joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442d10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.00411c30
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.0041a470
mov esi, eax
cmp esi, 0x104
jbe 0x442d6b
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00409430
mov rdi, rax
jmp 0x442d6f
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.0041a470
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x442dc5
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x442da6
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x442dd7
mov rcx, rdi
call fcn.00409460
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x4443e0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x828
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rcx, rbx
call fcn.00411360
mov rcx, rsi
call fcn.00412730
mov rdi, rax
mov rcx, rdi
lea rdx, [rbp + 0x20]
mov r8d, 0x400
call sub.kernel32.dll_GetEnvironmentVariableW
mov esi, eax
cmp esi, 0x400
jge 0x444434
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8d, esi
call fcn.00411660
jmp 0x444457
mov rcx, rbx
mov edx, esi
sub edx, 1
call fcn.00412980
mov rcx, qword [rbx]
call fcn.00412730
mov rcx, rdi
mov rdx, rax
mov r8d, esi
call sub.kernel32.dll_GetEnvironmentVariableW
mov rax, rbx
lea rsp, [rbp + 0x828]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x45d4d0
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb5
mov r8, rcx
xor edx, edx
mov ecx, edx
and ecx, 0x3f
mov r9, r8
shr r9, cl
and r9b, 0xff
xor al, r9b
add edx, 1
cmp edx, 8
jne 0x45d4d7
nop
ret

Function at 0x4642d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, r8d
mov edx, edx
lea rdx, [rcx + rdx]
cmp rcx, rdx
jae 0x4642f4
movzx r8, byte [rcx]
xor eax, r8d
imul eax, eax, 0x1000193
add rcx, 1
cmp rcx, rdx
jb 0x4642de
nop
ret
Function at 0x47d820
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov byte [rbp + 0x88], dl
cmp byte [rbp + 0x88], 0
je 0x47d85e
mov rcx, qword [rbp + 0x80]
movzx rdx, byte [rbp + 0x88]
call fcn.0040eb60
mov qword [rbp + 0x80], rax
nop
mov rcx, qword [0x00475760]
mov dl, 1
call fcn.004a9b60
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 8], rax
mov rcx, qword [0x0047c308]
mov dl, 1
call fcn.004ae900
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x10], rax
mov rcx, qword [0x0047c308]
mov dl, 1
call fcn.004ae900
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x18], rax
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_GetSystemInfo
mov rax, qword [rbp + 0x80]
mov ecx, dword [rbp + 0x34]
mov dword [rax + 0x20], ecx
cmp byte [rbp + 0x88], 0
je 0x47d91b
mov rcx, qword [rbp + 0x80]
call fcn.0040eba0
mov qword [rbp + 0x80], rax
jmp 0x47d91b
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x508420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov qword [rbp + 0x60], r8
movzx rax, byte [rbp + 0x70]
mov byte [rbp + 0x70], al
mov rcx, rsi
mov rdx, qword [rbp + 0x60]
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x20], 0
jne 0x50845f
mov rcx, rbp
call fcn.00508340
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_LoadResource
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x28], 0
jne 0x50847e
mov rcx, rbp
call fcn.00508340
mov rcx, qword [rbx + 0x28]
call sub.kernel32.dll_LockResource
mov rdi, rax
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_SizeofResource
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call fcn.00507440
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x51ad90
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
movzx rax, byte [rcx + 0x19]
or al, dl
test al, al
je 0x51ade0
cmp byte [rcx + 0x1d], 0
jne 0x51ade0
cmp byte [rcx + 0x40], 0
jne 0x51ade0
mov byte [rcx + 0x1b], 0
mov byte [rcx + 0x19], 0
mov rcx, qword [rcx + 0x10]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x51adfd
mov rcx, qword [0x004d3ec8]
mov dl, 1
mov r8, qword [0x00789bd8]
call fcn.0043f840
mov rcx, rax
call fcn.00410630
jmp 0x51adfd
mov rcx, qword [0x004d3ec8]
mov dl, 1
mov r8, qword [0x00789bd8]
call fcn.0043f840
mov rcx, rax
call fcn.00410630
add rsp, 0x28
ret

Function at 0x51ba90
Capabilities:
Suspend thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
movzx rax, byte [rax + 0x1b]
mov byte [rbp + 0x3f], al
nop
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x1b], 1
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_SuspendThread
mov rcx, qword [rbp + 0x50]
test eax, eax
setge dl
call fcn.0051ac10
jmp 0x51baeb
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x51bb10
Capabilities:
Resume thread

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rbx + 0x10]
call sub.kernel32.dll_ResumeThread
mov esi, eax
mov rcx, rbx
test esi, esi
setge dl
call fcn.0051ac10
cmp esi, 1
jne 0x51bb3a
mov byte [rbx + 0x1b], 0
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x554c70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
nop
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xc8]
call fcn.00411a60
mov rcx, qword [rbp + 0x78]
call fcn.00554170
mov byte [rbp + 0x83], al
cmp byte [rbp + 0x83], 0
jne 0x554ce3
lea rcx, [rbp + 0x78]
mov edx, 1
mov r8d, 1
call fcn.00412d40
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x98], rax
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.00555e40
mov qword [rbp + 0x90], rax
cmp qword [rbp + 0x90], 0
je 0x554e36
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x90]
call fcn.00554680
mov rcx, qword [rbp + 0xc0]
lea rdx, [rbp + 0x54]
call fcn.00554fa0
test al, al
je 0x554e16
lea rcx, [rbp + 0x70]
xor edx, edx
mov r8d, dword [rbp + 0x58]
add r8d, 1
call fcn.00411660
mov eax, dword [rbp + 0x54]
sub eax, 1
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x554e15
mov eax, dword [rbp + 0x58]
add eax, 1
mov dword [rbp + 0x88], eax
mov rcx, qword [rbp + 0x70]
call fcn.00412730
mov rcx, qword [rbp + 0x90]
mov edx, dword [rbp + 0x84]
mov r8, rax
lea r9, [rbp + 0x88]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.005545a0
test al, al
je 0x554e01
mov rcx, qword [rbp + 0x70]
call fcn.00412730
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.004127c0
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x40]
call fcn.00554c70
sub dword [rbp + 0x84], 1
cmp dword [rbp + 0x84], 0xffffffff
jne 0x554d75
nop
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x98]
call fcn.00554680
mov rcx, qword [rbp + 0x90]
call sub.advapi32.dll_RegCloseKey
cmp byte [0x00797734], 0
je 0x554e95
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.00554660
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.00412730
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0xc0]
mov r8d, dword [rax + 0x2c]
and r8d, 0x300
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.005545a0
mov byte [rbp + 0x8f], al
jmp 0x554ed4
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.00554660
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.00412730
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.005545a0
mov byte [rbp + 0x8f], al
nop
lea rcx, [rbp + 0x40]
call fcn.00411360
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.00411440
movzx rax, byte [rbp + 0x8f]
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret
Function at 0x554f70
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.00412730
mov rcx, qword [rbx + 8]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
mov rcx, rbx
mov edx, eax
call fcn.005545a0
add rsp, 0x20
pop rbx
ret

Function at 0x555050
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
nop
mov rax, qword [rbp + 0x50]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp + 0x70]
call fcn.00554fa0
test al, al
je 0x55514d
lea rcx, [rbp + 0x68]
xor edx, edx
mov r8d, dword [rbp + 0x74]
add r8d, 1
call fcn.00411660
xor eax, eax
mov esi, dword [rbp + 0x70]
sub esi, 1
mov ebx, eax
cmp ebx, esi
jg 0x55514c
sub esi, eax
add esi, 1
mov eax, dword [rbp + 0x74]
add eax, 1
mov dword [rbp + 0x8c], eax
mov rcx, qword [rbp + 0x68]
call fcn.00412730
mov rcx, qword [rbp + 0x48]
mov rcx, qword [rcx + 8]
mov edx, ebx
mov r8, rax
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov rcx, qword [rbp + 0x68]
call fcn.00412730
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.004127c0
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x50]
mov rax, qword [rax]
call qword [rax + 0x78]
add ebx, 1
sub esi, 1
test esi, esi
jne 0x5550c5
nop
nop
lea rcx, [rbp + 0x58]
call fcn.00411360
lea rcx, [rbp + 0x68]
call fcn.00411360
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rbp
ret
Function at 0x5565d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc0], r8
nop
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax + 0x50]
mov rax, qword [rax + 8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xb8]
call fcn.00554680
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
lea rdx, [rbp + 0x64]
call fcn.00554fa0
test al, al
je 0x556750
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
xor r9, r9
call fcn.00556450
lea rcx, [rbp + 0x58]
xor edx, edx
mov r8d, dword [rbp + 0x70]
add r8d, 1
call fcn.00411660
xor eax, eax
mov ebx, dword [rbp + 0x6c]
sub ebx, 1
mov dword [rbp + 0x80], eax
cmp dword [rbp + 0x80], ebx
jg 0x55674f
sub ebx, eax
add ebx, 1
mov eax, dword [rbp + 0x70]
add eax, 1
mov dword [rbp + 0x84], eax
mov rcx, qword [rbp + 0x58]
call fcn.00412730
mov rcx, qword [rbp + 0xb8]
mov edx, dword [rbp + 0x80]
mov r8, rax
lea r9, [rbp + 0x84]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumValueW
mov rcx, qword [rbp + 0xb0]
mov rcx, qword [rcx + 0x50]
mov edx, eax
call fcn.005545a0
test al, al
je 0x55673d
mov rcx, qword [rbp + 0x58]
call fcn.00412730
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.004127c0
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
mov r9, qword [rbp + 0x40]
call fcn.00556450
add dword [rbp + 0x80], 1
sub ebx, 1
test ebx, ebx
jne 0x55669f
nop
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0x88]
call fcn.00554680
nop
lea rcx, [rbp + 0x40]
call fcn.00411360
lea rcx, [rbp + 0x58]
call fcn.00411360
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x605c90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x48]
mov rax, qword [rax]
xor ecx, ecx
mov rdx, rax
test rdx, rdx
je 0x605cbe
mov ecx, dword [rdx - 4]
mov eax, ecx
test eax, eax
jge 0x605cc9
call fcn.0040da30
mov rcx, rdx
mov edx, eax
lea rdx, [rcx + rdx*2]
cmp rcx, rdx
jae 0x605ced
movzx r8d, word [rcx]
xor eax, r8d
imul eax, eax, 0x1000193
add rcx, 2
cmp rcx, rdx
jb 0x605cd7
nop
mov ebx, eax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x40]
mov rcx, qword [rax + 0x38]
mov edx, ebx
call fcn.0060e2a0
test al, al
je 0x605d4a
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x40]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0x38]
mov r8d, ebx
call fcn.0060cf10
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x48]
mov rdx, qword [rax]
call fcn.00412c90
test eax, eax
jne 0x605d68
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax + 0x48]
mov rdx, qword [rbp + 0x38]
call fcn.004119d0
jmp 0x605d68
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x40]
mov rcx, qword [rax + 0x38]
mov edx, ebx
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x48]
mov r8, qword [rax]
call fcn.0060dd50
nop
lea rcx, [rbp + 0x38]
call fcn.00411360
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x677200
Capabilities:
Read http header

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov dword [rbp + 0x44], r8d
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
nop
mov ebx, dword [rbp + 0x44]
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x67724e
or ebx, 0xffff
mov rcx, qword [rbp + 0x48]
call fcn.00412730
mov rsi, rax
jmp 0x677250
xor esi, esi
mov dword [rbp + 0x8c], 0
mov rcx, qword [rbp + 0x38]
mov edx, ebx
mov r8, rsi
xor r9, r9
lea rax, [rbp + 0x8c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call sub.winhttp.dll_WinHttpQueryHeaders
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f76
jne 0x67729a
mov rcx, qword [rbp + 0x30]
call fcn.00411360
jmp 0x6773b8
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x6772fc
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0x60], eax
mov byte [rbp + 0x68], 0
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x58]
mov edx, eax
mov r8, qword [0x00797c78]
call fcn.0043d220
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x78], 0x11
mov rcx, qword [0x006847e0]
mov dl, 1
mov r8, qword [0x00789740]
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], 1
call fcn.0043fa00
mov rcx, rax
call fcn.00410630
mov rcx, qword [rbp + 0x30]
mov edx, dword [rbp + 0x8c]
shr edx, 1
sub edx, 1
call fcn.00412980
xor eax, eax
mov rcx, qword [rbp + 0x30]
mov rcx, qword [rcx]
test rcx, rcx
je 0x677322
mov eax, dword [rcx - 4]
test eax, eax
jle 0x6773b8
mov rax, qword [rbp + 0x30]
mov rcx, qword [rax]
call fcn.00412730
mov rcx, qword [rbp + 0x38]
mov edx, ebx
mov r8, rsi
mov r9, rax
lea rax, [rbp + 0x8c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call sub.winhttp.dll_WinHttpQueryHeaders
test eax, eax
jne 0x6773b8
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0x60], eax
mov byte [rbp + 0x68], 0
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x50]
mov edx, eax
mov r8, qword [0x00797c78]
call fcn.0043d220
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x78], 0x11
mov rcx, qword [0x006847e0]
mov dl, 1
mov r8, qword [0x00789740]
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], 1
call fcn.0043fa00
mov rcx, rax
call fcn.00410630
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.00411440
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rbp
ret
Function at 0x677630
Capabilities:
Initialize winhttp library

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x60], rcx
mov byte [rbp + 0x68], dl
cmp byte [rbp + 0x68], 0
je 0x67765c
mov rcx, qword [rbp + 0x60]
movzx rdx, byte [rbp + 0x68]
call fcn.0040eb60
mov qword [rbp + 0x60], rax
nop
mov rcx, qword [rbp + 0x60]
call fcn.0068d430
mov rcx, qword [0x00674fe0]
mov dl, 1
call fcn.0067be00
mov rcx, qword [rbp + 0x60]
mov qword [rcx + 0x140], rax
mov rcx, qword [0x005c49f8]
mov dl, 1
call fcn.005daf00
mov rcx, qword [rbp + 0x60]
mov qword [rcx + 0x138], rax
mov rcx, qword [0x00673a38]
call fcn.0067b650
lea rcx, [0x00677770]
mov edx, 1
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
call sub.winhttp.dll_WinHttpOpen
mov rcx, qword [rbp + 0x60]
mov qword [rcx + 0x130], rax
test rax, rax
jne 0x6776f0
mov rcx, qword [0x00684920]
mov dl, 1
mov r8, qword [0x007899a8]
call fcn.0043f840
mov rcx, rax
call fcn.00410630
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 0x130]
lea rdx, [0x00677420]
mov r8d, 0x10010
xor r9, r9
call sub.winhttp.dll_WinHttpSetStatusCallback
cmp byte [rbp + 0x68], 0
je 0x677753
mov rcx, qword [rbp + 0x60]
call fcn.0040eba0
mov qword [rbp + 0x60], rax
jmp 0x677753
mov rax, qword [rbp + 0x60]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x6794d0
Capabilities:
Prepare http request

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
nop
mov rax, qword [rbp + 0x40]
mov byte [rax + 0x141], 0
mov byte [rax + 0x140], 0
mov rax, qword [rbp + 0x48]
cmp dword [rax + 0x20], 0
jle 0x679533
mov rax, qword [rbp + 0x48]
movzx rbx, word [rax + 0x20]
jmp 0x679535
xor ebx, ebx
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x18]
call fcn.00412730
mov rcx, qword [rbp + 0x40]
mov rcx, qword [rcx + 0xa0]
mov rcx, qword [rcx + 0x130]
mov rdx, rax
mov r8d, ebx
xor r9, r9
call sub.winhttp.dll_WinHttpConnect
mov rcx, qword [rbp + 0x40]
mov qword [rcx + 0x118], rax
test rax, rax
jne 0x6795b4
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x90], rax
mov byte [rbp + 0x98], 0x11
mov rcx, qword [0x00684a70]
mov dl, 1
mov r8, qword [0x007892e0]
lea r9, [rbp + 0x90]
mov dword [rsp + 0x20], 0
call fcn.0043fa00
mov rcx, rax
call fcn.00410630
xor ebx, ebx
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
lea rdx, [0x006797a0]
call fcn.00412c90
test eax, eax
jne 0x6795d3
or ebx, 0x800000
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp + 0x88]
call fcn.005d1780
mov rcx, qword [rbp + 0x88]
call fcn.00412730
mov rsi, rax
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x48]
call fcn.006771a0
mov rcx, qword [rbp + 0x80]
call fcn.00412730
mov rcx, qword [rbp + 0x40]
mov rcx, qword [rcx + 0x118]
mov rdx, rsi
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], ebx
call sub.winhttp.dll_WinHttpOpenRequest
mov rcx, qword [rbp + 0x40]
mov qword [rcx + 0x120], rax
test rax, rax
jne 0x6796a5
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0x60], eax
mov byte [rbp + 0x68], 0
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x58]
mov edx, eax
mov r8, qword [0x00797c78]
call fcn.0043d220
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x78], 0x11
mov rcx, qword [0x00684a70]
mov dl, 1
mov r8, qword [0x00789910]
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], 1
call fcn.0043fa00
mov rcx, rax
call fcn.00410630
mov rax, qword [rbp + 0x40]
mov ebx, dword [rax + 0x18]
mov rcx, qword [rbp + 0x40]
call fcn.005d1970
mov rcx, qword [rbp + 0x40]
mov rcx, qword [rcx + 0x120]
mov edx, ebx
mov r8d, ebx
mov r9d, eax
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x20], eax
call sub.winhttp.dll_WinHttpSetTimeouts
test eax, eax
jne 0x679734
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0x60], eax
mov byte [rbp + 0x68], 0
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x50]
mov edx, eax
mov r8, qword [0x00797c78]
call fcn.0043d220
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x70], rax
mov byte [rbp + 0x78], 0x11
mov rcx, qword [0x00684a70]
mov dl, 1
mov r8, qword [0x00789b00]
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], 1
call fcn.0043fa00
mov rcx, rax
call fcn.00410630
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.00411440
lea rcx, [rbp + 0x80]
mov edx, 2
call fcn.00411440
lea rsp, [rbp + 0xa0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x67b650
Capabilities:
Initialize winhttp library

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x60], rcx
mov rcx, qword [0x00797c70]
mov rax, qword [0x00797c70]
mov rbx, qword [rax]
call qword [rbx]
nop
cmp qword [0x00797c80], 0
jne 0x67b6cc
lea rcx, [0x0067b714]
mov edx, 1
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
call sub.winhttp.dll_WinHttpOpen
mov qword [0x00797c80], rax
cmp qword [0x00797c80], 0
jne 0x67b6cc
mov rcx, qword [0x00684920]
mov dl, 1
mov r8, qword [0x007899a8]
call fcn.0043f840
mov rcx, rax
call fcn.00410630
nop
mov rcx, qword [0x00797c70]
mov rax, qword [0x00797c70]
mov rbx, qword [rax]
call qword [rbx + 8]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x6843e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
mov r8d, r8d
pop rbp
jmp fcn.00683c70
Function at 0x72a0c0
Capabilities:
Capture screenshot

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.00411530
nop
lea rcx, [0x0072a1fc]
xor edx, edx
xor r8, r8
xor r9, r9
call sub.gdi32.dll_CreateDCW
mov rbx, rax
mov rcx, rbx
call sub.gdi32.dll_CreateCompatibleDC
mov rsi, rax
mov rcx, rbx
mov edx, 8
call sub.gdi32.dll_GetDeviceCaps
mov edi, eax
mov rcx, rbx
mov edx, 0xa
call sub.gdi32.dll_GetDeviceCaps
mov rcx, rbx
mov edx, edi
mov r8d, eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov r13, rax
mov rcx, rsi
mov rdx, r13
call sub.gdi32.dll_SelectObject
mov rcx, qword [0x0071d360]
mov dl, 1
call fcn.00725760
mov rdi, rax
mov rcx, rdi
mov rdx, r13
call fcn.00728250
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x60]
mov r13d, eax
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x48]
mov rcx, rsi
xor edx, edx
xor r8, r8
mov r9d, r13d
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0x40cc0020
call sub.gdi32.dll_BitBlt
mov rcx, rdi
mov rdx, qword [rbp + 0x80]
mov r13, qword [rdi]
call qword [r13 + 0xb0]
mov rcx, rdi
call fcn.0040e1c0
mov rcx, rbx
call sub.gdi32.dll_DeleteDC
mov rcx, rsi
call sub.gdi32.dll_DeleteDC
nop
lea rcx, [rbp + 0x80]
call fcn.00411360
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x72b990
Capabilities:
Copy file

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x70]
call fcn.00411530
nop
lea rcx, [rbp + 0x48]
mov rdx, qword [0x00797e38]
lea r8, [0x0072bb18]
call fcn.00412b20
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00435e00
test al, al
jne 0x72ba3f
mov rcx, qword [rbp + 0x70]
call fcn.00412730
mov rbx, rax
lea rcx, [rbp + 0x40]
mov rdx, qword [0x00797e38]
lea r8, [0x0072bb4c]
call fcn.00412b20
mov rcx, qword [rbp + 0x40]
call fcn.00412730
mov rcx, rbx
mov rdx, rax
movzx rax, byte [rbp + 0x27]
test al, al
setne al
movzx rax, al
neg eax
mov r8d, eax
call sub.kernel32.dll_CopyFileW
lea rcx, [rbp + 0x38]
mov rdx, qword [0x00797e38]
lea r8, [0x0072bb80]
call fcn.00412b20
mov rcx, qword [rbp + 0x38]
mov dl, 1
call fcn.00435e00
test al, al
jne 0x72bab6
lea rcx, [rbp + 0x30]
mov rdx, qword [0x00797e38]
lea r8, [0x0072bb80]
call fcn.00412b20
mov rcx, qword [rbp + 0x30]
call fcn.00412730
mov rbx, rax
lea rcx, [rbp + 0x28]
mov rdx, qword [0x00797e38]
lea r8, [0x0072bb4c]
call fcn.00412b20
mov rcx, qword [rbp + 0x28]
call fcn.00412730
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CreateHardLinkW
nop
lea rcx, [rbp + 0x28]
mov edx, 5
call fcn.00411440
lea rcx, [rbp + 0x70]
call fcn.00411360
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret