joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401982a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rsp + 0x70]
mov r14, r9
mov rbp, r8
mov rbx, rdx
mov r15, rcx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], r8
cmp r8, 0x1000
jae 0x1401982df
mov eax, 0xc0000017
jmp 0x14019846d
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140198481
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, 0x1000
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
mov rsi, rax
call fcn.14020c410
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rsi
mov rdx, rbx
mov rcx, r15
test r14, r14
je 0x140198348
mov rax, r14
call qword [case.0x14013f76a.0]
jmp 0x14019834e
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov ebx, eax
lfence
test eax, eax
js 0x140198466
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140198449
movsxd rcx, dword [rsi + 0x3c]
test rcx, rcx
je 0x140198449
cmp rcx, rbp
jae 0x140198449
nop
cmp rcx, 0x10000000
jae 0x140198449
lea rax, [rcx + 0x108]
cmp rax, 0x1000
jb 0x1401983a6
mov ebx, 0xc0000017
jmp 0x14019844e
cmp dword [rcx + rsi], 0x4550
lea r8, [rcx + rsi]
je 0x1401983bd
mov ebx, 0xc000007b
jmp 0x14019844e
movzx eax, word [r8 + 0x14]
mov edx, 0xe0
sub ax, dx
mov edx, 0xffef
test dx, ax
je 0x1401983db
mov ebx, 0xc0000903
jmp 0x14019844e
movzx eax, word [r8 + 0x18]
mov edx, 0x10b
mov word [rdi + 0x30], ax
sub ax, dx
mov edx, 0xfeff
test dx, ax
jne 0x1401983b3
movzx eax, word ds:[r8 + 6]
mov dword [rdi + 0x20], eax
cmp eax, 0x7f
jae 0x1401983b3
lea rdx, ds:[rax + rax*4]
movzx eax, word [r8 + 0x14]
add rcx, rax
lea rax, [rdx + 0x24]
lea rax, [rcx + rax*8]
cmp rax, 0x1000
jae 0x14019839c
mov qword [rdi], r15
mov qword [rdi + 0x18], r8
movzx ecx, word [r8 + 0x14]
add rcx, 0x18
mov qword [rdi + 0x38], rsi
add rcx, r8
mov qword [rdi + 0x28], rcx
jmp 0x140198466
mov ebx, 0xc000012f
lfence
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, 0xc000000d
jmp 0x14019846d
Function at 0x1401984a0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x1a0
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, qword [rsp + 0x1f0]
mov r14, r9
mov qword [rsp + 0x20], rbx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
call fcn.1401982a0
nop
cmp eax, 0xc0000017
jne 0x140198704
mov qword [rsp + 0x198], r12
mov qword [rsp + 0x190], r15
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rdi
cmp rdi, 0x40
jb 0x1401986ef
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1401986e8
lfence
xor r12d, r12d
lea r8, [rsp + 0x30]
mov r9d, 0x40
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rcx, rbp
mov rax, r14
call qword [case.0x14013f76a.0]
test eax, eax
js 0x1401985b6
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
je 0x140198565
mov eax, 0xc000012f
jmp 0x1401986f4
movsxd rax, dword [rsp + 0x6c]
test rax, rax
je 0x1401986ef
cmp rax, rdi
jae 0x1401986ef
nop dword [rax]
cmp rax, 0x10000000
jae 0x1401986ef
lfence
lea r15, [rsi + rax]
mov qword [rsp + 0x20], r12
mov rdx, r15
lea r8, [rsp + 0x70]
mov r9d, 0x108
mov rcx, rbp
mov rax, r14
call qword [case.0x14013f76a.0]
test eax, eax
jns 0x1401985be
lfence
jmp 0x1401986f4
cmp dword [rsp + 0x70], 0x4550
jne 0x1401986ef
movzx edx, word [rsp + 0x84]
mov ecx, 0xe0
movzx eax, dx
sub ax, cx
mov ecx, 0xffef
test cx, ax
je 0x1401985f3
mov eax, 0xc0000903
jmp 0x1401986f4
movzx eax, word [rsp + 0x88]
mov ecx, 0x10b
mov word [rbx + 0x30], ax
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x1401986ef
movzx ecx, word ds:[rsp + 0x76]
mov dword [rbx + 0x20], ecx
cmp ecx, 0x7f
jae 0x1401986ef
lea eax, ds:[rdx + 0x18]
lea rcx, [rcx + rcx*4]
lea rdi, [rax + rcx*8]
cmp rdi, 0x100000
ja 0x1401986ef
lfence
mov rcx, qword [0x1402c6140]
mov r8, rdi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14020c410
mov qword [rbx + 0x18], rsi
lfence
mov qword [rsp + 0x20], r12
mov r9, rdi
mov rdx, r15
mov rcx, rbp
test r14, r14
je 0x14019869f
mov r8, qword [rbx + 0x18]
mov rax, r14
call qword [case.0x14013f76a.0]
jmp 0x1401986a8
mov r8, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov edi, eax
lfence
test eax, eax
jns 0x1401986ce
mov r8, qword ds:[rbx + 0x18]
xor edx, edx
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
mov qword [rbx + 0x18], r12
jmp 0x1401986f4
mov rcx, qword [rbx + 0x18]
mov qword [rbx], rbp
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbx + 0x28], rcx
xor eax, eax
jmp 0x1401986f4
mov eax, 0xc000000d
jmp 0x1401986f4
mov eax, 0xc000007b
mov r12, qword [rsp + 0x198]
mov r15, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x1a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14019e700
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov rdi, rdx
mov r15, rcx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14019e876
lea rcx, str.BinaryData
mov qword [rsp + 0x48], rbp
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
jne 0x14019e755
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x14019e86b
mov qword [rsp + 0x40], rbx
mov rcx, rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbp
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [rdi + 0x1c]
mov rsi, rax
mov r9d, dword [rdi + 0x20]
mov ebx, ecx
mov r14d, dword [rdi + 0x14]
cmp ecx, r9d
jle 0x14019e79f
mov ebx, r9d
mov dword [rdi + 0x20], ecx
mov dword [rdi + 0x1c], ebx
mov r9d, ecx
test byte [rdi + 0x2c], 0x10
je 0x14019e807
cmp ebx, 0xffffffff
jne 0x14019e7cd
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x14019e7ba
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.14019e9a0
jmp 0x14019e826
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.14019e880
mov r9d, esi
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.14019e9a0
mov r9d, 0xffffffff
mov rdx, rdi
mov r8d, r9d
mov rcx, r15
call fcn.14019e2c0
jmp 0x14019e826
cmp ebx, 0xffffffff
jne 0x14019e81c
cmp dword [rdi + 0x18], 3
mov ebx, r14d
jne 0x14019e81c
lea ebx, [r14 + 1]
mov dword [rdi + 0x14], ebx
mov eax, dword [rdi + 8]
sub eax, ebx
cmp esi, eax
cmova esi, eax
mov ecx, ebx
mov rdx, r12
add rcx, qword [rdi]
mov r8d, esi
call fcn.14020c7e0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r9d, 0x105
mov dword [rdi + 0x14], r14d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x48]
add rsp, 0x28
pop r15
pop rdi
ret
Function at 0x1401a20e0
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x1401a231b
mov eax, dword [rsp + 0x5c]
or eax, dword [rsp + 0x54]
or eax, dword [rsp + 0x58]
or eax, dword [rsp + 0x50]
je 0x1401a231b
cmp dword [rbx + 0x24c], 0
mov qword [rsp + 0xe0], rsi
jg 0x1401a21b4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov rcx, qword [rbx + 0x250]
test rcx, rcx
jne 0x1401a217b
mov qword [rbx + 0x250], rsi
jmp 0x1401a2196
mov r9d, 2
mov r8, rsi
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
test rax, rax
je 0x1401a2313
jmp 0x1401a2305
test dword ds:[rbx + 0x40], 0x200000
je 0x1401a2273
cmp qword [rbx + 0x200], 0
jne 0x1401a2273
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
je 0x1401a2273
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbx + 0x200], rax
test rax, rax
je 0x1401a2273
movups xmm0, xmmword ds:[rbx + 0x60]
mov rcx, rsi
movups xmmword [rbx + 0x218], xmm0
mov edx, dword [rbx + 0x220]
mov r8d, dword [rbx + 0x224]
inc edx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbx + 0x210], rax
test rax, rax
jne 0x1401a224c
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rbx + 0x200], 0
jmp 0x1401a2273
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, qword [rbx + 0x210]
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbx + 0x208], rax
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
mov rsi, rax
test rax, rax
je 0x1401a2313
movups xmm0, xmmword [rsp + 0x6c]
mov r8, qword [rbx + 0x200]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x1401a22fc
call fcn.1401a81c0
mov ecx, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
sub ecx, r8d
mov edx, dword [rsp + 0x50]
mov rax, qword [rbx + 0x200]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x40], 0xcc0020
sub r9d, edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
jmp 0x1401a2305
mov r8, rsi
call fcn.1401a81c0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndPaint]
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401e5e40
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x1401a7080
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r9d, edx
mov rsi, rcx
cmp edx, 0x28
ja 0x1401a72f5
movabs rcx, 0x15e00000000
bt rcx, r9
jae 0x1401a72f5
mov rax, qword [rsi + 0x130]
mov r8d, dword [rax]
test r8d, r8d
je 0x1401a72e0
lea eax, ds:[r9 - 0x21]
mov qword [rsp + 0x78], rdi
cmp eax, 7
ja case.0x1401a70fa.36
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1a730c]
add rcx, rdx
jmp rcx
mov rax, qword [rsi + 0x98]
test rax, rax
je case.0x1401a70fa.36
mov edi, dword [rax + 0x2c]
test edi, edi
je case.0x1401a70fa.36
dec edi
jmp 0x1401a71b2
mov rdi, qword [rsi + 0x98]
test rdi, rdi
je case.0x1401a70fa.36
mov edi, dword [rdi + 0x2c]
inc edi
jmp 0x1401a71a5
mov rdi, qword ds:[rsi + 0x98]
test rdi, rdi
je 0x1401a7148
mov edi, dword [rdi + 0x2c]
test byte [rsi + 0x40], 8
je 0x1401a7153
mov ecx, dword [rsi + 0x7c]
jmp 0x1401a7155
xor ecx, ecx
mov eax, dword ds:[rsi + 0x6c]
sub eax, dword [rsi + 0x70]
sub eax, ecx
js 0x1401a72db
cdq
idiv dword [rsi + 0x74]
sub eax, 1
js 0x1401a72db
mov ecx, dword [rsi + 0x80]
cmp r9d, 0x21
jne 0x1401a7190
nop
cmp edi, ecx
jbe 0x1401a7188
mov edi, ecx
jmp 0x1401a71b2
cmp edi, eax
jb case.0x1401a70fa.36
sub edi, eax
jmp 0x1401a71b2
add ecx, eax
cmp ecx, r8d
jb 0x1401a719b
lea ecx, [r8 - 1]
cmp edi, ecx
jae 0x1401a71a3
mov edi, ecx
jmp 0x1401a71b2
add edi, eax
cmp edi, r8d
jb 0x1401a71b2
lea edi, [r8 - 1]
jmp 0x1401a71b2
xor edi, edi
mov qword [rsp + 0x68], rbx
mov ecx, 0x11
mov qword [rsp + 0x70], rbp
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov ecx, 0x10
shr bp, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rsi + 0x130]
xor r8d, r8d
mov edx, edi
movzx ebx, ax
mov rcx, qword [rcx + 8]
mov rdx, qword [rcx + rdx*8]
mov rcx, rsi
mov qword [rsi + 0x98], rdx
call fcn.1401a6760
shr bx, 0xf
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x1401a7226
mov r8d, dword [rsi + 0xa4]
cmp r8d, 0xffffffff
je 0x1401a7226
cmp edi, r8d
jbe 0x1401a723e
mov edx, r8d
mov r8d, edi
jmp 0x1401a7240
test bpl, bpl
jne 0x1401a729a
mov rax, qword [rsi + 0x98]
mov r8d, edi
mov ecx, dword [rax + 0x2c]
mov dword [rsi + 0xa4], ecx
mov edx, edi
lea rax, ds:[rsp + 0x30]
mov r9d, 4
mov qword [rsp + 0x28], rax
mov rcx, rsi
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call fcn.1401a6580
mov r8d, dword ds:[rsp + 0x30]
lea rax, [rsp + 0x38]
mov edx, dword [rsp + 0x34]
mov r9b, 1
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1401a6220
test al, al
je 0x1401a729a
mov rcx, qword [rsi]
lea rdx, [rsp + 0x38]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov rcx, rsi
call fcn.1401a6a40
mov rcx, qword [rsi + 0x38]
mov rbp, qword [rsp + 0x70]
test rcx, rcx
je 0x1401a72db
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41c
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsi + 0x160], 0xffffffffffffffff
mov dword [rsi + 0x190], 0xffffffff
mov rdi, qword [rsp + 0x78]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x50
pop rsi
ret
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x50
pop rsi
ret
Function at 0x1401cbf40
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x1402c6140]
mov ebp, 4
mov edx, ebp
mov r8d, 0x18
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
xorps xmm0, xmm0
mov rdi, rax
mov rcx, rbx
xor eax, eax
cmp dword [0x1402bbf68], 0x3f
mov dword [rsp + 0x20], eax
cmovae edx, ebp
xor r9d, r9d
movups xmmword [rdi], xmm0
xor r8d, r8d
mov qword [rdi + 0x10], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword ds:[rdi], rax
test rax, rax
jne 0x1401cbfc6
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x1402bbf68], 0x3f
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, 0x54
mov rcx, rax
jae 0x1401cbfec
mov dword [rsp + 0x70], 0xa00
jmp 0x1401cc090
mov dword [rsp + 0x70], 0x2800
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
mov r9d, ebp
mov dword [rsp + 0x78], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bbf68]
nop
cmp eax, 0x64
jb 0x1401cc04c
mov rcx, qword ds:[rdi]
lea r8, [rsp + 0x30]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bbf68]
cmp eax, 0x72
jb 0x1401cc096
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov edx, 0xc3
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x1402bbf68], 0x72
jb 0x1401cc096
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov r9d, ebp
mov edx, 0x9a
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov qword [rsi], rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401cc200
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov eax, ecx
test r9b, 1
je 0x1401cc21b
lfence
mov eax, 0x800000
nop dword [rax + rax]
test r9b, 2
je 0x1401cc22d
lfence
bts eax, 8
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401cc257
add rsp, 0x40
pop rbx
ret
mov r9d, 4
mov dword [rsp + 0x50], 8
lea r8, [rsp + 0x50]
mov edx, 0x3f
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x1401cc2e0
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1401cc340
Capabilities:
Set http header

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
mov eax, r8d
test eax, eax
mov r8d, 0xffffffff
mov r9d, 0xa0000000
cmovne r8d, eax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1401cc380
Capabilities:
Read http header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
lea rax, [rsp + 0x50]
mov rsi, rcx
mov qword [rsp + 0x28], rbp
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x16
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1401cc3c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp eax, 0x7a
jne 0x1401cc436
mov rdx, qword [0x1402c5ff0]
mov qword [rsp + 0x60], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
mov rdi, rax
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov edx, 0x16
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], bp
mov r9, qword [rdi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x1401cc441
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401cc436
call fcn.140143da0
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401cc460
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
lea rax, [rsp + 0x50]
mov rsi, rdx
mov qword [rsp + 0x28], r14
mov rbp, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
mov r8, rdx
xor r9d, r9d
mov dword [rsp + 0x50], r14d
mov edx, 0xffff
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop
test eax, eax
jne 0x1401cc4af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401cc52a
mov rdx, qword [0x1402c5ff0]
mov qword [rsp + 0x58], rbx
mov ebx, dword [rsp + 0x50]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
mov rdi, rax
mov qword [rsp + 0x28], r14
mov r8, rsi
mov edx, 0xffff
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
lea rax, [rsp + 0x50]
mov word [rcx + rbx], r14w
mov r9, qword [rdi + 8]
mov rcx, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x1401cc53a
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401cc52a
call fcn.140143da0
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r8, qword [rdi + 8]
xorps xmm1, xmm1
mov rax, r8
mov ecx, r8d
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401cc56d
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x1401cc569
mov eax, ecx
shr rax, 1
jmp 0x1401cc5a3
add rax, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x1401cc595
nop dword [rax]
add rax, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x1401cc580
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rbp, qword [rsp + 0x68]
add rax, rax
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401cc600
Capabilities:
Read http header

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, edx
mov dword [rsp + 0x30], 0x100
xor ebx, ebx
mov rsi, r8
mov edx, ebx
test al, 1
je 0x1401cc639
lfence
mov edx, 5
test al, 2
je 0x1401cc643
lfence
or edx, 0x13
mov rcx, qword ds:[rcx + 0x10]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1401cc71d
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x278], rdi
mov r9d, eax
xor dil, dil
test rax, rax
je 0x1401cc6ac
movzx ecx, word [rsp + 0x40]
cmp cx, 0x2d
je 0x1401cc69b
cmp cx, 0x2b
jne 0x1401cc6ac
cmp cx, 0x2d
lea r11, [rsp + 0x42]
lea r9, [rax - 2]
sete dil
shr r9, 1
mov r10b, 1
mov rdx, rbx
je 0x1401cc6fc
mov qword [rsp + 0x250], r14
lea r14, [0x14028e420]
nop word [rax + rax]
movzx eax, byte [r11 + rdx*2]
mov r8d, dword [r14 + rax*4]
cmp r8d, 0xa
jae 0x1401cc6e9
lea rcx, [rbx + rbx*4]
lea rbx, [r8 + rcx*2]
jmp 0x1401cc6ec
xor r10b, r10b
inc rdx
cmp rdx, r9
jb 0x1401cc6d0
mov r14, qword [rsp + 0x250]
mov rax, rbx
neg rax
test dil, dil
mov rdi, qword [rsp + 0x278]
cmove rax, rbx
test r10b, r10b
je 0x1401cc71d
mov qword [rsi], rax
mov al, 1
jmp 0x1401cc71f
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x258
pop rsi
pop rbx
ret
Function at 0x1401cc840
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x1040
call fcn.14020b7b0
sub rsp, rax
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov r14, r8
mov r15, rdx
mov rbp, rcx
mov edi, 0x1000
mov rcx, qword [0x1402c6140]
mov r8d, edi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x20]
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov rbx, rax
xor esi, esi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401cc96b
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1401cc92a
lea eax, ds:[rcx + rsi]
cmp edi, eax
jae 0x1401cc8f5
mov rcx, qword [0x1402c6140]
add edi, edi
mov r8d, edi
mov edx, 4
test rbx, rbx
je 0x1401cc8e8
mov r9d, r8d
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
jmp 0x1401cc8ee
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [rsp + 0x20]
mov rbx, rax
mov r8d, ecx
lea rdx, [rsp + 0x30]
mov ecx, esi
add rcx, rbx
call fcn.14020c7e0
add esi, dword ds:[rsp + 0x20]
lea r9, [rsp + 0x20]
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x1401cc8b1
lea eax, [rsi + 1]
cmp edi, eax
jae 0x1401cc96b
lea r8d, [rdi + 1]
lfence
mov rdi, qword [0x1402c6140]
mov edx, 4
mov rcx, rdi
test rbx, rbx
je 0x1401cc95d
mov r9d, r8d
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rbx, rax
jmp 0x1401cc972
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
jmp 0x1401cc972
mov rdi, qword [0x1402c6140]
mov byte [rsi + rbx], 0
test esi, esi
je 0x1401cc99e
test r15, r15
je 0x1401cc984
mov qword [r15], rbx
jmp 0x1401cc992
mov r8, rbx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r14, r14
je 0x1401cc99a
mov dword [r14], esi
mov al, 1
jmp 0x1401cc9ae
mov r8, rbx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401e5e40
mov rbx, qword [rsp + 0x1088]
add rsp, 0x1040
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret