joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a17d8
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1000a181e
test byte [rcx + 0x1c], 1
je 0x1000a181e
cmp byte [rcx + 0x19], 4
jb 0x1000a181e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x1f
call fcn.10001c854
xor ebx, ebx
xor eax, eax
lea r8, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x34]
lea r9d, [rbx + 0xc]
lea edx, [rbx + 5]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.ntdll.dll_NtQueryKey]
cmp eax, ebx
jge 0x1000a1882
mov ebx, eax
bts ebx, 0x1c
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000a190c
test byte [rcx + 0x1c], 1
je 0x1000a18e6
cmp byte [rcx + 0x19], 2
jb 0x1000a18e6
mov edx, 0x20
jmp 0x1000a18cc
mov eax, dword [rsp + 0x40]
mov r9d, 4
lea r8, [rsp + 0x30]
or eax, 0xe
lea edx, [r9 - 2]
mov rcx, rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
cmp eax, ebx
jge 0x1000a18df
mov ebx, eax
bts ebx, 0x1c
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000a190c
test byte [rcx + 0x1c], 1
je 0x1000a18e6
cmp byte [rcx + 0x19], 2
jb 0x1000a18e6
mov edx, 0x21
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov r9d, ebx
call fcn.10001c878
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000a190c
test byte [rcx + 0x1c], 1
je 0x1000a190c
cmp byte [rcx + 0x19], 4
jb 0x1000a190c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x22
call fcn.10001c854
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1000a1924
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov r12, rcx
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x1000a197c
test byte [rcx + 0x1c], 1
je 0x1000a197c
cmp byte [rcx + 0x19], 4
jb 0x1000a197c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x23
call fcn.10001c854
mov eax, dword [rsp + 0x70]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rdi
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebx
je 0x1000a19e9
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000a19d8
test byte [rcx + 0x1c], 1
je 0x1000a19d8
cmp byte [rcx + 0x19], 2
jb 0x1000a19d8
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x24]
lea r8, [0x1000039a8]
xor r9d, r9d
call fcn.10001c878
mov rcx, qword [0x1001653b8]
movzx eax, di
or eax, 0x80070000
cmp edi, ebx
cmovle eax, edi
mov ebx, eax
jmp 0x1000a19f0
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000a1a16
test byte [rcx + 0x1c], 1
je 0x1000a1a16
cmp byte [rcx + 0x19], 4
jb 0x1000a1a16
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x25
call fcn.10001c854
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x1000a1a38
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r12, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a1a83
test byte [rcx + 0x1c], 1
je 0x1000a1a83
cmp byte [rcx + 0x19], 4
jb 0x1000a1a83
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x26
call fcn.10001c854
xor ebx, ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x78], ebx
mov dword [rdi], ebx
cmp rsi, rbx
jne 0x1000a1ab0
lea r8, [0x10000a388]
lea rcx, [0x10000a238]
mov edx, 0x2cf
call fcn.10009a050
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov rdx, rsi
mov rcx, r12
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
cmp ebp, ebx
je 0x1000a1af1
cmp eax, 2
jne 0x1000a1af1
lea ebx, [rax - 1]
jmp 0x1000a1b69
cmp eax, ebx
je 0x1000a1b47
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000a1b9d
test byte [rcx + 0x1c], 1
je 0x1000a1b77
cmp byte [rcx + 0x19], 3
jb 0x1000a1b77
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x27
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
jmp 0x1000a1b70
cmp dword [rsp + 0x68], 4
je 0x1000a1b55
mov ebx, 0x8007065d
jmp 0x1000a1b69
cmp dword [rsp + 0x78], 4
je 0x1000a1b63
mov ebx, 0x80004005
jmp 0x1000a1b69
mov eax, dword [rsp + 0x70]
mov dword [rdi], eax
lea rdi, [0x1001653b8]
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000a1b9d
test byte [rcx + 0x1c], 1
je 0x1000a1b9d
cmp byte [rcx + 0x19], 4
jb 0x1000a1b9d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x28
call fcn.10001c854
mov eax, ebx
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000a1bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, r9
mov r12, r8
mov r13, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a1c02
test byte [rcx + 0x1c], 1
je 0x1000a1c02
cmp byte [rcx + 0x19], 4
jb 0x1000a1c02
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x2c
call fcn.10001c854
xor ebx, ebx
xor ecx, ecx
lea esi, [rbx + 0x40]
mov qword [r12], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], esi
mov dword [rbp], ebx
jmp 0x1000a1c95
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a1c51
test byte [rcx + 0x1c], 1
je 0x1000a1c51
cmp byte [rcx + 0x19], 4
jb 0x1000a1c51
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x2d
mov r9d, esi
call fcn.10001c878
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
lea rdx, [0x100015b18]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
cmp eax, ebx
je 0x1000a1d52
cmp eax, 0xea
jne 0x1000a1d05
mov esi, dword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
cmp rax, rbx
jne 0x1000a1c1a
mov ebx, 0x8007000e
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a1cf2
test byte [rcx + 0x1c], 1
je 0x1000a1cf2
cmp byte [rcx + 0x19], 4
jb 0x1000a1cf2
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x2f
call fcn.10001c854
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a1cb5
test byte [rcx + 0x1c], 1
je 0x1000a1cb5
cmp byte [rcx + 0x19], 2
jb 0x1000a1cb5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x2e
mov r9d, ebx
call fcn.10001c878
jmp 0x1000a1cb5
cmp dword [rsp + 0x70], 7
je 0x1000a1d63
mov ebx, 0x8000ffff
jmp 0x1000a1cb5
mov eax, dword [rsp + 0x68]
mov qword [r12], rdi
mov rdi, rbx
mov dword [rbp], eax
jmp 0x1000a1cb5
Function at 0x1000a1e1c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
mov qword [rax + 8], rbx
test rcx, rcx
jne 0x1000a1e56
lea r8, [0x10000a3b0]
lea rcx, [0x10000a238]
mov edx, 0x614
call fcn.10009a050
and qword [rsi], rbx
mov edi, 0x208
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
test rax, rax
jne 0x1000a1e76
mov edi, 0x8007000e
jmp 0x1000a1ed0
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov edx, 0x104
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test eax, eax
js 0x1000a1eb9
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.10009b954
mov edi, eax
test eax, eax
js 0x1000a1eb4
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
jmp 0x1000a1eb9
mov rbx, qword [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x1000a1ed0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x1000a2534
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x40
mov ebp, r8d
mov rdi, rcx
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
lea r14, [0x1000039a8]
cmp rcx, r13
je 0x1000a258e
test byte [rcx + 0x1c], 1
je 0x1000a258e
cmp byte [rcx + 0x19], 4
jb 0x1000a258e
mov rcx, qword [rcx + 0x10]
mov edx, 0x5d
mov r8, r14
call fcn.10001c854
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
cmp rdi, rbx
jne 0x1000a25b6
lea r8, [0x10000a530]
lea rcx, [0x10000a238]
mov edx, 0x767
call fcn.10009a050
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, ebx
jne 0x1000a261f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000a276e
test byte [rcx + 0x1c], 1
je 0x1000a274c
cmp byte [rcx + 0x19], 2
jb 0x1000a274c
mov rcx, qword [rcx + 0x10]
mov edx, 0x5e
mov r9d, eax
mov r8, r14
call fcn.10001c878
jmp 0x1000a2745
mov eax, dword [rsp + 0x24]
cmp eax, 1
jne 0x1000a2666
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000a276e
test byte [rcx + 0x1c], al
je 0x1000a274c
cmp byte [rcx + 0x19], 4
jb 0x1000a274c
lea edx, [rax + 0x5e]
mov rcx, qword [rcx + 0x10]
lea r9, [0x10000a520]
mov r8, r14
call fcn.10001db08
jmp 0x1000a2745
mov r15d, 0x1388
cmp eax, 3
je 0x1000a2676
cmp eax, 4
jne 0x1000a26bb
mov ecx, dword [rsp + 0x38]
cmp ecx, r15d
cmovb ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, ebx
je 0x1000a272b
cmp dword [rsp + 0x24], 1
je 0x1000a2709
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r11, rax
sub r11, rsi
cmp r11, rbp
ja 0x1000a26d2
mov eax, dword [rsp + 0x24]
jmp 0x1000a266c
mov rcx, qword [0x1001653b8]
cmp eax, 1
je 0x1000a274c
mov ebx, 0x80780129
jmp 0x1000a274c
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000a2702
test byte [rcx + 0x1c], 1
je 0x1000a2702
cmp byte [rcx + 0x19], 2
jb 0x1000a2702
mov rcx, qword [rcx + 0x10]
mov edx, 0x61
mov r8, r14
call fcn.10001c854
mov rcx, qword [0x1001653b8]
mov ebx, 0x800705b4
jmp 0x1000a274c
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000a276e
test byte [rcx + 0x1c], 1
je 0x1000a274c
cmp byte [rcx + 0x19], 4
jb 0x1000a274c
mov edx, 0x60
jmp 0x1000a264e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000a276e
test byte [rcx + 0x1c], 1
je 0x1000a276e
cmp byte [rcx + 0x19], 4
jb 0x1000a276e
mov rcx, qword [rcx + 0x10]
mov edx, 0x62
mov r8, r14
call fcn.10001c854
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
Function at 0x1000a5530
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r15
sub rsp, 0x40
mov rdi, r9
mov r12, rdx
mov rbx, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
lea r15, [0x100003988]
cmp rcx, rax
je 0x1000a5585
test byte [rcx + 0x1c], 1
je 0x1000a5585
cmp byte [rcx + 0x19], 4
jb 0x1000a5585
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r8, r15
call fcn.10001c854
and qword [rsp + 0x68], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x38], 0
test rdi, rdi
jne 0x1000a55b4
lea r8, [0x10000a908]
lea rcx, [0x10000a830]
mov edx, 0x1e3
call fcn.10009a050
or qword [rdi], 0xffffffffffffffff
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1000a5ab8
mov ebx, eax
test eax, eax
js 0x1000a571d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9d, 8
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x1000a570f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a564b
test byte [rcx + 0x1c], 1
je 0x1000a564b
cmp byte [rcx + 0x19], 2
jb 0x1000a564b
mov rcx, qword [rcx + 0x10]
mov edx, 0x1d
mov r9d, ebx
mov r8, r15
call fcn.10001c878
cmp ebx, 0x8007052e
je 0x1000a5667
cmp ebx, 0x8007051f
je 0x1000a5667
cmp ebx, 0x8007052f
jne 0x1000a571d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov r8, r12
lea r9d, [rbx + 9]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x1000a56df
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a571d
test byte [rcx + 0x1c], 1
je 0x1000a571d
cmp byte [rcx + 0x19], 2
jb 0x1000a571d
mov rcx, qword [rcx + 0x10]
mov edx, 0x1e
mov r9d, ebx
mov r8, r15
call fcn.10001c878
jmp 0x1000a571d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a570f
test byte [rcx + 0x1c], 1
je 0x1000a570f
cmp byte [rcx + 0x19], 4
jb 0x1000a570f
mov rcx, qword [rcx + 0x10]
mov edx, 0x1f
mov r8, r15
call fcn.10001c854
mov rax, qword [rsp + 0x68]
or qword [rsp + 0x68], 0xffffffffffffffff
mov qword [rdi], rax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
or qword [rsp + 0x68], 0xffffffffffffffff
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a5774
test byte [rcx + 0x1c], 1
je 0x1000a5774
cmp byte [rcx + 0x19], 4
jb 0x1000a5774
mov rcx, qword [rcx + 0x10]
mov edx, 0x20
mov r8, r15
call fcn.10001c854
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r15
ret
Function at 0x1000a74ac
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor ebp, ebp
mov rsi, rcx
cmp rcx, rbp
jne 0x1000a74f5
lea r8, [0x10000acd0]
lea rcx, [0x10000ac30]
mov edx, 0x24a
call fcn.10009a050
mov qword [rsi], rbp
mov rbx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rbx, r12
je 0x1000a7533
test byte [rbx + 0x1c], 1
je 0x1000a7533
cmp byte [rbx + 0x19], 4
jb 0x1000a7533
mov rcx, qword [rbx + 0x10]
lea r8, [0x1000036e8]
mov edx, 0x23
call fcn.10001c854
mov rbx, qword [0x1001653b8]
mov edi, 0x208
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rdi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x230]
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
lea r8, [0x1000036f8]
lea rax, [rsp + 0x20]
mov r11d, 0x104
sub r8, rax
lea rcx, [rsp + 0x20]
mov rdx, r11
mov edi, ebp
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1000a759b
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x1000a759b
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000a7578
cmp rdx, rbp
jne 0x1000a75a9
sub rcx, 2
mov edi, 0x8007007a
cmp edi, ebp
mov word [rcx], bp
jl 0x1000a75fc
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, r11d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
jne 0x1000a75e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, ebp
cmovle edi, eax
jmp 0x1000a75f5
lea rcx, [rsp + 0x230]
xor r8d, r8d
mov rdx, rsi
call fcn.10009bac4
mov edi, eax
mov rbx, qword [0x1001653b8]
cmp rbx, r12
je 0x1000a7622
test byte [rbx + 0x1c], 1
je 0x1000a7622
cmp byte [rbx + 0x19], 4
jb 0x1000a7622
mov rcx, qword [rbx + 0x10]
lea r8, [0x1000036e8]
mov edx, 0x24
call fcn.10001c854
mov eax, edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1000b2138
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor edi, edi
lea r13, [0x1001653b8]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000b21c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x20
jne 0x1000b21ff
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000b21b6
test byte [rcx + 0x1c], 1
je 0x1000b21b6
cmp byte [rcx + 0x19], 3
jb 0x1000b21b6
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x32]
lea r8, [0x1000036a8]
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.10001df74
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x1000b2160
cmp edi, 5
jne 0x1000b2247
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000b21f8
test byte [rcx + 0x1c], 1
je 0x1000b21f8
cmp byte [rcx + 0x19], 2
jb 0x1000b21f8
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x4f]
lea r8, [0x1000036a8]
call fcn.10001c854
mov eax, 0x80780163
jmp 0x1000b2249
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x1000b2238
test byte [rcx + 0x1c], 1
je 0x1000b2238
cmp byte [rcx + 0x19], 2
jb 0x1000b2238
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r8, [0x1000036a8]
mov edx, 0x53
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.10001e39c
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1000b2249
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x1000b32d4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x58], rax
and dword [rsp + 0x30], 0
mov ebx, edx
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000b3379
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000b336a
test byte [rcx + 0x1c], 2
je 0x1000b336a
cmp byte [rcx + 0x19], 2
jb 0x1000b336a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000036a8]
mov edx, 0x63
mov r9d, ebx
call fcn.10001c878
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1000b33e3
mov r9d, dword [rsp + 0x30]
cmp r9d, 0x20
je 0x1000b33c2
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000b33da
test byte [rcx + 0x1c], 2
je 0x1000b33da
cmp byte [rcx + 0x19], 2
jb 0x1000b33da
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000036a8]
mov edx, 0x64
mov dword [rsp + 0x20], 0x20
call fcn.10001d914
jmp 0x1000b33da
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x38]
mov r8d, 0x20
call fcn.10009b09c
test eax, eax
jns 0x1000b33e3
neg ebx
sbb eax, eax
add eax, 0x80780002
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1000b3404
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x58], rax
and dword [rsp + 0x30], 0
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x20]
lea rcx, [rsp + 0x38]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x38]
mov r8d, 0x20
call fcn.10009af3c
mov ebx, eax
test eax, eax
js 0x1000b34e5
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000b34c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000b34b6
test byte [rcx + 0x1c], 2
je 0x1000b34b6
cmp byte [rcx + 0x19], 2
jb 0x1000b34b6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000036a8]
mov edx, 0x65
mov r9d, edi
call fcn.10001c878
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1000b34e5
cmp dword [rsp + 0x30], 0x20
je 0x1000b34e5
lea r8, [0x10000b8f8]
lea rcx, [0x10000b0c0]
mov edx, 0xd2f
call fcn.10009a050
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1000b8814
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
test r8d, r8d
je 0x1000b8853
test rdx, rdx
jne 0x1000b8860
lea r8, [0x10000be10]
lea rcx, [0x10000bd60]
mov edx, 0x2c3
call fcn.10009a050
test rdi, rdi
jne 0x1000b8860
or eax, 0xffffffff
jmp 0x1000b8a5a
xor eax, eax
test ebp, ebp
je 0x1000b887c
mov rdx, rdi
mov r8, rbp
movzx ecx, byte [rdx]
rol eax, 1
inc rdx
xor eax, ecx
sub r8, 1
jne 0x1000b886c
mov r9, qword [rsi + 0x10]
xor edx, edx
div dword [rsi]
mov r15d, edx
mov ebx, edx
mov r12d, edx
shl r15, 3
add r9, r15
mov qword [rsp + 0x78], r15
mov r14, qword [r9]
test r14, r14
jne 0x1000b88d0
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call fcn.1000ba710
test eax, eax
jns 0x1000b88c8
lea rdx, [0x100161530]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call sub.msvcrt.dll__CxxThrowException
int3
shl ebx, 0xb
jmp 0x1000b8a58
mov rax, qword [rsi + 0x18]
mov ecx, ebx
mov r13d, 1
and ecx, 0x1f
shr r12, 5
shl r13d, cl
test dword [rax + r12*4], r13d
jne 0x1000b8999
cmp byte [r14], 9
jne 0x1000b8927
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rdx, r14
mov rcx, rsi
call fcn.1000bb554
cmp dword [rsp + 0x70], ebp
jne 0x1000b8927
mov r8d, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov rdx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1000b88c8
lea r9, [rsp + 0x68]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call fcn.1000ba710
test eax, eax
jns 0x1000b8954
lea rdx, [0x100161530]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call sub.msvcrt.dll__CxxThrowException
int3
mov rax, qword [rsi + 0x10]
mov r8, qword [rsp + 0x68]
mov rdx, r14
lea r9, [r15 + rax]
mov rcx, rsi
call fcn.1000ba7e4
test eax, eax
jns 0x1000b8986
lea rdx, [0x100161530]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call sub.msvcrt.dll__CxxThrowException
int3
mov rax, qword [rsi + 0x18]
shl ebx, 0xb
or dword [rax + r12*4], r13d
or ebx, 1
jmp 0x1000b8a58
mov r13d, dword [r14]
xor r12d, r12d
lea r15, [r14 + 8]
test r13d, r13d
je 0x1000b89ea
mov rdx, qword [r15]
cmp byte [rdx], 9
jne 0x1000b89de
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rcx, rsi
call fcn.1000bb554
cmp dword [rsp + 0x70], ebp
jne 0x1000b89de
mov r8d, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov rdx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1000b8a17
inc r12d
add r15, 8
cmp r12d, r13d
jb 0x1000b89a8
lea r9, [rsp + 0x68]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call fcn.1000ba710
test eax, eax
jns 0x1000b8a1f
lea rdx, [0x100161530]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call sub.msvcrt.dll__CxxThrowException
int3
shl ebx, 0xb
or ebx, r12d
jmp 0x1000b8a58
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
mov rdx, r14
add r9, qword [rsi + 0x10]
mov rcx, rsi
call fcn.1000ba910
test eax, eax
jns 0x1000b8a52
lea rdx, [0x100161530]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call sub.msvcrt.dll__CxxThrowException
int3
shl ebx, 0xb
or ebx, r13d
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret