joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rdx + 0x20]
lea rax, [rdx + 8]
cmp r9, 8
jb 0x18004702c
mov r8, qword [rax]
jmp 0x18004702f
mov r8, rax
mov rcx, qword [rdx + 0x18]
lea rcx, [r8 + rcx*2]
cmp r9, 8
jb 0x180047040
mov rax, qword [rax]
mov r8d, 0x811c9dc5
cmp rax, rcx
je 0x180047066
nop dword [rax + rax]
movzx edx, word [rax]
imul r8, r8, 0x1000193
add rax, 2
xor r8, rdx
cmp rax, rcx
jne 0x180047050
mov edx, 0x1f31d
mov ecx, r8d
call qword [sym.imp.msvcrt.dll_ldiv]
mov qword [rsp + 0x30], rax
shr rax, 0x20
imul ecx, eax, 0x41a7
imul eax, dword [rsp + 0x30], 0xb14
sub ecx, eax
jns 0x18004709c
lea eax, [rcx + 0x7fffffff]
cdqe
add rsp, 0x28
ret
movsxd rax, ecx
add rsp, 0x28
ret

Function at 0x18005cb10
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x51]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x50], 0
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0xc2]
xor edx, edx
mov r8d, 0xc6
mov word [rsp + 0xc0], ax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x50]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x18005cbeb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
test eax, eax
jle 0x18005cb8b
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x40], ebx
lea rcx, [0x180002040]
test ebx, ebx
lea rax, [0x180002050]
lea r8, [0x180011c00]
lea rdx, [0x18000fa90]
cmovs rax, rcx
mov r9d, 0x3b5
mov ecx, 1
mov qword [rsp + 0x38], rax
lea rax, [0x180011bc0]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
jmp 0x18005ccb9
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
mov r8d, 0xc8
call qword [sym.imp.SHLWAPI.dll_SHAnsiToUnicode]
test eax, eax
jne 0x18005cc61
mov dword [rsp + 0x40], 0x80004005
lea rcx, [0x180002040]
lea rax, [0x180002090]
mov qword [rsp + 0x38], rcx
lea rcx, [0x180011c70]
lea r8, [0x180011c00]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rdx, [0x18000fa90]
mov ecx, 1
mov r9d, 0x3b6
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, 0x80004005
jmp 0x18005ccbb
lea rcx, [rsp + 0xc0]
mov rdx, rbx
call fcn.18005cce0
mov ebx, eax
test eax, eax
jns 0x18005ccbb
mov dword [rsp + 0x38], eax
lea rax, [0x180011cb8]
lea r8, [0x180011c00]
mov qword [rsp + 0x30], rax
lea rax, [0x180002160]
lea rdx, [0x18000fa90]
mov qword [rsp + 0x28], rax
mov r9d, 0x3b7
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.18003b8c0
add rsp, 0x1a0
pop rbx
ret
Function at 0x18005cce0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
mov qword [rsp + 0x68], rsi
mov rsi, rdx
mov qword [rsp + 0x70], rbx
test rcx, rcx
jne 0x18005cd11
mov ebx, 0x80070057
lea rax, [0x180011cd8]
mov r9d, 0x3c2
jmp 0x18005cd9a
lea r9, [rsp + 0x70]
lea r8, [0x1800b1db0]
xor edx, edx
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
je 0x18005cd6f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x18005cd37
mov ebx, eax
jmp 0x18005cd40
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x3c6
mov qword [rsp + 0x38], rax
lea rax, [0x180011d50]
jmp 0x18005ce59
lea rdx, [0x1800b1510]
mov ecx, 0xc8
call fcn.18003b8e8
mov qword [rsi], rax
test rax, rax
jne 0x18005cdd4
mov ebx, 0x8007000e
lea rax, [0x180011940]
mov r9d, 0x3c9
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
mov qword [rsp + 0x28], rax
lea r8, [0x180011cf0]
lea rdx, [0x18000fa90]
mov ecx, 1
mov dword [rsp + 0x20], 2
call sym.StorageClientLib.dll_griteLog
jmp 0x18005ce8a
mov qword [rsp + 0x78], rdi
mov rdi, rax
xor eax, eax
mov ecx, 0xc8
xor r8d, r8d
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x70]
mov r9, qword [rsi]
mov dword [rsp + 0x60], 0x64
mov edx, dword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAAddressToStringW]
mov rdi, qword [rsp + 0x78]
test eax, eax
je 0x18005ce8a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x18005ce26
mov ebx, eax
jmp 0x18005ce2f
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x3d2
mov qword [rsp + 0x38], rax
lea rax, [0x180011da0]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
lea r8, [0x180011cf0]
mov qword [rsp + 0x28], rax
lea rdx, [0x18000fa90]
mov ecx, 1
mov dword [rsp + 0x20], 2
call sym.StorageClientLib.dll_griteLog
mov rcx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
test rcx, rcx
je 0x18005ce9f
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x18005d440
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x50
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov dword [rsp + 0x70], 0
test r8, r8
jne 0x18005d4be
mov dword [rsp + 0x38], 0x80070057
lea rax, [0x180012010]
lea r8, [0x180012020]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x18000fa90]
mov qword [rsp + 0x28], rax
lea ecx, [rsi + 1]
mov r9d, 0x479
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, 0x80070057
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
lea rax, [rsp + 0x70]
mov r8, rdx
xor r9d, r9d
mov edx, 0xffff
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x7a
jne 0x18005d624
mov ecx, dword [rsp + 0x70]
mov eax, 2
inc ecx
mul rcx
mov rcx, 0xffffffffffffffff
lea rdx, [0x1800b1510]
cmovo rax, rcx
mov rcx, rax
call fcn.18003b8e8
mov qword [rsi], rax
test rax, rax
jne 0x18005d576
mov dword [rsp + 0x38], 0x8007000e
lea rax, [0x180012090]
lea r8, [0x180012020]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x18000fa90]
mov qword [rsp + 0x28], rax
lea ecx, [rdi - 0x79]
mov r9d, 0x487
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, 0x8007000e
jmp 0x18005d67a
mov ecx, dword [rsp + 0x70]
mov rdi, rax
xor eax, eax
add rcx, 2
mov qword [rsp + 0x28], rax
mov r8, rbx
rep stosb byte [rdi], al
mov r9, qword [rsi]
lea rax, [rsp + 0x70]
mov edx, 0xffff
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d678
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x18005d5c5
movzx edi, ax
or edi, 0x80070000
mov dword [rsp + 0x40], edi
lea rcx, [0x180002040]
test edi, edi
lea rax, [0x180002050]
lea r8, [0x180012020]
lea rdx, [0x18000fa90]
cmovs rax, rcx
mov r9d, 0x491
mov ecx, 1
mov qword [rsp + 0x38], rax
lea rax, [0x1800120a0]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, edi
jmp 0x18005d67a
cmp eax, 0x2f76
je 0x18005d678
test eax, eax
je 0x18005d678
mov dword [rsp + 0x38], eax
lea rax, [0x180012100]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180012020]
lea rdx, [0x18000fa90]
mov r9d, 0x499
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
test edi, edi
jle 0x18005d620
movzx eax, di
or eax, 0x80070000
jmp 0x18005d67a
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x18005d6a0
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2050
call fcn.18003c0b0
sub rsp, rax
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rcx
mov rdi, r8
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov r8d, 0x1ffe
mov word [rsp + 0x40], si
call sub.msvcrt.dll_memset
lea rdx, [0x180001308]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], 0x1000
call fcn.180046e10
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [0x180001848]
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d738
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18005d75a
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x18005d741
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180046e10
xor eax, eax
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.18003b8c0
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18005d790
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x62]
xor ebp, ebp
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x54], 4
mov word [rsp + 0x60], bp
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x54]
mov r9, rbx
xor r8d, r8d
mov edx, 0x20000013
mov rcx, rdi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x50], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d84b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x18005d81f
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x4cc
mov qword [rsp + 0x38], rax
lea rax, [0x180012160]
jmp 0x18005d8b2
xor r8d, r8d
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
lea edx, [r8 + 0x14]
mov rcx, rdi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d8e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x18005d888
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x4d4
mov qword [rsp + 0x38], rax
lea rax, [0x180012230]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
lea r8, [0x1800121c0]
mov qword [rsp + 0x28], rax
lea rdx, [0x18000fa90]
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, ebx
jmp 0x18005d909
lea rcx, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], bp
jne 0x18005d8f0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.180046e10
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.18003b8c0
mov rbx, qword [rsp + 0x8a8]
add rsp, 0x870
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005de50
Capabilities:
Set http header

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rdx
mov rbp, rcx
xor r14d, r14d
mov edi, r14d
mov qword [r11 - 0x30], 7
mov qword [r11 - 0x38], r14
mov word [r11 - 0x48], r14w
mov rax, qword [rdx + 8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x18005dffb
nop dword [rax]
lea rdx, [rbx + 0x18]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x58]
call fcn.18003e0a0
mov r8d, 2
lea rdx, [0x18001251c]
lea rcx, [rsp + 0x58]
call fcn.180045020
lea rdx, [rbx + 0x40]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x58]
call fcn.180044ef0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r9d, 0x20000000
or r8d, 0xffffffff
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x18005df8a
cmp byte [rbx + 0x69], 0
je 0x18005df35
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18003b960
jmp 0x18005df7e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x69], 0
jne 0x18005df5e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
jne 0x18005df7e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x18005df50
jmp 0x18005df7e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x69], 0
jne 0x18005df7b
cmp rbx, qword [rax + 0x10]
jne 0x18005df7b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x18005df68
mov rbx, rax
cmp rbx, qword [rsi + 8]
jne 0x18005deb0
jmp 0x18005dffb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x18005df9f
movzx edi, ax
or edi, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test edi, edi
cmovs rax, rcx
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [0x180012530]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 0x590
lea r8, [0x180012580]
lea rdx, [0x18000fa90]
mov ecx, 1
call sym.StorageClientLib.dll_griteLog
nop
cmp qword [rsp + 0x78], 8
jb 0x18005e00d
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_free
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r14
mov word [rsp + 0x60], r14w
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18003b8c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180071810
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180071910]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x1800718c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180071865
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180071877
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x38], eax
lea rax, [0x18001a288]
lea r8, [0x18001a2b0]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x180019580]
mov qword [rsp + 0x28], rax
mov r9d, 0x172
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, ebx
add rsp, 0x40
pop rbx
ret
lea rcx, [0x18001a350]
lea r8, [0x18001a2b0]
lea rdx, [0x180019580]
mov qword [rsp + 0x28], rcx
mov ecx, 1
mov r9d, 0x173
mov dword [rsp + 0x20], 3
call sym.StorageClientLib.dll_griteLog
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x180075320
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180075e40]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xa8], rax
test rax, rax
jne 0x1800753d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180075378
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x18007538a
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x38], eax
lea rax, [0x18001cab0]
lea r8, [0x18001cae0]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x18001c7d0]
mov qword [rsp + 0x28], rax
mov r9d, 0xeb
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, ebx
add rsp, 0x40
pop rbx
ret
lea rcx, [0x18001cb90]
lea r8, [0x18001cae0]
lea rdx, [0x18001c7d0]
mov qword [rsp + 0x28], rcx
mov ecx, 1
mov r9d, 0xed
mov dword [rsp + 0x20], 3
call sym.StorageClientLib.dll_griteLog
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1800765c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov r9, qword [0x1800b1d38]
lea rax, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x180076760]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800b1d28], rax
test rax, rax
jne 0x180076672
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180076617
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180076629
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x38], eax
lea rax, [0x18001d4f8]
mov r9d, 0x58
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea r8, [0x18001d520]
mov qword [rsp + 0x28], rax
lea rdx, [0x18001d3b0]
lea ecx, [r9 - 0x57]
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov eax, ebx
add rsp, 0x40
pop rbx
ret
lea rcx, [0x18001d5a0]
mov qword [rsp + 0x30], rax
mov r9d, 0x59
mov qword [rsp + 0x28], rcx
lea r8, [0x18001d520]
lea rdx, [0x18001d3b0]
lea ecx, [r9 - 0x58]
mov dword [rsp + 0x20], 3
call sym.StorageClientLib.dll_griteLog
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x180076af0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, 1
lock xadd dword [0x1800b1d30], ebx
lea rax, [0x18001da10]
inc ebx
lea r8, [0x18001da60]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rdx, [0x18001d3b0]
mov r9d, SHAnsiToUnicode
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
cmp ebx, 0x80
jle 0x180076ba2
lea rax, [0x18001daf0]
mov dword [rsp + 0x30], 0x80
lea r8, [0x18001da60]
mov qword [rsp + 0x28], rax
lea rdx, [0x18001d3b0]
mov r9d, 0xd8
mov ecx, 1
mov dword [rsp + 0x20], 5
call sym.StorageClientLib.dll_griteLog
mov ecx, 0x2bf20
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xfec
mov rcx, rax
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x40
pop rbx
ret
Function at 0x18007ee00
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x208
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
test edx, edx
je 0x18007ef69
dec edx
jne 0x18007ef6f
xor eax, eax
xorps xmm0, xmm0
xor ecx, ecx
mov dword [0x1800b1d50], 1
mov qword [0x1800b1d58], rax
mov qword [0x1800b1d60], rax
movdqa xmmword [0x1800b1d70], xmm0
mov qword [0x1800b1d68], rax
mov qword [0x1800b1d80], rax
mov dword [0x1800b1d88], eax
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
mov qword [0x1800b1d90], rax
test rax, rax
jne 0x18007eeb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x17
lea r8, [0x1800222b0]
mov dword [rsp + 0x30], eax
lea rax, [0x180022250]
lea rdx, [0x1800222c0]
mov qword [rsp + 0x28], rax
lea ecx, [r9 - 0x16]
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
jmp 0x18007eeba
mov qword [0x1800b1d58], rax
lea rdx, [rsp + 0x50]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18007ef09
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 0x21
lea r8, [0x1800222b0]
mov dword [rsp + 0x30], eax
lea rax, [0x180022330]
lea rdx, [0x1800222c0]
mov qword [rsp + 0x28], rax
lea ecx, [r9 - 0x20]
mov dword [rsp + 0x20], 3
call sym.StorageClientLib.dll_griteLog
mov r9d, 4
lea r8, [rsp + 0x40]
xor ecx, ecx
lea edx, [r9 + 0x4c]
mov dword [rsp + 0x40], 0x200
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x18007ef6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x28
lea r8, [0x1800222b0]
mov dword [rsp + 0x30], eax
lea rax, [0x180022380]
lea rdx, [0x1800222c0]
mov qword [rsp + 0x28], rax
lea ecx, [r9 - 0x27]
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
jmp 0x18007ef6f
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18003b8c0
add rsp, 0x208
ret
Function at 0x180083900
Capabilities:
Create process memory minidump
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, rcx
lea rcx, [rsp + 0x52]
xor ebp, ebp
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x50], bp
call sub.msvcrt.dll_memset
mov r8, qword [0x1800b1d10]
test r8, r8
je 0x1800839b9
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], bp
jne 0x180083955
test rax, rax
je 0x1800839b9
lea rax, [rsp + 0x50]
mov ebx, 0x400
lea rcx, [rsp + 0x50]
sub r8, rax
mov edx, ebx
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffbfe]
test rax, rax
je 0x1800839ab
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1800839ab
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x180083980
sub rcx, 2
mov word [rcx], bp
jmp 0x1800839cb
test rdx, rdx
jne 0x1800839b4
sub rcx, 2
mov word [rcx], bp
jmp 0x1800839cb
mov ebx, 0x400
lea rdx, [rsp + 0x50]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
lea rax, [rsp + 0x50]
cmp word [rax], bp
je 0x1800839e3
add rax, 2
dec rcx
jne 0x1800839d3
jmp 0x180083a3c
test rcx, rcx
je 0x180083a3c
mov rdx, rbx
lea rax, [rsp + 0x50]
sub rdx, rcx
lea rax, [rax + rdx*2]
sub rbx, rdx
je 0x180083a35
lea rcx, [rdx + 0x7ffffbfe]
lea r8, [0x1800269a0]
add rcx, rbx
sub r8, rax
test rcx, rcx
je 0x180083a30
movzx edx, word [r8 + rax]
test dx, dx
je 0x180083a30
mov word [rax], dx
add rax, 2
dec rcx
dec rbx
jne 0x180083a10
jmp 0x180083a35
test rbx, rbx
jne 0x180083a39
sub rax, 2
mov word [rax], bp
lea rax, [rsp + 0x50]
lea r8, [0x180026a50]
lea rdx, [0x180026610]
mov qword [rsp + 0x30], rax
lea rax, [0x1800269e0]
mov r9d, 0x92
mov qword [rsp + 0x28], rax
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_griteLog
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180083af5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x44], rsi
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x30], rbp
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x1906
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18003b8c0
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800956b0
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x60
cmp qword [rcx + 0x18], 0
mov ebx, r8d
je 0x180095700
cmp qword [rcx + 0x40], 0
jne 0x1800956cc
xor r9d, r9d
jmp 0x1800956dd
cmp qword [rcx + 0x48], 8
jb 0x1800956d9
mov r9, qword [rcx + 0x30]
jmp 0x1800956dd
lea r9, [rcx + 0x30]
cmp qword [rcx + 0x20], 8
jb 0x1800956f2
mov r8, qword [rcx + 8]
mov edx, 3
jmp 0x1800957c2
lea r8, [rcx + 8]
mov edx, 3
jmp 0x1800957c2
cmp byte [rcx + 0xf0], 0
je 0x1800957ba
lea rcx, [rsp + 0x40]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x18009577f
mov r8, qword [rsp + 0x50]
test r8, r8
je 0x18009574c
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [r8 + rax*2], 0
jne 0x180095730
test rax, rax
je 0x18009574c
mov r9, qword [rsp + 0x58]
mov edx, 3
jmp 0x1800957c2
mov r9d, 0x27
lea rax, [0x18002e320]
lea r8, [0x18002e3f0]
mov qword [rsp + 0x28], rax
lea ecx, [r9 - 0x26]
lea rdx, [0x18002e440]
mov dword [rsp + 0x20], 2
call sym.StorageClientLib.dll_griteLog
jmp 0x1800957ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x2c
lea r8, [0x18002e3f0]
mov dword [rsp + 0x30], eax
lea rax, [0x18002e4c0]
lea rdx, [0x18002e440]
mov qword [rsp + 0x28], rax
lea ecx, [r9 - 0x2b]
mov dword [rsp + 0x20], 2
call sym.StorageClientLib.dll_griteLog
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18001dbf0]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
add rsp, 0x60
pop rbx
ret