joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180038880
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
movzx ebx, word [r8 + 0x18]
lea r10, [rcx + 0x260]
mov r9, qword [r10]
mov r8, r9
mov rcx, qword [r9 + 8]
mov rax, rcx
cmp byte [rcx + 0x19], 0
jne 0x1800388ce
movzx edx, word [rax + 0x20]
cmp dx, bx
jae 0x1800388b4
mov rax, qword [rax + 0x10]
jmp 0x1800388c8
cmp byte [r8 + 0x19], 0
je 0x1800388c2
cmp bx, dx
cmovb r8, rax
mov r9, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800388a5
cmp byte [r8 + 0x19], 0
jne 0x1800388d8
mov rcx, qword [r8]
cmp byte [rcx + 0x19], 0
jne 0x1800388f8
nop
cmp bx, word [rcx + 0x20]
jae 0x1800388ee
mov r8, rcx
mov rcx, qword [rcx]
jmp 0x1800388f2
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], 0
je 0x1800388e0
mov rdx, r9
mov rcx, r10
call fcn.180039be0
cmp byte [0x18010a364], 0
je 0x1800389de
mov eax, dword [0x18010bb98]
mov rcx, qword gs:[0x58]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1800ec7c0]
mov edx, 4
mov rcx, qword [rcx + rax*8]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1800ec7a0]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d264], eax
jg 0x1800389e6
cmp byte [0x180106500], 0
lea rdx, [0x1801064e0]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
je 0x1800389d1
xor r10d, r10d
mov qword [rsp + 0x50], rdi
mov r11d, 1
movabs rdi, 0xd993efbb19cfe32d
sub r11, rdx
nop word [rax + rax]
lea r9, [r10 + rdx]
movzx ecx, r10b
and cl, 7
mov rax, rdi
shl cl, 3
mov r8, rdi
shr rax, cl
add r10, 2
xor byte [r9], al
lea ecx, [r9 + r11]
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + 1], r8b
cmp r10, 0x20
jb 0x180038990
mov rdi, qword [rsp + 0x50]
mov byte [0x180106500], 0
mov r8d, ebx
mov ecx, 4
call fcn.18006a848
mov al, 1
add rsp, 0x40
pop rbx
ret
lea rcx, [0x18010d264]
call fcn.18009d704
cmp dword [0x18010d264], 0xffffffff
jne 0x180038951
lea rcx, [0x1800ce580]
mov byte [0x180106500], 1
movaps xmmword [0x1801064e0], xmm6
movaps xmmword [0x1801064f0], xmm7
call fcn.18009d564
lea rcx, [0x18010d264]
call fcn.18009d6a4
jmp 0x180038951
Function at 0x180042040
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov dword [rcx], 0x10000
lea rdi, [rcx + 8]
mov qword [rsp + 0x48], rdi
call fcn.180044000
mov qword [rdi], rax
call fcn.180044000
add rax, 0x28
mov qword [rdi + 8], rax
lea rbx, [rdi + 0x10]
xor ebp, ebp
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
lea ecx, [rbp + 0x10]
call fcn.18009d1b8
mov qword [rax + 8], rbp
mov qword [rbx], rax
mov qword [rax], rbx
lea rbx, [rdi + 0x38]
mov qword [rsp + 0x50], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
lea ecx, [rbp + 0x28]
call fcn.18009d1b8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi + 0x48], 0x1000
mov qword [rdi + 0x50], rbp
mov qword [rdi + 0x58], 0x1000
mov rax, qword [rdi]
mov rcx, qword [rax + 0x20]
mov qword [rdi + 0x60], rcx
mov qword [rsi + 0x70], rbp
mov qword [rsi + 0x80], rbp
mov qword [rsi + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rsi + 0x70], bpl
mov qword [rsi + 0x90], rbp
mov qword [rsi + 0x98], rbp
mov qword [rsi + 0xa0], rbp
mov qword [rsi + 0xa8], rbp
mov qword [rsi + 0xb8], rbp
mov qword [rsi + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rsi + 0xa8], bpl
mov byte [rsi + 0xc8], bpl
mov rcx, qword gs:[0x58]
mov eax, dword [0x18010bb98]
mov edx, 4
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d2c8], eax
jg 0x1800421c5
mov rax, qword [0x18010d2d0]
mov qword [rsi + 0xd0], rax
mov qword [rsi + 0xd8], rbp
mov qword [rsi + 0xe8], rbp
mov qword [rsi + reloc.WS2_32.dll_ntohs0], 0xf
mov byte [rsi + 0xd8], 0
mov qword [rsi + 0xf8], rbp
mov qword [rsi + 0x108], rbp
mov qword [rsi + 0x110], reloc.WS2_32.dll_ntohs
mov byte [rsi + 0xf8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x18010d2c8]
call fcn.18009d704
cmp dword [0x18010d2c8], 0xffffffff
jne 0x180042167
call fcn.180043c80
lea rcx, [0x1800ce760]
call fcn.18009d564
nop
lea rcx, [0x18010d2c8]
call fcn.18009d6a4
jmp 0x180042167
Function at 0x1800443a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov r14, rdx
mov ecx, 8
sub rcx, qword [rsi + 0x28]
lea rax, [rcx - 1]
cmp rax, 7
ja 0x1800444fd
xor edi, edi
mov ebp, 1
shl bpl, cl
mov qword [rsi + 0x28], rdi
dec bpl
mov dword [rdx], edi
cmp qword [rsi + 0x28], rdi
ja 0x1800444fd
cmp qword [rsi + 0x18], rdi
je 0x1800444fd
mov rcx, qword [rsi + 0x20]
lea rax, [rsi + 8]
mov qword [rsp + 0x40], r15
cmp rcx, 0x10
jb 0x18004440d
mov rax, qword [rsi + 8]
movzx r15d, byte [rax]
lea r9, [rsi + 8]
mov r8, qword [rsi + 0x18]
mov eax, 1
cmp r8, rax
cmovb rax, r8
cmp rcx, 0x10
jb 0x18004442f
mov r9, qword [rsi + 8]
sub r8, rax
lea rdx, [r9 + rax]
mov qword [rsi + 0x18], r8
mov rcx, r9
inc r8
call fcn.18009fc20
movzx ecx, bpl
and ecx, r15d
movzx edx, bpl
mov r15, qword [rsp + 0x40]
cmp ecx, edx
mov dword [r14], ecx
sete al
jne 0x1800444f9
cmp rdi, 0x20
jae 0x1800444f9
cmp qword [rsi + 0x28], 0
ja 0x1800444fd
cmp qword [rsi + 0x18], 0
je 0x1800444fd
mov rcx, qword [rsi + 0x20]
lea rax, [rsi + 8]
cmp rcx, 0x10
jb 0x180044491
mov rax, qword [rsi + 8]
movzx ebp, byte [rax]
lea r9, [rsi + 8]
mov r8, qword [rsi + 0x18]
mov eax, 1
cmp r8, rax
cmovb rax, r8
cmp rcx, 0x10
jb 0x1800444b2
mov r9, qword [rsi + 8]
sub r8, rax
lea rdx, [r9 + rax]
mov qword [rsi + 0x18], r8
mov rcx, r9
inc r8
call fcn.18009fc20
movzx eax, bpl
mov rcx, rdi
and bpl, 0x7f
shr al, 7
movzx r8d, bpl
mov r9d, r8d
shl r9d, cl
mov edx, r9d
shr edx, cl
cmp edx, r8d
jne 0x1800444fd
add dword [r14], r9d
add rdi, 7
test al, al
jne 0x180044463
xor al, 1
jmp 0x1800444ff
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800478b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x130
mov r8d, 0x104
lea rdx, [rsp + 0x20]
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x20]
call fcn.1800a4a50
lea rdx, str.aim.exe
lea rcx, [rsp + 0x20]
call fcn.18009eb24
test rax, rax
movzx edi, sil
lea ebp, [rsi + 1]
lea rcx, str.acccore.dll
cmovne edi, ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x150], rax
mov rbx, rax
movabs r12, 0xd993efbb19cfe32d
test rax, rax
jne 0x18004799e
test dil, dil
je 0x180047994
lea rcx, [rsp + 0x150]
call fcn.180049ae4
mov rbx, qword [rsp + 0x150]
test rbx, rbx
je 0x180047994
cmp byte [0x18010a364], sil
je 0x1800479ed
lea rcx, [rsp + 0x150]
call fcn.1800470a0
mov r8, rax
cmp byte [rax + 0x3a], sil
je 0x1800479e0
mov r9d, esi
mov cl, r9b
mov rax, r12
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + r8], al
add r9, rbp
cmp r9, 0x3a
jb 0x180047976
jmp 0x1800479dc
mov eax, 0x7e
jmp 0x180047b27
cmp byte [0x18010a364], sil
je 0x1800479ed
lea rcx, [rsp + 0x150]
call fcn.1800475d0
mov r8, rax
cmp byte [rax + 0x3a], sil
je 0x1800479e0
mov r9, rsi
mov cl, r9b
mov rax, r12
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + r8], al
add r9, rbp
cmp r9, 0x3a
jb 0x1800479c0
mov byte [r8 + 0x3a], sil
mov rdx, r8
mov ecx, 4
call fcn.18006a848
lea rdx, str.AccGetSessions
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801082f8], rax
test rax, rax
je 0x180047b22
lea rdx, str.AccArrayGetCount
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180108300], rax
test rax, rax
je 0x180047b22
lea rdx, str.AccArrayGetElement
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180108308], rax
test rax, rax
je 0x180047b22
lea rdx, str.AccCreateSession
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180108310], rax
test rax, rax
je 0x180047b22
call fcn.18009a9a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18009acd0
lea rdx, [0x180049060]
lea rcx, [0x180108310]
call fcn.18009a470
call fcn.18009aa00
test eax, eax
jne 0x180047b27
cmp byte [0x18010a364], sil
je 0x180047aec
lea rcx, [rsp + 0x150]
call fcn.180046fd8
cmp byte [rax + 0x2a], sil
je 0x180047adf
mov r9, rsi
mov cl, r9b
mov r8, r12
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
add r9, rbp
cmp r9, 0x2a
jb 0x180047abf
mov byte [rax + 0x2a], sil
mov rdx, rax
mov ecx, 4
call fcn.18006a848
lea rdx, str.aimpro.exe
mov dword [0x180108318], ebp
lea rcx, [rsp + 0x20]
call fcn.18009eb24
mov ecx, dword [0x180108320]
test rax, rax
cmovne ecx, ebp
add dword [0x180108298], ebp
mov dword [0x180108320], ecx
call fcn.180047bf8
jmp 0x180047b27
mov eax, 0x7f
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180047b48
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x180108318], 0
jne 0x180047b5e
xor eax, eax
jmp 0x180047bf0
lea rcx, [0x180108290]
call fcn.180049820
call fcn.18009a9a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18009acd0
lea rdx, [0x180049060]
lea rcx, [0x180108310]
call fcn.18009a754
call fcn.18009aa00
cmp byte [0x18010a364], 0
mov ebx, eax
je 0x180047be7
lea rcx, [rsp + 0x30]
call fcn.1800476bc
cmp byte [rax + 0x28], 0
je 0x180047bda
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x28
jb 0x180047bb3
mov byte [rax + 0x28], 0
mov rdx, rax
mov ecx, 4
call fcn.18006a848
and dword [0x180108318], 0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180047bf8
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xor esi, esi
cmp dword [0x180108318], esi
je 0x180047eb9
cmp dword [0x180108320], esi
je 0x180047c2d
cmp dword [0x18010831c], esi
jne 0x180047eb9
lea rcx, [rbp + 0x88]
call qword [0x1801082f8]
test eax, eax
js 0x180047eb9
mov rcx, qword [rbp + 0x88]
lea rdx, [rbp + 0x78]
call qword [0x180108300]
mov edi, esi
cmp dword [rbp + 0x78], esi
jle 0x180047eb9
movabs r13, 0xd993efbb19cfe32d
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x88]
lea r8, [rsp + 0x20]
mov edx, edi
call qword [0x180108308]
test eax, eax
js 0x180047eae
movzx eax, word [rsp + 0x20]
mov ecx, 0xfffb
sub ax, 9
test cx, ax
jne 0x180047eae
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x180047eae
mov rax, qword [rcx]
lea r8, [rbp + 0x80]
lea rdx, [0x1800d3110]
call qword [rax]
test eax, eax
js 0x180047eae
mov rbx, qword [rbp + 0x80]
test rbx, rbx
je 0x180047eae
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.1800a02d0
mov rax, qword [0x1801082a8]
mov r8, qword [0x1801082a0]
sub rax, r8
sar rax, 4
sub eax, 1
js 0x180047d29
movsxd rdx, eax
mov rcx, rdx
shl rcx, 4
add rcx, r8
cmp qword [rcx], rbx
je 0x180047d29
dec eax
sub rcx, 0x10
sub rdx, 1
jns 0x180047d18
cmp eax, 0xffffffff
je 0x180047d76
cmp byte [0x18010a364], sil
je 0x180047ea5
lea rcx, [rbp + 0x70]
call fcn.18004726c
cmp byte [rax + 0x37], sil
je 0x180047e85
mov r9, rsi
mov cl, r9b
mov r8, r13
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x37
jb 0x180047d51
mov byte [rax + 0x37], sil
jmp 0x180047e85
mov rdx, rbx
lea rcx, [0x180108290]
call fcn.180047ed8
mov rbx, qword [rbp + 0x80]
mov rax, qword [0x1801082a8]
test rbx, rbx
jne 0x180047da8
sub rax, qword [0x1801082a0]
sar rax, 4
test rax, rax
jmp 0x180047ddc
mov r8, qword [0x1801082a0]
sub rax, r8
sar rax, 4
sub eax, 1
js 0x180047dd9
movsxd rdx, eax
mov rcx, rdx
shl rcx, 4
add rcx, r8
cmp qword [rcx], rbx
je 0x180047dd9
dec eax
sub rcx, 0x10
sub rdx, 1
jns 0x180047dc8
cmp eax, 0xffffffff
setne al
test al, al
je 0x180047e4a
cmp byte [0x18010a364], sil
je 0x180047e3e
lea rcx, [rbp + 0x70]
call fcn.180047354
cmp byte [rax + 0x2f], sil
je 0x180047e1e
mov r9, rsi
mov cl, r9b
mov r8, r13
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x2f
jb 0x180047dfe
mov byte [rax + 0x2f], sil
mov r9, qword [rbp + 0x80]
lea r8, [rsp + 0x40]
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov rbx, qword [rbp + 0x80]
mov dword [0x18010831c], 1
jmp 0x180047ea5
cmp byte [0x18010a364], sil
je 0x180047ea5
lea rcx, [rbp + 0x70]
call fcn.180046f18
cmp byte [rax + 0x3f], sil
je 0x180047e85
mov r9, rsi
mov cl, r9b
mov r8, r13
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3f
jb 0x180047e65
mov byte [rax + 0x3f], sil
mov r9, qword [rbp + 0x80]
lea r8, [rsp + 0x40]
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov rbx, qword [rbp + 0x80]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
inc edi
cmp edi, dword [rbp + 0x78]
jl 0x180047c68
xor eax, eax
add rsp, 0x140
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180049504
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x138], rdi
mov rdi, rdx
cmp r8d, 0x258
jne 0x180049666
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x100
call fcn.1800a02d0
mov rax, qword [rdi]
lea rdx, [rbp]
mov rcx, rdi
call qword [rax + 0x70]
mov r8, qword [rbp]
xor esi, esi
test r8, r8
je 0x180049607
test eax, eax
js 0x180049607
or r9, 0xffffffffffffffff
mov rax, r9
inc rax
cmp word [r8 + rax*2], si
jne 0x180049573
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1800495ec
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800495a5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18009d830
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1800495ec
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rsi
xor edx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov byte [rbx], sil
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb r8, r8
and r8, rbx
jmp 0x1800495ef
mov r8, rsi
mov edx, 0x100
lea rcx, [rbp + 0x10]
call fcn.180004100
mov rcx, qword [rbp]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [0x18010a364], sil
je 0x180049660
lea rcx, [rbp + 0x130]
call fcn.180047504
cmp byte [rax + 0x34], sil
je 0x18004964c
mov r9, rsi
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x34
jb 0x180049625
mov byte [rax + 0x34], sil
mov r9, rdi
lea r8, [rbp + 0x10]
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov dword [0x18010831c], esi
mov rbx, qword [rbp + 0x120]
mov rsi, qword [rbp + 0x128]
mov rdi, qword [rbp + 0x138]
lea rsp, [rbp + 0x110]
pop rbp
ret

Function at 0x180049ae4
Capabilities:
Encode data using xor
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
mov eax, 0x2130
call fcn.18009d830
sub rsp, rax
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
test rax, rax
je 0x180049bf0
lea r9, [rsp + 0x2160]
mov r8d, 0x2000
lea rdx, [rsp + 0x130]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x180049bf0
xor ebx, ebx
test dword [rsp + 0x2160], 0xfffffff8
jbe 0x180049bf0
mov rdx, qword [rsp + rbx*8 + 0x130]
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov rcx, rdi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x180049b7d
lea rdx, str.acccore.dll
lea rcx, [rsp + 0x20]
call fcn.18009eb24
test rax, rax
jne 0x180049b8f
mov eax, dword [rsp + 0x2160]
inc ebx
shr eax, 3
cmp ebx, eax
jae 0x180049bf0
jmp 0x180049b48
cmp byte [0x18010a364], 0
je 0x180049be5
lea rcx, [rsp + 0x2158]
call fcn.180047770
cmp byte [rax + 0x28], 0
je 0x180049bd5
xor r8d, r8d
mov cl, r8b
movabs r9, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r9, cl
xor byte [r8 + rax], r9b
inc r8
cmp r8, 0x28
jb 0x180049bae
mov byte [rax + 0x28], 0
mov r8d, ebx
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov rax, qword [rsp + rbx*8 + 0x130]
mov qword [r14], rax
mov rbx, qword [rsp + 0x2150]
add rsp, 0x2130
pop r14
pop rdi
pop rsi
ret
Function at 0x18004a1ec
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
xor ebx, ebx
mov rsi, rcx
xor edx, edx
xor r9d, r9d
lea r8, str._AOL_Static
call qword [sym.imp.USER32.dll_FindWindowExA]
mov rdi, rax
test rax, rax
je 0x18004a256
mov r8d, 0x50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x18004a24c
lea rdx, str.AOL_will_never_ask_you_for_your_password_or_billing_information.
mov byte [rsp + 0x6f], bl
lea rcx, [rsp + 0x20]
call fcn.18009eb24
test rax, rax
jne 0x18004a254
mov rdx, rdi
mov rcx, rsi
jmp 0x18004a202
mov bl, 1
lea r11, [rsp + 0x70]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18004fb44
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov edx, 2
call qword [sym.imp.USER32.dll_GetAncestor]
test rax, rax
cmovne rdi, rax
xor r9d, r9d
lea r8, str.AOL_Toolbar
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x18004fbde
xor r9d, r9d
lea r8, str._AOL_Toolbar
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x18004fbde
xor r9d, r9d
lea r8, str._AOL_Edit
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x18004fbde
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
nop
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rbx], 0
mov eax, 0x490
jmp 0x18004fbce

Function at 0x18004fbec
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov byte [rdx], 0
mov rcx, qword [0x18010a5a8]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x18004fc3b
mov rcx, rsi
call fcn.18004fa38
mov rcx, rax
mov qword [0x18010a5a8], rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x18004fc3b
mov eax, 1
jmp 0x18004fc55
mov rcx, qword [0x18010a5a8]
mov r9, rbx
mov r8, rdi
mov edx, recv
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800543a8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov r15, r8
mov rdi, rdx
mov rbx, rcx
and dword [rbp + 0x30], 0
cmp qword [rcx + 0x18], 0x10
jb 0x1800543e0
mov rcx, qword [rcx]
lea r8, [rbp + 0x30]
xor edx, edx
call qword [sym.imp.WININET.dll_GetUrlCacheEntryInfoA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1800545c9
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x1800545c9
mov ecx, eax
call fcn.18009d8b4
mov rsi, rax
test rax, rax
je 0x1800545c9
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180054426
mov rcx, qword [rbx]
lea r8, [rbp + 0x30]
mov rdx, rsi
call qword [sym.imp.WININET.dll_GetUrlCacheEntryInfoA]
test eax, eax
je 0x1800545c1
mov ecx, dword [rsi + 0x30]
shl rcx, 0x20
mov eax, dword [rsi + 0x2c]
or rcx, rax
cmp rcx, rdi
jae 0x1800545c1
mov ecx, dword [rsi + 0x40]
shl rcx, 0x20
mov eax, dword [rsi + 0x3c]
or rcx, rax
cmp rcx, rdi
jb 0x1800545c1
lea rax, [0x1801083c0]
mov qword [rbp - 0x48], rax
mov rcx, rax
call fcn.180007dac
mov byte [rbp - 0x40], 1
mov r8, rbx
lea rdx, [rbp - 0x30]
lea r13, [0x1801083b0]
mov rcx, r13
call fcn.18004a36c
mov rdi, qword [0x1801083b0]
mov r14, qword [rbp - 0x20]
cmp byte [r14 + 0x19], 0
jne 0x1800544b6
lea rdx, [r14 + 0x20]
mov rcx, rbx
call fcn.180008b38
test al, al
je 0x1800544b9
mov r14, rdi
cmp r14, rdi
jne 0x1800545b4
mov eax, dword [0x1801012c8]
mov r14, qword [0x1801083b8]
cmp r14, rax
jbe 0x1800544ff
mov r8, qword [rdi + 8]
mov rdx, r13
mov rcx, r13
call fcn.18004a300
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rdi + 0x10], rdi
xor r14d, r14d
mov qword [0x1801083b8], r14
mov rdi, qword [0x1801083b0]
mov r8, rbx
lea rdx, [rbp - 0x60]
mov rcx, r13
call fcn.18004a36c
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp - 0x20], xmm0
mov rdx, qword [rbp - 0x20]
cmp byte [rdx + 0x19], 0
jne 0x180054535
add rdx, 0x20
mov rcx, rbx
call fcn.180008b38
test al, al
je 0x18005459e
movabs rax, 0x3ffffffffffffff
cmp r14, rax
je 0x1800545ea
mov r9, rbx
mov r8, rdi
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.18004a274
mov rdi, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18005458a
add rcx, 0x20
xor edx, edx
call fcn.1800078c8
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18005458a
mov edx, 0x40
call fcn.18009d1f4
movdqu xmmword [rbp - 0x30], xmm6
mov r8, rdi
lea rdx, [rbp - 0x30]
mov rcx, r13
call fcn.18000697c
cmp qword [rbx + 0x18], 0x10
jb 0x1800545a8
mov rbx, qword [rbx]
mov edx, r15d
mov rcx, rbx
call fcn.180092620
nop
lea rcx, [0x1801083c0]
call fcn.180007dc4
nop
mov rcx, rsi
call fcn.18009d1f4
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.1800048d0
nop
Function at 0x18005d050
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x80
lea rcx, [rsp + 0x30]
call fcn.18001002c
nop
lea rcx, [rsp + 0x58]
call fcn.18000d560
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.18000d6ac
mov bl, al
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18005d0bb
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005d0b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005d231
call fcn.18009d1f4
test bl, bl
je 0x18005d1ee
lea rdx, str.ConfigOSSProxySettings
lea rcx, [rsp + 0x30]
call fcn.18000d480
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
and qword [rsp + 0xa8], 0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18005d1ee
mov rbx, qword [rsp + 0xa8]
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [0x1800d40a4]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18005d17f
mov eax, dword [0x18010146c]
cmp dword [rsp + 0xa0], 4
cmove eax, dword [rsp + 0x90]
mov dword [0x18010146c], eax
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [0x1800d40a8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18005d1df
mov eax, dword [0x180101470]
cmp dword [rsp + 0xa0], 4
cmove eax, dword [rsp + 0x90]
mov dword [0x180101470], eax
test rbx, rbx
je 0x18005d1ee
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x18005d228
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005d222
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005d237
call fcn.18009d1f4
nop
add rsp, 0x80
pop rbx
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3