joyce8/EMBER2024-capa huggingface dataset:
Function at 0x109c5cc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xff0
mov rax, qword [0x010c91a0]
xor rax, rsp
mov qword [rsp + 0xfe0], rax
mov qword [rsp + 0x38], rsp
mov ebx, ecx
lea rcx, [0x010d6fe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp ebx, dword [0x010d7008]
jb 0x109c61b
xor al, al
jmp 0x109c635
mov rcx, qword [0x010d6fd8]
test rcx, rcx
jne 0x109c62b
mov al, 1
jmp 0x109c635
mov rax, rbx
cmp byte [rbx + rcx], 0
setne al
movzx eax, al
test eax, eax
jne 0x109c64d
lea rdx, [0x0109c72a]
mov rcx, qword [rsp + 0x38]
call fcn.010ae490
lea r13, [rsp + 0x1030]
lea r8, [0x010d7010]
mov esi, 0x7d0
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.010a41b4
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r12, eax
mov rdx, qword [0x010d7328]
test rdx, rdx
je 0x109c6d0
mov rcx, rbx
imul rcx, rcx, 0x84
lea rdi, [rcx + rdx + 4]
call qword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, eax
sub ebx, dword [0x010d6c24]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov ecx, esi
sub ecx, r12d
movsxd rdx, ecx
lea rcx, [rsp + r12*2 + 0x40]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
lea r8, [0x010974f8]
call fcn.010a43d8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, eax
movsxd rdx, esi
cdqe
lea rcx, [rsp + rax*2 + 0x40]
mov r9, r13
mov r8, qword [rsp + 0x1028]
call fcn.010a4370
cmp byte [0x010d7330], 0
je 0x109c70c
lea rcx, [rsp + 0x40]
call fcn.0109c770
jmp 0x109c717
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
and qword [rsp + 0x30], 0
lea rcx, [0x010d6fe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xfe0]
xor rcx, rsp
call fcn.010a3ca0
add rsp, 0xff0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x109c770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x010c91a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov rcx, qword [0x010d6dc8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rcx, 0xffffffffffffffff
xor eax, eax
and qword [rsp + 0x20], rax
mov rdi, rbx
lea r9, [rsp + 0x30]
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, qword [0x010d6dc8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x010d6dc8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov word [rsp + 0x38], 0xd
mov word [rsp + 0x3a], 0xa
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.010a3ca0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x109c824
Capabilities:
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0x50
lea rax, [r11 + 0x20]
lea rbp, [0x010d6dd0]
lea r9, [r11 + 0x18]
mov qword [r11 - 0x40], rax
lea rdx, [0x01097560]
xor r8d, r8d
mov qword [r11 - 0x48], rbp
mov rbx, rcx
mov dword [r11 + 0x20], 0x104
mov dword [r11 + 0x18], 4
mov byte [0x010d7330], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x109c99d
cmp dword [rsp + 0x80], 1
jne 0x109c99d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
mov rcx, rbp
je 0x109c8e1
and qword [rsp + 0x30], rax
lea r8d, [rax + 3]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov qword [0x010d6dc8], rax
je 0x109c9ea
mov byte [0x010d7330], 1
jmp 0x109c9ea
lea r8, [0x01097570]
mov edx, 0x104
call fcn.010a41b4
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 3]
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x010d6dc8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x109c962
and qword [rsp + 0x30], 0
lea r8d, [rax + 3]
xor r9d, r9d
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x010d6dc8], rax
jmp 0x109c969
mov rax, qword [0x010d6dc8]
cmp rax, 0xffffffffffffffff
je 0x109c9ea
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov r8d, 4
mov rcx, rax
mov byte [rsp + 0x78], 0xff
mov byte [rsp + 0x79], 0xfe
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x109c8d5
lea r8, [0x010974f0]
mov edx, 0x104
mov rcx, rbp
call fcn.010a41b4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea rdx, [0x01097560]
lea r9d, [rax + 1]
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
add ecx, 1
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [0x010d7330], 0
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x109cb70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x010ccae0]
xor edx, edx
xor ebx, ebx
call fcn.010a33d8
lea ebp, [rbx + 1]
jmp 0x109cc4d
test rbx, rbx
jne 0x109cc59
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rbx, rax
je 0x109cc3c
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x109cbe9
xor ebx, ebx
jmp 0x109cc37
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x109cbe5
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x109cc26
cmp rdi, r11
jae 0x109cbe5
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x109cc14
cmp rdi, r11
jae 0x109cbe5
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x109cc5b
lea rcx, [0x010ccae0]
mov edx, ebp
call fcn.010a33d8
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x109cba6
xor esi, esi
test rsi, rsi
jne 0x109cc64
xor eax, eax
jmp 0x109cc72
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.0109cc94
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x109cc94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x109cdfd
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x109cdfd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x109cdfd
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x109cd35
cmp rdi, r11
jae 0x109cdfd
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x109cd1f
cmp rdi, r11
jae 0x109cdfd
cmp word [rdi], 0
je 0x109cdfd
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x109cd69
mov edx, ebx
mov rcx, rsi
call fcn.0109c440
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x109cd86
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.010a4234
test eax, eax
je 0x109cdd4
cmp eax, 0xc
je 0x109cdc9
cmp eax, 0x16
je 0x109cdbe
cmp eax, 0x22
je 0x109cdbe
cmp eax, 0x50
je 0x109cdd4
mov ecx, 0x80004005
call fcn.0109c59c
int3
mov ecx, 0x80070057
call fcn.0109c59c
int3
mov ecx, 0x8007000e
call fcn.0109c59c
int3
test ebx, ebx
js 0x109cdf2
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x109cdf2
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
and word [rdi + rcx], 0
jmp 0x109cdff
mov ecx, 0x80070057
call fcn.0109c59c
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x109f460
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, r8
mov r8d, dword [r8]
mov esi, edx
mov r9d, edx
lea ebp, [rbx + 0x1d]
lea rdx, [0x01098ef8]
mov ecx, ebp
mov qword [rax - 0x10], rbx
call fcn.0109c5cc
lea r8, [rsp + 0x38]
lea rdx, [0x010971e0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x109f574
cmp esi, ebx
lea rdx, [0x01098f30]
je 0x109f4ff
lea r9d, [rbx + 4]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, ebp
cmp eax, ebx
je 0x109f4f1
lea rdx, [0x01098f48]
jmp 0x109f55f
lea rdx, [0x01098f88]
call fcn.0109c5cc
jmp 0x109f54f
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x109f556
mov r8d, dword [rsp + 0x68]
cmp r8d, ebx
je 0x109f556
lea rdx, [0x01098fb8]
xor ecx, ecx
call fcn.0109c5cc
mov r11d, dword [rsp + 0x68]
mov dword [rdi], r11d
mov ebx, 1
jmp 0x109f567
lea rdx, [0x01098fd8]
mov ecx, ebp
mov r8d, eax
call fcn.0109c5cc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x109f585
lea rdx, [0x01099020]
mov r8d, eax
mov ecx, ebp
call fcn.0109c5cc
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x109f914
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov esi, edx
mov r8d, edx
mov rbx, rcx
lea rdx, [0x010991c8]
mov ecx, 0x1d
call fcn.0109c5cc
xor edi, edi
lea r8, [rsp + 0x38]
and qword [rsp + 0x38], rdi
and dword [rsp + 0x34], edi
lea rdx, [0x01097528]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x109f9b2
lea rax, [rsp + 0x30]
lea rdx, [0x01098cc0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x109f9a7
mov eax, 0x80070006
jmp 0x109fadf
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.0109fdd8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbx + 0xb0], rdi
je 0x109f9eb
lea rcx, [0x01098ce8]
xor r8d, r8d
xor edx, edx
call qword [rbx + 0x78]
mov ecx, 0xa
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x010d72e4], 0
je 0x109fa1e
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x109fabd
or r8d, 0xffffffff
test esi, esi
mov rcx, rdi
je 0x109fa15
lea edx, [r8 + 2]
jmp 0x109fa17
xor edx, edx
call rax
jmp 0x109fabd
mov rax, qword [rbx + 0x88]
and dword [rsp + 0x60], 0
or dword [rsp + 0x68], 0xffffffff
test rax, rax
je 0x109fa85
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call rax
test al, al
je 0x109fa85
mov r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
lea rdx, [0x01099130]
mov ecx, 0x1d
call fcn.0109c5cc
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x109fa96
lea r8, [rbx + 0xcc]
mov edx, 1
mov rcx, rbx
mov dword [r8], r11d
call fcn.0109f460
jmp 0x109fa96
lea rdx, [0x01099180]
mov ecx, 0x1d
call fcn.0109c5cc
test esi, esi
mov rcx, rbx
je 0x109faae
call fcn.0109f664
mov r8d, dword [rbx + 0xcc]
mov rcx, rbx
jmp 0x109fab1
xor r8d, r8d
or r9d, 0xffffffff
mov rdx, rdi
call fcn.0109f5a4
mov rax, qword [rbx + 0xa8]
test rax, rax
je 0x109face
mov rcx, rdi
call rax
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x109fadd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x109fdd8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x010d72e4], 0
mov rbx, rcx
jne 0x109fdfd
cmp dword [0x010d72e8], 0
jne 0x109fdfd
mov eax, 0x80070006
jmp 0x109ff57
and qword [rcx + 0x78], 0
and qword [rcx + 0x80], 0
and qword [rcx + 0x88], 0
and qword [rcx + 0x90], 0
and qword [rcx + 0x98], 0
and qword [rcx + 0xa0], 0
and qword [rcx + 0xa8], 0
lea rcx, [0x01099290]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 0x58], rax
je 0x109ff47
lea rdx, [0x010992c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x010992d8]
mov qword [rbx + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x010d72e8], 0
mov qword [rbx + 0x80], rax
je 0x109ff2d
mov rcx, qword [rbx + 0x58]
lea rdx, [0x010992f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01099318]
mov qword [rbx + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01099338]
mov qword [rbx + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01099350]
mov qword [rbx + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x010992c0]
mov qword [rbx + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01099368]
mov qword [rbx + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01099368]
mov qword [rbx + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc0], rax
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01099388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa8], rax
jmp 0x109ff55
lea rdx, [0x010993a0]
xor ecx, ecx
call fcn.0109c5cc
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x10a1ee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor r13d, r13d
mov rdi, rcx
cmp qword [rcx + 0x98], r13
mov ebp, r13d
jne 0x10a1f44
mov rax, qword [rcx + 0x60]
mov rsi, qword [rax]
mov qword [rax], rax
mov rax, qword [rcx + 0x60]
mov qword [rax + 8], rax
cmp rsi, qword [rcx + 0x60]
mov qword [rcx + 0x68], r13
je 0x10a2139
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.010a03b8
mov rcx, rsi
call fcn.010a35a4
cmp rbx, qword [rdi + 0x60]
mov rsi, rbx
jne 0x10a1f22
jmp 0x10a2139
cmp qword [rcx + 0x68], r13
jne 0x10a1fe8
mov rax, qword [rcx + 0x90]
mov qword [rsp + 0x78], r13
lea r8, [rsp + 0x78]
mov rcx, qword [rax]
mov rax, qword [rdi + 0x70]
mov rdx, qword [rcx + 0x10]
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x28]
cmp eax, r13d
mov ebp, eax
je 0x10a1fcb
mov ecx, eax
call fcn.010b28f0
lea rcx, [0x010980d0]
lea r8, [0x01099de0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rdx, [0x01096ea0]
xor ecx, ecx
mov r9d, 0x160
mov dword [rsp + 0x20], ebp
call fcn.0109c5cc
mov rcx, qword [rsp + 0x78]
cmp rcx, r13
je 0x10a2139
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10a2139
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.010a16e4
mov rcx, qword [rsp + 0x78]
cmp rcx, r13
je 0x10a1fe8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rdi + 0x60]
mov rbx, qword [rax]
cmp rbx, rax
je 0x10a2139
cmp dword [rbx + 0x3c], r13d
jne 0x10a212c
mov r8, qword [rbx + 0x70]
lea rdx, [0x010997b0]
mov ecx, 0x1d
call fcn.0109c5cc
cmp dword [rbx + 0x3c], r13d
jne 0x10a212c
mov rcx, qword [rbx + 0x28]
cmp rcx, r13
jne 0x10a2056
lea rax, [0x010975f0]
lea r8, [0x010997e0]
lea rdx, [0x010975b0]
mov r9d, 0x70
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.0109c5cc
jmp 0x10a212c
cmp qword [rbx + 0x30], r13
jne 0x10a212c
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x68]
lea r8, [rbx + 0x30]
call qword [rax + 0x28]
cmp qword [rbx + 0x30], r13
je 0x10a212c
cmp qword [rbx + 0x48], r13
jne 0x10a2092
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x48], rax
cmp qword [rbx + 0x50], r13
jne 0x10a20ac
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
cmp qword [rbx + 0x20], r13
jne 0x10a212c
lea rax, [rsp + 0x70]
lea r9, [rbx + 0x10]
lea r8, [0x010a03ac]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
mov qword [rbx + 0x20], rax
jne 0x10a20f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rbx + 0x70]
lea rdx, [0x01099850]
xor ecx, ecx
call fcn.0109c5cc
jmp 0x10a2113
mov r9d, dword [rsp + 0x70]
mov r8, qword [rbx + 0x70]
lea rdx, [0x010998a0]
mov ecx, 0x1d
call fcn.0109c5cc
mov eax, 1
mov dword [rbx + 0x3c], 1
xchg dword [rbx + 0x18], eax
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x60]
jne 0x10a1ff8
mov eax, ebp
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10a28a4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x010d7318]
lea rdx, [0x0109a468]
mov ecx, 0x1d
call fcn.0109c5cc
mov rcx, qword [rbx + 0x48]
xor edi, edi
cmp rcx, rdi
je 0x10a28db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x48], rdi
mov rcx, qword [rbx + 0x50]
cmp rcx, rdi
je 0x10a28ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rcx, qword [rbx + 0x88]
cmp rcx, rdi
je 0x10a2907
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x88], rdi
mov rcx, qword [rbx + 0x30]
cmp rcx, rdi
je 0x10a291a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x30], rdi
mov rcx, qword [rbx + 0x38]
cmp rcx, rdi
je 0x10a292d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x38], rdi
cmp qword [rbx + 0x40], rdi
je 0x10a2958
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], rdi
mov rcx, qword [rbx + 0x58]
cmp rcx, rdi
je 0x10a296b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx + 0x58], rdi
cmp byte [rbx + 0x7d], dil
je 0x10a29ee
lea rdx, [0x0109a850]
mov ecx, 0x1d
call fcn.0109c5cc
mov rcx, qword [rbx + 0x98]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbx + 0xa0]
lea rdx, [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rbx + 0x90]
cmp rcx, rdi
je 0x10a29bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x90], rdi
mov rcx, qword [rbx + 0x98]
cmp rcx, rdi
je 0x10a29d5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x98], rdi
mov rcx, qword [rbx + 0xa0]
cmp rcx, rdi
je 0x10a29ee
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0xa0], rdi
lea rdx, [0x0109a4a0]
mov ecx, 0x1d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.0109c5cc
Function at 0x10a345c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x010c91a0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.010a4ac0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x01015000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.010a4ac0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10a34ef
cmp dword [rsp + 0x24], 5
jb 0x10a3509
jmp 0x10a3505
cmp dword [rsp + 0x30], esi
jne 0x10a3509
cmp dword [rsp + 0x24], 4
ja 0x10a3505
jne 0x10a3509
cmp dword [rsp + 0x28], 0
jbe 0x10a3509
mov byte [rbx + 0x18], sil
lea rax, [0x010165f8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.010a3288
movzx ecx, byte [0x010d735c]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x010d735c], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.010a3ca0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10a3c7c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x6f3a0704
jmp 0x1009e8b
dec rcx
jmp 0x100be3c
jmp 0x100c2f9
jne 0x1009e8b
jmp 0x100a6b9
jmp 0x100c331
jmp 0x100c37c
jmp 0x100c3c9
jmp 0x100c459
jmp 0x100c498
jmp 0x100c4f3
jmp 0x100c528
jmp 0x100c574
jmp 0x100c5e8
jmp 0x100c604
jmp 0x100c64c
jmp 0x100c691
jmp 0x100c715
jmp 0x100c757
jmp 0x100c7c0
jmp 0x100c800
jmp 0x100c864
jmp 0x100c893
jmp 0x100c8ee
xor rcx, rcx
nop
nop
nop
mov rdx, 0x8896
nop
nop
nop
nop
nop
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
nop
call 0x100c91b
pop rsi
add rsi, 0xe4f
nop
nop
nop
nop
nop
mov rdi, rax
mov rcx, 0x8896
rep movsb byte [rdi], byte [rsi]
nop
nop
jmp rax
sub rsp, 0x28
call fcn.010a6d68
add rsp, 0x28
xor rcx, rcx
jmp 0x10028dd