joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000de4c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r11, r8
mov r10, rdx
xor r8d, r8d
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
mov rdi, rcx
mov rbx, rdx
shr rbx, 1
lea rax, [rbx + rbx*2]
sub r10, rax
lea rcx, [rbx*4 + 1]
cmp r10, 1
mov rax, r10
setne r8b
add r8d, 2
neg rax
sbb eax, eax
and eax, r8d
add rcx, rax
cmp rcx, 0x81
ja 0x14000dfc0
xor r9d, r9d
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W
xor esi, esi
test rbx, rbx
je 0x14000df36
movzx ecx, byte [rdi]
inc esi
movzx edx, byte [rdi + 2]
mov eax, ecx
movzx r8d, byte [rdi + 1]
and cl, 3
shr rax, 2
add rdi, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, r8d
shr rax, 4
and r8b, 0xf
or rcx, rax
shl r8b, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
movzx ecx, r8b
or rcx, rax
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 2], al
mov al, byte [rdx + r14]
mov byte [r9 + r11 + 3], al
add r9, 4
mov eax, esi
cmp rax, rbx
jb 0x14000dec5
sub r10, 1
je 0x14000df8c
cmp r10, 1
jne 0x14000dfbb
movzx ecx, byte [rdi]
movzx edx, byte [rdi + 1]
mov eax, ecx
shr rax, 2
and cl, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, edx
shr rax, 4
and dl, 0xf
or rcx, rax
shl dl, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
movzx eax, dl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 2], al
mov byte [r9 + r11 + 3], 0x3d
jmp 0x14000dfb7
movzx ecx, byte [rdi]
mov eax, ecx
and cl, 3
shr rax, 2
shl cl, 4
mov al, byte [rax + r14]
mov byte [r9 + r11], al
movzx eax, cl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 1], al
mov word [r9 + r11 + 2], 0x3d3d
add r9, 4
mov byte [r9 + r11], 0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x14000e328
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r10, r8
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14000e360
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14000e3eb
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14000e3eb
mov ecx, dword [r10]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x14000e3b9
cmp rdi, qword [rax + r8*8]
jne 0x14000e3a8
jmp 0x14000e3eb
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.140017ff4
mov rax, qword [rsp + 0x68]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x14000e519
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14000e425
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14000e442
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000e471
cmp rax, rdi
jne 0x14000e44d
mov qword [rdx + r8*8], rbx
jmp 0x14000e471
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000e471
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140022b74]
test rax, rax
jns 0x14000e492
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14000e4a3
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14000e50e
cmp rdx, 0x200
jae 0x14000e4bb
shl rdx, 3
jmp 0x14000e4cd
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14000e4cd
add rdx, rdx
mov rcx, rsi
call fcn.14000bdb8
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14000e509
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14000e328
cmp rdi, qword [rsp + 0x20]
jne 0x14000e4e7
mov r9, qword [rsp + 0x68]
mov qword [r9], rbx
mov byte [r9 + 8], 1
mov rax, r9
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000e5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14000e5bd
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14000e615
cmp qword [rcx + rdx*8], r8
jne 0x14000e60a
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14000e60e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14000e622
cmp qword [rcx + rdx*8], r8
jne 0x14000e622
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140017ff4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f4f8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x14002a370]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x1d0]
mov r13, rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x40]
mov r14d, 0x104
mov qword [rsp + 0x38], rax
xor esi, esi
mov edx, r14d
and qword [rsp + 0x20], rsi
mov r12, r9
mov r15, r8
xor edi, edi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x14000f6a0
lea r8, str.kernel32.dll
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140002440
mov ebx, eax
test eax, eax
js 0x14000f6b8
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000f5cc
mov edx, r14d
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x14000f611
lea r8, str._ntdll.dll
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140002440
mov ebx, eax
test eax, eax
js 0x14000f6b8
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r14d, eax
test eax, eax
je 0x14000f611
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rsi, rax
test rax, rax
je 0x14000f611
mov r8d, r14d
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14000f61b
mov ebx, 0x8007000e
jmp 0x14000f6b8
mov ebx, 0x8000ffff
jmp 0x14000f6b8
mov r9, rdi
lea rcx, [rsp + 0x40]
mov r8d, r14d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14000f6a0
lea r9, [rsp + 0x28]
mov rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [0x14001c510]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x14000f6a0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
movzx eax, word [rcx + 0xa]
mov dword [r13], eax
movzx eax, word [rcx + 8]
mov dword [rdx], eax
movzx r8d, word [rcx + 0xe]
mov rax, qword [rsp + 0x38]
mov dword [rax], r8d
cmp r8d, 0x23f0
jae 0x14000f693
mov eax, 0xcccccccd
mul r8d
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
jmp 0x14000f696
xor r8d, r8d
mov dword [r15], r8d
and dword [r12], 0
jmp 0x14000f6a5
mov ebx, 0x8000ffff
test rdi, rdi
je 0x14000f6b8
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140018010
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000fe3c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r11d, r11d
lea r8, [0x140000000]
mov r9, rdx
test rdx, rdx
jne 0x14000fe6d
mov r9, r8
not r9
mov rdx, r9
mov rcx, r8
call fcn.14000fb90
test eax, eax
je 0x140010071
mov edx, 0x40
call fcn.14000fb90
test eax, eax
je 0x140010071
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140010071
movsxd rax, dword [0x14000003c]
cmp rax, r9
jae 0x140010071
lea rcx, [rax + r8]
mov edx, 0x108
call fcn.14000fb90
test eax, eax
je 0x140010071
cmp dword [rcx], 0x4550
jne 0x140010071
movzx eax, word [rcx + 0x14]
cmp rax, r9
jae 0x140010071
add rcx, 0x18
mov edx, 0x10b
cmp word [rcx], dx
jne 0x14000ff16
cmp rax, 0x60
jb 0x140010071
mov edx, 0xe0
call fcn.14000fb90
test eax, eax
je 0x140010071
mov eax, dword [rcx + 0x5c]
add rcx, 0x70
jmp 0x14000ff47
mov edx, 0x20b
cmp word [rcx], dx
jne 0x140010071
cmp rax, 0x70
jb 0x140010071
mov edx, pe_nt_image_headers64
call fcn.14000fb90
test eax, eax
je 0x140010071
mov eax, dword [rcx + 0x6c]
sub rcx, 0xffffffffffffff80
cmp eax, 2
jbe 0x140010071
mov eax, dword [rcx]
test rax, rax
je 0x140010071
mov edx, dword [rcx + 4]
test rdx, rdx
je 0x140010071
lea rdi, [rax + r8]
test rdi, rdi
je 0x140010071
mov rcx, rdi
call fcn.14000fb90
test eax, eax
je 0x140010071
mov ebp, 0x10
cmp rdx, rbp
jb 0x140010071
movzx ebx, word [rdi + 0xe]
test rbx, rbx
je 0x140010071
movzx ecx, word [rdi + 0xc]
lea r14d, [rbp - 8]
add rcx, 2
mov rsi, r11
lea rcx, [rdi + rcx*8]
test rbx, rbx
je 0x14000ffd7
mov rdx, r14
call fcn.14000fb90
test eax, eax
je 0x140010071
cmp word [rcx], bp
je 0x14000ffd7
add rcx, r14
inc rsi
cmp rsi, rbx
jb 0x14000ffb7
cmp rsi, rbx
je 0x140010071
mov ebx, dword [rcx + 4]
test ebx, ebx
jns 0x140010059
mov esi, 0x7fffffff
mov rdx, rbp
and rbx, rsi
add rbx, rdi
mov rcx, rbx
call fcn.14000fb90
test eax, eax
je 0x140010071
cmp word [rbx + 0xe], r11w
jne 0x14001000f
cmp word [rbx + 0xc], r11w
je 0x140010071
lea rcx, [rbx + 0x10]
mov rdx, r14
call fcn.14000fb90
test eax, eax
je 0x140010071
mov ebx, dword [rcx + 4]
test ebx, ebx
jns 0x140010059
and rbx, rsi
mov rdx, rbp
add rbx, rdi
mov rcx, rbx
call fcn.14000fb90
test eax, eax
je 0x140010071
cmp word [rbx + 0xe], r11w
jne 0x140010049
cmp word [rbx + 0xc], r11w
je 0x140010071
lea rcx, [rbx + 0x10]
mov rdx, r14
call fcn.14000fb90
test eax, eax
je 0x140010071
mov ecx, dword [rcx + 4]
mov rdx, rbp
add rcx, rdi
call fcn.14000fb90
test eax, eax
je 0x140010071
mov r11d, dword [rcx]
add r11, r8
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400105e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14002a370]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdx, [0x14001cec8]
add rcx, 8
call fcn.14000f45c
lea rcx, [rbx + 0x10]
lea rdx, str.UpgradeRemediation
call fcn.14000f45c
lea rcx, [rbx + 0x18]
lea rdx, str.RemediationShell
call fcn.14000f45c
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion_rempl_settings
lea rcx, [rbx + 0x20]
call fcn.14000f45c
mov rcx, rbx
mov qword [rbx + 0x70], 0xffffffff80000002
call fcn.1400123cc
xor r14d, r14d
mov edi, eax
test eax, eax
js 0x1400106f8
mov rcx, rbx
call fcn.1400121e8
mov edi, eax
test eax, eax
js 0x1400106f8
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rdx, qword [rbx + 0x20]
lea rax, [rsp + 0x40]
mov rcx, qword [rbx + 0x70]
lea r9d, [r14 + 2]
mov qword [rsp + 0x30], rax
lea r8, str.Endpoint
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x1400106e9
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400106d5
lea rdx, [rsp + 0x50]
test rax, rax
jne 0x1400106f0
lea rdx, str.settings_win.data.microsoft.com
mov rcx, rbx
call fcn.14000f45c
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140018010
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140010724
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rcx + 0x20]
lea r8, str.RefreshAfter
xor eax, eax
mov dword [rbp + 0x38], 8
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov rcx, qword [rcx + 0x70]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rax
xor r14d, r14d
lea rax, [rbp - 0x10]
xor edi, edi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rdi
lea r9d, [r14 + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x140010789
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp edi, 0x80070002
jne 0x140010797
xor edi, edi
xor ebx, ebx
jmp 0x1400107e3
test edi, edi
js 0x1400107c5
xor eax, eax
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x40], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x4c], eax
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x48], eax
mov rax, qword [rbp - 0x10]
cmp qword [rbp + 0x48], rax
seta r14b
xor edi, edi
mov ebx, edi
test edi, edi
jns 0x1400107d9
lea rdx, str.OneSettings_IsTimeToRequery_failed
mov ecx, edi
call fcn.1400088b0
cmp r14d, 1
jne 0x140010869
lea rdx, str.OneSettings_requery_is_TRUE
mov ecx, edi
call fcn.140008ad0
test edi, edi
js 0x14001086e
cmp qword [rsi + 0x78], 0
je 0x140010810
cmp qword [rsi + 0x80], 0
je 0x140010810
cmp qword [rsi + 0x88], 0
jne 0x14001082a
mov rdx, qword [rsi]
mov rcx, rsi
call fcn.140010ee8
mov ebx, eax
test eax, eax
jns 0x14001082a
lea rdx, str.OneSettings_OpenWebRequest_failed
jmp 0x140010840
mov rcx, rsi
call fcn.1400117c4
mov ebx, eax
cmp eax, 1
jbe 0x140010849
lea rdx, str.OneSettings_GetCloudSettings_failed
mov ecx, eax
call fcn.1400088b0
jmp 0x14001086e
mov rcx, rsi
call fcn.140011d08
mov ebx, eax
test eax, eax
jns 0x14001086e
lea rdx, str.OneSettings_UpdateNextRefreshTime_failed
mov ecx, eax
call fcn.1400088b0
xor ebx, ebx
jmp 0x14001086e
mov ebx, 1
mov rcx, rsi
call fcn.140012820
mov eax, ebx
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140010e48
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [rcx + 0x20]
lea rax, [rsp + 0x48]
mov rcx, qword [rcx + 0x70]
mov r9d, 0xf003f
and qword [rsp + 0x48], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x140010e8b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010ecf
mov rcx, qword [rsp + 0x48]
lea rdx, str.ETag
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010ecf
mov rcx, qword [rsp + 0x48]
lea rdx, str.RefreshAfter
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140010edf
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140010ee8
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x1050
call fcn.140019130
sub rsp, rax
mov rax, qword [0x14002a370]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
call fcn.140011eb8
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x1000
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
and dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rdi + 0x78], rax
mov r14d, 0x80070000
test rax, rax
jne 0x140010f77
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011075
mov rcx, qword [rdi + 0x78]
mov edx, 0x2710
mov r9d, edx
mov dword [rsp + 0x20], edx
mov r8d, edx
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x140010faf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011075
mov rcx, qword [rdi + 0x78]
mov r8d, 0x1bb
xor r9d, r9d
mov rdx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rdi + 0x80], rax
test rax, rax
jne 0x140010ff4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011075
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14001109c
lea r8, [rsp + 0x40]
xor ecx, ecx
lea rdx, str.The_following_query_string_will_be_used:__s
mov ebx, eax
call fcn.140008ad0
test ebx, ebx
js 0x140011075
mov rcx, qword [rdi + 0x80]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], 0x800000
lea rdx, [0x14001e9f8]
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rdi + 0x88], rax
test rax, rax
jne 0x140011075
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140018010
mov rbx, qword [rsp + 0x1080]
add rsp, 0x1050
pop r14
pop rdi
pop rsi
ret
Function at 0x140011b28
Capabilities:
Read http header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
lea rax, [r11 + 8]
mov r15, r9
mov qword [r11 - 0x30], rbx
mov r13, r8
mov qword [r11 - 0x38], rax
mov r12, rdx
mov rsi, rcx
mov rcx, qword [rcx + 0x88]
lea edx, [rbx + 0x36]
xor r9d, r9d
xor r8d, r8d
mov edi, ebx
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ebp, 0x80070000
test eax, eax
jne 0x140011ba4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x140011ba4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov edi, 0x80004005
or ecx, ebp
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs edi, ecx
mov ecx, dword [rsp + 0x60]
lea rdx, [0x14002ac82]
call fcn.140019094
mov r14, rax
mov eax, 0x8007000e
test r14, r14
cmove edi, eax
test edi, edi
js 0x140011c0e
xor r8d, r8d
mov word [r14], bx
mov rcx, qword [rsi + 0x88]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov r9, r14
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x36]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140011c0e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov edi, 0x80004005
or ecx, ebp
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs edi, ecx
mov rdx, r14
mov rcx, r12
call fcn.14000f45c
mov rax, qword [r12]
or rbp, 0xffffffffffffffff
test rax, rax
jne 0x140011c2a
mov esi, ebx
jmp 0x140011c4b
mov rsi, rbp
inc rsi
cmp word [rax + rsi*2], bx
jne 0x140011c2d
mov eax, esi
cmp rax, rsi
je 0x140011c4b
mov ecx, 0x216
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
or esi, 0xffffffff
cmp qword [r15], rbx
je 0x140011c5c
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [r15], rbx
mov eax, esi
lea rcx, [rax + rax]
cmp rcx, rax
jbe 0x140011c8b
mov esi, ecx
cmp rsi, rcx
jne 0x140011c8b
mov ecx, esi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov qword [r15], rax
test rax, rax
je 0x140011c8b
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
test edi, edi
js 0x140011cde
mov rax, qword [r12]
test rax, rax
je 0x140011cba
inc rbp
cmp word [rax + rbp*2], bx
jne 0x140011c98
mov eax, ebp
cmp rax, rbp
je 0x140011cb8
mov ecx, 0x216
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
or ebx, 0xffffffff
jmp 0x140011cba
mov ebx, ebp
mov r9, qword [r15]
lea rdx, str._lu:_s
mov r8, r13
mov dword [rsp + 0x20], ebx
mov rcx, r14
call fcn.140019044
cmp eax, 1
mov ecx, 0x8000ffff
cmovle edi, ecx
mov rcx, r14
call fcn.1400186f0
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140011d08
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
xor eax, eax
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x30], rax
xor edi, edi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
and qword [rsp + 0x40], rdi
xor eax, eax
and qword [rbp + 0x38], rax
xor r9d, r9d
mov eax, dword [rbp + 0x34]
xor r8d, r8d
mov rdx, qword [rbx + 0x20]
mov dword [rbp + 0x2c], eax
mov eax, dword [rbp + 0x30]
mov dword [rbp + 0x28], eax
mov eax, dword [rbx + 0x90]
imul rcx, rax, 0x23c34600
lea rax, [rbp + 0x38]
add qword [rbp + 0x28], rcx
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov ebx, 0x80070000
test eax, eax
je 0x140011d95
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140011dce
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x28], 8
lea rdx, str.RefreshAfter
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x140011dce
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140011ddd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret

Function at 0x140011de8
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
lea rax, [r11 + 8]
mov qword [r11 - 0x18], rsi
mov rdi, rdx
mov rdx, qword [rcx + 0x20]
xor r9d, r9d
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov qword [r11 - 0x20], rax
mov ebx, esi
mov qword [r11 - 0x28], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
mov qword [r11 + 8], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x140011e49
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140011e93
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x140011e4d
mov rcx, qword [rsp + 0x60]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.ETag
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x140011e93
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140011ea3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret