joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1800014a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001710
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, rdx
mov rsi, rdx
sub r10, rcx
mov rbx, rcx
mov r8, rcx
mov r11d, 4
nop dword [rax]
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [r10 + r8 + 0xe0]
xor byte [r8], al
inc r8
sub r9, 1
jne 0x180001750
sub r11, 1
jne 0x180001740
mov dil, 0xd
lea rbp, [0x180022a30]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
nop word [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + rbp]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1800017f0
inc r8
sub r9, 1
jne 0x1800017e0
movzx r8d, dil
lea r9d, [rdx + 4]
shl r8, 4
mov rax, rbx
sub r8, rbx
add r8, rsi
nop dword [rax]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x180001840
sub r9, 1
jne 0x180001830
test dil, dil
je 0x18000186c
mov rcx, rbx
call fcn.180001470
add dil, 0xff
jmp 0x180001775
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002c20
Capabilities:
Check if file exists
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x830]
sub rsp, 0x930
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rbp + 0x820], rax
mov r8d, 0x104
lea rdx, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp - 0x20]
call fcn.1800086e4
xor ebx, ebx
test rax, rax
je 0x180002c70
mov word [rax], bx
lea r9, [rbp - 0x20]
mov edx, 0x104
lea r8, str._s_ts
lea rcx, [rbp + 0x400]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r9, [rbp - 0x20]
mov edx, 0x104
lea r8, str._s_st
lea rcx, [rbp + 0x610]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rcx, [rbp + 0x400]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180002dff
xorps xmm0, xmm0
lea rcx, [rbp + 0x1f0]
xor eax, eax
xor edx, edx
mov r8d, 0x208
mov qword [rbp - 0x30], rax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.180008b40
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x400]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea rcx, [rbp + 0x610]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180002da0
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x610]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rbp + 0x1f0]
call fcn.180001ee0
nop dword [rax]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x1f0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov rcx, qword [rsp + 0x50]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x180002da0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rcx, [rbp + 0x400]
call fcn.180002740
int3
Function at 0x180005740
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword gs:[0x60]
mov rdi, rcx
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x1800057b2
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x1800057aa
test rdi, rdi
je 0x1800057bf
mov r10, rdi
sub r10, rax
nop word [rax + rax]
movzx edx, word [r10 + rax]
movzx ecx, word [rax]
cmp dx, cx
je 0x18000579f
mov r9d, ecx
add ecx, 0xffffffe0
cmp edx, ecx
je 0x18000579f
lea ecx, [r9 + 0x20]
cmp edx, ecx
jne 0x1800057aa
test dx, dx
je 0x1800057bf
add rax, 2
jmp 0x180005780
mov r11, qword [r11]
cmp r11, rbx
jne 0x180005766
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rax, qword [r11 + 0x20]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800057d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebx, ebx
mov eax, 0x5a4d
mov rbp, rdx
mov rsi, rcx
mov r8d, ebx
cmp word [rcx], ax
jne 0x18000582c
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x18000582c
lea r8, [rcx + 0x18]
add r8, rax
mov eax, dword [r8 + 0x70]
add rax, rsi
mov edi, dword [rax + 0x20]
mov r15d, dword [rax + 0x1c]
add rdi, rsi
mov r12d, dword [rax + 0x24]
add r15, rsi
mov r14d, dword [rax + 0x18]
add r12, rsi
test r14d, r14d
je 0x1800058f9
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x22]
mov r8d, 0x1fe
call fcn.180008b40
mov edx, dword [rdi]
lea r8, [rsp + 0x20]
add rdx, rsi
mov ecx, 0xff
movsx eax, byte [rdx]
lea rdx, [rdx + 1]
mov word [r8], ax
lea r8, [r8 + 2]
mov r9d, ecx
test ax, ax
je 0x1800058a4
sub ecx, 1
jns 0x180005881
mov ecx, 0x101
jmp 0x1800058a9
mov ecx, 0xff
sub rcx, r9
test rcx, rcx
je 0x1800058f9
lea r10, [rsp + 0x20]
mov rax, rbp
sub r10, rbp
nop dword [rax]
movzx edx, word [r10 + rax]
movzx ecx, word [rax]
cmp dx, cx
je 0x1800058df
mov r8d, ecx
add ecx, 0xffffffe0
cmp edx, ecx
je 0x1800058df
lea ecx, [r8 + 0x20]
cmp edx, ecx
jne 0x1800058ea
test dx, dx
je 0x18000592d
add rax, 2
jmp 0x1800058c0
inc ebx
add rdi, 4
cmp ebx, r14d
jb 0x180005860
xor eax, eax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180006c10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov eax, ebx
movzx ecx, word [r12 + rax*2]
mov eax, dword [r15 + rcx*4]
add rax, rsi
jmp 0x1800058fb
Function at 0x180005940
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x1800059d6
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x1800059ce
lea r10, str.Winhttp.dll
sub r10, rax
nop dword [rax]
movzx edx, word [r10 + rax]
movzx ecx, word [rax]
cmp dx, cx
je 0x1800059bf
mov r9d, ecx
add ecx, 0xffffffe0
cmp edx, ecx
je 0x1800059bf
lea ecx, [r9 + 0x20]
cmp edx, ecx
jne 0x1800059ce
test dx, dx
je 0x180005a74
add rax, 2
jmp 0x1800059a0
mov r11, qword [r11]
cmp r11, rbx
jne 0x180005986
xor ebx, ebx
xor ecx, ecx
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1800059f8
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x1800059f8
lea rcx, [rbx + 0x18]
add rcx, rax
mov eax, dword [rcx + 0x70]
xor edi, edi
add rax, rbx
mov qword [rsp + 0x250], r12
mov esi, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r15d, dword [rax + 0x24]
add r14, rbx
mov ebp, dword [rax + 0x18]
add r15, rbx
test ebp, ebp
je 0x180005aca
lea r12, str.WinHttpOpen
nop
xor edx, edx
lea rcx, [rsp + 0x22]
mov r8d, 0x1fe
call fcn.180008b40
mov edx, dword [rsi]
lea r8, [rsp + 0x20]
add rdx, rbx
mov ecx, 0xff
movsx eax, byte [rdx]
lea rdx, [rdx + 1]
mov word [r8], ax
lea r8, [r8 + 2]
mov r9d, ecx
test ax, ax
je 0x180005a7d
sub ecx, 1
jns 0x180005a51
mov ecx, 0x101
jmp 0x180005a82
mov rbx, qword [r11 + 0x20]
jmp 0x1800059d8
mov ecx, 0xff
sub rcx, r9
test rcx, rcx
je 0x180005aca
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx + 0x20]
movzx eax, word [rcx + r12]
cmp dx, ax
je 0x180005ab1
mov r9d, eax
add eax, 0xffffffe0
cmp edx, eax
je 0x180005ab1
lea eax, [r9 + 0x20]
cmp edx, eax
jne 0x180005abc
test dx, dx
je 0x180005b0a
add rcx, 2
jmp 0x180005a90
inc edi
add rsi, 4
cmp edi, ebp
jb 0x180005a30
mov qword [0x180027fa8], 0
mov r12, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180006c10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [r15 + rdi*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
mov qword [0x180027fa8], rax
jmp 0x180005ad5
Function at 0x180005b20
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180005bb6
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x180005bae
lea r10, str.Winhttp.dll
sub r10, rax
nop dword [rax]
movzx edx, word [r10 + rax]
movzx ecx, word [rax]
cmp dx, cx
je 0x180005b9f
mov r9d, ecx
add ecx, 0xffffffe0
cmp edx, ecx
je 0x180005b9f
lea ecx, [r9 + 0x20]
cmp edx, ecx
jne 0x180005bae
test dx, dx
je 0x180005c54
add rax, 2
jmp 0x180005b80
mov r11, qword [r11]
cmp r11, rbx
jne 0x180005b66
xor ebx, ebx
xor ecx, ecx
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180005bd8
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x180005bd8
lea rcx, [rbx + 0x18]
add rcx, rax
mov eax, dword [rcx + 0x70]
xor edi, edi
add rax, rbx
mov qword [rsp + 0x250], r12
mov esi, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r15d, dword [rax + 0x24]
add r14, rbx
mov ebp, dword [rax + 0x18]
add r15, rbx
test ebp, ebp
je 0x180005caa
lea r12, str.WinHttpConnect
nop
xor edx, edx
lea rcx, [rsp + 0x22]
mov r8d, 0x1fe
call fcn.180008b40
mov edx, dword [rsi]
lea r8, [rsp + 0x20]
add rdx, rbx
mov ecx, 0xff
movsx eax, byte [rdx]
lea rdx, [rdx + 1]
mov word [r8], ax
lea r8, [r8 + 2]
mov r9d, ecx
test ax, ax
je 0x180005c5d
sub ecx, 1
jns 0x180005c31
mov ecx, 0x101
jmp 0x180005c62
mov rbx, qword [r11 + 0x20]
jmp 0x180005bb8
mov ecx, 0xff
sub rcx, r9
test rcx, rcx
je 0x180005caa
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx + 0x20]
movzx eax, word [rcx + r12]
cmp dx, ax
je 0x180005c91
mov r9d, eax
add eax, 0xffffffe0
cmp edx, eax
je 0x180005c91
lea eax, [r9 + 0x20]
cmp edx, eax
jne 0x180005c9c
test dx, dx
je 0x180005cea
add rcx, 2
jmp 0x180005c70
inc edi
add rsi, 4
cmp edi, ebp
jb 0x180005c10
mov qword [0x180027fc0], 0
mov r12, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180006c10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [r15 + rdi*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
mov qword [0x180027fc0], rax
jmp 0x180005cb5
Function at 0x180005d00
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180005d96
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x180005d8e
lea r10, str.Winhttp.dll
sub r10, rax
nop dword [rax]
movzx edx, word [r10 + rax]
movzx ecx, word [rax]
cmp dx, cx
je 0x180005d7f
mov r9d, ecx
add ecx, 0xffffffe0
cmp edx, ecx
je 0x180005d7f
lea ecx, [r9 + 0x20]
cmp edx, ecx
jne 0x180005d8e
test dx, dx
je 0x180005e34
add rax, 2
jmp 0x180005d60
mov r11, qword [r11]
cmp r11, rbx
jne 0x180005d46
xor ebx, ebx
xor ecx, ecx
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180005db8
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x180005db8
lea rcx, [rbx + 0x18]
add rcx, rax
mov eax, dword [rcx + 0x70]
xor edi, edi
add rax, rbx
mov qword [rsp + 0x250], r12
mov esi, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r15d, dword [rax + 0x24]
add r14, rbx
mov ebp, dword [rax + 0x18]
add r15, rbx
test ebp, ebp
je 0x180005e8a
lea r12, str.WinHttpOpenRequest
nop
xor edx, edx
lea rcx, [rsp + 0x22]
mov r8d, 0x1fe
call fcn.180008b40
mov edx, dword [rsi]
lea r8, [rsp + 0x20]
add rdx, rbx
mov ecx, 0xff
movsx eax, byte [rdx]
lea rdx, [rdx + 1]
mov word [r8], ax
lea r8, [r8 + 2]
mov r9d, ecx
test ax, ax
je 0x180005e3d
sub ecx, 1
jns 0x180005e11
mov ecx, 0x101
jmp 0x180005e42
mov rbx, qword [r11 + 0x20]
jmp 0x180005d98
mov ecx, 0xff
sub rcx, r9
test rcx, rcx
je 0x180005e8a
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx + 0x20]
movzx eax, word [rcx + r12]
cmp dx, ax
je 0x180005e71
mov r9d, eax
add eax, 0xffffffe0
cmp edx, eax
je 0x180005e71
lea eax, [r9 + 0x20]
cmp edx, eax
jne 0x180005e7c
test dx, dx
je 0x180005eca
add rcx, 2
jmp 0x180005e50
inc edi
add rsi, 4
cmp edi, ebp
jb 0x180005df0
mov qword [0x180027fb8], 0
mov r12, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180006c10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [r15 + rdi*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
mov qword [0x180027fb8], rax
jmp 0x180005e95
Function at 0x180005ee0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180005f76
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x180005f6e
lea r10, str.Winhttp.dll
sub r10, rax
nop dword [rax]
movzx edx, word [r10 + rax]
movzx ecx, word [rax]
cmp dx, cx
je 0x180005f5f
mov r9d, ecx
add ecx, 0xffffffe0
cmp edx, ecx
je 0x180005f5f
lea ecx, [r9 + 0x20]
cmp edx, ecx
jne 0x180005f6e
test dx, dx
je 0x180006014
add rax, 2
jmp 0x180005f40
mov r11, qword [r11]
cmp r11, rbx
jne 0x180005f26
xor ebx, ebx
xor ecx, ecx
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180005f98
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x180005f98
lea rcx, [rbx + 0x18]
add rcx, rax
mov eax, dword [rcx + 0x70]
xor edi, edi
add rax, rbx
mov qword [rsp + 0x250], r12
mov esi, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r15d, dword [rax + 0x24]
add r14, rbx
mov ebp, dword [rax + 0x18]
add r15, rbx
test ebp, ebp
je 0x18000606a
lea r12, str.WinHttpSendRequest
nop
xor edx, edx
lea rcx, [rsp + 0x22]
mov r8d, 0x1fe
call fcn.180008b40
mov edx, dword [rsi]
lea r8, [rsp + 0x20]
add rdx, rbx
mov ecx, 0xff
movsx eax, byte [rdx]
lea rdx, [rdx + 1]
mov word [r8], ax
lea r8, [r8 + 2]
mov r9d, ecx
test ax, ax
je 0x18000601d
sub ecx, 1
jns 0x180005ff1
mov ecx, 0x101
jmp 0x180006022
mov rbx, qword [r11 + 0x20]
jmp 0x180005f78
mov ecx, 0xff
sub rcx, r9
test rcx, rcx
je 0x18000606a
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx + 0x20]
movzx eax, word [rcx + r12]
cmp dx, ax
je 0x180006051
mov r9d, eax
add eax, 0xffffffe0
cmp edx, eax
je 0x180006051
lea eax, [r9 + 0x20]
cmp edx, eax
jne 0x18000605c
test dx, dx
je 0x1800060aa
add rcx, 2
jmp 0x180006030
inc edi
add rsi, 4
cmp edi, ebp
jb 0x180005fd0
mov qword [0x180027fc8], 0
mov r12, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180006c10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [r15 + rdi*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
mov qword [0x180027fc8], rax
jmp 0x180006075
Function at 0x1800060c0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x180006156
mov rax, qword [r11 + 0x50]
test rax, rax
je 0x18000614e
lea r10, str.Winhttp.dll
sub r10, rax
nop dword [rax]
movzx edx, word [r10 + rax]
movzx ecx, word [rax]
cmp dx, cx
je 0x18000613f
mov r9d, ecx
add ecx, 0xffffffe0
cmp edx, ecx
je 0x18000613f
lea ecx, [r9 + 0x20]
cmp edx, ecx
jne 0x18000614e
test dx, dx
je 0x1800061f4
add rax, 2
jmp 0x180006120
mov r11, qword [r11]
cmp r11, rbx
jne 0x180006106
xor ebx, ebx
xor ecx, ecx
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180006178
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x180006178
lea rcx, [rbx + 0x18]
add rcx, rax
mov eax, dword [rcx + 0x70]
xor edi, edi
add rax, rbx
mov qword [rsp + 0x250], r12
mov esi, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r15d, dword [rax + 0x24]
add r14, rbx
mov ebp, dword [rax + 0x18]
add r15, rbx
test ebp, ebp
je 0x18000624a
lea r12, str.WinHttpReceiveResponse
nop
xor edx, edx
lea rcx, [rsp + 0x22]
mov r8d, 0x1fe
call fcn.180008b40
mov edx, dword [rsi]
lea r8, [rsp + 0x20]
add rdx, rbx
mov ecx, 0xff
movsx eax, byte [rdx]
lea rdx, [rdx + 1]
mov word [r8], ax
lea r8, [r8 + 2]
mov r9d, ecx
test ax, ax
je 0x1800061fd
sub ecx, 1
jns 0x1800061d1
mov ecx, 0x101
jmp 0x180006202
mov rbx, qword [r11 + 0x20]
jmp 0x180006158
mov ecx, 0xff
sub rcx, r9
test rcx, rcx
je 0x18000624a
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx + 0x20]
movzx eax, word [rcx + r12]
cmp dx, ax
je 0x180006231
mov r9d, eax
add eax, 0xffffffe0
cmp edx, eax
je 0x180006231
lea eax, [r9 + 0x20]
cmp edx, eax
jne 0x18000623c
test dx, dx
je 0x18000628a
add rcx, 2
jmp 0x180006210
inc edi
add rsi, 4
cmp edi, ebp
jb 0x1800061b0
mov qword [0x180027fb0], 0
mov r12, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180006c10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [r15 + rdi*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
mov qword [0x180027fb0], rax
jmp 0x180006255