Function at 0x100001000
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Initialize winhttp library
Open clipboard
Prepare http request
Receive http response
Resume thread
Schedule task via at
Set http header
Terminate process
Use process replacement
Write clipboard data

Disassembly:
sub rsp, 0x11c8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r15
sub r12, r12
sub r13, r13
sub r14, r14
call qword [sym.imp.kernel32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
mov qword [rsp + 0x94], rax
test rax, rax
je 0x100001bfa
cmp dword [rsp + 0x90], 4
jb 0x100001bfa
mov rbx, qword [rsp + 0x94]
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
je 0x10000109e
lea rdx, [0x1000022d8]
call qword [sym.imp.shell32.dll_StrStrW]
test rax, rax
je 0x10000107c
lea rcx, [rax + 0x10]
mov qword [rsp + 0x1198], rcx
mov rbx, qword [rsp + 0x94]
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
je 0x100001bfa
lea rdx, [0x1000022ec]
call qword [sym.imp.shell32.dll_StrStrW]
test rax, rax
je 0x1000010ae
add rax, 0x10
cmp word [rax], 0
je 0x100001bfa
mov qword [rsp + 0x11a0], rax
mov rbx, qword [rsp + 0x94]
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
je 0x100001bfa
lea rdx, [0x100002314]
call qword [sym.imp.shell32.dll_StrStrW]
test rax, rax
je 0x1000010ee
add rax, 0xc
cmp word [rax], 0
je 0x100001bfa
mov qword [rsp + 0x11a8], rax
mov rbx, qword [rsp + 0x94]
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
je 0x100001bfa
lea rdx, [0x100002324]
call qword [sym.imp.shell32.dll_StrStrW]
test rax, rax
je 0x10000112e
add rax, 0x14
cmp word [rax], 0
je 0x100001bfa
mov qword [rsp + 0x11b0], rax
mov rbx, qword [rsp + 0x94]
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
je 0x10000118c
lea rdx, [0x10000233c]
call qword [sym.imp.shell32.dll_StrStrW]
test rax, rax
je 0x10000116e
setne byte [rsp + 0x11b8]
mov rbx, qword [rsp + 0x94]
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000011ba
lea rdx, [0x10000234c]
call qword [sym.imp.shell32.dll_StrStrW]
test rax, rax
je 0x10000119c
setne byte [rsp + 0x11b9]
lea rcx, [rsp + 0xac]
mov edx, 0x68
call qword [sym.imp.kernel32.dll_RtlZeroMemory]
mov rcx, qword [rsp + 0x11a0]
sub rdx, rdx
mov r8, rdx
lea r9, [rsp + 0xac]
mov dword [r9], 0x68
mov dword [r9 + 0x20], 0xffffffff
mov dword [r9 + 0x50], 0xffffffff
call qword [sym.imp.winhttp.dll_WinHttpCrackUrl]
test al, al
je 0x100001bfa
mov rax, qword [rsp + 0xf4]
cmp word [rax], 0
je 0x100001bfa
lea rsi, [rsp + 0x194]
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x10000122a
cmp byte [rsp + 0x11b8], 0
je 0x100001308
lea rax, [0x10000216c]
lea rcx, [0x100002198]
cmp qword [rsp + 0x1198], 0
cmovne rax, rcx
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x100001267
mov word [rsi], 0
add rsi, 2
mov rdi, rsi
lea rax, [0x1000021bc]
mov cl, byte [rax]
mov byte [rsi], cl
add rax, 1
add rsi, 1
cmp byte [rax], 0
jne 0x10000128e
mov rdx, qword [rsp + 0x11a8]
mov cl, byte [rdx]
mov byte [rsi], cl
add rdx, 2
add rsi, 1
cmp word [rdx], 0
jne 0x1000012a7
add rax, 1
mov cl, byte [rax]
mov byte [rsi], cl
add rax, 1
add rsi, 1
cmp byte [rax], 0
jne 0x1000012bd
mov rdx, qword [rsp + 0x11b0]
mov cl, byte [rdx]
mov byte [rsi], cl
add rdx, 2
add rsi, 1
cmp word [rdx], 0
jne 0x1000012d6
add rax, 1
mov cl, byte [rax]
mov byte [rsi], cl
add rax, 1
add rsi, 1
cmp byte [rax], 0
jne 0x1000012ec
mov byte [rsi], 0
sub rsi, rdi
jmp 0x1000014a1
lea rax, [0x10000209c]
lea rcx, [0x1000020c0]
cmp qword [rsp + 0x1198], 0
cmovne rax, rcx
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x100001323
lea rax, [0x1000020f0]
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x10000133e
mov rax, qword [rsp + 0x11a8]
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x10000135a
lea rcx, [rsp + 0x9c]
sub rdx, rdx
mov r8, rdx
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test al, al
je 0x100001bfa
mov rcx, qword [rsp + 0x9c]
mov edx, 0x8004
sub r8, r8
mov r9, r8
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_CryptCreateHash]
mov bpl, al
test al, al
je 0x10000145c
lea rax, [0x100002100]
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x1000013d0
mov rax, qword [rsp + 0x11b0]
mov r8, rsi
mov cl, byte [rax]
mov byte [r8], cl
add rax, 2
add r8, 1
cmp word [rax], 0
jne 0x1000013ef
mov rcx, qword [rsp + 0xa4]
mov rdx, rsi
sub r8, rsi
sub r9, r9
call qword [sym.imp.advapi32.dll_CryptHashData]
test al, al
je 0x10000144b
mov rcx, qword [rsp + 0xa4]
mov edx, 2
mov r8, rsi
lea r9, [rsp + 0x1194]
mov dword [r9], 0x14
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_CryptGetHashParam]
mov bpl, al
mov rcx, qword [rsp + 0xa4]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x9c]
sub rdx, rdx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
test bpl, bpl
je 0x100001bfa
mov rcx, rsi
lea rdx, [0x100002134]
mov r8, qword [rcx]
bswap r8
mov r9, qword [rcx + 8]
bswap r9
mov eax, dword [rcx + 0x10]
bswap eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.user32.dll_wsprintfW]
lea rsi, [rsi + rax*2]
sub rcx, rcx
mov rdx, rcx
mov r8, rcx
mov r9, rcx
mov qword [rsp + 0x20], rcx
call qword [sym.imp.winhttp.dll_WinHttpOpen]
test rax, rax
je 0x100001cb6
mov r12, rax
mov rcx, rax
sub rdx, rdx
mov r8d, 0x2710
mov r9, r8
mov qword [rsp + 0x20], r8
call qword [sym.imp.winhttp.dll_WinHttpSetTimeouts]
mov rcx, r12
mov rdx, qword [rsp + 0xc4]
mov ebx, dword [rsp + 0xcc]
lea rbx, [rdx + rbx*2]
sub rbp, rbp
xchg word [rbx], bp
movzx r8d, word [rsp + 0xd0]
sub r9, r9
call qword [sym.imp.winhttp.dll_WinHttpConnect]
mov word [rbx], bp
test rax, rax
je 0x100001cb6
mov r13, rax
mov rcx, r13
lea rax, [0x100002094]
lea rdx, [0x100002160]
cmp byte [rsp + 0x11b8], 0
cmove rdx, rax
lea r8, [rsp + 0x194]
sub r9, r9
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], r9
mov eax, 0x800000
cmp dword [rsp + 0xc0], 2
ja 0x100001bfa
cmovb rax, r9
mov qword [rsp + 0x30], rax
call qword [sym.imp.winhttp.dll_WinHttpOpenRequest]
test rax, rax
je 0x100001cb6
mov r14, rax
mov rcx, rax
mov edx, 0x1f
lea r8, [rsp + 0x1194]
mov dword [r8], 0x3300
mov r9d, 4
call qword [sym.imp.winhttp.dll_WinHttpSetOption]
mov rbx, qword [rsp + 0x94]
add rbx, 8
mov rcx, qword [rbx]
jecxz 0x1000015ea
lea rdx, [0x100002300]
call qword [sym.imp.shell32.dll_StrStrW]
test rax, rax
je 0x1000015a6
add rax, 0x10
cmp word [rax], 0
je 0x100001bfa
mov rcx, r14
mov rdx, rax
mov r8d, 0xffffffff
mov r9d, 0xa0000000
call qword [sym.imp.winhttp.dll_WinHttpAddRequestHeaders]
jmp 0x1000015a6
cmp byte [rsp + 0x11b8], 0
je 0x100001610
mov rcx, r14
lea rdx, [0x1000021f4]
mov r8d, 0xffffffff
mov r9d, 0xa0000000
call qword [sym.imp.winhttp.dll_WinHttpAddRequestHeaders]
mov rcx, r14
lea rdx, [0x100002234]
mov r8d, 0xffffffff
mov r9d, 0xa0000000
call qword [sym.imp.winhttp.dll_WinHttpAddRequestHeaders]
mov rcx, r14
sub rdx, rdx
mov r8, rdx
mov r9, rdx
mov rax, rdx
cmp byte [rsp + 0x11b8], 0
cmovne r9, rdi
cmovne rax, rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rdx
call qword [sym.imp.winhttp.dll_WinHttpSendRequest]
test al, al
je 0x100001cb6
mov rcx, r14
sub rdx, rdx
call qword [sym.imp.winhttp.dll_WinHttpReceiveResponse]
test al, al
je 0x100001cb6
mov rcx, r14
lea rdx, [rsp + 0x1194]
call qword [sym.imp.winhttp.dll_WinHttpQueryDataAvailable]
test al, al
je 0x100001cbf
mov rcx, r14
lea rdx, [rsp + 0x194]
mov r8d, 0x1ff
cmp r8d, dword [rsp + 0x1194]
cmova r8d, dword [rsp + 0x1194]
sub r9, r9
mov byte [rdx + r8], r9b
call qword [sym.imp.winhttp.dll_WinHttpReadData]
test al, al
je 0x100001cbf
cmp byte [rsp + 0x11b8], 0
je 0x10000171c
lea rcx, [rsp + 0x194]
lea rdx, [0x1000021dc]
call qword [sym.imp.shell32.dll_StrStrA]
test rax, rax
je 0x100001c88
lea rdi, [rax + 9]
lea rcx, [rsp + 0x194]
lea rdx, [0x1000021e8]
call qword [sym.imp.shell32.dll_StrStrA]
test rax, rax
je 0x100001c88
lea r15, [rax + 9]
jmp 0x100001777
lea rcx, [rsp + 0x194]
lea rdx, [0x100002118]
call qword [sym.imp.shell32.dll_StrStrA]
test rax, rax
je 0x100001c88
lea rdi, [rax + 0xc]
cmp word [rdi], 0x2f3c
je 0x100001c88
lea rcx, [rsp + 0x194]
lea rdx, [0x100002128]
call qword [sym.imp.shell32.dll_StrStrA]
test rax, rax
je 0x100001c88
lea r15, [rax + 8]
cmp word [r15], 0x2f3c
je 0x100001c88
mov rax, qword [rsp + 0x1198]
cmp word [rax], 0
je 0x100001af0
mov rbp, rax
lea rsi, [rsp + 0x394]
mov word [rsi], 0x22
add rsi, 2
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x10000179d
mov word [rsi], 0x22
mov word [rsi + 2], 0x20
mov word [rsi + 4], 0x55
mov word [rsi + 6], 0x53
mov word [rsi + 8], 0x20
add rsi, 0xa
mov rax, qword [rsp + 0x11a0]
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x1000017da
mov word [rsi], 0x20
add rsi, 2
cmp byte [rsp + 0x11b8], 0
je 0x100001836
movzx cx, byte [rdi]
mov word [rsi], cx
add rsi, 2
add rdi, 1
cmp byte [rdi], 0x22
jne 0x100001801
mov word [rsi], 0x20
add rsi, 2
movzx cx, byte [r15]
mov word [rsi], cx
add rsi, 2
add r15, 1
cmp byte [r15], 0x7d
jne 0x10000181e
jmp 0x10000186d
movzx cx, byte [rdi]
mov word [rsi], cx
add rsi, 2
add rdi, 1
cmp word [rdi], 0x2f3c
jne 0x100001836
mov word [rsi], 0x20
add rsi, 2
movzx cx, byte [r15]
mov word [rsi], cx
add rsi, 2
add r15, 1
cmp word [r15], 0x2f3c
jne 0x100001855
mov word [rsi], 0
lea rcx, [rsp + 0x114]
mov edx, 0x68
call qword [sym.imp.kernel32.dll_RtlZeroMemory]
mov dword [rsp + 0x114], 0x68
mov rcx, rbp
lea rdx, [rsp + 0x394]
sub r8, r8
mov r9, r8
mov qword [rsp + 0x20], r8
mov eax, 0x20
lea r10d, [rax + 4]
cmp byte [rsp + 0x11b9], 0
cmovne rax, r10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r8
lea rax, [rsp + 0x114]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x17c]
mov qword [rsp + 0x48], rax
call qword [sym.imp.kernel32.dll_CreateProcessW]
test al, al
je 0x100001bfa
cmp byte [rsp + 0x11b9], 0
je 0x100001acf
mov rcx, qword [rsp + 0x184]
lea rdx, [rsp + 0x194]
mov dword [rdx], 0x10002
call qword [sym.imp.kernel32.dll_Wow64GetThreadContext]
test al, al
je 0x100001cc8
mov rcx, qword [rsp + 0x17c]
mov edx, dword [rsp + 0x238]
add edx, 8
mov r8, rsi
mov r9d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test al, al
je 0x100001cc8
mov ebx, dword [rsi]
mov rcx, qword [rsp + 0x17c]
mov rdx, rbx
mov r8, rsi
mov r9d, 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test al, al
je 0x100001cc8
cmp word [rsi], 0x5a4d
jne 0x100001cc8
mov rcx, qword [rsp + 0x17c]
lea rdx, [rbx + 0x3c]
mov r8, rsi
mov r9d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test al, al
je 0x100001cc8
mov eax, dword [rsi]
mov rcx, qword [rsp + 0x17c]
lea rdx, [rbx + rax + 0x58]
mov r8, rsi
mov r9d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test al, al
je 0x100001cc8
cmp dword [rsi], 0xaee528
jne 0x100001cc8
mov rcx, qword [rsp + 0x17c]
lea rdx, [rbx + 0x249ab0]
lea r8, [0x100002362]
mov r9d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100001cc8
mov rcx, qword [rsp + 0x17c]
lea rdx, [rbx + 0x24b320]
lea r8, [0x100002363]
mov r9d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100001cc8
mov rcx, qword [rsp + 0x17c]
lea rdx, [rbx + 0x249a38]
lea r8, [0x100002364]
mov r9d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100001cc8
mov rcx, qword [rsp + 0x17c]
lea rdx, [rbx + 0x2610a3]
lea r8, [0x100002365]
mov r9d, 0xa
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100001cc8
mov rcx, qword [rsp + 0x184]
call qword [sym.imp.kernel32.dll_ResumeThread]
mov rcx, qword [rsp + 0x17c]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x184]
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x100001c14
sub rcx, rcx
mov edx, 0x200
call qword [sym.imp.kernel32.dll_LocalAlloc]
mov rbp, rax
mov word [rax], 0x55
mov word [rax + 2], 0x53
mov word [rax + 4], 0x20
lea rsi, [rax + 6]
mov rax, qword [rsp + 0x11a0]
mov cx, word [rax]
mov word [rsi], cx
add rax, 2
add rsi, 2
cmp word [rax], 0
jne 0x100001b1e
mov word [rsi], 0x20
add rsi, 2
cmp byte [rsp + 0x11b8], 0
je 0x100001b7a
movzx cx, byte [rdi]
mov word [rsi], cx
add rsi, 2
add rdi, 1
cmp byte [rdi], 0x22
jne 0x100001b45
mov word [rsi], 0x20
add rsi, 2
movzx cx, byte [r15]
mov word [rsi], cx
add rsi, 2
add r15, 1
cmp byte [r15], 0x7d
jne 0x100001b62
jmp 0x100001bb1
movzx cx, byte [rdi]
mov word [rsi], cx
add rsi, 2
add rdi, 1
cmp word [rdi], 0x2f3c
jne 0x100001b7a
mov word [rsi], 0x20
add rsi, 2
movzx cx, byte [r15]
mov word [rsi], cx
add rsi, 2
add r15, 1
cmp word [r15], 0x2f3c
jne 0x100001b99
mov word [rsi], 0
sub rcx, rcx
mov rdx, rbp
lea r8, [0x100001d18]
mov r9, rcx
call qword [sym.imp.user32.dll_MessageBoxW]
sub rcx, rcx
call qword [sym.imp.user32.dll_OpenClipboard]
call qword [sym.imp.user32.dll_EmptyClipboard]
mov ecx, 0xd
mov rdx, rbp
call qword [sym.imp.user32.dll_SetClipboardData]
call qword [sym.imp.user32.dll_CloseClipboard]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_LocalFree]
jmp 0x100001c14
sub rcx, rcx
lea rdx, [0x100001d54]
lea r8, [0x100001d18]
mov r9, rcx
call qword [sym.imp.user32.dll_MessageBoxW]
mov rcx, r14
jecxz 0x100001c20
call qword [sym.imp.winhttp.dll_WinHttpCloseHandle]
mov rcx, r13
jecxz 0x100001c2c
call qword [sym.imp.winhttp.dll_WinHttpCloseHandle]
mov rcx, r12
jecxz 0x100001c38
call qword [sym.imp.winhttp.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x94]
jecxz 0x100001c49
call qword [sym.imp.kernel32.dll_LocalFree]
sub rcx, rcx
call qword [sym.imp.kernel32.dll_ExitProcess]
lea rax, [rsp + 0x194]
lea rsi, [rsp + 0x394]
mov rdx, rsi
movzx cx, byte [rax]
mov word [rsi], cx
add rax, 1
add rsi, 2
cmp byte [rax], 0
jne 0x100001c9b
mov word [rsi], 0
jmp 0x100001cfc
lea rdx, [0x100002258]
jmp 0x100001cfc
lea rdx, [0x100002280]
jmp 0x100001cfc
mov rcx, qword [rsp + 0x17c]
sub rdx, rdx
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x17c]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x184]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdx, [0x1000022ac]
sub rcx, rcx
lea r8, [0x100001d18]
mov r9d, 0x10
call qword [sym.imp.user32.dll_MessageBoxW]
jmp 0x100001c14