joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c88e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c8b68
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
test rdi, rdi
je 0x5c8b5a
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x70], rax
mov rcx, qword [rax + 0xb0]
xor ebx, ebx
mov rax, rcx
nop
call fcn.00405fe0
mov rax, qword [rsp + 0x70]
call fcn.005c8220
test rax, rax
jne 0x5c8b50
mov rcx, qword [rsp + 0x78]
test byte [rcx], al
lea rax, [rcx + 0x20]
mov qword [rsp + 0x38], rax
call fcn.00472620
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx + 0x28]
mov qword [rsp + 0x28], rdx
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x38]
call fcn.00472920
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x5c8b41
mov rcx, qword [0x007dff48]
mov rax, qword [rsp + 0x88]
cmp qword [0x007dff40], rax
jne 0x5c89d5
mov rbx, qword [rsp + 0x90]
nop dword [rax]
call fcn.00403f40
test al, al
jne 0x5c8b27
mov rax, qword [rsp + 0x88]
lea rcx, [0x00686040]
nop dword [rax]
cmp rax, rcx
jne 0x5c8a4b
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx + 0x78], rcx
jne 0x5c8a39
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x48], rcx
lea rax, [0x00617d40]
lea rbx, [rsp + 0x40]
nop dword [rax]
call fcn.0040a5c0
mov rbx, rax
lea rax, [0x00685fa0]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x70]
call fcn.005c81a0
test al, al
je 0x5c8b0d
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x70]
cmp qword [r8 + 0x78], rdx
je 0x5c8ac8
movups xmmword [rsp + 0x50], xmm15
mov rdx, qword [rsp + 0x88]
nop
test rdx, rdx
je 0x5c8a8b
mov rdi, qword [rdx + 8]
jmp 0x5c8a8e
mov rdi, rdx
mov qword [rsp + 0x50], rdi
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rdx
lea rax, [0x00656404]
mov ebx, 0x32
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
movups xmmword [rsp + 0x40], xmm15
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x48], rcx
lea rax, [0x00617d40]
lea rbx, [rsp + 0x40]
call fcn.0040a5c0
mov rbx, rax
lea rax, [0x00685fa0]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.005c88e0
Function at 0x5c9ba0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c9d9e
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
cmp qword [rax + 0xe8], 0
jne 0x5c9d94
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov rcx, qword [rax + 0x68]
mov rax, rcx
call fcn.0057e6c0
nop word [rax + rax]
test rax, rax
jle 0x5c9cbe
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx + 0x68]
mov rbx, rax
mov rax, rdx
nop dword [rax + rax]
call fcn.0057e0e0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
call fcn.005c9de0
nop dword [rax]
test al, al
jne 0x5c9d6f
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.0040a8c0
lea rdx, [0x005fbe80]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x40]
nop
test rdx, rdx
je 0x5c9c8b
mov rbx, qword [rdx + 8]
jmp 0x5c9c8e
mov rbx, rdx
mov qword [rsp + 0x68], rbx
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x70], rdx
lea rax, [0x00658b3e]
mov ebx, 0x4b
lea rcx, [rsp + 0x58]
mov edi, 2
mov rsi, rdi
call fcn.004d1140
mov rcx, qword [0x007dfb68]
mov rax, qword [rsp + 0x40]
cmp qword [0x007dfb60], rax
jne 0x5c9cee
mov rbx, qword [rsp + 0x98]
nop dword [rax + rax]
call fcn.00403f40
test al, al
jne 0x5c9d47
mov rax, qword [rsp + 0x40]
movups xmmword [rsp + 0x48], xmm15
test rax, rax
je 0x5c9cff
mov rbx, qword [rax + 8]
jmp 0x5c9d02
mov rbx, rax
mov qword [rsp + 0x48], rbx
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x50], rdx
lea rax, [0x0064d6e5]
mov ebx, 0x1a
lea rcx, [rsp + 0x48]
mov edi, 1
mov rsi, rdi
call fcn.004acb60
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x88]
call fcn.005cbb60
jmp 0x5c9d65
mov rbx, qword [0x007dff40]
mov rcx, qword [0x007dff48]
mov rax, qword [rsp + 0x88]
nop dword [rax]
call fcn.005cbb60
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, qword [0x007dff40]
mov rcx, qword [0x007dff48]
mov rax, qword [rsp + 0x88]
call fcn.005cbb60
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.005c9ba0
Function at 0x5daca0
Capabilities:
Persist via run registry key
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5dae59
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov r13, 0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x2f], 0
movups xmmword [rsp + 0x48], xmm15
mov ecx, 0x2d
mov edi, 3
mov eax, 0x80000001
lea rbx, [0x00654b89]
call fcn.005d9040
mov qword [rsp + 0x30], rax
nop
test rbx, rbx
je 0x5dad32
movups xmmword [rsp + 0x58], xmm15
je 0x5dad11
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x58]
mov ebx, 1
mov rcx, rbx
call fcn.004d11e0
mov rax, qword [rsp + 0x30]
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x005dae80]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x2f], 1
mov rbx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x80]
call fcn.005846a0
mov rcx, rbx
lea rdi, [0x0064548f]
mov esi, 8
mov rbx, rax
xor eax, eax
call fcn.0044c9c0
lea rcx, [0x00645ba4]
mov edi, 0xa
call fcn.005da940
test rax, rax
je 0x5dadc5
movups xmmword [rsp + 0x58], xmm15
je 0x5dada8
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x58]
mov ebx, 1
mov rcx, rbx
nop
call fcn.004d11e0
mov rax, qword [rsp + 0x30]
lea rbx, [0x006450ae]
mov ecx, 7
lea rdi, [0x00645ba4]
mov esi, 0xa
call fcn.005d9760
test rax, rax
je 0x5dae14
movups xmmword [rsp + 0x58], xmm15
je 0x5dadf8
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x58]
mov ebx, 1
mov rcx, rbx
call fcn.004d11e0
movups xmmword [rsp + 0x48], xmm15
mov byte [rsp + 0x2f], 0
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005daca0
Function at 0x5e32a0
Capabilities:
Persist via run registry key
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e33e8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x005fe120]
mov qword [rsp + 0x40], rdx
lea rdx, [0x006843e0]
mov qword [rsp + 0x48], rdx
mov ecx, 1
lea rax, [rsp + 0x40]
mov rbx, rcx
call fcn.004af540
mov eax, 0x80000001
lea rbx, [0x0065425d]
mov ecx, 0x2b
mov edi, 0xf003f
call fcn.005d9100
test rcx, rcx
jne 0x5e33d8
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
call fcn.005d9760
test rax, rax
jne 0x5e33ce
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.005d9000
test rax, rax
jne 0x5e33c4
mov eax, 0x77359400
call fcn.0045e0c0
lea rax, [0x00646a41]
mov ebx, 0xc
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.005dfe60
call fcn.005e0b40
test rax, rax
je 0x5e3381
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
nop
ret
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
movabs rax, 0x12a05f200
call fcn.0045e0c0
mov eax, 0x80000001
lea rbx, [0x0064c21d]
mov ecx, 0x18
call fcn.005d91e0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e32a0
Function at 0x5e3420
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e35d6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x005fe120]
mov qword [rsp + 0x38], rdx
lea rdx, [0x006843a0]
mov qword [rsp + 0x40], rdx
mov ecx, 1
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.004af540
mov eax, 0x80000001
lea rbx, [0x00657f5f]
mov ecx, 0x3f
mov edi, 2
call fcn.005d9100
test rcx, rcx
jne 0x5e35c6
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
call fcn.005d9760
test rax, rax
jne 0x5e35bc
mov rax, qword [rsp + 0x28]
call fcn.005d9000
test rax, rax
jne 0x5e35b2
mov eax, 0x77359400
call fcn.0045e0c0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rcx, [0x006443db]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 2
lea rcx, [0x00647deb]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 0xf
lea rax, [0x00644607]
mov ebx, 3
lea rcx, [rsp + 0x48]
mov edi, 2
mov rsi, rdi
call fcn.005dfe60
mov qword [rsp + 0x30], rax
lea rax, [0x00635620]
call fcn.0040d1e0
mov byte [rax], 1
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x98], rax
mov rax, rcx
call fcn.005e19e0
test rdi, rdi
jne 0x5e35a2
movabs rax, 0x12a05f200
call fcn.0045e0c0
mov eax, 0x80000001
lea rbx, [0x00657f5f]
mov ecx, 0x3f
nop dword [rax + rax]
call fcn.005d91e0
test rax, rax
je 0x5e3594
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e3420
Function at 0x5e3600
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5e3807
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
movups xmmword [rsp + 0x50], xmm15
lea rdx, [0x005fe120]
mov qword [rsp + 0x50], rdx
lea rdx, [0x006843c0]
mov qword [rsp + 0x58], rdx
mov ecx, 1
lea rax, [rsp + 0x50]
mov rbx, rcx
call fcn.004af540
mov eax, 0x80000001
lea rbx, [0x006461ad]
mov ecx, 0xb
mov edi, 2
nop dword [rax]
call fcn.005d9100
test rcx, rcx
jne 0x5e37f1
mov qword [rsp + 0x28], rax
lea rbx, [0x00644dc9]
mov ecx, 6
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
call fcn.005d9760
test rax, rax
jne 0x5e37e1
mov rax, qword [rsp + 0x28]
call fcn.005d9000
test rax, rax
jne 0x5e37d0
mov eax, 0x77359400
call fcn.0045e0c0
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
lea rcx, [0x006443db]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 2
lea rcx, [0x006582de]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 0x41
lea rax, [0x00644607]
mov ebx, 3
lea rcx, [rsp + 0x60]
mov edi, 2
mov rsi, rdi
call fcn.005dfe60
mov qword [rsp + 0x40], rax
lea rax, [0x00635620]
call fcn.0040d1e0
mov byte [rax], 1
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x98], rax
mov rax, rcx
call fcn.005e19e0
test rdi, rdi
je 0x5e3771
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rdi
mov eax, 0x80000001
lea rbx, [0x006461ad]
mov ecx, 0xb
mov edi, 2
call fcn.005d9040
mov qword [rsp + 0x30], rax
lea rbx, [0x00644dc9]
mov ecx, 6
call fcn.005d97e0
mov rax, qword [rsp + 0x30]
call fcn.005d9000
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
nop
ret
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e3600
Function at 0x5e3840
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e3a35
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x005fe120]
mov qword [rsp + 0x48], rdx
lea rdx, [0x00684390]
mov qword [rsp + 0x50], rdx
mov ecx, 1
lea rax, [rsp + 0x48]
mov rbx, rcx
call fcn.004af540
mov eax, 0x80000001
lea rbx, [0x0065563c]
mov ecx, 0x2f
mov edi, 3
call fcn.005d9100
test rcx, rcx
jne 0x5e3a25
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
call fcn.005d9760
nop word [rax + rax]
test rax, rax
jne 0x5e3a1b
mov rax, qword [rsp + 0x28]
lea rbx, [0x0064793b]
mov ecx, 0xf
xor edi, edi
xor esi, esi
nop
call fcn.005d9760
test rax, rax
jne 0x5e3a11
mov rax, qword [rsp + 0x28]
call fcn.005d9000
nop dword [rax + rax]
test rax, rax
jne 0x5e3a07
mov eax, 0x77359400
call fcn.0045e0c0
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
lea rcx, [0x006443db]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 2
lea rcx, [0x0064d7b5]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0x1a
lea rax, [0x00644607]
mov ebx, 3
lea rcx, [rsp + 0x58]
mov edi, 2
mov rsi, rdi
call fcn.005dfe60
mov qword [rsp + 0x38], rax
lea rax, [0x00635620]
call fcn.0040d1e0
mov byte [rax], 1
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x98], rax
mov rax, rcx
call fcn.005e19e0
test rdi, rdi
je 0x5e39c4
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], rdi
movabs rax, 0x12a05f200
call fcn.0045e0c0
mov eax, 0x80000001
lea rbx, [0x0064e2d6]
mov ecx, 0x1c
call fcn.005d91e0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e3840
Function at 0x5e3a60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e3bfb
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x005fe120]
mov qword [rsp + 0x40], rdx
lea rdx, [0x006843b0]
mov qword [rsp + 0x48], rdx
mov ecx, 1
lea rax, [rsp + 0x40]
mov rbx, rcx
call fcn.004af540
mov eax, 0x80000001
lea rbx, [0x0065563c]
mov ecx, 0x2f
mov edi, 2
call fcn.005d9100
test rcx, rcx
jne 0x5e3beb
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
call fcn.005d9760
test rax, rax
jne 0x5e3be1
mov rax, qword [rsp + 0x28]
lea rbx, [0x0064794a]
mov ecx, 0xf
xor edi, edi
xor esi, esi
call fcn.005d9760
test rax, rax
jne 0x5e3bd7
mov rax, qword [rsp + 0x28]
nop
call fcn.005d9000
test rax, rax
jne 0x5e3bcd
mov eax, 0x77359400
call fcn.0045e0c0
lea rax, [0x00649b87]
mov ebx, 0x13
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.005dfe60
call fcn.005e0b40
test rax, rax
jne 0x5e3bc3
movabs rax, 0x12a05f200
call fcn.0045e0c0
mov eax, 0x80000001
lea rbx, [0x0065563c]
mov ecx, 0x2f
call fcn.005d91e0
nop
test rax, rax
je 0x5e3b8f
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov eax, 0x80000001
lea rbx, [0x0064e2d6]
mov ecx, 0x1c
call fcn.005d91e0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e3a60
Function at 0x5e3c20
Capabilities:
Persist via run registry key
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e3d92
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x005fe120]
mov qword [rsp + 0x40], rdx
lea rdx, [0x006843d0]
mov qword [rsp + 0x48], rdx
mov ecx, 1
lea rax, [rsp + 0x40]
mov rbx, rcx
call fcn.004af540
mov eax, 0x80000001
lea rbx, [0x00654232]
mov ecx, 0x2b
mov edi, 0xf003f
call fcn.005d9100
test rcx, rcx
jne 0x5e3d82
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor ecx, ecx
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
call fcn.005d9760
test rax, rax
jne 0x5e3d78
mov rax, qword [rsp + 0x28]
lea rbx, [0x0064793b]
mov ecx, 0xf
xor edi, edi
xor esi, esi
call fcn.005d9760
test rax, rax
jne 0x5e3d6e
mov rax, qword [rsp + 0x28]
nop
call fcn.005d9000
test rax, rax
jne 0x5e3d64
mov eax, 0x77359400
call fcn.0045e0c0
lea rax, [0x00645647]
mov ebx, 8
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.005dfe60
call fcn.005e0b40
test rax, rax
je 0x5e3d21
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
nop
ret
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
movabs rax, 0x12a05f200
call fcn.0045e0c0
mov eax, 0x80000001
lea rbx, [0x0064c9d6]
mov ecx, 0x19
call fcn.005d91e0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e3c20
Function at 0x5e3dc0
Capabilities:
Persist via run registry key
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e3f0d
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov r13, 0
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x27], 0
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x50], xmm15
mov eax, 0x80000002
lea rbx, [0x0065473d]
mov ecx, 0x2c
mov edi, 1
call fcn.005d9040
test rbx, rbx
je 0x5e3e4a
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x60], xmm15
je 0x5e3e29
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x60]
mov ebx, 1
mov rcx, rbx
call fcn.004d11e0
mov rax, qword [rsp + 0x38]
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x005e3f20]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x27], 1
lea rbx, [0x0064c77e]
mov ecx, 0x19
nop dword [rax]
call fcn.005d9400
test rcx, rcx
je 0x5e3ebc
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x60], xmm15
je 0x5e3e9b
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x60]
mov ebx, 1
mov rcx, rbx
call fcn.004d11e0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
movups xmmword [rsp + 0x50], xmm15
mov byte [rsp + 0x27], 0
mov rdx, qword [rsp + 0x70]
mov rax, qword [rdx]
call rax
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.0045f280
jmp fcn.005e3dc0
Function at 0x180022280
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.180022180
mov ebx, eax
test eax, eax
jne 0x1800223a7
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180022381
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180022280
mov ebx, eax
test eax, eax
jne 0x1800223a7
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180022330
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180022396
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov rdx, rsi
mov rcx, rdi
call fcn.180022490
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800223bc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov eax, ebx
mov dword [rsp + 0x50], ebp
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret