joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d730
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0044bf34], 0
je 0x40d76b
mov ecx, dword [0x00441264]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40d77f
call fcn.0040d610
mov ecx, dword [0x00441264]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40d77f
mov rax, qword [0x0044bf70]
jmp 0x40d77f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x00441264]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x41ea60
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41ea87
movzx rax, word [rbp + 0x2c]
jmp 0x41ea89
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x420360
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00420100
mov ebx, eax
mov rax, qword [0x00446240]
cmp byte [rax], 0
je 0x420498
mov rcx, qword [0x00446068]
call fcn.00405720
call fcn.00405250
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00420320]
mov r8d, 1
movsxd r9, esi
call fcn.0040ae30
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x00420538]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x4204de
mov rcx, qword [0x0044bf38]
call fcn.0040b160
mov rcx, rax
mov rax, qword [0x00446018]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00420320]
call fcn.0040b010
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x422cb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.00409410
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.0040d2e0
mov esi, eax
cmp esi, 0x104
jbe 0x422d0d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00404f40
mov rdi, rax
jmp 0x422d11
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.0040d2e0
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x422d64
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x422d48
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x422d76
mov rcx, rdi
call fcn.00404f70
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x427870
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rbx
mov r9d, edx
test r9d, r9d
jle 0x42797b
mov eax, ecx
test eax, 1
je 0x4278b8
lea rax, [0x00443338]
mov edx, r8d
shr edx, 0x10
movzx r10, byte [rcx]
xor edx, r10d
and edx, 0xff
mov edx, edx
shl r8d, 8
mov eax, dword [rax + rdx*4]
xor eax, r8d
mov r8d, eax
add rcx, 1
sub r9d, 1
xor r10, r10
mov r11d, 2
mov eax, r9d
cdq
idiv r11d
mov r11, rax
sub r11d, 1
mov eax, r10d
cmp eax, r11d
jg 0x427938
add r11d, 1
movsxd rdx, eax
movzx edx, word [rcx + rdx*2]
lea r10, [0x00443338]
mov ebx, r8d
shr ebx, 0x10
xor ebx, edx
and ebx, 0xff
mov ebx, ebx
shl r8d, 8
mov r10d, dword [r10 + rbx*4]
xor r10d, r8d
mov r8d, r10d
lea r10, [0x00443338]
mov ebx, r8d
shr ebx, 0x10
shr edx, 8
xor ebx, edx
and ebx, 0xff
mov ebx, ebx
shl r8d, 8
mov edx, dword [r10 + rbx*4]
xor edx, r8d
mov r8d, edx
add eax, 1
cmp eax, r11d
jne 0x4278dc
nop
mov eax, r9d
test eax, 1
je 0x427974
lea rax, [0x00443338]
mov edx, r8d
shr edx, 0x10
and r9d, 0xfffffffe
movsxd r9, r9d
movzx rcx, byte [rcx + r9]
xor edx, ecx
and edx, 0xff
mov edx, edx
shl r8d, 8
mov eax, dword [rax + rdx*4]
xor eax, r8d
mov r8d, eax
and r8d, 0xffffff
mov eax, r8d
pop rbx
ret

Function at 0x427ca0
Capabilities:
Hash data with md5

Disassembly:
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov qword [rcx + 0x18], 0
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140013000
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011280
Capabilities:
Execute command
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x1400118d0
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x498], rax
lea rcx, [0x1400230a8]
call fcn.14001138e
nop
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140011937
lea rcx, str.Failed_to_initialize_Winsock._n
call fcn.14001119f
nop
mov eax, 1
jmp 0x140011a20
mov edx, 0x100
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x140011974
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_getting_hostname:__d_n
call fcn.14001119f
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov eax, 1
jmp 0x140011a20
lea rdx, [rbp + 0x1d0]
lea rcx, str.Hostname:__s_n
call fcn.14001119f
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x2e8], rax
cmp qword [rbp + 0x2e8], 0
jne 0x1400119c9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_getting_host_info:__d_n
call fcn.14001119f
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov eax, 1
jmp 0x140011a20
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x2e8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov eax, dword [rax]
mov dword [rbp + 0x304], eax
mov ecx, dword [rbp + 0x304]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, str.IP_Address:__s_n
call fcn.14001119f
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
jmp 0x140011a1e
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad10]
call fcn.140011320
mov rax, rdi
mov rcx, qword [rbp + 0x498]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x4a8]
pop rdi
pop rbp
ret
Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014350
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014370
xor al, al
jmp 0x1400143f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014383
xor al, al
jmp 0x1400143f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400143ad
xor al, al
jmp 0x1400143f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400143c1
xor al, al
jmp 0x1400143f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400143d3
xor al, al
jmp 0x1400143f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400143ef
xor al, al
jmp 0x1400143f1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012240
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140012260
mov ecx, 7
call fcn.14001132a
nop
mov byte [rsp + 0x20], 0
call fcn.14001133e
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x140012284
mov ecx, 7
call fcn.14001132a
nop
jmp 0x1400122dc
cmp dword [0x14001d868], 0
jne 0x1400122d7
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111a4
test eax, eax
je 0x1400122b8
mov eax, 0xff
jmp 0x1400123e1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011334
mov dword [0x14001d868], 2
jmp 0x1400122dc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011316
call fcn.1400112ad
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012339
mov rcx, qword [rsp + 0x30]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140012339
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.1400112e4
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001236d
mov rcx, qword [rsp + 0x38]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x14001236d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011375
nop
call fcn.140012490
mov dword [rsp + 0x28], eax
call fcn.14001128a
movzx eax, al
test eax, eax
jne 0x14001238c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001239b
call fcn.14001137f
nop
xor edx, edx
mov cl, 1
call fcn.140011140
mov eax, dword [rsp + 0x28]
jmp 0x1400123e1
add rsp, 0x68
ret
Function at 0x1400022cc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140002418
xor ecx, ecx
call qword [sym.imp.dcntel.dll_SetCustomTrigger]
nop dword [rax + rax]
lea r9, str.WNF_CSHL_PRODUCT_READY
xor ecx, ecx
lea r8, str.Device_Census_Gather
lea rdx, str.MicrosoftWindowsApplication_Experience
call qword [sym.imp.dcntel.dll_SetCustomTriggerEx]
nop dword [rax + rax]
and dword [rsp + 0x44], 0
lea rcx, [rsp + 0x50]
and dword [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x20a
call sub.msvcrt.dll_memset
mov edx, 0x105
lea rcx, [rsp + 0x50]
call qword [sym.imp.dcntel.dll_GetCensusRegistryLocation]
nop dword [rax + rax]
test eax, eax
js 0x14000240c
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rax
lea r8, str.RunCounter
lea rax, [rsp + 0x44]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14000240c
cmp dword [rsp + 0x44], 2
jb 0x14000240c
lea r9, str.WNF_SHEL_OOBE_USER_LOGON_COMPLETE
xor ecx, ecx
lea r8, str.Device
lea rdx, str.MicrosoftWindowsDevice_Information
call qword [sym.imp.dcntel.dll_SetCustomTriggerEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x14000240c
lea r9, str.WNF_SHEL_OOBE_USER_LOGON_COMPLETE
xor ecx, ecx
lea r8, str.Device_Census_Gather
lea rdx, str.MicrosoftWindowsApplication_Experience
call qword [sym.imp.dcntel.dll_SetCustomTriggerEx]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140015530
add rsp, 0x270
pop rbx
ret
Function at 0x14000243c
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov eax, dword [rcx]
xor edx, edx
and qword [rsp + 0x58], 0
lea rcx, [rsp + 0x60]
mov r8d, 0x20a
mov dword [rsp + 0x50], eax
call sub.msvcrt.dll_memset
mov edx, 0x105
lea rcx, [rsp + 0x60]
call qword [sym.imp.dcntel.dll_GetCensusRegistryLocation]
nop dword [rax + rax]
test eax, eax
js 0x140002500
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140002500
mov rcx, qword [rsp + 0x58]
lea r9d, [rax + 4]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ReturnCode
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140002516
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140015530
add rsp, 0x288
ret
Function at 0x14000297c
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor ebx, ebx
cmp byte [0x140020824], bl
jne 0x140002a14
call fcn.140009940
test al, al
jne 0x140002a0d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x30], rax
lea r8, str.CommercialDataOptIn
lea rax, [rsp + 0x40]
mov r9d, 0x20000018
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesDataCollection
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp dword [rsp + 0x40], ebx
setne byte [0x140020825]
mov byte [0x140020824], 1
cmp byte [0x140020825], bl
jne 0x140002b22
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [rsp + 0x54]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x44], eax
mov esi, 0x104
mov eax, dword [rsp + 0x50]
mov edx, esi
mov dword [rsp + 0x40], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x140002a90
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
mov r8d, 0x42a
lea r9, str.GetSystemDirectoryW_failed___d_
lea rdx, str.TelemetryController::IsProviderEndOfService
mov ecx, 1
call fcn.14000c024
jmp 0x140002b22
cmp eax, esi
jbe 0x140002aa4
mov dword [rsp + 0x20], 0x6f
mov r8d, 0x42f
jmp 0x140002a73
lea r8, [0x140019070]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140001860
test eax, eax
jns 0x140002acf
mov dword [rsp + 0x20], eax
lea r9, str.StringCchPrintfW_failed___x_
mov r8d, 0x436
jmp 0x140002a7a
lea r8, [0x140019190]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140001860
test eax, eax
jns 0x140002afa
mov dword [rsp + 0x20], eax
lea r9, str.StringCchPrintfW_failed___x_
mov r8d, 0x43d
jmp 0x140002a7a
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400030dc
test al, al
jne 0x140002b22
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
call fcn.140002b50
test al, al
jne 0x140002b22
mov bl, 1
mov al, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140015530
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000381c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rbp + 0x180], rax
and qword [rsp + 0x50], 0
lea r8, str._ls_ls_ls
xor eax, eax
mov dword [rsp + 0x44], 8
mov rdi, rcx
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], al
mov edx, 0x104
lea rax, [rcx + 0x230]
mov dword [rsp + 0x48], 4
add rcx, 0x28
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rdi + 0x438]
lea rcx, [rsp + 0x70]
xor bl, bl
call fcn.1400085fc
test eax, eax
js 0x1400039c4
lea rax, [rsp + 0x44]
mov rbx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
lea r8, str.RefreshAfter
lea rax, [rsp + 0x58]
mov r9d, 0x48
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x70]
and qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1400039c2
lea rax, [rsp + 0x48]
mov r9d, 0x18
mov qword [rsp + 0x30], rax
lea rsi, [rdi + 0x18]
mov qword [rsp + 0x28], rsi
lea r8, str.RefreshInterval
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
xor bl, bl
test eax, eax
jne 0x1400039c4
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140003454
test eax, eax
js 0x1400039c4
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
mov eax, dword [rsi]
mov rbx, qword [rsp + 0x60]
imul rdx, rax, 0x23c34600
mov rax, qword [rsp + 0x58]
cmp rax, rdx
mov rcx, rax
cmovb rdx, rax
sub rcx, rdx
mov qword [rdi + 0x640], rcx
cmp rbx, rcx
jae 0x1400039b2
mov rcx, rdi
call fcn.140007db0
mov eax, dword [rsi]
imul rax, rax, 0x23c34600
mov qword [rdi + 0x640], rbx
add rax, rbx
cmp byte [rsp + 0x40], 0
jne 0x1400039c2
cmp rbx, rax
jae 0x1400039c2
mov bl, 1
jmp 0x1400039c4
xor bl, bl
mov al, bl
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140015530
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140004fcc
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, qword [rsp + 0x4b8]
mov bpl, r8b
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x400
mov rsi, r9
call sub.msvcrt.dll_memset
xor r15d, r15d
lea rcx, str.OneSettingsQuery
mov word [rsi], r15w
xor r9d, r9d
xor r8d, r8d
mov word [r14], r15w
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
jne 0x140005069
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x140005153
mov r8d, 0x1bb
xor r9d, r9d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
nop dword [rax + rax]
mov qword [rbx + 8], rax
test rax, rax
je 0x14000504a
mov qword [rsp + 0x30], r14
mov r9b, bpl
mov r8, rdi
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call fcn.1400048b0
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], 0x800
lea edx, [r9 + 0x50]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
nop dword [rax + rax]
test eax, eax
je 0x14000504a
lea rax, [rbx + 0x230]
mov edx, 0x200
lea r9, [rbx + 0x28]
mov qword [rsp + 0x20], rax
lea r8, str.settings_v2.0__ls__ls
lea rcx, [rsp + 0x50]
call fcn.1400085fc
mov ecx, eax
test eax, eax
js 0x14000510e
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140004e5c
mov ecx, eax
test ecx, ecx
js 0x140005153
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x30], 0x800000
lea rdx, [0x140019c10]
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov qword [rsp + 0x20], r15
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
nop dword [rax + rax]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14000504a
mov ecx, r15d
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140015530
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x460
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400075f4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor r12d, r12d
mov r9d, 0x4f7c
mov qword [rsp + 0x48], r12
mov sil, r12b
mov dword [rsp + 0x40], r12d
mov r15, rdx
mov word [rbp + 0x160], r12w
mov r14, rcx
mov word [rsp + 0x50], r12w
call fcn.140004500
test al, al
je 0x140007663
mov eax, 0x80004005
jmp 0x1400077c3
mov rdi, r12
cmp rdi, 1
jne 0x1400076a8
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call fcn.140004604
mov ebx, eax
test eax, eax
js 0x140007744
cmp dword [rsp + 0x40], r12d
je 0x1400076a8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
nop dword [rax + rax]
test eax, eax
je 0x140007781
mov sil, dil
lea rax, [rbp + 0x160]
mov r8b, sil
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
call fcn.140004fcc
mov ebx, eax
test eax, eax
js 0x140007722
mov rcx, r14
call fcn.140007320
mov ebx, eax
cmp eax, 0x80070005
jne 0x140007722
cmp r12w, word [rsp + 0x50]
je 0x140007722
mov rcx, qword [r14 + 0x10]
lea rax, [rbp + 0x160]
mov edx, 1
mov qword [rsp + 0x28], r12
mov r8d, edx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
call qword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
nop dword [rax + rax]
test eax, eax
je 0x140007722
mov rcx, r14
call fcn.140007320
mov ebx, eax
cmp rdi, 1
jne 0x140007740
test sil, sil
je 0x140007740
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
nop dword [rax + rax]
test eax, eax
je 0x1400077a6
mov sil, r12b
test ebx, ebx
jns 0x140007751
inc rdi
cmp rdi, 2
jb 0x140007666
test sil, sil
je 0x1400077c1
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
nop dword [rax + rax]
test eax, eax
jne 0x1400077c1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140007751
mov ebx, 0x80004005
jmp 0x140007751
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov eax, ebx
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140015530
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret