joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f4a7c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
mov rsi, rdx
mov r10, rcx
mov qword [r11 + 0x10], rbp
cmp rdx, rbp
je 0x1000f4bc0
cmp word [rdx], bp
je 0x1000f4bc0
cmp rbx, rbp
je 0x1000f4ba0
cmp word [r9], bp
je 0x1000f4ba0
mov eax, dword [0x100158a34]
mov qword [r11 - 0x18], rbp
neg eax
lea rax, [r11 + 0x10]
sbb ecx, ecx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbp
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebp
je 0x1000f4b28
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4b8c
test byte [rcx + 0x1c], 1
je 0x1000f4b8c
lea edx, [rbp + 0x1a]
mov r9, rsi
jmp 0x1000f4b78
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
je 0x1000f4b8c
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4b8c
test byte [rcx + 0x1c], 1
je 0x1000f4b8c
mov edx, 0x1b
mov r9, rbx
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov dword [rsp + 0x20], eax
call fcn.10003b678
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x1000f4b9c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000f4bf3
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4bee
test byte [rcx + 0x1c], 1
je 0x1000f4bee
mov edx, 0x19
jmp 0x1000f4bde
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4bee
test byte [rcx + 0x1c], 1
je 0x1000f4bee
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034784
mov eax, 0x57
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1000f4c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov dword [rax - 0x18], 8
mov qword [rax - 0x10], rbp
cmp rdx, rbp
je 0x1000f4d64
cmp word [rdx], bp
je 0x1000f4d64
cmp r8, rbp
je 0x1000f4d44
cmp word [r8], bp
je 0x1000f4d44
cmp r9, rbp
jne 0x1000f4c8d
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f4d92
test byte [rcx + 0x1c], 1
je 0x1000f4d92
lea edx, [rbp + 0x1e]
jmp 0x1000f4d82
mov eax, dword [0x100158a34]
neg eax
lea rax, [rsp + 0x38]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f4d30
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f4d30
mov r8d, dword [rsp + 0x58]
cmp r8d, 0xb
je 0x1000f4d30
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f4d2b
test byte [rcx + 0x1c], 1
je 0x1000f4d2b
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x10001dbe8]
mov edx, 0x1f
mov r9, rdi
call fcn.10003b678
mov ebx, 0xd
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1000f4d40
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f4d97
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f4d92
test byte [rcx + 0x1c], 1
je 0x1000f4d92
mov edx, 0x1d
jmp 0x1000f4d82
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f4d92
test byte [rcx + 0x1c], 1
je 0x1000f4d92
mov edx, 0x1c
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034784
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1000f4db4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
mov rsi, rdx
mov r10, rcx
mov qword [r11 + 0x10], rbp
cmp rdx, rbp
je 0x1000f4efb
cmp word [rdx], bp
je 0x1000f4efb
cmp rbx, rbp
je 0x1000f4edb
cmp word [r9], bp
je 0x1000f4edb
mov eax, dword [0x100158a34]
mov qword [r11 - 0x18], rbp
neg eax
lea rax, [r11 + 0x10]
sbb ecx, ecx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbp
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebp
je 0x1000f4e60
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4ec7
test byte [rcx + 0x1c], 1
je 0x1000f4ec7
lea edx, [rbp + 0x22]
mov r9, rsi
jmp 0x1000f4eb3
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
mov r9d, 0xb
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
je 0x1000f4ec7
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4ec7
test byte [rcx + 0x1c], 1
je 0x1000f4ec7
mov edx, 0x23
mov r9, rbx
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov dword [rsp + 0x20], eax
call fcn.10003b678
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x1000f4ed7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000f4f2e
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4f29
test byte [rcx + 0x1c], 1
je 0x1000f4f29
mov edx, 0x21
jmp 0x1000f4f19
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4f29
test byte [rcx + 0x1c], 1
je 0x1000f4f29
mov edx, 0x20
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034784
mov eax, 0x57
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1000f4f4c
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, r8
mov qword [r11 + 0x10], rsi
cmp rdx, rsi
je 0x1000f4ff2
cmp word [rdx], si
je 0x1000f4ff2
cmp rbx, rsi
je 0x1000f4fd2
cmp word [r8], si
je 0x1000f4fd2
mov eax, dword [0x100158a34]
neg eax
lea rax, [r11 + 0x10]
sbb r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x18], rax
and r9d, 0x100
add r9d, 0x20006
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, esi
jne 0x1000f4fbe
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, rsi
je 0x1000f4fce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000f5025
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f5020
test byte [rcx + 0x1c], 1
je 0x1000f5020
mov edx, 0x25
jmp 0x1000f5010
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f5020
test byte [rcx + 0x1c], 1
je 0x1000f5020
mov edx, 0x24
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034784
mov eax, 0x57
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1000f5984
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x270
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r13d, r13d
mov r12, rcx
xor eax, eax
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov rsi, r9
mov ebp, r13d
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x24], eax
mov word [rsp + 0x50], r13w
call sub.msvcrt.dll_memset
lea edi, [r13 + 0x57]
cmp rsi, r13
jne 0x1000f5a20
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f5b81
test byte [rcx + 0x1c], 1
je 0x1000f5b81
mov rcx, qword [rcx + 0x10]
lea edx, [rdi - 0x16]
lea r8, [0x10001dbe8]
call fcn.100034784
jmp 0x1000f5b81
lea rax, [rsp + 0x50]
mov r14d, 0x104
mov r8, r12
lea rcx, [rsp + 0x50]
mov r9d, r13d
sub r8, rax
mov rdx, r14
lea rax, [rdx + 0x7ffffefa]
cmp rax, r13
je 0x1000f5a60
movzx eax, word [r8 + rcx]
cmp ax, r13w
je 0x1000f5a60
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000f5a3c
cmp rdx, r13
jne 0x1000f5a6f
sub rcx, 2
mov r9d, 0x8007007a
cmp r9d, r13d
mov word [rcx], r13w
jge 0x1000f5aa3
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f5b81
test byte [rcx + 0x1c], 1
je 0x1000f5b81
mov edx, 0x46
jmp 0x1000f5b71
mov ebx, r13d
lea r8, [rsp + 0x50]
mov r9d, ebx
mov rdx, r14
mov rcx, rsi
call fcn.1000f1d78
cmp eax, r13d
mov r9d, eax
jl 0x1000f5b53
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, r13d
je 0x1000f5b4e
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
cmp eax, r13d
je 0x1000f5b0e
cmp ebx, r13d
je 0x1000f5b02
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, r13d
jle 0x1000f5b0e
mov rax, qword [rsp + 0x3c]
mov ebp, ebx
mov qword [rsp + 0x20], rax
inc ebx
cmp ebx, 0xa
jb 0x1000f5aa6
mov r9d, ebp
mov r8, r12
mov rdx, r14
mov rcx, rsi
call fcn.1000f1d78
cmp eax, r13d
mov r9d, eax
jge 0x1000f5b4e
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f5b81
test byte [rcx + 0x1c], 1
je 0x1000f5b81
mov edx, 0x48
jmp 0x1000f5b71
mov edi, r13d
jmp 0x1000f5b81
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f5b81
test byte [rcx + 0x1c], 1
je 0x1000f5b81
mov edx, 0x47
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100036510
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10011be80
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000f5f74
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xa0]
mov r15, r8
mov r13d, edx
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp dword [rsp + 0xa0], 0xffffffff
je 0x1000f5fc9
cmp dword [rsp + 0xa0], 0
je 0x1000f5fc9
mov ebp, dword [rsp + 0xa0]
sub ebp, ebx
mov r9d, ebp
xor r8d, r8d
mov rdx, r15
mov ecx, r13d
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp eax, r13d
jne 0x1000f6022
mov ebx, 1
jmp 0x1000f6007
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1000f5ff1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, r12d
cmp r12d, eax
jbe 0x1000f6034
dec ebx
cmp edi, r13d
je 0x1000f5fac
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f6072
test byte [rcx + 0x1c], 4
je 0x1000f6072
mov rcx, qword [rcx + 0x10]
invalid
invalid
invalid
invalid
invalid
Function at 0x1000f609c
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x4a0
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r12, rcx
xor r13d, r13d
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x24c
mov edi, r13d
mov dword [rsp + 0x30], r13d
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x280], r13w
call sub.msvcrt.dll_memset
cmp r12, r13
jne 0x1000f6149
lea edi, [r13 + 0x57]
mov rcx, qword [0x100153eb8]
lea rbx, [0x100153eb8]
cmp rcx, rbx
je 0x1000f62ff
test byte [rcx + 0x1c], 1
je 0x1000f62ff
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xc]
lea r8, [0x10001dbe8]
call fcn.100034784
jmp 0x1000f62ff
lea rax, [0x100027100]
lea r8, [0x100026f90]
lea rcx, [rsp + 0x280]
mov r9, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1000f1d78
cmp eax, r13d
jge 0x1000f61bc
mov edi, eax
and edi, 0x1000ffff
mov rcx, qword [0x100153eb8]
lea rbx, [0x100153eb8]
cmp rcx, rbx
je 0x1000f62ff
test byte [rcx + 0x1c], 1
je 0x1000f62ff
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x64
mov r9d, eax
call fcn.100036510
jmp 0x1000f62ff
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000f6219
mov rcx, qword [0x100153eb8]
lea rbx, [0x100153eb8]
cmp rcx, rbx
je 0x1000f62f0
test byte [rcx + 0x1c], 4
je 0x1000f62f0
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x66]
lea r9, [rsp + 0x280]
lea r8, [0x10001dbe8]
call fcn.1000347a8
jmp 0x1000f62f0
lea rbx, [0x100153eb8]
cmp dword [rsp + 0x30], 0x10
je 0x1000f62d9
lea rax, [rsp + 0x5c]
lea r8, [0x100026f90]
lea rcx, [rsp + 0x280]
mov r9, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1000f1d78
cmp eax, r13d
mov ebp, eax
jl 0x1000f62a7
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x1000f62d9
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x1000f62d9
test byte [rcx + 0x1c], 1
je 0x1000f62d9
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x280]
lea r8, [0x10001dbe8]
mov edx, 0x66
mov dword [rsp + 0x20], eax
call fcn.10003b678
jmp 0x1000f62d9
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x1000f62d1
test byte [rcx + 0x1c], 1
je 0x1000f62d1
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x67
mov r9d, eax
call fcn.100036510
mov edi, ebp
and edi, 0x1000ffff
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
jne 0x1000f6220
cmp rsi, 0xffffffffffffffff
je 0x1000f62ff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10011be80
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1000f7524
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
lea rax, [rcx + 0x48]
xor ebx, ebx
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
lea rax, [rcx + 0x88]
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
lea rax, [rcx + 0xc8]
mov dword [rax + 0x30], ebx
mov dword [rax + 0x34], ebx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
mov qword [rcx + 0x108], rbx
mov dword [rcx + 0x114], ebx
mov dword [rcx + 0x110], ebx
mov qword [rcx + 0x128], rbx
mov dword [rcx + 0x134], ebx
mov dword [rcx + 0x130], ebx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x30], rbx
mov qword [rcx + 0x348], rbx
mov dword [rcx + 0x350], ebx
mov dword [rcx + 0x354], ebx
mov qword [rcx + 0x358], rbx
mov dword [rcx + 0x44], ebx
mov qword [rcx + 0x118], rbx
mov dword [rcx + 0x120], ebx
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x34]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
jne 0x1000f7662
lea rcx, [0x100153eb8]
mov rax, qword [0x100153eb8]
cmp rax, rcx
je 0x1000f766a
test byte [rax + 0x1c], 1
je 0x1000f766a
call sub.KERNEL32.dll_GetLastError
mov r9d, eax
lea edx, [rbx + 0x3e]
lea r8, [0x10001dba8]
mov rcx, qword [0x100153eb8]
mov rcx, qword [rcx + 0x10]
call fcn.100036510
jmp 0x1000f766a
cmp dword [rsp + 0x34], 6
setae bl
mov dword [rdi + 0x40], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10011be80
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x1000f8d8c
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x830
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x348]
mov ebx, edx
mov byte [rsp + 0x20], 0
test rcx, rcx
je 0x1000f8dce
call fcn.10011bc94
and qword [rdi + 0x348], 0
and dword [rdi + 0x354], 0
and dword [rdi + 0x350], 0
mov edx, ebx
mov rcx, rdi
call fcn.1000f8f3c
mov ebx, eax
test eax, eax
jns 0x1000f8e50
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f8ecc
test byte [rcx + 0x1c], 1
je 0x1000f8ecc
mov edx, 0x3a
jmp 0x1000f8eb9
mov rcx, rdi
call fcn.1000f7a08
mov ebx, eax
test eax, eax
js 0x1000f8f13
mov r8d, dword [rdi + 0x368]
test r8d, r8d
je 0x1000f8f0f
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1000f9edc
mov ebx, eax
test eax, eax
js 0x1000f8eef
mov rcx, rdi
call fcn.1000f7698
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x800
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rcx, rdi
mov ebx, eax
call fcn.1000f76e8
test ebx, ebx
jne 0x1000f8e17
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f8ecc
test byte [rcx + 0x1c], 1
je 0x1000f8ecc
mov edx, 0x3b
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov r9d, ebx
call fcn.100036510
mov eax, ebx
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.10011be80
mov rbx, qword [rsp + 0x850]
add rsp, 0x830
pop rdi
ret
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f8ecc
test byte [rcx + 0x1c], 1
je 0x1000f8ecc
mov edx, 0x3d
jmp 0x1000f8eb9
xor ebx, ebx
jmp 0x1000f8ecc
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f8ecc
test byte [rcx + 0x1c], 1
je 0x1000f8ecc
mov edx, 0x3c
jmp 0x1000f8eb9
Function at 0x1000f8f3c
Capabilities:
Read http header
Receive http response

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x60], 0
mov ebp, edx
mov rdi, rcx
call fcn.1000f7698
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rdi
mov ebx, eax
call fcn.1000f76e8
test ebx, ebx
jne 0x1000f8fb9
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x1000f918c
test byte [rcx + 0x1c], 1
je 0x1000f918c
mov edx, 0x3e
mov r9d, ebx
jmp 0x1000f8ff0
mov rcx, rdi
call fcn.1000f7a08
mov ebx, eax
test eax, eax
jns 0x1000f9005
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x1000f918c
test byte [rcx + 0x1c], 1
je 0x1000f918c
mov edx, 0x3f
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
call fcn.100036510
jmp 0x1000f918c
mov rcx, rdi
mov dword [rsp + 0x60], 4
call fcn.1000f7698
mov rcx, qword [rdi + 0x10]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
lea r9, [rdi + 0x340]
xor r8d, r8d
mov edx, 0x20000013
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea rsi, [0x100153eb8]
mov ebx, eax
test eax, eax
je 0x1000f912d
test ebp, ebp
je 0x1000f912d
mov rcx, qword [rdi + 0x10]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x4000000b
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x10
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ebx, eax
test eax, eax
jne 0x1000f90c7
mov rax, qword [0x100153eb8]
cmp rax, rsi
je 0x1000f90c0
test byte [rax + 0x1c], 1
je 0x1000f90c0
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100153eb8]
lea edx, [rbx + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov r9d, eax
call fcn.100036510
mov ebx, 1
jmp 0x1000f912d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x1000f9111
mov rax, qword [0x100153eb8]
cmp rax, rsi
je 0x1000f9111
test byte [rax + 0x1c], 1
je 0x1000f9111
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100153eb8]
lea r8, [0x10001db30]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x41
call fcn.100036510
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x358], rax
mov rcx, rdi
call fcn.1000f76e8
test ebx, ebx
jne 0x1000f918a
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000f918c
test byte [rcx + 0x1c], 1
je 0x1000f918c
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x42
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.10003be4c
jmp 0x1000f918c
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000f91a4
Capabilities:
Read http header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov rbp, rcx
mov ebx, 0x80070057
test r8, r8
je 0x1000f929f
test r9, r9
je 0x1000f929f
cmp dword [r9], 2
jb 0x1000f929f
call fcn.1000f7698
mov rcx, qword [rbp + 0x10]
and qword [rsp + 0x28], 0
mov r9, rsi
mov r8, r12
mov edx, 0xffff
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1000f925d
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f9295
test byte [rcx + 0x1c], 1
je 0x1000f9295
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x44
mov r9, r12
mov dword [rsp + 0x20], ebx
call fcn.10003b678
jmp 0x1000f9295
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f9293
test byte [rcx + 0x1c], 4
je 0x1000f9293
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x45
mov r9, r12
mov qword [rsp + 0x20], rsi
call fcn.10003b3bc
xor ebx, ebx
mov rcx, rbp
call fcn.1000f76e8
jmp 0x1000f92cd
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f92cd
test byte [rcx + 0x1c], 1
je 0x1000f92cd
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x43
call fcn.100034784
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret

Function at 0x1000f9d58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1000f9db0
mov rax, qword [0x100153eb8]
lea rcx, [0x100153eb8]
cmp rax, rcx
je 0x1000f9db0
test byte [rax + 0x1c], 1
je 0x1000f9db0
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100153eb8]
lea r8, [0x10001db30]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x7f
call fcn.100036510
lea rcx, [rbx + 0x88]
call fcn.1000fa6b4
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000f9dce
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and qword [rbx], 0
lea rcx, [rbx + 0x88]
call fcn.1000fa720
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1000f9df4