joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001f930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x18014a010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x20], rcx
call fcn.1800982a0
test eax, eax
jne 0x18001fb42
mov r8, qword [rbp + 0x1a0]
test r8, r8
je 0x18001fa5a
lea r14, [rbp + 0xf0]
add r8, 8
mov r9, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x18001f99a
mov rdx, qword [r8]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x18001f9d3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r10
inc rcx
cmp rcx, r9
jb 0x18001f9c0
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.180026980
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x18001fa5a
mov rcx, qword [r14 + 0x30]
and rcx, rdi
shl rcx, 4
mov rdx, qword [r14 + 0x18]
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x18001fa23
cmp rax, rbx
jne 0x18001fa19
mov rax, qword [r14 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x18001fa2e
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x18001fa2e
cmp rax, rbx
jne 0x18001fa2e
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
dec qword [r14 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
lea rcx, [rbx + 0x10]
call fcn.18002d450
mov edx, 0x40
mov rcx, rbx
call fcn.180096034
mov r8, qword [rsi]
test r8, r8
je 0x18001fa86
lea rcx, [rbp + 0xf0]
add r8, 8
lea rdx, [rsp + 0x38]
call fcn.180026470
mov rcx, qword [rax]
add rcx, 0x30
mov rdx, rsi
call fcn.1800216b0
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov qword [rsi], 0
mov qword [rsi + 8], 0
mov qword [rbp + 0x1a0], rax
mov rbx, qword [rbp + 0x1a8]
mov qword [rbp + 0x1a8], rcx
mov edi, 0xffffffff
test rbx, rbx
je 0x18001fae5
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18001fae5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18001fae5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x20]
call fcn.1800982c4
nop
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x18001fb20
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18001fb20
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18001fb20
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180096010
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.180097f44
int3
Function at 0x180025760
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x18014a010]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x60]
call fcn.1800c1ae0
mov qword [rsp + 0x70], 0
lea rsi, vtable.fmt::v7::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], 0xfa
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov rdx, rbx
call qword [rax + 8]
mov rcx, qword [rdi + 0x98]
mov rbx, qword [rsp + 0x70]
add rcx, rbx
mov qword [rdi + 0x98], rcx
cmp rcx, qword [rdi + 0x88]
jbe 0x18002580c
mov rcx, rdi
call fcn.18002b6f0
mov rbx, qword [rsp + 0x70]
mov qword [rdi + 0x98], rbx
mov r9, qword [rdi + 0xa8]
mov r8, rbx
mov edx, 1
mov rcx, qword [rsp + 0x68]
call fcn.1800d2e30
cmp rax, rbx
jne 0x180025897
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
je 0x18002586c
mov rdx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025867
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180025891
call fcn.180096034
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180096010
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1800d0cf4
nop
call fcn.1800d56cc
nop
mov ebx, dword [rax]
lea rdx, [rdi + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.18001cfd0
nop
mov r8, rax
lea rdx, str.Failed_writing_to_file
lea rcx, [rsp + 0x40]
call fcn.1800255e0
nop
mov edx, ebx
mov rcx, rax
call fcn.18001ce50
int3
Function at 0x180025bf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x1c0
mov rax, qword [0x18014a010]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x28], 0xffffffffffffffff
je 0x180025d38
mov rbx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.1800982a0
test eax, eax
jne 0x180025d62
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x90]
call fcn.1800c1ae0
mov qword [rsp + 0xa0], 0
lea r14, vtable.fmt::v7::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x90], r14
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], 0xfa
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
lea r8, [rsp + 0x90]
mov rdx, rsi
call qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.1800d29a8
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180025d6a
mov qword [rsp + 0x90], r14
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x180025d30
mov rdx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180025d2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180025d5c
call fcn.180096034
nop
mov rcx, rbx
call fcn.1800982c4
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180096010
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1c0
pop r14
pop rdi
pop rsi
ret
call fcn.1800d0cf4
nop
mov ecx, eax
call fcn.180097f44
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.180017ca0
nop
mov r8, rax
lea rdx, str.stdout_sink_base:_WriteFile___failed._GetLastError__:
lea rcx, [rsp + 0x40]
call fcn.1800255e0
mov rcx, rax
call fcn.18001cee0
int3
Function at 0x18002b2a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18002b42e
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180021e30
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18002b3f7
mov qword [rsp + 0x58], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
movzx r10d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
mov eax, r10d
mov rdx, qword [rdx]
xor rax, rdi
imul rax, rbp
and r11, rax
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18002b366
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18002b3e6
mov rax, qword [r11 + 8]
cmp r10b, byte [rax + 0x10]
jne 0x18002b39f
mov r10, qword [rax]
cmp r10, rcx
je 0x18002b399
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18002b3e6
mov r8, rax
cmp r9, rax
je 0x18002b3c2
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r10b, byte [rax + 0x10]
je 0x18002b408
cmp r9, rax
jne 0x18002b3b0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x18002b331
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18002b3e6
lea rcx, str.invalid_hash_bucket_count
call fcn.180097470
int3
Function at 0x18002c680
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x18014a010]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18002c86d
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.1800982a0
test eax, eax
jne 0x18002c89a
xor r14d, r14d
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r14
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x50]
call fcn.1800c1ae0
mov qword [rsp + 0x60], r14
lea r15, vtable.fmt::v7::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xfa
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov rdx, rsi
call qword [rax + 8]
cmp byte [rdi + 0x20], r14b
je 0x18002c801
mov rax, qword [rsi + 0x28]
cmp qword [rsi + 0x30], rax
jbe 0x18002c801
test rax, rax
je 0x18002c75f
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movsxd rax, dword [rsi + 0x10]
movzx ebp, word [rdi + rax*2 + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x18002c780
lea ebp, [rax + 7]
jmp 0x18002c79b
mov edx, dword [rsp + 0x40]
and edx, 0xfff0
or edx, ebp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx ebp, word [rsp + 0x40]
mov rcx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x28]
cmp rcx, r8
jbe 0x18002c7c8
sub ecx, r8d
mov rdx, qword [rsp + 0x58]
add rdx, r8
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ecx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx edx, bp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsp + 0x60]
cmp rcx, rdx
jbe 0x18002c825
sub ecx, edx
add rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ecx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x18002c825
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x18002c865
mov rdx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c85f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c894
call fcn.180096034
nop
mov rcx, rbx
call fcn.1800982c4
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180096010
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1800d0cf4
nop
mov ecx, eax
call fcn.180097f44
int3
Function at 0x18004d2a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx + 4]
mov ebx, 2
xor dword [rcx + 0x1404], eax
mov r11d, dword [rcx + 0x1404]
mov r10d, dword [rcx + 0x1408]
lea edi, [rbx + 6]
nop dword [rax]
mov eax, r11d
shr rax, 0x10
movzx edx, al
mov eax, r11d
shr rax, 0x18
mov r9d, dword [rcx + rdx*4 + 0x804]
add r9d, dword [rcx + rax*4 + 0x404]
mov eax, r11d
shr rax, 8
movzx edx, al
movzx eax, r11b
xor r9d, dword [rcx + rdx*4 + 0xc04]
add r9d, dword [rcx + rax*4 + 0x1004]
lea eax, [rbx - 1]
xor r9d, dword [rcx + rax*4 + 4]
xor r10d, r9d
mov dword [rcx + 0x1408], r10d
mov eax, r10d
shr rax, 0x10
movzx edx, al
mov eax, r10d
shr rax, 0x18
mov r9d, dword [rcx + rdx*4 + 0x804]
add r9d, dword [rcx + rax*4 + 0x404]
mov eax, r10d
shr rax, 8
movzx edx, al
movzx eax, r10b
xor r9d, dword [rcx + rdx*4 + 0xc04]
add r9d, dword [rcx + rax*4 + 0x1004]
mov eax, ebx
add ebx, 2
xor r9d, dword [rcx + rax*4 + 4]
xor r9d, r11d
mov dword [rcx + 0x1404], r9d
mov r11d, r9d
sub rdi, 1
jne 0x18004d2d0
xor r10d, dword [rcx + 0x48]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rcx + 0x1404], r10d
mov dword [rcx + 0x1408], r9d
ret
Function at 0x1800647e0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
movzx eax, byte [r8 + 1]
mov rdi, rcx
movzx ecx, byte [r8 + 5]
mov rbx, r9
movzx r10d, byte [r8]
shl r10d, 8
or r10d, eax
movzx eax, byte [r8 + 2]
shl r10d, 8
or r10d, eax
movzx eax, byte [r8 + 3]
shl r10d, 8
or r10d, eax
movzx eax, byte [r8 + 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [r8 + 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [r8 + 7]
shl eax, 8
or eax, ecx
mov ecx, dword [rsp + 0x30]
cmp edx, 1
jne 0x1800648a6
xor r8d, r8d
test ecx, ecx
je 0x18006491d
mov r9d, r8d
mov r11d, ecx
mov ecx, eax
and r9d, 3
shl ecx, 4
mov edx, eax
shr edx, 5
xor edx, ecx
mov ecx, dword [rdi + r9*4]
add edx, eax
add ecx, r8d
add r8d, 0x9e3779b9
xor edx, ecx
mov r9d, r8d
add r10d, edx
mov ecx, r10d
mov edx, r10d
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, r8d
shr rcx, 0xb
add edx, r10d
and ecx, 3
mov ecx, dword [rdi + rcx*4]
add ecx, r8d
xor edx, ecx
add eax, edx
sub r11, 1
jne 0x180064851
jmp 0x18006491d
imul r11d, ecx, 0x9e3779b9
test ecx, ecx
je 0x18006491d
mov qword [rsp + 0x10], rsi
mov rsi, rcx
mov r9d, r11d
nop dword [rax]
shr r9, 0xb
mov ecx, r10d
shl ecx, 4
and r9d, 3
mov edx, r10d
shr edx, 5
xor edx, ecx
mov ecx, dword [rdi + r9*4]
add edx, r10d
add ecx, r11d
add r11d, 0x61c88647
xor edx, ecx
mov r9d, r11d
sub eax, edx
mov ecx, eax
mov r8d, eax
shr r8d, 5
shl ecx, 4
xor r8d, ecx
mov ecx, r11d
and ecx, 3
add r8d, eax
mov edx, dword [rdi + rcx*4]
add edx, r11d
xor r8d, edx
sub r10d, r8d
sub rsi, 1
jne 0x1800648c0
mov rsi, qword [rsp + 0x10]
mov byte [rbx + 7], al
mov ecx, r10d
shr ecx, 0x18
mov byte [rbx], cl
mov ecx, r10d
shr ecx, 0x10
mov byte [rbx + 1], cl
mov ecx, r10d
shr ecx, 8
mov byte [rbx + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [rbx + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [rbx + 6], cl
xor eax, eax
mov byte [rbx + 3], r10b
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x1800888a0
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x68
mov rax, qword [0x18014a010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov r12, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 0x10], rbp
je 0x180088a54
cmp qword [rdx + 0x10], rbp
je 0x180088a54
cmp qword [rdx + 0x18], 0x10
mov rcx, rdx
mov qword [rsp + 0x58], r14
jb 0x1800888ea
mov rcx, qword [rdx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov r14d, eax
test eax, eax
je 0x180088a50
mov qword [rsp + 0x60], rdi
lea rdx, [0x180100ce1]
mov ecx, r14d
mov qword [rsp + 0x50], r15
call fcn.180096a30
mov rdi, rax
test rax, rax
je 0x180088a28
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.1800c1ae0
cmp qword [rbx + 0x18], 0x10
jb 0x18008893c
mov rbx, qword [rbx]
mov edx, dword [rsp + 0x40]
mov r9, rdi
mov r8d, r14d
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x180088a0e
lea r9, [rsp + 0x44]
mov rcx, rdi
lea r8, [rsp + 0x30]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x180088a0e
mov rax, qword [rsp + 0x30]
lea rdx, [0x180100ce1]
mov ecx, pe_nt_image_headers64
movzx ebx, word [rax]
movzx eax, word [rax + 2]
shl ebx, 0x10
or ebx, eax
call fcn.180096a30
mov rbp, rax
test rax, rax
je 0x180088a0e
cmp qword [rsi + 0x18], 0x10
jb 0x1800889ad
mov rsi, qword [rsi]
mov r9d, ebx
mov qword [rsp + 0x20], rsi
lea r8, str.StringFileInfo_08lx_s
mov edx, pe_nt_image_headers64
mov rcx, rbp
call fcn.180088840
lea r9, [rsp + 0x44]
mov rdx, rbp
lea r8, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x180088a02
mov rdx, qword [rsp + 0x38]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1800889f0
mov rcx, r12
call fcn.180006090
mov rcx, rdi
mov bl, 1
call fcn.180096034
jmp 0x180088a1d
mov rcx, rdi
call fcn.180096034
xor bl, bl
test rbp, rbp
je 0x180088a25
mov rcx, rbp
call fcn.180096034
movzx eax, bl
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180096010
add rsp, 0x68
pop r12
pop rsi
pop rbp
pop rbx
ret
xor al, al
jmp 0x180088a32
xor al, al
jmp 0x180088a37
Function at 0x18008efb0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rax, vtable.CWinHttp.0
mov qword [rcx], rax
mov byte [rcx + 8], 0
xor esi, esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov dword [rcx + 0x28], 0x1388
mov dword [rcx + 0x2c], 0x1388
mov dword [rcx + 0x30], 0x1388
lea rbx, [rcx + 0x38]
mov qword [rsp + 0x40], rbx
lea rax, vtable.CHttpHeader.0
mov qword [rbx], rax
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], select
mov byte [rbx + 0x10], sil
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], select
mov byte [rbx + 0x30], sil
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x68], select
mov byte [rbx + 0x50], sil
add rbx, 0x70
mov qword [rsp + 0x48], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
lea ecx, [rsi + 0x60]
call fcn.18009603c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi + 0xb8], xmm0
mov qword [rdi + 0xc8], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 4]
lea rcx, str.Microsoft_Internet_Explorer
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, rax
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x18008f0bd
mov dword [rdi + 0xc8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x2c]
mov r8d, dword [rdi + 0x28]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800900c0
Capabilities:
Receive http response

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x88
mov rax, qword [0x18014a010]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov edi, r9d
mov rbx, r8
mov r15, rdx
mov r13, rcx
mov qword [rbp - 0x19], rdx
mov r9, qword [rbp + 0x6f]
mov r11, qword [rbp + 0x77]
mov r10, qword [rbp + 0x7f]
xor r14d, r14d
mov r12d, r14d
mov qword [rbp - 0x29], r14
mov esi, select
mov qword [rbp - 0x21], rsi
mov byte [rbp - 0x39], r12b
mov eax, dword [rbp + 0x87]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r11
mov r8d, edi
mov rdx, rbx
call fcn.1800903b0
test al, al
je 0x180090270
mov ecx, 0x1000
call fcn.1800caa98
mov rdi, rax
lea rdx, [rbp - 0x3d]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x180090244
movzx ebx, byte [rbp - 0x41]
nop dword [rax + rax]
mov r8d, dword [rbp - 0x3d]
test r8d, r8d
je 0x180090241
cmp r8d, 0x1000
jbe 0x1800901a6
test rdi, rdi
je 0x180090197
mov rcx, rdi
call fcn.1800ca7c8
mov r8d, dword [rbp - 0x3d]
mov ecx, r8d
call fcn.1800caa98
mov rdi, rax
mov r8d, dword [rbp - 0x3d]
test rdi, rdi
je 0x18009025b
lea r9, [rbp - 0x19]
mov rdx, rdi
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x18009024b
mov r14d, dword [rbp - 0x19]
mov rax, rsi
sub rax, r12
cmp r14, rax
ja 0x180090205
lea rax, [r12 + r14]
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
cmp rsi, 0x10
cmovae rax, qword [rbp - 0x39]
lea rsi, [rax + r12]
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
call fcn.1800c1d10
mov byte [rsi + r14], 0
jmp 0x18009021d
mov qword [rsp + 0x20], r14
mov r9, rdi
movzx r8d, bl
mov rdx, r14
lea rcx, [rbp - 0x39]
call fcn.180006990
lea rdx, [rbp - 0x3d]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov rsi, qword [rbp - 0x21]
test eax, eax
je 0x18009023c
mov r12, qword [rbp - 0x29]
jmp 0x180090170
xor r14b, r14b
jmp 0x180090244
mov r14b, 1
test rdi, rdi
je 0x180090256
jmp 0x18009024e
xor r14b, r14b
mov rcx, rdi
call fcn.1800ca7c8
test r14b, r14b
jne 0x180090270
lea rax, [rbp - 0x39]
cmp rsi, 0x10
cmovae rax, qword [rbp - 0x39]
xor ecx, ecx
mov qword [rbp - 0x29], rcx
mov byte [rax], cl
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [r15 + 0x10], xmm1
mov rax, r15
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.180096010
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800902b0
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18014a010]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov rsi, rdx
lea rax, [rsp + 0x30]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x20]
xor r8d, r8d
lea edx, [r9 + 0x15]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800903ac
mov ecx, dword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
call fcn.1800caa98
mov rcx, qword [rdi + 0x20]
mov rbx, rax
xor r8d, r8d
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x15]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x180090396
test rbx, rbx
je 0x180090377
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x180090350
mov rdx, rbx
mov rcx, rsi
call fcn.180018c50
mov rcx, rbx
mov dil, 1
call fcn.1800ca7c8
movzx eax, dil
jmp 0x180090379
xor al, al
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180096010
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor dil, dil
test rbx, rbx
je 0x1800903a6
mov rcx, rbx
call fcn.1800ca7c8
movzx eax, dil
jmp 0x180090379
xor al, al
jmp 0x18009037e