joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ecab0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push r13
sub rsp, 0x40
test rdx, rdx
mov r13d, r9d
mov rbx, r8
mov rbp, rdx
jne 0x1400ecaf1
mov rdx, qword [r8]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecae6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x40
pop r13
pop rbp
pop rbx
ret
mov rdx, qword [r8]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rdi
lea rdi, [0x14019cf88]
mov ecx, 1
mov rsi, rdx
repe cmpsw word [rsi], word [rdi]
jne 0x1400ecb35
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecb2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400ecc91
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], r12
mov r12d, dword [rsp + 0x80]
mov r9d, r12d
xor edi, edi
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
or r9d, 0x2001f
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ecb79
mov rdi, qword [rsp + 0x30]
xor esi, esi
test eax, eax
sete sil
test rdi, rdi
je 0x1400ecb8f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1400ecba9
mov r8d, r12d
mov rdx, rbp
mov rcx, 0xffffffff80000002
call fcn.1400ed800
test eax, eax
je 0x1400ecc21
lea rax, [rsp + 0x38]
or r12d, 2
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov r9d, r12d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ecc6b
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rbx]
lea rax, [rsp + 0x68]
mov rcx, rdi
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x68], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ecc37
test rdi, rdi
je 0x1400ecc21
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jmp 0x1400ecc7f
test rdi, rdi
je 0x1400ecc45
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecc64
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x1400ecc8c
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecc8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop rbp
pop rbx
ret
Function at 0x1400ecdc0
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov edi, r8d
mov rbx, rcx
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.1400ed630
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ecec8
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ece8f
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ece7b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ece8b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400eceec
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400eceb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ecec1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400eceec
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400eceea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400ed030
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov edi, r8d
mov rbx, rcx
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.1400ed630
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ed18f
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ed0ef
cmp dword [rsp + 0x34], 4
jne 0x1400ed0ef
cmp dword [rsp + 0x88], edi
je 0x1400ed156
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ed156
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed142
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ed152
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ed1b3
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed178
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ed188
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400ed1b3
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed1b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400ed460
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov edi, r8d
mov rbx, rcx
test rcx, rcx
jne 0x1400ed48e
xor eax, eax
jmp 0x1400ed5f1
xor esi, esi
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x58]
call fcn.1400ed630
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ed4d5
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rcx
jmp 0x1400ed52a
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400ed5cd
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x90], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ed594
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed580
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ed590
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ed5f1
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed5b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ed5c6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400ed5f1
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed5ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400edcd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x10080
call fcn.140181870
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x100b8], rbx
mov rax, qword [0x140210348]
xor rax, rsp
mov qword [rsp + 0x10070], rax
mov r13, r9
mov r12, r8
mov rbp, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x60], r9
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov qword [rsp + 0x48], rbx
call fcn.14013d07c
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x1400edd4a
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, [0x14019cf88]
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400edd8b
movzx edi, dx
mov ecx, edi
call fcn.14013d654
test rax, rax
je 0x1400edda6
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call fcn.1400020e0
jmp 0x1400edda6
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.140002390
nop
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ede6e
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], 0xfffe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r13]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ede6e
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x1400ede2c
cmp eax, 2
jne 0x1400ede6e
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400ede45
test al, 1
jne 0x1400ede6e
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x1400ede4c
jmp 0x1400ede6e
mov word [rsp + 0x70], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.140002390
nop
test rbx, rbx
je 0x1400ede7d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ede9d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400edeba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbp
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14015d000
mov rbx, qword [rsp + 0x100b8]
add rsp, 0x10080
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f0580
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r12
push r13
push r14
sub rsp, 0x58
xor r14d, r14d
mov r13, rcx
mov rcx, qword [rcx]
test rcx, rcx
mov rbp, r9
mov r12, rdx
mov dword [rsp + 0x80], r14d
jne 0x1400f05b9
mov eax, 0xc0000008
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbp
ret
test rdx, rdx
mov qword [rsp + 0x90], rsi
je 0x1400f06e9
test r9, r9
je 0x1400f06e9
mov rsi, qword [rsp + 0xa0]
test rsi, rsi
je 0x1400f06e9
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
lea r8d, [r9 + 0xc]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
js 0x1400f067a
mov qword [rsp + 0x88], rbx
mov ebx, dword [rsp + 0x80]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
jne 0x1400f068e
mov ebx, 0xc0000017
test rdi, rdi
je 0x1400f066b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x90]
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [r13]
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x80]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rdi
lea r8d, [r9 + 0xc]
mov rdx, r12
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
mov ebx, eax
js 0x1400f0652
mov ecx, dword [rsp + 0x80]
mov qword [rbp], rdi
mov dword [rsi], ecx
jmp 0x1400f066d
mov eax, 0xc000000d
jmp 0x1400f067a
Function at 0x1400f0f20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0xa4], edi
je 0x1400f0f44
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
add rcx, 0xa8
mov qword [rsp + 0x40], rsi
call fcn.1400f1730
test eax, eax
jns 0x1400f0f70
mov rsi, qword [rsp + 0x40]
mov edi, 0x80004005
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0xd8], rax
je 0x1400f1044
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0xc8], rax
je 0x1400f1044
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0xd0], rax
je 0x1400f1044
lea r8, [0x1400f1060]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0xc0], rax
je 0x1400f1044
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x1400f1044
mov rax, qword [rcx]
mov rdx, qword [rbx + 0xd0]
call qword [rax + 0x18]
test eax, eax
js 0x1400f1044
mov dword [rbx + 0xe8], 1
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x1400f1044
mov r8, qword [rcx]
mov rdx, qword [rbx + 0xc8]
call qword [r8 + 0x30]
test eax, eax
js 0x1400f1044
mov dword [rbx + 0xec], 1
mov rsi, qword [rsp + 0x40]
mov dword [rbx + 0xa4], 1
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400f1940
Capabilities:
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x40], r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
call fcn.1401495d0
nop
lea rax, [0x1401b6188]
mov qword [rbx], rax
lea rax, vtable.k.1.0
mov qword [rbx + 0x40], rax
call fcn.14013d07c
mov rcx, rax
xor esi, esi
mov eax, esi
test rcx, rcx
setne al
test eax, eax
jne 0x1400f19ad
mov ecx, 0x80004005
call fcn.140001c00
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x48], rax
lea r12, [rbx + 0x60]
mov qword [r12], rsi
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x78], rsi
lea rdi, [rbx + 0x80]
mov esi, 4
nop
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
add rdi, 8
sub rsi, 1
jne 0x1400f19e0
test rbp, rbp
jne 0x1400f1a06
xor ecx, ecx
jmp 0x1400f1a19
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rbx + 0x48]
call fcn.140002390
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
mov dword [rbx + 0x50], eax
mov eax, dword [rcx + 4]
mov dword [rbx + 0x54], eax
mov eax, dword [rcx + 8]
mov dword [rbx + 0x58], eax
mov eax, dword [rcx + 0xc]
mov dword [rbx + 0x5c], eax
mov qword [rsp + 0x20], r12
lea r9, [0x1401ae630]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1401ae620]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400f1b15
mov rcx, qword [r12]
mov rax, qword [rcx]
lea rdx, [rbx + 0x40]
call qword [rax + 0x30]
test eax, eax
js 0x1400f1b15
xor ebp, ebp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1400f21b0]
call fcn.14014d1a0
mov rsi, rax
test rax, rax
je 0x1400f1b15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
lea r9, [rbx + 0x78]
mov r8, rdi
mov rdx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call fcn.1400f2090
test eax, eax
je 0x1400f1b15
mov rcx, rbx
call fcn.1400f2090
test eax, eax
je 0x1400f1b15
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1400f1b15
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov rax, rbx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f2bf0
Capabilities:
Check http status code

Disassembly:
push rbx
sub rsp, 0xa0
test rdx, rdx
mov rbx, rcx
je 0x1400f2e5f
mov qword [rcx + 0x20], rdx
call fcn.1400555b0
mov rcx, qword [rbx + 0x20]
mov rax, qword [rcx]
lea rdx, [rbx + 0x30]
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x30]
add rdx, 0x304
mov r8d, 0x64
call fcn.140161150
mov r11, qword [rsp + 0x30]
shr r11, 0x20
test r11b, 1
je 0x1400f2c4d
bt r11d, 0xb
jae 0x1400f2c7b
test r11b, 8
je 0x1400f2c5a
bt r11d, 0xe
jae 0x1400f2c7b
test r11b, 2
je 0x1400f2c67
bt r11d, 0xc
jae 0x1400f2c7b
test r11b, 4
je 0x1400f2c74
bt r11d, 0xd
jae 0x1400f2c7b
mov dword [rbx + 0x28], 1
mov rax, qword [0x14022e6d8]
add dword [rax + 0x1d60], 1
test rax, rax
je 0x1400f2e51
cmp dword [rax + 0x168], 0x11
mov r8, qword [0x1402123f8]
jne 0x1400f2ceb
lea rdx, [0x1402129d0]
cmp r8, rdx
je 0x1400f2ceb
mov ecx, dword [rax + 0x178]
cmp ecx, 0xc8
je 0x1400f2ccc
cmp ecx, 0xcb
je 0x1400f2ccc
cmp ecx, 0xcc
jne 0x1400f2ceb
mov dword [0x140211e1c], 0xe
mov qword [0x1402123f8], rdx
mov eax, 1
add rsp, 0xa0
pop rbx
ret
mov edx, dword [rax + 0x1a0]
lea r9, [0x140212ab0]
shr edx, 3
and edx, 1
je 0x1400f2d47
cmp r8, r9
je 0x1400f2d47
bt dword [rax + 0x548], 9
jae 0x1400f2d47
lea rax, [0x140212b60]
mov rcx, rbx
mov dword [rbx + 0xac], 1
mov qword [0x1402123f8], rax
mov dword [0x140211e1c], 4
call fcn.1400f5c20
mov eax, 1
add rsp, 0xa0
pop rbx
ret
mov ecx, dword [rax + 0x548]
bt ecx, 0xc
jb 0x1400f2d9b
bt ecx, 0xb
jb 0x1400f2d9b
bt ecx, 0xf
jb 0x1400f2d9b
bt ecx, 0x10
jb 0x1400f2d9b
bt ecx, 0x13
jb 0x1400f2d9b
test edx, edx
je 0x1400f2e51
cmp r8, r9
je 0x1400f2e51
mov dword [0x140211e1c], 0xb
mov qword [0x1402123f8], r9
mov eax, 1
add rsp, 0xa0
pop rbx
ret
lea rax, [0x140212ba0]
lea rcx, [rbx + 0x80]
xor edx, edx
mov qword [0x1402123f8], rax
xor eax, eax
mov dword [0x140211e1c], 0xc
lea r8d, [rax + 0x28]
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0xc0], rax
call fcn.140160e90
lea r11, [rsp + 0xb8]
lea r9, [rsp + 0xc0]
lea r8, str.UniqueCustomEQ
lea rdx, [0x1401b62c0]
lea rcx, [0x14022e890]
mov qword [rsp + 0x20], r11
call fcn.14014c020
test eax, eax
je 0x1400f2e51
cmp dword [rsp + 0xb8], 0x28
jne 0x1400f2e51
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx]
mov qword [rbx + 0x80], rcx
mov rcx, qword [rdx + 8]
mov qword [rbx + 0x88], rcx
mov rcx, qword [rdx + 0x10]
mov qword [rbx + 0x90], rcx
mov rcx, qword [rdx + 0x18]
mov qword [rbx + 0x98], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rbx + 0xa0], rcx
mov eax, 1
add rsp, 0xa0
pop rbx
ret
xor eax, eax
add rsp, 0xa0
pop rbx
ret
Function at 0x1400f7d80
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movaps xmmword [rax - 0x18], xmm6
mov rbp, r9
cmp edx, 0x21010093
jne 0x1400f7f17
xorps xmm6, xmm6
movss dword [rax - 0x40], xmm6
xor eax, eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
lea rbx, [rcx - 0xb8]
cmp qword [rbx + 0x78], rax
jne 0x1400f7df6
lea edx, [rax + 1]
mov rcx, rbx
call fcn.1400f5f00
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400f7e67
mov qword [rsp + 0x20], 0x28
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
xor esi, esi
test rax, rax
setne sil
test esi, esi
je 0x1400f7e43
lea rcx, [rsp + 0x38]
mov rdx, rax
mov r8d, 0x28
call fcn.140161150
movss xmm6, dword [rsp + 0x38]
jmp 0x1400f7e5a
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400f7e5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x78], 0
test esi, esi
je 0x1400f7e67
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movss xmm2, dword [0x1401c6138]
mulss xmm6, xmm2
cvttss2si eax, xmm6
mov dword [rbp], eax
movss xmm0, dword [rsp + 0x3c]
mulss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [rbp + 4], eax
movss xmm1, dword [rsp + 0x40]
mulss xmm1, xmm2
cvttss2si eax, xmm1
mov dword [rbp + 8], eax
movss xmm0, dword [rsp + 0x44]
mulss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [rbp + 0xc], eax
movss xmm1, dword [rsp + 0x48]
mulss xmm1, xmm2
cvttss2si eax, xmm1
mov dword [rbp + 0x10], eax
movss xmm0, dword [rsp + 0x4c]
mulss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [rbp + 0x14], eax
movss xmm1, dword [rsp + 0x50]
mulss xmm1, xmm2
cvttss2si eax, xmm1
mov dword [rbp + 0x18], eax
movss xmm0, dword [rsp + 0x54]
mulss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [rbp + 0x1c], eax
movss xmm1, dword [rsp + 0x58]
mulss xmm1, xmm2
cvttss2si eax, xmm1
mov dword [rbp + 0x20], eax
movss xmm0, dword [rsp + 0x5c]
mulss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [rbp + 0x24], eax
xor eax, eax
jmp 0x1400f7f19
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop rdi
ret