joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fa324
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edi, edi
mov rbx, rcx
mov word [rsp + 0x30], di
cmp rcx, rdi
je 0x1000fa4dd
mov word [rcx], di
mov rdx, rcx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
je 0x1000fa47f
cmp word [rbx], di
je 0x1000fa47f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000fa38b
and eax, 0x10
jne 0x1000fa3d3
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, edi
jne 0x1000fa3d3
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fa3cb
test byte [rcx + 0x1c], 1
je 0x1000fa3cb
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0x13
mov r9, rbx
call fcn.1000347a8
mov word [rbx], di
jmp 0x1000fa4bc
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, edi
jne 0x1000fa430
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fa4d9
test byte [rcx + 0x1c], 1
je 0x1000fa4d9
mov edx, 0x14
jmp 0x1000fa466
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rbx
call fcn.10006ac9c
cmp eax, edi
mov ebx, eax
jge 0x1000fa47b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fa4d9
test byte [rcx + 0x1c], 1
je 0x1000fa4d9
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov r9d, ebx
call fcn.100036510
jmp 0x1000fa4d9
mov ebx, edi
jmp 0x1000fa4d9
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fa4bc
test byte [rcx + 0x1c], 1
je 0x1000fa4bc
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100153eb8]
lea r8, [0x10001dba8]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x12
call fcn.100036510
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
mov eax, ebx
jmp 0x1000fa510
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fa50b
test byte [rcx + 0x1c], 1
je 0x1000fa50b
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0x11
call fcn.100034784
mov eax, 0x80070057
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10011be80
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1000fa538
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
mov ecx, edi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000fa5b7
test byte [rcx + 0x1c], 4
je 0x1000fa5b7
cmp eax, esi
jb 0x1000fa597
sub eax, esi
jmp 0x1000fa59b
sub eax, esi
dec eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0x18
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10003b678
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1000fc50c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x80070057
test rcx, rcx
jne 0x1000fc551
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fc642
test byte [rcx + 0x1c], 1
je 0x1000fc642
lea edx, [rdi + 0xc]
jmp 0x1000fc57c
test rdx, rdx
jne 0x1000fc591
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fc642
test byte [rcx + 0x1c], 1
je 0x1000fc642
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034784
jmp 0x1000fc642
lea r8, [0x1000021e8]
mov edx, 0x104
call fcn.10006ad10
mov ebx, eax
test eax, eax
jns 0x1000fc5cc
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fc642
test byte [rcx + 0x1c], 1
je 0x1000fc642
mov edx, 0xe
jmp 0x1000fc600
mov r8, rsi
mov edx, 0x104
mov rcx, rdi
call fcn.10006ad10
mov ebx, eax
test eax, eax
jns 0x1000fc615
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fc642
test byte [rcx + 0x1c], 1
je 0x1000fc642
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036510
jmp 0x1000fc642
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000fc640
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x1000fc640
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000fc642
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000fceb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, r8
mov rdi, rcx
mov esi, edx
lea rcx, [rsp + 0x92]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x90], bp
call sub.msvcrt.dll_memset
xor eax, eax
lea r8, [0x100027490]
lea rcx, [rsp + 0x90]
mov r9, rdi
mov edx, 0x104
mov word [rsp + 0x68], bp
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0x82], eax
mov word [rsp + 0x86], ax
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], eax
call fcn.1000f1d78
cmp eax, ebp
mov edi, eax
jge 0x1000fcf7d
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000fd0a6
test byte [rcx + 0x1c], 1
je 0x1000fd0a6
lea edx, [rbp + 0x22]
mov r9d, eax
jmp 0x1000fd096
lea r8, [0x1000203d0]
lea rcx, [rsp + 0x68]
mov r9d, esi
mov edx, 0x10
call fcn.1000f1d78
cmp eax, ebp
mov edi, eax
jge 0x1000fcfc4
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000fd0a6
test byte [rcx + 0x1c], 1
je 0x1000fd0a6
mov edx, 0x23
jmp 0x1000fcf75
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x1000fd067
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x1000fd067
mov eax, dword [rsp + 0x64]
lea rdx, [rsp + 0x68]
mov r9d, 0xb
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebp
je 0x1000fd063
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000fd0a6
test byte [rcx + 0x1c], 1
je 0x1000fd0a6
mov edx, 0x25
jmp 0x1000fd085
mov edi, ebp
jmp 0x1000fd0a6
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000fd0a6
test byte [rcx + 0x1c], 1
je 0x1000fd0a6
mov edx, 0x24
movzx r9d, ax
or r9d, 0x80070000
cmp eax, ebp
cmovle r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100036510
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x1000fd0b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.10011be80
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x100102174
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, rcx
add rcx, 0x40
mov ebp, r8d
mov ebx, edx
mov esi, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x1001021c7
cmp qword [rax + 0x18], 0
je 0x1001021c7
cmp qword [rax], 0
je 0x1001021c7
mov rdx, qword [rax]
mov r8d, ebx
mov ecx, ebp
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1001021fa
mov rcx, qword [rcx]
test rcx, rcx
je 0x1001021fa
test ebp, ebp
js 0x1001021fa
cmp ebx, 0xc8
je 0x1001021f4
cmp ebx, 0x193
je 0x1001021f4
cmp ebx, 0xc9
jne 0x1001021fa
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret
Function at 0x10010839c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov rbx, rcx
mov qword [rcx], rdi
mov dword [rcx + 8], edi
mov word [rcx + 0xc], di
cmp dword [0x100158b8c], edi
jne 0x100108433
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [0x100158b8c], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, edi
je 0x100108433
cmp dword [rsp + 0x24], 5
jb 0x100108413
cmp dword [rsp + 0x28], 1
jae 0x10010841a
cmp dword [rsp + 0x24], 6
jb 0x100108433
mov ecx, dword [0x100153ecc]
cmp dword [rsp + 0x30], 2
mov eax, 0x7f
cmove ecx, eax
mov dword [0x100153ecc], ecx
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10011be80
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x10010b9a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x70
cmp dword [0x100158bb8], 0
mov rbx, rdx
mov rdi, rcx
lea r12, [0x100156290]
jne 0x10010ba97
test r12, r12
je 0x10010ba05
and dword [0x100156298], 0
and dword [0x1001562a0], 0
mov dword [0x100156290], 0x1423
mov dword [0x100156294], 0x100
mov dword [0x10015629c], 7
mov dword [0x1001562a4], 1
lea rax, [rsp + 0x60]
lea rdx, [0x10002eff0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0x50
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10010ba8d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [0x100156240]
lea rdx, [0x10002efe8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x100158bb8], 1
test rdi, rdi
je 0x10010bab9
test rbx, rbx
je 0x10010bab9
mov r8d, dword [rbx]
test r8d, r8d
je 0x10010bab9
test r12, r12
je 0x10010bab9
mov rdx, qword [rdi]
mov rcx, r12
call fcn.10010cc30
lea r11, [rsp + 0x70]
mov eax, 1
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x100110138
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x20
mov rax, qword [rsp + 0x60]
xor ebp, ebp
mov rbx, rcx
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rcx + 8], r9
mov qword [rcx + 0x30], rax
mov eax, dword [rsp + 0x50]
mov word [rcx + 0x18], bp
mov qword [rcx + 0x20], rdx
mov dword [rcx + 0x3c], r8d
mov dword [rcx + 0x40], ebp
mov dword [rcx + 0x1c], eax
mov r12d, 0x8000
cmp byte [rsp + 0x68], bpl
jne 0x10011019a
lea rcx, [rdx + 0x8000]
mov r8, r12
call sub.msvcrt.dll_memcpy
mov rcx, rbx
mov word [rbx + 0x44], bp
mov dword [rbx + 0x48], ebp
call fcn.1001105c0
mov rdx, qword [rbx + 0x20]
mov r13d, 2
mov word [rbx + 0x54], r12w
mov dword [rbx + 0x4c], r12d
mov dword [rbx + 0x38], ebp
add rdx, r12
mov r8, r13
movzx eax, byte [rdx]
mov ecx, dword [rbx + 0x38]
inc rdx
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
sub r8, 1
mov dword [rbx + 0x38], ecx
jne 0x1001101c5
cmp byte [rsp + 0x68], bpl
je 0x100110243
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x28]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
sub r9, 1
jne 0x1001101ef
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x30]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
sub r9, 1
jne 0x10011021b
jmp 0x10011025a
mov rcx, rbp
mov rdx, r12
mov rax, qword [rbx + 0x28]
mov word [rcx + rax], bp
add rcx, r13
sub rdx, 1
jne 0x100110249
mov edx, 0x43
mov rcx, rbx
lea r8d, [rdx - 0x3b]
call fcn.1001102d4
mov edx, 0x4b
mov rcx, rbx
lea r8d, [rdx - 0x43]
call fcn.1001102d4
mov rcx, rbx
call fcn.100111784
add ax, r13w
movzx ecx, ax
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
cmp byte [rsp + 0x68], bpl
je 0x1001102ac
mov rcx, qword [rbx + 0x20]
mov r8, r12
lea rdx, [rcx + 0x8000]
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx + 0x40]
mov rbp, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 3
add rsp, 0x20
pop r13
ret
Function at 0x10011bae0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10011bb73
cmp dword [rsp + 0x24], 5
jb 0x10011bb8d
jmp 0x10011bb89
cmp dword [rsp + 0x30], esi
jne 0x10011bb8d
cmp dword [rsp + 0x24], 4
ja 0x10011bb89
jne 0x10011bb8d
cmp dword [rsp + 0x28], 0
jbe 0x10011bb8d
mov byte [rbx + 0x18], sil
lea rax, [0x100001db8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1000356cc
movzx ecx, byte [0x100159de0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x100159de0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10011be80
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10011be80
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100152198]
jne 0x10011be9b
rol rcx, 0x10
test cx, 0xffff
jne 0x10011be97
ret 0
ror rcx, 0x10
jmp 0x10011c360
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100155540]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100155638]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10011c3e5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100155540]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10011c407
mov rax, qword [rsp + 0x88]
mov qword [0x100155638], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1001555d8], rax
mov rax, qword [0x100155638]
mov qword [0x1001554b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1001555c0], rax
mov dword [0x1001554a0], 0xc0000409
mov dword [0x1001554a4], 1
mov rax, qword [0x100152198]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1001521a0]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001e68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10011c4b8
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10011c523
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x10011c543
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001e78]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x10011ef50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov r13, r8
mov r14, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r12d, 0x50
lea edx, [r12 - 0x48]
mov rcx, rax
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x10011f0d0
mov rdi, rax
xor eax, eax
mov rcx, r12
rep stosb byte [rdi], al
xor edi, edi
lea ebp, [rax + 0x14]
mov eax, edi
mov ecx, edi
add edi, 1
shr eax, 2
mov edx, eax
shl eax, 2
sub ecx, eax
movzx eax, byte [rsi]
add rsi, 1
shl ecx, 3
shl eax, cl
or dword [rbx + rdx*4], eax
cmp edi, ebp
jb 0x10011efa3
xor edx, edx
lea rcx, [rsp + 0x5c]
mov dword [rsp + 0x40], 0x123174bb
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x44], 0x86521ff8
mov dword [rsp + 0x48], 0x98d2438b
mov dword [rsp + 0x4c], 0x7966ce12
mov dword [rsp + 0x50], 0xc5d92014
mov dword [rsp + 0x58], 0
call sub.msvcrt.dll_memset
lea rdi, [rsp + 0x58]
lea rsi, [0x10015334c]
mov rcx, rbp
rep movsb byte [rdi], byte [rsi]
xor esi, esi
lea rdi, [rsp + 0x58]
lea r8d, [rsi + 5]
mov rcx, rsi
movabs rax, 0xcccccccccccccccd
mul rsi
add rsi, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x40]
xor dword [rdi], eax
add rdi, 4
sub r8, 1
jne 0x10011f023
mov r9d, dword [0x100153360]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r8
lea rax, [0x100153e90]
lea rdi, [rsp + 0x70]
lea rsi, [rsp + 0x58]
mov rcx, rbp
lea r8, [rsp + 0x70]
rep movsb byte [rdi], byte [rsi]
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.100126af0
lea rax, [rsp + 0x70]
mov edx, 0xffffffff
mov byte [rax], 0
add rax, 1
add ebp, edx
jne 0x10011f09d
mov rcx, rbx
mov byte [rcx], 0
add rcx, 1
add r12d, edx
jne 0x10011f0ab
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [r12 + 1]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1001201a0
Capabilities:
Encode data using xor

Disassembly:
or edx, edx
je 0x1001201f4
movzx r10, byte [rcx + 0x100]
movzx r11, byte [rcx + 0x101]
add r8, rdx
neg rdx
xor r9d, r9d
nop dword [rax]
inc r10b
mov al, byte [r10 + rcx]
add r11b, al
mov r9b, byte [r11 + rcx]
mov byte [r10 + rcx], r9b
add r9b, al
mov byte [r11 + rcx], al
mov al, byte [r9 + rcx]
xor byte [rdx + r8], al
inc rdx
jne 0x1001201c0
mov byte [rcx + 0x100], r10b
mov byte [rcx + 0x101], r11b
ret
Function at 0x100121120
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, r9
xor r10d, r10d
mov r11, rdx
cmp rbx, r10
mov r9, rcx
je 0x100121164
sub r9, rdx
sub r8, rdx
mov ecx, dword [r9 + r11]
mov edx, dword [r11]
lea eax, [rdx + rcx]
add r10d, eax
mov eax, edx
or edx, ecx
mov dword [r8 + r11], r10d
xor eax, ecx
add r11, 4
and r10d, eax
xor r10d, edx
shr r10d, 0x1f
sub rbx, 1
jne 0x100121139
mov eax, r10d
pop rbx
ret

Function at 0x100121170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov r12, qword [rsp + 0x50]
xor eax, eax
mov rdi, r9
cmp r12, rax
mov rsi, r8
mov r11, rdx
mov rbp, rcx
mov ebx, eax
je 0x1001211e8
sub rbp, rdx
sub rsi, rdx
sub rdi, rdx
mov r8d, dword [r11 + rbp]
mov edx, dword [r11]
mov r9d, dword [rsi + r11]
lea r10d, [rdx + r8]
add r10d, eax
mov eax, r10d
mov ecx, r10d
sub eax, r9d
xor ecx, edx
sub eax, ebx
mov ebx, eax
mov dword [rdi + r11], eax
mov eax, r10d
xor eax, r8d
xor ebx, r10d
add r11, 4
or eax, ecx
mov ecx, r10d
xor ecx, r9d
xor eax, r10d
or ebx, ecx
shr eax, 0x1f
xor ebx, r10d
shr ebx, 0x1f
sub r12, 1
jne 0x10012119a
sub eax, ebx
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1001212c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, r9
xor r10d, r10d
mov r11, rdx
cmp rbx, r10
mov r9, rcx
je 0x100121303
sub r9, rdx
sub r8, rdx
mov ecx, dword [r9 + r11]
mov eax, dword [r11]
mov edx, ecx
sub edx, eax
xor eax, ecx
sub edx, r10d
mov dword [r8 + r11], edx
xor edx, ecx
add r11, 4
or edx, eax
xor edx, ecx
shr edx, 0x1f
sub rbx, 1
mov r10d, edx
jne 0x1001212d9
mov eax, r10d
pop rbx
ret
Function at 0x1400012dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x140001328
cmp rax, rbx
jne 0x14000131b
mov ebx, 1
mov esi, ebx
jmp 0x14000132d
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001300
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x140001343
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400013a8
mov eax, dword [0x140003640]
test eax, eax
jne 0x1400013a2
mov dword [0x140003640], ebx
lea r15, [0x1400022c0]
lea rdi, [0x1400022a8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001394
test eax, eax
jne 0x140001398
cmp qword [rdi], 0
je 0x140001389
mov rax, qword [rdi]
mov rcx, qword [0x140002288]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000136a
test eax, eax
je 0x1400013a8
mov eax, 0xff
jmp 0x140001484
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400013cf
lea rdx, [0x1400022a0]
lea rcx, [0x140002290]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x1400013dc
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001410
lea rcx, [0x140003648]
call fcn.140001650
test eax, eax
je 0x140001410
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [0x140002288]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.14000119c
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x140001440
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x140001455
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x140001484
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400016d0
add rsp, 0x28
jmp 0x1400012dc

Function at 0x140001550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000159c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001594
cmp dword [rcx + 0x3c], edx
jl 0x140001594
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001594
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000159c
mov rax, rdx
add rsp, 0x18
ret