joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006f870
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
mov rax, r8
mov qword [rsp + 0x28], r9
mov rdi, r9
mov rbx, rdx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x48]
xor esi, esi
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x48], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test rbx, rbx
je 0x18006f93c
mov ecx, dword [rdi]
test ecx, ecx
je 0x18006f939
mov edx, dword [rsp + 0x48]
test edx, edx
je 0x18006f921
cmp edx, 2
jbe 0x18006f90f
cmp edx, 7
jne 0x18006f921
test cl, 1
jne 0x18006f8f7
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x18006f8f7
mov rdx, rcx
shr rdx, 1
cmp word [rbx + rdx*2 - 2], si
jne 0x18006f8f7
cmp eax, 1
jbe 0x18006f93c
cmp word [rbx + rdx*2 - 4], si
je 0x18006f93c
mov word [rbx], si
mov eax, SafeArrayGetDim
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test cl, 1
jne 0x18006f921
mov rax, rcx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x18006f93c
mov word [rbx], si
mov eax, SafeArrayGetDim
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov word [rbx], si
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov eax, r11d
add rsp, 0x30
pop rdi
ret

Function at 0x18006f950
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor esi, esi
lea rax, [r11 - 0x48]
mov rdi, rdx
mov rdx, rcx
mov qword [r11 - 0x20], 7
mov qword [r11 - 0x28], rsi
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x58], rax
mov rbx, rsi
mov word [rsp + 0x40], si
mov qword [r11 - 0x48], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006f9d3
mov rbx, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rbx, rbx
je 0x18006f9d3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
cmp qword [rsp + 0x58], 8
jb 0x18006f9e5
mov rcx, qword [rsp + 0x40]
call fcn.1800bf8b4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
test rbx, rbx
je 0x18006fa06
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800bf8d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18006fa30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x2b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2f8], rbx
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r13
mov word [rcx + 8], r13w
mov dword [rsp + 0x40], 1
mov rbx, r13
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x30], 0x104
mov word [rsp + 0x90], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call fcn.1800c31a0
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r13
mov word [rsp + 0x70], r13w
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006fc83
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x38], r13d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x18006fbd7
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x18006fbc9
cmp edx, 2
jbe 0x18006fba5
cmp edx, 7
jne 0x18006fbc9
test cl, 1
jne 0x18006fb97
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x18006fb97
mov rdx, rcx
shr rdx, 1
cmp word [rsp + rdx*2 + 0x8e], r13w
jne 0x18006fb97
cmp eax, 1
jbe 0x18006fbe0
cmp word [rsp + rdx*2 + 0x8c], r13w
je 0x18006fbe0
mov word [rsp + 0x90], r13w
jmp 0x18006fc72
test cl, 1
jne 0x18006fbbb
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], 0
je 0x18006fbe0
mov word [rsp + 0x90], r13w
jmp 0x18006fc72
mov word [rsp + 0x90], r13w
jmp 0x18006fc72
mov word [rsp + 0x90], r13w
test edi, edi
jne 0x18006fc0e
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.180014810
jmp 0x18006fc72
cmp edi, 0xea
jne 0x18006fc72
mov eax, 2
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.1800bf8ac
mov rbp, rax
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18006f870
test eax, eax
jne 0x18006fc6a
xor eax, eax
mov rcx, rdi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
mov rcx, rsi
call fcn.180014810
mov rcx, rbp
call fcn.1800bf8f0
test rbx, rbx
je 0x18006fc83
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r13
cmp qword [rsp + 0x88], 8
jb 0x18006fc98
mov rcx, qword [rsp + 0x70]
call fcn.1800bf8b4
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r13
mov word [rsp + 0x70], r13w
test rbx, rbx
je 0x18006fcc5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
jmp 0x18006fcc8
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1800bf8d0
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006fcf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
lea rax, [rsp + 0x38]
mov rbp, rdx
mov rsi, r8
mov rdx, rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov ebx, 1
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006fdb6
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rdi
mov rdi, qword [rsp + 0x38]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x68], 4
jne 0x18006fd8f
test eax, eax
jne 0x18006fd8f
mov eax, dword [rsp + 0x30]
mov dword [rsi], eax
jmp 0x18006fd91
xor ebx, ebx
test rdi, rdi
je 0x18006fd9f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rsi
ret

Function at 0x18006fdd0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
lea rax, [rsp + 0x58]
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
mov rdx, rcx
xor ebp, ebp
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006fe22
mov rbx, qword [rsp + 0x58]
jmp 0x18006fe7d
mov qword [rsp + 0x60], rbp
call fcn.180069830
mov r8d, 0xf013f
test eax, eax
lea rax, [rsp + 0x50]
mov edx, 0xf023f
mov qword [rsp + 0x40], rax
cmovne edx, r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edx
mov rdx, rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006febc
mov rbx, qword [rsp + 0x60]
lea rax, [rsp + 0x98]
mov r9d, 4
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x18006febc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18006fee0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
lea rax, [rsp + 0x50]
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
mov rdx, rcx
xor ebp, ebp
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006ff32
mov rbx, qword [rsp + 0x50]
jmp 0x18006ff90
mov qword [rsp + 0x58], rbp
call fcn.180069830
mov r8d, 0xf013f
test eax, eax
lea rax, [rsp + 0x88]
mov edx, 0xf023f
mov qword [rsp + 0x40], rax
cmovne edx, r8d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edx
mov rdx, rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006ffc9
mov rbx, qword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
xor r8d, r8d
inc eax
mov rdx, rsi
mov rcx, rbx
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x18006ffc9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x18006fff0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x2b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2f8], rbx
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor r13d, r13d
mov dword [rsp + 0x3c], r13d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r13
mov word [rcx + 8], r13w
mov dword [rsp + 0x3c], 1
mov rbx, r13
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x38], 0x104
mov word [rsp + 0x90], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call fcn.1800c31a0
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
call fcn.180069830
mov ebp, 0x20219
mov ecx, 0x20119
test eax, eax
cmovne ebp, ecx
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800701e8
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
and ebp, 0x300
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], r13d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x1800701a2
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x180070197
cmp edx, 2
jbe 0x180070176
cmp edx, 7
jne 0x180070197
test cl, 1
jne 0x18007016b
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x18007016b
mov rdx, rcx
shr rdx, 1
cmp word [rsp + rdx*2 + 0x8e], r13w
jne 0x18007016b
cmp eax, 1
jbe 0x1800701ab
cmp word [rsp + rdx*2 + 0x8c], r13w
je 0x1800701ab
mov word [rsp + 0x90], r13w
jmp 0x1800701d7
test cl, 1
jne 0x18007018c
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], 0
je 0x1800701ab
mov word [rsp + 0x90], r13w
jmp 0x1800701d7
mov word [rsp + 0x90], r13w
jmp 0x1800701d7
mov word [rsp + 0x90], r13w
test edi, edi
jne 0x1800701d7
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.180014810
test rbx, rbx
je 0x1800701e8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r13
cmp qword [rsp + 0x80], 8
jb 0x1800701fd
mov rcx, qword [rsp + 0x68]
call fcn.1800bf8b4
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
test rbx, rbx
je 0x180070227
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
jmp 0x18007022a
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1800bf8d0
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180072ae0
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rcx
lea rax, vtable.CWininetCom.0
mov qword [rcx], rax
mov qword [rcx + 0x28], 7
xor eax, eax
mov qword [rcx + 0x20], rax
mov word [rcx + 0x10], ax
mov qword [rcx + 0x30], rax
lea rbx, [rcx + 0x38]
mov qword [rbx], rax
cmp qword [rcx + 0x30], rax
jne 0x180072b4a
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.GSD_COMS
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 0x30], rax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1800746b0
mov rsi, rax
cmp rbx, rax
je 0x180072b78
mov rcx, rbx
call fcn.180018470
mov r11, qword [rsi]
mov qword [rbx], r11
test r11, r11
je 0x180072b78
lock add dword [r11 + 0x10], 1
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x180072bc8
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
jne 0x180072bc3
test rbx, rbx
je 0x180072bbe
mov rcx, qword [rbx]
test rcx, rcx
je 0x180072ba2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180072bb0
call fcn.1800bf8f0
mov rcx, rbx
call fcn.1800bf8b4
nop
mov rax, rdi
jmp 0x180072bcb
mov rax, rdi
jmp 0x180072bcb
mov rax, rdi
jmp 0x180072bcb
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180072c10
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rsi
mov rax, rdx
mov rdi, rcx
lea rcx, vtable.CWininetCom.0
mov qword [rdi], rcx
mov qword [rdi + 0x28], 7
xor ecx, ecx
mov qword [rdi + 0x20], rcx
mov word [rdi + 0x10], cx
mov qword [rdi + 0x30], rcx
lea rbx, [rdi + 0x38]
mov qword [rbx], rcx
cmp qword [rdi + 0x30], rcx
jne 0x180072c79
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 0x30], rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1800746b0
mov rsi, rax
cmp rbx, rax
je 0x180072ca7
mov rcx, rbx
call fcn.180018470
mov r11, qword [rsi]
mov qword [rbx], r11
test r11, r11
je 0x180072ca7
lock add dword [r11 + 0x10], 1
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x180072cf7
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
jne 0x180072cf2
test rbx, rbx
je 0x180072ced
mov rcx, qword [rbx]
test rcx, rcx
je 0x180072cd1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180072cdf
call fcn.1800bf8f0
mov rcx, rbx
call fcn.1800bf8b4
nop
mov rax, rdi
jmp 0x180072cfa
mov rax, rdi
jmp 0x180072cfa
mov rax, rdi
jmp 0x180072cfa
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180073aa0
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x130
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x168], rbx
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x60]
mov rax, qword [str.Accept:___r_n_r_n]
mov qword [rcx], rax
mov rax, qword [0x18010a2e8]
mov qword [rcx + 8], rax
mov rax, qword [0x18010a2f0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x18010a2f8]
mov qword [rcx + 0x18], rax
cmp qword [rbx + 0x30], r12
je 0x180073c8d
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x4000000
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180073c83
mov dword [rsp + 0x34], RegisterTypeLib
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x80]
lea edx, [r12 + 0x13]
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x180073bbf
lea rcx, [rsp + 0x80]
call fcn.1800c1918
cmp eax, 0x194
jne 0x180073bbf
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x180073c96
lea rdx, [0x18010a300]
mov rcx, rsi
call fcn.1800bfb3c
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180073bf3
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x180073c96
mov dword [rsp + 0x30], r12d
mov ecx, 0x19000
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
nop word [rax + rax]
xor edx, edx
mov r8d, 0x19000
mov rcx, rsi
call fcn.1800c31a0
lea r9, [rsp + 0x30]
mov r8d, 0x18fff
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x180073c5c
mov rdx, r11
mov r9, rbx
mov r8d, 1
mov rcx, rsi
call fcn.1800c0124
cmp dword [rsp + 0x30], 0
jne 0x180073c10
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x180073c7a
mov rcx, rbx
call fcn.1800c0710
mov rcx, rbx
call fcn.1800bfbd4
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov eax, 1
jmp 0x180073c96
mov rcx, qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal]
xor rcx, rsp
call fcn.1800bf8d0
mov rbx, qword [rsp + 0x168]
add rsp, 0x130
pop r12
pop rdi
pop rsi
ret
Function at 0x180074500
Capabilities:
Parse url

Disassembly:
push rbx
push rbp
push rsi
push r13
mov eax, 0x10a8
call fcn.1800dd850
sub rsp, rax
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x1080], rax
mov r13, r9
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
jne 0x18007453d
xor eax, eax
jmp 0x180074670
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x10a0], rdi
mov r9d, 0x2000000
mov qword [rsp + 0x1098], r12
mov dword [rsp + 0x20], 0x824
xor r12d, r12d
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
jne 0x1800745cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800745c8
mov edx, dword [rsp + 0x20]
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1800bf8ac
lea r8, [rsp + 0x20]
mov r9d, 0x2000000
mov rcx, rsi
mov rdx, rax
mov r12d, 1
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
jne 0x1800745d4
mov rcx, rdi
call fcn.1800bf8f0
xor eax, eax
jmp 0x180074660
lea rdi, [rsp + 0x30]
mov r9, rbp
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
mov esi, eax
test r12d, r12d
je 0x1800745f4
mov rcx, rdi
call fcn.1800bf8f0
test esi, esi
je case.default.0x18007461e
movzx eax, word [rbp + 0x24]
mov word [r13], ax
mov eax, dword [rbp + 0x14]
dec eax
cmp eax, 6
ja case.default.0x18007461e
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x74690]
add rcx, rdx
jmp rcx
mov dword [rbx], 1
jmp 0x18007465e
mov dword [rbx], 2
jmp 0x18007465e
mov dword [rbx], 3
jmp 0x18007465e
mov dword [rbx], 0x100b
jmp 0x18007465e
mov dword [rbx], 0x1001
jmp 0x18007465e
mov dword [rbx], 0x1006
jmp 0x18007465e
mov dword [rbx], 0x1002
jmp 0x18007465e
mov dword [rbx], 0x1000
mov eax, esi
mov rdi, qword [rsp + 0x10a0]
mov r12, qword [rsp + 0x1098]
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.1800bf8d0
add rsp, 0x10a8
pop r13
pop rsi
pop rbp
pop rbx
ret
Function at 0x180075160
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x40], rdx
mov qword [r11 - 0x48], 7
xor r13d, r13d
mov qword [r11 - 0x50], r13
mov word [r11 - 0x60], r13w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [r11 - 0x68]
call fcn.180003570
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180076100
cmp qword [rax + 0x20], 0x10
jb 0x1800751de
mov rcx, qword [rax + 8]
jmp 0x1800751e2
lea rcx, [rax + 8]
call fcn.1800dd4c4
mov rbp, rax
cmp qword [rsp + 0x40], 0x10
jb 0x1800751fc
mov rcx, qword [rsp + 0x28]
call fcn.1800bf8b4
mov qword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x28], r13b
cmp qword [rdi + 0x20], 8
jb 0x18007521f
lea rsi, [rdi + 8]
mov rcx, qword [rsi]
jmp 0x180075226
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [0x18010a300]
call fcn.1800bfb3c
mov r12, rax
test rax, rax
je 0x1800752a7
mov r9, rax
mov r8d, 1
mov rdx, qword [rbx + 0x18]
mov rcx, rbp
call fcn.1800c0124
mov rcx, r12
call fcn.1800bfbd4
mov rcx, rbp
call fcn.1800c17d4
nop
cmp qword [rdi + 0x20], 8
jb 0x18007526f
mov rcx, qword [rsi]
call fcn.1800bf8b4
mov qword [rdi + 0x20], 7
mov qword [rdi + 0x18], r13
mov word [rsi], r13w
cmp qword [rbx + 0x20], 8
jb 0x18007528f
mov rcx, qword [rbx + 8]
call fcn.1800bf8b4
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r13
mov word [rbx + 8], r13w
mov eax, 1
jmp 0x1800752f2
mov rcx, rbp
call fcn.1800c17d4
nop
cmp qword [rdi + 0x20], 8
jb 0x1800752bf
mov rcx, qword [rsi]
call fcn.1800bf8b4
mov qword [rdi + 0x20], 7
mov qword [rdi + 0x18], r13
mov word [rsi], r13w
cmp qword [rbx + 0x20], 8
jb 0x1800752df
mov rcx, qword [rbx + 8]
call fcn.1800bf8b4
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r13
mov word [rbx + 8], r13w
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1800bf8d0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret