx
test rax, rax
je 0x1400d9644
mov rax, qword [0x14034e630]
mov qword [rdi + 0x218], rax
mov qword [rdi + 0x220], rbx
cmp rax, rbx
jne 0x1400d95c3
lea ecx, [rbx + 0x18]
call fcn.14018ef40
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400d9597
lea rcx, vtable.CSABSDKFunctions.0
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
jmp 0x1400d959a
mov rax, rbx
mov qword [rdi + 0x218], rax
xor r8d, r8d
mov edx, 0x1000
mov rcx, rax
call fcn.140011040
mov qword [rdi + 0x220], rax
mov rcx, qword [rdi + 0x218]
mov qword [rcx + 0x10], rax
mov ecx, 0x38
call fcn.14018ef40
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400d95e8
mov rdx, qword [rdi + 0x218]
mov rcx, rax
call fcn.140069340
jmp 0x1400d95eb
mov rax, rbx
mov qword [rdi + 0x228], rax
mov r8d, 0x104
mov rdx, rdi
lea rcx, [0x14028c088]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rdi + 0x208], rdi
mov qword [rdi + 0x210], rbx
mov r8, rdi
mov edx, 0x104
lea rcx, [rdi + 0x230]
call fcn.140251ec0
lea r8, str.System32RUNDLL32.EXE
mov edx, 0x104
lea rcx, [rdi + 0x230]
call fcn.140251e40
jmp 0x1400d9647
mov rdi, rbx
mov qword [0x14034e628], rdi
mov r9d, esi
mov r8, rbp
mov edx, r14d
mov rcx, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp fcn.140030c50
Function at 0x1400dadb0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x870
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, r8
mov ebx, edx
mov edi, 1
mov r9d, edi
mov r8d, 0x10000
lea rdx, str.CSASSOUser::GetCurrentUserSpecialFolderPath
lea rcx, [rsp + 0x38]
call fcn.1400b30a0
nop
xor edx, edx
mov r8d, 0x820
lea rcx, [rsp + 0x50]
call fcn.140249b10
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400dae53
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x898], rax
test rax, rax
je 0x1400dae76
mov rdx, rax
mov rcx, rsi
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1400dae55
xor edi, edi
lea rcx, [rsp + 0x38]
call fcn.1400b3190
mov eax, edi
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ecx, 0x8007000e
call fcn.140004cd0
int3
Function at 0x1400de750
Capabilities:
Access firewall settings via inetfwmgr
Print debug messages

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x1400de750
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
lea rcx, str.AddApplicationExceptionToTheWindowsFirewall
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
lea r9, [0x1402b3688]
xor edx, edx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rax
lea rcx, [0x1402b3678]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x1400de7de
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov ebx, eax
test eax, eax
js 0x1400de7de
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400de7ee
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400de7fe
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test ebx, ebx
jne 0x1400de84f
mov rcx, qword [rsp + 0x30]
mov r8, rsi
mov rdx, rdi
call fcn.1400de870
lea rcx, str.WindowsFirewallAddApp_Succeeded_
test eax, eax
je 0x1400de824
lea rcx, str.WindowsFirewallAddApp_Failed_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400de83a
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rcx, [0x1402b36b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400df910
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov ecx, 0x38
call fcn.14018ef40
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400df955
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rdx, rax
mov rcx, rbx
call fcn.1400debc0
nop
mov qword [0x140351830], rax
add rsp, 0x30
pop rbx
ret
mov qword [0x140351830], 0
add rsp, 0x30
pop rbx
ret
Function at 0x1400e0560
Capabilities:
Check if file exists
Copy file

Disassembly:
push rbx
sub rsp, 0x240
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.140249b10
lea rdx, [0x14034eb30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.SUPERANTISPYWARE.DB3
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400e060d
xor edx, edx
lea rcx, [rsp + 0x130]
mov r8d, 0x104
call fcn.140249b10
lea rdx, [0x14034e928]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.SUPERANTISPYWARE.DB3
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov r8d, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1400e0621
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14006d170
test eax, eax
jne 0x1400e062c
xor eax, eax
add rsp, 0x240
pop rbx
ret
mov eax, 1
add rsp, 0x240
pop rbx
ret

Function at 0x1400e0640
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x430
mov rbp, r8
mov qword [rsp + 0x450], 0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.140249b10
mov r8, rbx
lea rdx, str.SELECT__FROM_sas_defaults_WHERE_setting_s
lea rcx, [rsp + 0x30]
call fcn.140006bc0
lea rcx, [rdi + 0x40]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1400e06b6
mov rax, qword [rcx]
lea r8, [rsp + 0x450]
xor r9d, r9d
lea rdx, [rsp + 0x30]
call qword [rax]
mov esi, eax
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1400e077a
mov rcx, qword [rsp + 0x450]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
lea r8, [0x140294f68]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400e074c
mov rcx, qword [rsp + 0x450]
lea r9, [rsp + 0x468]
mov qword [rsp + 0x468], 0
lea r8, str.value
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400e074c
mov rdx, qword [rsp + 0x468]
test rdx, rdx
je 0x1400e074c
mov rcx, rbp
call fcn.140004820
mov rdx, qword [rsp + 0x450]
mov rcx, rdi
call fcn.140075720
mov eax, 1
jmp 0x1400e077c
mov rsi, qword [rsp + 0x450]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1400e0770
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x458]
add rsp, 0x430
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e0b40
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x430
mov rbp, r8
mov qword [rsp + 0x450], 0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.140249b10
mov r8, rbx
lea rdx, str.SELECT__FROM_sas_variables_WHERE_variable_s
lea rcx, [rsp + 0x30]
call fcn.140006bc0
lea rcx, [rdi + 0x40]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1400e0bb6
mov rax, qword [rcx]
lea r8, [rsp + 0x450]
xor r9d, r9d
lea rdx, [rsp + 0x30]
call qword [rax]
mov esi, eax
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1400e0c7a
mov rcx, qword [rsp + 0x450]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
lea r8, [0x140294f68]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400e0c4c
mov rcx, qword [rsp + 0x450]
lea r9, [rsp + 0x468]
mov qword [rsp + 0x468], 0
lea r8, str.value
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400e0c4c
mov rdx, qword [rsp + 0x468]
test rdx, rdx
je 0x1400e0c4c
mov rcx, rbp
call fcn.140004820
mov rdx, qword [rsp + 0x450]
mov rcx, rdi
call fcn.140075720
mov eax, 1
jmp 0x1400e0c7c
mov rsi, qword [rsp + 0x450]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1400e0c70
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x458]
add rsp, 0x430
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e3690
Capabilities:
Read data from internet
Receive data

Disassembly:
push rbx
mov rax, qword [rsp + 0x38]
mov r10d, r9d
mov r9, qword [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov qword [rsp + 0x30], rax
mov r8d, r10d
mov rdx, r11
pop rbx
jmp 0x1400e3690
push r14
sub rsp, 0x50
mov qword [rsp + 0x60], rbx
xor r14d, r14d
mov qword [rsp + 0x68], rbp
mov rbp, rcx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov qword [rsp + 0x48], rdi
lea rdx, str.https:__
mov qword [rsp + 0x40], r12
mov rcx, rsi
mov qword [rsp + 0x38], r13
mov r12, r9
mov r13d, r8d
mov edi, 0x80000000
mov qword [r9], r14
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
mov ecx, 0x80800000
cmovne edi, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [0x140351848]
lea rdx, [0x140351840]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
lea edx, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
or edi, 0x3000
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbp, rax
test rax, rax
je 0x1400e37fd
mov ecx, r13d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x78], r14d
mov ebx, r14d
call fcn.140247068
mov r8d, r13d
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140249b10
lea r9, [rsp + 0x78]
mov rdx, rsi
lea r8d, [r13 - 1]
mov rcx, rbp
mov rdi, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400e37aa
mov eax, dword [rsp + 0x78]
add ebx, eax
test eax, eax
je 0x1400e37c4
add rdi, rax
lea r8d, [r13 - 1]
sub r8d, ebx
lea r9, [rsp + 0x78]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400e3781
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x1400e37b8
test ebx, ebx
jne 0x1400e37bc
mov ebx, eax
test ebx, ebx
je 0x1400e37cc
mov r14d, 1
jmp 0x1400e37d1
mov r14d, 1
jmp 0x1400e37b8
test r14d, r14d
je 0x1400e37e7
mov eax, ebx
mov byte [rax + rsi], 0
mov rax, qword [rsp + 0x80]
mov qword [r12], rsi
mov dword [rax], ebx
jmp 0x1400e37ef
mov rcx, rsi
call fcn.140247060
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r15, qword [rsp + 0x30]
cmp qword [0x140351840], 0
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
je 0x1400e383b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [0x140351840]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov eax, r14d
add rsp, 0x50
pop r14
ret
Function at 0x1400e49c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.140247340
sub rsp, rax
mov rcx, qword [rsp + 0x2080]
lea rax, [rsp + 0x30]
xor ebp, ebp
lea rsi, [rsp + 0x30]
sub rax, 4
mov r13d, r8d
mov r15, rdx
mov qword [rsp + 0x20], rax
mov dword [rcx], ebp
mov dword [r9], ebp
lea r14d, [rbp + 2]
nop word [rax + rax]
mov r12, rbp
mov ebx, r13d
test r13d, r13d
je 0x1400e4b4b
nop
mov r9d, r14d
mov r8d, 1
mov rdx, rsi
mov rcx, r15
call sub.WSOCK32.dll_recv
mov edi, eax
cmp eax, 1
je 0x1400e4a6e
cmp eax, 0xffffffff
je 0x1400e4a80
mov ecx, PathResolve
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, PathResolve
cmp ebx, eax
cmovb eax, ebx
sub ebx, eax
jne 0x1400e4a30
jmp 0x1400e4b4b
xor r9d, r9d
mov rdx, rsi
mov rcx, r15
lea r8d, [r9 + 1]
call sub.WSOCK32.dll_recv
test ebx, ebx
je 0x1400e4b4b
cmp edi, 0xffffffff
je 0x1400e4b45
test edi, edi
je 0x1400e4b3d
inc rsi
inc rbp
cmp rbp, 4
jl 0x1400e4ab5
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + rbp]
cmp eax, dword [str._r_n_r_n]
je 0x1400e4acc
cmp r12, 0x2000
jl 0x1400e4a20
mov eax, 9
jmp 0x1400e4b4e
mov r8d, 5
mov byte [rsi + 4], 0
lea rdx, str.HTTP_
lea rcx, [rsp + 0x30]
call fcn.140250b10
test eax, eax
jne 0x1400e4b10
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14024a10c
test rax, rax
je 0x1400e4b10
lea rcx, [rax + 1]
call fcn.1402520ac
mov rcx, qword [rsp + 0x2078]
mov dword [rcx], eax
lea rdx, str._r_nContent_Length:
lea rcx, [rsp + 0x30]
call fcn.140248db4
test rax, rax
je 0x1400e4b39
lea rcx, [rax + 0x12]
call fcn.1402520ac
mov rcx, qword [rsp + 0x2080]
mov dword [rcx], eax
xor eax, eax
jmp 0x1400e4b4e
mov r14d, 4
jmp 0x1400e4b4b
mov r14d, 3
mov eax, r14d
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400e59a0
Capabilities:
Connect to http server
Create http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx]
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbx + 8]
xor ebp, ebp
mov edx, ebp
mov dword [rbx + 0x58], edi
cmp dword [rbx + 0x10], edx
mov dword [rsp + 0x20], ebp
sete dl
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x1400e5a3a
mov qword [rsp + 0x38], rbp
neg edi
mov dword [rsp + 0x30], ebp
mov rdx, rsi
sbb r8w, r8w
mov dword [rsp + 0x28], 3
and r8w, 0x1bb
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x1400e5a2c
lea eax, [rbp + 1]
jmp 0x1400e5a3c
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rbx + 0x50], rbp
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400e5a60
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x1d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov r14, rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, 0x20
call fcn.14018ef40
mov rdi, rax
mov qword [rsp + 0x1e0], rax
test rax, rax
je 0x1400e5afe
lea rax, vtable.CWinsockHttp.0
mov qword [rdi], rax
mov ecx, 0x101
lea rdx, [rsp + 0x30]
call sub.WSOCK32.dll_WSAStartup
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x1400e5ac7
inc eax
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov qword [rdi + 8], rax
mov r8, rsi
mov edx, ebx
mov rcx, rax
call fcn.140253604
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
jmp 0x1400e5b00
xor edi, edi
mov qword [r14 + 0x48], rdi
mov eax, 1
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret