Function at 0x1400973d0
Capabilities:
Enumerate internet cache
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2930]
mov eax, 0x2a30
call fcn.140247340
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2a88], rbx
mov rsi, rcx
xor r15d, r15d
mov r13d, r15d
mov qword [rbp + 0x2980], r15
lea ebx, [r15 + 0x7a]
mov r12d, 0x2000
mov r14d, r15d
mov dword [rbp + 0x2978], r15d
mov edi, r15d
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x1360]
call fcn.140249b10
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x900]
call fcn.140249b10
lea rcx, [rbp + 0xd10]
call fcn.1400270b0
nop
lea rax, [rbp + 0x1360]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx - 0x59]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1400977d8
mov ecx, r15d
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x1360]
mov byte [rbp + rcx + 0x900], al
lea rcx, [rcx + 1]
test al, al
jne 0x140097490
lea rcx, [rbp + 0x900]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400974b1
mov eax, dword [str..txt]
mov dword [rcx], eax
movzx eax, word [0x14029b40c]
mov word [rcx + 4], ax
movzx eax, byte [0x14029b40e]
mov byte [rcx + 6], al
mov rax, qword [rsi + 8]
lea r8, [rbp + 0x7c0]
lea rdx, [rbp + 0x900]
lea rcx, [rsi + 8]
call qword [rax + 0x20]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400977ce
movabs r13, 0x3a65696b6f6f63
nop word [rax + rax]
mov edx, 0xffffffff
mov rcx, qword [rsi + 0x1290]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [0x14028b4b8]
lea rcx, [rbp + 0x7ec]
call fcn.140252114
test eax, eax
je 0x14009778e
lea rdx, [0x14029b36c]
lea rcx, [rbp + 0x7ec]
call fcn.140252114
test eax, eax
je 0x14009778e
xor edx, edx
mov r8d, 0x8df
lea rcx, [rbp + 0x1771]
call fcn.140249b10
xor edx, edx
mov r8d, 0x8d8
lea rcx, [rbp + 0x2058]
call fcn.140249b10
mov qword [rbp + 0x2050], r13
lea rcx, [rbp + 0x2050]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140097591
lea r8, [rbp + 0x7ec]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400975b0
mov byte [rbp + 0x1770], PathResolve
mov r9d, 0x8e0
lea r8, [rbp + 0x1771]
lea rdx, [rbp + 0x2050]
mov rcx, rsi
call fcn.140098ed0
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x1360]
mov byte [rbp + rcx + 0x900], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400975f0
lea rcx, [rbp + 0x900]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140097611
movzx eax, word [0x140287e84]
mov word [rcx], ax
lea rcx, [rbp + 0x900]
dec rcx
nop
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140097630
lea r8, [rbp + 0x7ec]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140097650
mov rcx, qword [rbp + 0xd48]
test rcx, rcx
je 0x14009767c
call fcn.140247060
mov qword [rbp + 0xd48], 0
lea rcx, [rbp + 0x900]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140097690
mov dword [rbp + 0xd50], eax
lea ecx, [rax + 1]
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0xd48], rax
test rax, rax
je 0x1400976cc
mov r8d, dword [rbp + 0xd50]
inc r8d
lea rdx, [rbp + 0x900]
call fcn.1402496a0
mov rcx, qword [rsi + 0x12d8]
test rcx, rcx
je 0x1400976ed
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0xd10]
mov edx, 0x400
call qword [rax + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1400279f0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1770]
mov rcx, rsi
call fcn.140089400
test eax, eax
je 0x140097784
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140097726
call fcn.140247060
mov qword [rbp - 0x78], 0
lea rcx, [rbp + 0x900]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140097734
mov dword [rbp - 0x70], eax
lea ecx, [rax + 1]
call fcn.140247068
mov rcx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140097767
mov r8d, dword [rbp - 0x70]
inc r8d
lea rdx, [rbp + 0x900]
call fcn.1402496a0
mov dword [rbp + 0x7a0], 1
lea r8, [rsp + 0x40]
mov edx, 0x400
mov rcx, rsi
call fcn.14007e430
nop
lea rcx, [rsp + 0x40]
call fcn.1400283f0
cmp dword [rsi + 0x127c], 0
jne 0x1400977b4
mov rax, qword [rsi + 8]
lea r8, [rbp + 0x7c0]
mov rdx, r15
lea rcx, [rsi + 8]
call qword [rax + 0x28]
test eax, eax
jne 0x140097510
mov rax, qword [rsi + 8]
mov rdx, r15
lea rcx, [rsi + 8]
call qword [rax + 0x30]
mov r13, qword [rbp + 0x2980]
mov r14d, r13d
jmp 0x1400977d5
mov r14d, dword [rbp + 0x2978]
xor r15d, r15d
cmp dword [rsi + 0x127c], 0
jne 0x140097c7d
test r14d, r14d
jne 0x140097c62
mov edx, 0xffffffff
mov rcx, qword [rsi + 0x1290]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test ebx, ebx
je 0x140097867
cmp ebx, 0x7a
je 0x140097814
mov r14d, 1
jmp 0x140097c55
test rdi, rdi
je 0x140097821
mov rcx, rdi
call fcn.140247060
mov ecx, r12d
call fcn.140247068
mov rdi, rax
test rax, rax
je 0x140097809
mov dword [rax], r12d
mov dword [rbp + 0x2970], r12d
lea r8, [rbp + 0x2970]
mov rdx, rax
test r13, r13
jne 0x140097c34
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov r13, rax
mov eax, r15d
test r13, r13
setne al
jmp 0x140097c3d
test dword [rdi + 0x18], 0x100000
je 0x140097c23
xor edx, edx
mov r8d, 0x8df
lea rcx, [rbp + 0x1771]
call fcn.140249b10
mov byte [rbp + 0x1770], PathResolve
mov r9d, 0x8df
lea r8, [rbp + 0x1771]
mov rdx, qword [rdi + 8]
mov rcx, rsi
call fcn.140098ed0
mov rbx, qword [rdi + 0x10]
mov rcx, qword [rbp + 0xd48]
test rcx, rcx
je 0x1400978c4
call fcn.140247060
mov qword [rbp + 0xd48], r15
test rbx, rbx
je 0x14009790a
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400978d0
mov dword [rbp + 0xd50], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0xd48], rax
test rax, rax
je 0x14009792b
mov r8d, dword [rbp + 0xd50]
inc r8d
mov rdx, rbx
mov rcx, rax
call fcn.1402496a0
jmp 0x14009792b
mov dword [rbp + 0xd50], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0xd48], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, qword [rsi + 0x12d8]
test rcx, rcx
je 0x14009794c
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0xd10]
mov edx, 0x400
call qword [rax + 0x28]
lea rax, vtable.CSASDescriptor.0
mov qword [rsp + 0x40], rax
lea rax, vtable.CSASDescriptor.1.0
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call fcn.1400270b0
nop
lea rcx, [rbp + 0x598]
call fcn.14000cb90
nop
lea rbx, vtable.CSABString.0
mov qword [rbp + 0x758], rbx
mov qword [rbp + 0x760], r15
mov dword [rbp + 0x768], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x760], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x76c], 1
mov qword [rbp + 0x770], rbx
mov qword [rbp + 0x778], r15
mov dword [rbp + 0x780], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x778], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x784], 1
mov qword [rbp + 0x788], rbx
mov qword [rbp + 0x790], r15
mov dword [rbp + 0x798], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x790], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rbp + 0x79c], 1
mov dword [rbp + 0x748], r15d
mov qword [rbp + 0x750], r15
mov qword [rbp + 0x7a8], r15
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1770]
mov rcx, rsi
call fcn.140089400
test eax, eax
je 0x140097b92
mov rcx, qword [rsi + 0x1558]
mov rax, qword [rcx]
mov rdx, qword [rdi + 0x10]
call qword [rax + 0xa0]
cmp eax, 0xffffffff
je 0x140097b92
mov rbx, qword [rdi + 0x10]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140097a93
call fcn.140247060
mov qword [rbp - 0x78], r15
test rbx, rbx
je 0x140097ad1
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x140097aa0
mov dword [rbp - 0x70], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140097aec
mov r8d, dword [rbp - 0x70]
inc r8d
mov rdx, rbx
mov rcx, rax
call fcn.1402496a0
jmp 0x140097aec
mov dword [rbp - 0x70], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x78], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rbx, qword [rdi + 8]
mov rcx, qword [rbp + 0x790]
test rcx, rcx
je 0x140097b08
call fcn.140247060
mov qword [rbp + 0x790], r15
test rbx, rbx
je 0x140097b4e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x140097b14
mov dword [rbp + 0x798], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x790], rax
test rax, rax
je 0x140097b6f
mov r8d, dword [rbp + 0x798]
inc r8d
mov rdx, rbx
mov rcx, rax
call fcn.1402496a0
jmp 0x140097b6f
mov dword [rbp + 0x798], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x790], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x7a0], 1
lea r8, [rsp + 0x40]
mov edx, 0x400
mov rcx, rsi
call fcn.14007e430
lea rbx, vtable.CSABString.0
lea rax, vtable.CSASDescriptor.0
mov qword [rsp + 0x40], rax
lea rax, vtable.CSASDescriptor.1.0
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x788], rbx
add dword [rbp + 0x79c], 0xffffffff
jne 0x140097bcb
mov rcx, qword [rbp + 0x790]
test rcx, rcx
je 0x140097bcb
call fcn.140247060
mov qword [rbp + 0x770], rbx
add dword [rbp + 0x784], 0xffffffff
jne 0x140097bec
mov rcx, qword [rbp + 0x778]
test rcx, rcx
je 0x140097bec
call fcn.140247060
mov qword [rbp + 0x758], rbx
add dword [rbp + 0x76c], 0xffffffff
jne 0x140097c0d
mov rcx, qword [rbp + 0x760]
test rcx, rcx
je 0x140097c0d
call fcn.140247060
lea rcx, [rbp + 0x598]
call fcn.14000d760
lea rcx, [rsp + 0x50]
call fcn.140027e10
mov dword [rbp + 0x2970], r12d
lea r8, [rbp + 0x2970]
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x140097c46
mov ebx, r15d
jmp 0x140097c55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, dword [rbp + 0x2970]
mov ebx, eax
cmp dword [rsi + 0x127c], 0
je 0x1400977e5
test rdi, rdi
je 0x140097c6f
mov rcx, rdi
call fcn.140247060
test r13, r13
je 0x140097c7d
mov rcx, r13
call qword [sym.imp.WININET.dll_FindCloseUrlCache]
mov rcx, rsi
call fcn.140097080
mov rcx, rsi
call fcn.1400a1630
nop
lea rcx, [rbp + 0xd10]
call fcn.140027e10
mov rbx, qword [rsp + 0x2a88]
add rsp, 0x2a30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret