joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100099304
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
xor edi, edi
and qword [rax + 0x18], rdi
and qword [rbp], rdi
and dword [rsi], edi
lea rcx, [rax - 0x28]
mov rbx, r8
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test rbx, rbx
je 0x100099364
lea r9, [rsp + 0x70]
mov r8d, 0x20019
mov rdx, rbx
xor ecx, ecx
call fcn.100099268
mov ebx, eax
test eax, eax
jns 0x100099369
jmp 0x100099461
and qword [rsp + 0x70], rdi
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
je 0x1000993a9
test eax, eax
js 0x100099461
mov ebx, 0xc0000001
jmp 0x100099461
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x1000993d9
mov ebx, 0xc000009a
jmp 0x100099461
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
js 0x100099461
cmp dword [rdi + 4], 1
je 0x10009941a
mov ebx, 0xc0000024
jmp 0x100099461
add dword [rsp + 0x60], 0xfffffff4
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbp], rax
test rax, rax
je 0x1000993cf
mov r8d, dword [rsp + 0x60]
lea rdx, [rdi + 0xc]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r11d, dword [rsp + 0x60]
xor ebx, ebx
mov dword [rsi], r11d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x100099471
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x100099492
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000994a8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rsi, rdx
mov rdx, rcx
xor ebp, ebp
lea rcx, [rax - 0x58]
mov qword [rax + 0x20], rbp
mov qword [rax - 0x60], rbp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea edx, [rbp + 1]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp eax, ebp
jl 0x100099685
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edi, ebp
mov dword [rsp + 0xa0], ebp
jmp 0x10009958d
cmp qword [rsp + 0x28], rbp
je 0x100099554
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [rsp + 0xa0]
xor edx, edx
mov word [rsp + 0x22], ax
lea edi, [rax + 2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8d, edi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x28], rax
cmp rax, rbp
je 0x100099695
mov rcx, qword [rsp + 0xa8]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
mov ebx, eax
cmp eax, 0xc0000023
je 0x10009952f
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
cmp ebx, ebp
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rbp
jl 0x100099660
movzx ecx, word [rsp + 0x20]
lea r8, [rsp + 0x40]
mov edx, 1
shr rcx, 1
mov word [rax + rcx*2], bp
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0xa8]
mov word [rsp + 0x22], di
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp eax, ebp
jge 0x10009958d
mov rax, qword [rsp + 0x28]
mov ebx, ebp
mov qword [rsi], rax
mov rcx, qword [rsp + 0xa8]
cmp rcx, rbp
je 0x10009965c
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rbp
cmp ebx, ebp
jge 0x100099683
cmp rax, rbp
je 0x100099683
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0xc000009a
jmp 0x10009963c
Function at 0x10009a124
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
jne 0x10009a151
lea edx, [rcx + 0x38]
lea r8, [0x100009b00]
lea rcx, [0x100009b10]
call fcn.10009a050
and qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor edi, edi
mov rcx, rbx
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
call fcn.10009b954
mov ebx, eax
test eax, eax
js 0x10009a22f
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10009a1b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070005
jne 0x10009a22f
mov ebx, 0x80780047
jmp 0x10009a22f
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [0x100009b40]
call fcn.10009bb88
mov ebx, eax
test eax, eax
js 0x10009a22a
and qword [rsp + 0x30], rdi
mov rdi, qword [rsp + 0x58]
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x10009a22f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x80780047
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x80070005
cmove ecx, ebx
mov ebx, ecx
jmp 0x10009a22f
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rsi, 0xffffffffffffffff
je 0x10009a252
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x10009b30c
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r9d
mov rdi, r8
mov rbp, rdx
cmp rdx, rbx
jne 0x10009b348
lea r8, [0x100009c30]
lea rcx, [0x100009ba8]
mov edx, 0x205
call fcn.10009a050
cmp rdi, rbx
jne 0x10009b365
lea r8, [0x100009be8]
lea rcx, [0x100009ba8]
mov edx, 0x206
call fcn.10009a050
cmp esi, ebx
jbe 0x10009b3bd
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call sub.bcrypt.dll_BCryptHashData
cmp eax, ebx
jge 0x10009b3f4
bts eax, 0x1c
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009b3f4
test byte [rcx + 0x1c], 1
je 0x10009b3f4
cmp byte [rcx + 0x19], 2
jb 0x10009b3f4
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ad8]
mov edx, 0x13
mov r9d, ebx
call fcn.10001c878
jmp 0x10009b3f4
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009b3f4
test byte [rcx + 0x1c], 1
je 0x10009b3f4
cmp byte [rcx + 0x19], 5
jb 0x10009b3f4
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ad8]
mov edx, 0x14
mov r9, rdi
call fcn.10001d71c
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10009c568
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor r14d, r14d
mov r12, rdx
lea r9, [rax + 0x10]
mov qword [rdx], r14
xor r8d, r8d
xor edx, edx
mov r13, rcx
mov ebx, r14d
mov dword [rax + 0x18], r14d
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp eax, r14d
jne 0x10009c5c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x10009c5c7
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
jmp 0x10009c690
mov ecx, dword [rsp + 0x68]
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
cmp rax, r14
jne 0x10009c5e6
mov ebx, 0x8007000e
jmp 0x10009c682
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x70]
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp eax, r14d
jne 0x10009c618
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
jmp 0x10009c682
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbp, rcx
cmp ecx, r14d
je 0x10009c682
lea eax, [rcx + 1]
mov ebx, eax
lea rcx, [rax + rax]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
cmp rax, r14
jne 0x10009c650
mov ebx, 0x8007000e
jmp 0x10009c674
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1000c23ac
cmp eax, r14d
mov ebx, eax
jl 0x10009c674
lea ecx, [rbp - 1]
mov qword [r12], rdi
mov word [rdi + rcx*2], r14w
mov rdi, r14
cmp rdi, r14
je 0x10009c682
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rsi, r14
je 0x10009c690
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, r14d
jge 0x10009c6d0
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009c6d0
test byte [rcx + 0x1c], 1
je 0x10009c6d0
cmp byte [rcx + 0x19], 3
jb 0x10009c6d0
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ab8]
mov edx, 0xa
mov r9, r13
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10009c6f0
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push r12
push r15
sub rsp, 0x40
and qword [rdx], 0
and qword [rax + 0x18], 0
mov rsi, rdx
lea rdx, [rax + 0x18]
mov r12, rcx
call fcn.10009ba10
lea r15, [0x1001653b8]
mov ebx, eax
test eax, eax
js 0x10009c84c
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x80]
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x10009c78d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009c81b
test byte [rcx + 0x1c], 1
je 0x10009c81b
cmp byte [rcx + 0x19], 2
jb 0x10009c81b
lea edx, [rbp + 0xc]
jmp 0x10009c7f8
xor eax, eax
xor r9d, r9d
xor r8d, r8d
and qword [rsp + 0x38], rax
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov edx, 0x7405c
mov rcx, rbp
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10009c82b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r15
je 0x10009c81b
test byte [rcx + 0x1c], 1
je 0x10009c81b
cmp byte [rcx + 0x19], 2
jb 0x10009c81b
mov edx, 0xc
mov r9, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ab8]
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x10009c83d
mov rax, qword [rsp + 0x88]
mov qword [rsi], rax
mov rcx, qword [0x1001653b8]
cmp rbp, 0xffffffffffffffff
je 0x10009c853
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
cmp qword [rsp + 0x80], 0
je 0x10009c873
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
test ebx, ebx
jns 0x10009c8a5
cmp rcx, r15
je 0x10009c8a5
bt dword [rcx + 0x1c], 9
jae 0x10009c8a5
cmp byte [rcx + 0x19], 2
jb 0x10009c8a5
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ab8]
mov edx, 0xd
mov r9, r12
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
mov eax, ebx
add rsp, 0x40
pop r15
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x10009d72c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
lea r14, [0x100003ab8]
mov ebp, 1
cmp rcx, r12
je 0x10009d790
test byte [rcx + 0x1c], bpl
je 0x10009d790
cmp byte [rcx + 0x19], 4
jb 0x10009d790
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x17]
mov r8, r14
call fcn.10001c854
xor ebx, ebx
lea rcx, [rsp + 0x20]
xor edx, edx
lea edi, [rbx + 0x14]
mov r8, rdi
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
lea ecx, [rbx + 0x5a]
xor r9d, r9d
mov r8d, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, ebx
jge 0x10009d7fa
mov ebx, eax
bts ebx, 0x1c
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10009d89d
test byte [rcx + 0x1c], 8
je 0x10009d87b
cmp byte [rcx + 0x19], 2
jb 0x10009d87b
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 5]
mov r9d, ebx
mov r8, r14
call fcn.10001c878
jmp 0x10009d874
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10009d82f
test byte [rcx + 0x1c], bpl
je 0x10009d82f
cmp byte [rcx + 0x19], 4
jb 0x10009d82f
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r8, r14
call fcn.10001c878
mov rcx, qword [0x1001653b8]
cmp dword [rsp + 0x30], 2
movzx edi, bl
cmove edi, ebp
cmp rcx, r12
je 0x10009d871
test byte [rcx + 0x1c], bpl
je 0x10009d871
cmp byte [rcx + 0x19], 4
jb 0x10009d871
mov rcx, qword [rcx + 0x10]
lea rax, [0x1000049b8]
cmp dil, bl
lea r9, [0x1000049c0]
mov edx, 0x1b
mov r8, r14
cmovne r9, rax
call fcn.10001db08
mov byte [rsi], dil
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10009d89d
test byte [rcx + 0x1c], bpl
je 0x10009d89d
cmp byte [rcx + 0x19], 4
jb 0x10009d89d
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r8, r14
call fcn.10001c854
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x1000a033c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1000a0383
lea r8, [0x10000a168]
lea rcx, [0x10000a010]
mov edx, 0x79d
call fcn.10009a050
test rsi, rsi
jne 0x1000a03a0
lea r8, [0x10000a180]
lea rcx, [0x10000a010]
mov edx, 0x79e
call fcn.10009a050
and qword [rsi], 0
lea rcx, [rsp + 0x30]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x20], rdi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x1000a0403
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000a0494
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x1000a0471
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x1000a0496
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a046a
test byte [rcx + 0x1c], 1
je 0x1000a046a
cmp byte [rcx + 0x19], 2
jb 0x1000a046a
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x3e]
lea r8, [0x100003aa8]
call fcn.10001c854
mov ebx, 0x8000ffff
jmp 0x1000a0494
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x240]
xor r8d, r8d
call fcn.10009bac4
mov rdi, qword [rsp + 0x20]
mov ebx, eax
test eax, eax
js 0x1000a0498
mov qword [rsi], rdi
test ebx, ebx
jns 0x1000a04a1
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1000a0554
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1000a0580
lea r8, [0x10000a198]
lea rcx, [0x10000a010]
mov edx, 0x814
call fcn.10009a050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000a0603
xor r9d, r9d
xor r8d, r8d
mov dl, dil
mov rcx, rbx
call fcn.10009dbf8
test eax, eax
js 0x1000a0605
mov edx, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1000a0603
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a05f4
test byte [rcx + 0x1c], 2
je 0x1000a05f4
cmp byte [rcx + 0x19], 2
jb 0x1000a05f4
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x40
mov r9d, ebx
call fcn.10001c878
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1000a0605
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000a0af4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov r12, rdx
mov rbp, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
lea r14, [0x1000039a8]
cmp rcx, rax
je 0x1000a0b49
test byte [rcx + 0x1c], 1
je 0x1000a0b49
cmp byte [rcx + 0x19], 4
jb 0x1000a0b49
mov rcx, qword [rcx + 0x10]
mov edx, 0xa
mov r8, r14
call fcn.10001c854
xor ebx, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
cmp eax, ebx
jne 0x1000a0bac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000a0c76
test byte [rcx + 0x1c], 1
je 0x1000a0c76
cmp byte [rcx + 0x19], 2
jb 0x1000a0c76
lea edx, [rdi + 0xb]
jmp 0x1000a0c22
mov rcx, rsi
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
cmp rax, rbx
jne 0x1000a0bd1
mov ebx, 0x8007000e
lea rsi, [0x1001653b8]
jmp 0x1000a0c76
mov r8d, esi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
jne 0x1000a0c37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000a0c76
test byte [rcx + 0x1c], 1
je 0x1000a0c76
cmp byte [rcx + 0x19], 2
jb 0x1000a0c76
mov edx, 0xc
mov rcx, qword [rcx + 0x10]
mov r9, rbp
mov r8, r14
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
jmp 0x1000a0c76
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000a0c6f
test byte [rcx + 0x1c], 1
je 0x1000a0c6f
cmp byte [rcx + 0x19], 4
jb 0x1000a0c6f
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov r9, rbp
mov r8, r14
mov qword [rsp + 0x20], rdi
call fcn.10001df74
mov qword [r12], rdi
mov rdi, rbx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000a0ca8
test byte [rcx + 0x1c], 1
je 0x1000a0ca8
cmp byte [rcx + 0x19], 4
jb 0x1000a0ca8
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r8, r14
call fcn.10001c854
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x1000a0ccc
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 5]
lea r8, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1000a0d0e
lea r8, [0x10000a230]
lea rcx, [0x10000a238]
mov edx, 0x76
call fcn.10009a050
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700ea
jne 0x1000a0d9f
mov ecx, dword [rsp + 0x38]
xor ebx, ebx
inc ecx
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1000a0d4a
mov ebx, 0x8007000e
jmp 0x1000a0d91
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
inc r8d
add r8, r8
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x38]
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1000a0d8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000a0d91
mov qword [rsi], rdi
xor edi, edi
test rdi, rdi
je 0x1000a0d9f
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000a13b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r13, r9
mov r12, r8
mov rsi, rdx
mov r14, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000a1406
test byte [rcx + 0x1c], 1
je 0x1000a1406
cmp byte [rcx + 0x19], 4
jb 0x1000a1406
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x18
call fcn.10001c854
mov rbp, qword [rsp + 0x90]
xor ebx, ebx
and dword [rsp + 0x30], ebx
and dword [rsp + 0x80], ebx
test r12, r12
je 0x1000a142f
test rsi, rsi
je 0x1000a142f
test r13, r13
je 0x1000a142f
test rbp, rbp
jne 0x1000a1447
lea r8, [0x10000a2d0]
lea rcx, [0x10000a238]
mov edx, 0x1bc
call fcn.10009a050
and qword [r12], rbx
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000a14cd
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1000a15f9
test byte [rcx + 0x1c], 1
je 0x1000a15d3
cmp byte [rcx + 0x19], 2
jb 0x1000a15d3
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x19
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
jmp 0x1000a15cc
mov eax, dword [rsp + 0x80]
test eax, eax
jne 0x1000a14f7
lea r8, [0x10000a320]
lea rcx, [0x10000a238]
mov edx, 0x1ca
call fcn.10009a050
mov eax, dword [rsp + 0x80]
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1000a1511
mov ebx, 0x8007000e
jmp 0x1000a15b0
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x80]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000a1598
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x1000a15be
test byte [rcx + 0x1c], 1
je 0x1000a15be
cmp byte [rcx + 0x19], 2
jb 0x1000a15be
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x1a
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
jmp 0x1000a15b7
mov eax, dword [rsp + 0x30]
mov qword [r12], rdi
xor edi, edi
mov dword [r13], eax
mov eax, dword [rsp + 0x80]
mov dword [rbp], eax
lea rbp, [0x1001653b8]
mov rcx, qword [0x1001653b8]
test rdi, rdi
je 0x1000a15d3
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000a15f9
test byte [rcx + 0x1c], 1
je 0x1000a15f9
cmp byte [rcx + 0x19], 4
jb 0x1000a15f9
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x1b
call fcn.10001c854
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret