joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000647c0
Capabilities:
Accept command line arguments
Create directory
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dil, r8b
mov rbx, rdx
xor ebp, ebp
mov dword [rsp + 0x88], ebp
lea r9, [rax - 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [0x10002ae30]
call sub.SHELL32.dll_SHGetKnownFolderPath
cmp eax, ebp
jl 0x1000649e7
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.10016e414
nop
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dil, bpl
je 0x100064977
lea edx, [rbp + 0x74]
lea rcx, [rsp + 0x48]
call fcn.10016e534
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.10016e7cc
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
xor edx, edx
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebp
je 0x10006489c
mov r8d, 0x273e
lea rdx, [0x100029ec0]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebp
jge 0x1000648c4
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov rcx, rdi
call sub.msvcrt.dll_free
mov rax, rbx
jmp 0x1000649f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000648c4
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov rcx, rdi
call sub.msvcrt.dll_free
mov rax, rbx
jmp 0x1000649f5
mov edx, 0x75
lea rcx, [rsp + 0x48]
call fcn.10016e534
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.10016e7cc
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
xor edx, edx
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebp
je 0x100064952
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp rax, rbp
je 0x1000649cc
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
cmp rax, rbp
je 0x1000649cc
cmp dword [rsp + 0x88], ebp
jle 0x100064947
mov r8d, 0xaa
mov rdx, qword [rax]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1000649cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000649cc
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, rbx
jmp 0x1000649f5
mov edx, 0x74
lea rcx, [rsp + 0x48]
call fcn.10016e534
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.10016e7cc
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
mov edx, 0x75
lea rcx, [rsp + 0x48]
call fcn.10016e534
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.10016e7cc
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
mov rsi, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.10016e3a0
nop
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, rbx
jmp 0x1000649f5
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10006a9ac
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, r8
cmp dword [r8], 0
je 0x10006aae1
mov ebx, 1
cmp dword [r8], ebx
je 0x10006aae1
cmp dword [r8], 2
je 0x10006aae1
cmp dword [r8], 3
je 0x10006aae1
cmp dword [r8], 4
je 0x10006aae1
cmp dword [r8], 5
je 0x10006aae1
mov byte [rsp + 0x28], bl
mov eax, dword [r8 + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [r8 + 4]
mov r8, rdx
lea rdx, [rsp + 0x38]
call fcn.100069ad0
nop
xor edx, edx
mov r9d, dword [rsp + 0x40]
test r9d, r9d
jle 0x10006aa81
mov r8d, dword [rdi + 0xc]
mov rcx, qword [rsp + 0x38]
cmp r8d, dword [rcx + 0xc]
jne 0x10006aa64
mov eax, dword [rcx + 0x10]
cmp dword [rdi + 0x10], eax
jne 0x10006aa64
mov eax, dword [rcx]
cmp eax, 0xc
jne 0x10006aa60
cmp dword [rdi], 9
je 0x10006aa71
cmp dword [rdi], 0xa
je 0x10006aa71
cmp dword [rdi], 0xb
je 0x10006aa71
cmp dword [rdi], eax
je 0x10006aa71
jmp 0x10006aa64
cmp dword [rdi], eax
je 0x10006aa7f
add edx, ebx
add rcx, 0x14
cmp edx, r9d
jge 0x10006aa81
jmp 0x10006aa36
lea rcx, [rsp + 0x38]
call fcn.10006d790
mov al, bl
jmp 0x10006aae3
jmp 0x10006aad3
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 8]
mov r8d, dword [rdi + 4]
lea rdx, [0x10002a0e0]
lea rcx, [rsp + 0x48]
call fcn.10016e8bc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
nop
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.10006d790
mov al, bl
jmp 0x10006aae3
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x10006db34
Capabilities:
Parse credit card information

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rbp, rdx
mov r12, rcx
mov rcx, rdx
call qword [sym.imp.msvcrt.dll_fgetc]
cmp eax, 0xffffffff
je 0x10006db93
cmp eax, 0x7b
je 0x10006db93
cmp eax, 0x3b
je 0x10006db93
cmp eax, 0x25
je 0x10006db93
cmp eax, 0x41
jl 0x10006db85
cmp eax, 0x7a
jle 0x10006db93
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fgetc]
cmp eax, 0xffffffff
jne 0x10006db6c
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
cmp eax, 0xffffffff
je 0x10006dcfa
cmp eax, 0x25
je 0x10006dcd2
cmp eax, 0x3b
je 0x10006dcd2
cmp eax, 0x7b
je 0x10006dccb
cmp eax, 0x61
jl 0x10006dbd3
cmp eax, 0x68
jle 0x10006dc05
cmp eax, 0x4f
je 0x10006dc05
cmp eax, 0x4e
je 0x10006dc05
cmp eax, 0x42
je 0x10006dc05
cmp eax, 0x52
je 0x10006dc05
cmp eax, 0x51
je 0x10006dc05
cmp eax, 0x4b
je 0x10006dc05
mov dword [rsi], 2
xor ecx, ecx
call sub.msvcrt.dll_free
xor al, al
jmp 0x10006dd06
mov edi, 1
movsx r8d, al
lea rdx, [0x10002a39c]
lea rcx, [rsp + 0x30]
call fcn.10016e8bc
lea ebx, [rdi + 9]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fgetc]
cmp eax, 0xffffffff
je 0x10006dc98
cmp eax, 0x20
je 0x10006dc98
cmp eax, ebx
je 0x10006dc98
cmp eax, 9
je 0x10006dc98
cmp eax, 0x21
je 0x10006dc98
cmp eax, 0x3f
je 0x10006dc98
mov byte [rsp + 0x88], al
mov r8d, 1
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll_mbtowc]
mov word [rsp + 0x22], r13w
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.10016e788
inc edi
cmp edi, 7
jle 0x10006dc22
mov dword [rsi], 2
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
xor al, al
jmp 0x10006dd06
mov eax, 8
cmp edi, eax
jge 0x10006dcbc
sub eax, edi
mov ebx, eax
lea rdx, [0x10002a3a4]
lea rcx, [rsp + 0x30]
call fcn.10016e788
sub rbx, 1
jne 0x10006dca5
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.100040a4c
jmp 0x10006dce9
mov ebx, 0x7d
jmp 0x10006dcd7
mov ebx, 0xa
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fgetc]
cmp eax, 0xffffffff
je 0x10006dce9
cmp ebx, eax
jne 0x10006dcd7
mov dword [rsi], r13d
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
mov al, 1
jmp 0x10006dd06
mov dword [rsi], r13d
xor ecx, ecx
call sub.msvcrt.dll_free
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x10007f9cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x18]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rdx
mov rdx, rcx
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ebx, eax
jne 0x10007fa1f
cmp dword [rsp + 0x30], 4
jne 0x10007fa1f
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1000806bc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp qword [0x1001a7330], 0
mov esi, dword [0x10019f5b4]
mov edi, ecx
mov dword [0x10019f5b4], ecx
jne 0x100080760
cmp qword [0x1001a7338], 0
jne 0x100080760
lea rcx, [0x10002cc28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x100080725
lea rcx, [0x10002cc28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x100080725
lea rdx, [0x10002cc38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1001a7330], rax
lea rcx, [0x10002cc48]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x100080760
lea rcx, [0x10002cc48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x100080760
lea rdx, [0x10002cc38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1001a7338], rax
mov eax, dword [0x100199ef8]
cmp eax, 0xffffffff
jne 0x10008080f
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
lea rdx, [0x10002cbe8]
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000807f8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [0x100199ef8]
lea rdx, [0x10002cc58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1000807f8
cmp dword [rsp + 0x58], 4
jne 0x1000807f8
mov eax, dword [0x100199ef8]
jmp 0x100080800
xor eax, eax
mov dword [0x100199ef8], eax
test eax, eax
je 0x100080813
mov eax, 1
mov dword [0x100199ef8], eax
test eax, eax
jne 0x100080833
mov rax, qword [0x1001a7330]
test rax, rax
je 0x100080823
mov ecx, edi
call rax
mov rax, qword [0x1001a7338]
test rax, rax
je 0x100080833
mov ecx, edi
call rax
mov eax, esi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x100080844
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1001a90a0], 0
jne 0x100080900
lea rdx, [0x100002840]
xor ecx, ecx
mov dword [0x1001a90a0], 1
xor esi, esi
call fcn.10007b104
lea rdx, [0x100002840]
xor ecx, ecx
mov rdi, rax
call fcn.10007b104
mov rbx, rax
test rdi, rdi
je 0x10008089d
test rax, rax
je 0x10008089d
cmp rdi, rax
jne 0x1000808a2
mov esi, 1
test rdi, rdi
je 0x1000808af
mov rcx, rdi
call sub.msvcrt.dll_free
test rbx, rbx
je 0x1000808c1
cmp rbx, rdi
je 0x1000808c1
mov rcx, rbx
call sub.msvcrt.dll_free
xor ecx, ecx
call sub.msvcrt.dll_free
test esi, esi
je 0x100080900
lea rcx, [0x10002cc70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x10002ccd0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x10002cd30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x10002cd88]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x100080918
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x100190170]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, rdx
mov rbx, rcx
test rdx, rdx
jne 0x100080942
mov eax, 0x8876086c
jmp 0x1000809e9
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x10000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
mov qword [rbx], rax
call sub.msvcrt.dll_free
cmp qword [rbx], 0xffffffffffffffff
je 0x1000809de
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1000809de
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x18], eax
cmp eax, 0xffffffff
je 0x1000809de
test eax, eax
je 0x1000809fc
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
xor r9d, r9d
lea edx, [r9 + 4]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x100080a01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.10017a260
add rsp, 0x50
pop rbx
ret
and qword [rbx + 0x10], 0
xor eax, eax
jmp 0x1000809e9
Function at 0x10008db70
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
xor ebp, ebp
mov r13, r9
mov esi, r8d
mov r12, rdx
mov rdi, rcx
test eax, eax
je 0x10008dd29
sub eax, 1
je 0x10008dc5f
cmp eax, 1
jne 0x10008dcc2
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ecx, dword [rdi + 0x3c]
lea edx, [rsi + rcx]
cmp edx, eax
jbe 0x10008dc2e
mov rcx, qword [rdi + 0x28]
mov ebx, dword [rdi + 0x3c]
mov rax, qword [rcx]
add ebx, esi
call qword [rax + 0x20]
add eax, eax
cmp ebx, eax
ja 0x10008dbef
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ebx, eax
add ebx, ebx
mov rbp, qword [rdi + 0x28]
cmp ebx, dword [rbp + 0xc]
jbe 0x10008dc2e
lea rdx, [0x100002840]
mov ecx, ebx
call fcn.10007b104
mov r14, rax
test rax, rax
je 0x10008dc55
mov r8d, dword [rbp + 0xc]
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_free
mov qword [rbp + 0x10], r14
mov dword [rbp + 0xc], ebx
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ecx, dword [rdi + 0x3c]
mov r8, rsi
add rcx, rax
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov dword [r13], esi
add dword [rdi + 0x3c], esi
jmp 0x10008dd29
mov eax, 0x8007000e
jmp 0x10008dd2b
mov ecx, dword [rcx + 0x38]
mov ebx, 0x10000
lea eax, [rcx + rsi]
cmp eax, ebx
ja 0x10008dc82
add rcx, qword [rdi + 0x30]
mov r8, rsi
call sub.msvcrt.dll_memcpy
add dword [rdi + 0x38], esi
jmp 0x10008dd25
cmp ecx, ebx
je 0x10008dca2
test ecx, ecx
je 0x10008dcd5
mov r8d, ebx
sub r8d, ecx
add rcx, qword [rdi + 0x30]
call sub.msvcrt.dll_memcpy
mov ecx, dword [rdi + 0x38]
sub r12, rcx
add r12, rbx
test ecx, ecx
je 0x10008dcd5
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi]
and qword [rsp + 0x20], rbp
mov r9, r13
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10008dcc9
mov eax, 0x80004005
jmp 0x10008dd2b
add dword [rdi + 0x3c], ebx
mov ebp, ebx
sub ebp, dword [rdi + 0x38]
and dword [rdi + 0x38], 0
mov ebx, esi
sub ebx, ebp
shr ebx, 0x10
test ebx, ebx
je 0x10008dd09
mov rcx, qword [rdi]
and qword [rsp + 0x20], 0
shl ebx, 0x10
mov r8d, ebx
mov r9, r13
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10008dcc2
add dword [rdi + 0x3c], ebx
mov eax, ebx
add ebp, ebx
add r12, rax
cmp ebp, esi
jae 0x10008dd25
mov rcx, qword [rdi + 0x30]
mov eax, esi
mov rdx, r12
sub eax, ebp
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
mov dword [rdi + 0x38], ebx
mov dword [r13], esi
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x10008dd50
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
mov rbx, rcx
test eax, eax
je 0x10008dda2
sub eax, 1
je 0x10008dd6c
cmp eax, 1
je 0x10008dda2
jmp 0x10008dd91
mov r8d, dword [rcx + 0x38]
test r8d, r8d
je 0x10008dda2
mov rdx, qword [rcx + 0x30]
mov rcx, qword [rcx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10008dd98
mov eax, 0x80004005
jmp 0x10008dda4
mov eax, dword [rbx + 0x38]
add dword [rbx + 0x3c], eax
and dword [rbx + 0x38], 0
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1000926b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
imul r9d, dword [rsp + 0x50]
mov rbx, rdx
mov rbp, rcx
mov edi, r9d
add rdi, rdx
cmp rdx, rdi
jae 0x1000927e1
mov r13d, dword [rsp + 0x50]
mov r14d, dword [rsp + 0x58]
mov eax, r8d
lea rsi, [rdx + rax*4]
mov edx, 0xffc03fc0
lea r12, [r13 + r13]
mov r15, rbx
cmp rbx, rsi
jae 0x1000927cf
mov r14, rbp
mov r11d, dword [r15 + 4]
mov r9d, dword [r15]
mov r10d, dword [r13 + r15]
mov r8d, dword [r13 + r15 + 4]
mov ecx, r9d
mov eax, r11d
shr eax, 2
shr ecx, 2
add r15, 8
and eax, edx
and ecx, edx
add ecx, eax
mov eax, r10d
shr eax, 2
and eax, edx
add ecx, eax
mov eax, r8d
shr eax, 2
and eax, edx
lea edx, [rcx + rax - 0x7fff80]
mov ecx, r10d
shr r10d, 2
and ecx, 0xff00ff
mov eax, r8d
shr r8d, 2
and eax, 0xff00ff
add ecx, eax
mov eax, r9d
shr r9d, 2
and eax, 0xff00ff
add ecx, eax
mov eax, r11d
shr r11d, 2
and eax, 0xff00ff
lea ecx, [rcx + rax + 0x20002]
shr ecx, 2
xor edx, ecx
mov ecx, 0x3fc03fc0
and r10d, ecx
and edx, 0xff00ff
and r8d, ecx
add r10d, r8d
and r9d, ecx
and r11d, ecx
add r10d, r9d
lea eax, [r10 + r11 + 0x800080]
xor edx, eax
mov dword [r14], edx
add r14, 4
mov edx, 0xffc03fc0
cmp r15, rsi
jb 0x10009270d
mov r14d, dword [rsp + 0x58]
add rbx, r12
add rbp, r14
add rsi, r12
cmp rbx, rdi
jb 0x1000926fe
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10009298c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x100092ab4
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x100092a9a
mov esi, 0x7e0
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
mov edx, 0xf81f
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 4
and eax, edx
add r12, 4
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x1002]
mov ecx, r10d
mov eax, r8d
and eax, esi
and ecx, esi
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, esi
add ecx, eax
mov eax, r11d
and eax, esi
lea ecx, [rcx + rax + 0x40]
mov eax, 0xf81f
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dx, cx
add r10d, r9d
and dx, si
lea eax, [r10 + r11 + 0x1002]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x1000929f7
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x1000929cf
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100092c0c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x100092d37
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x100092d1d
mov esi, 0x7c1f
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
mov edx, 0x83e0
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 4
and eax, edx
add r12, 4
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x10040]
mov ecx, r10d
mov eax, r8d
and eax, esi
and ecx, esi
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, esi
add ecx, eax
mov eax, r11d
and eax, esi
lea ecx, [rcx + rax + 0x802]
mov eax, 0x83e0
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dx, cx
add r10d, r9d
and dx, si
lea eax, [r10 + r11 + 0x10040]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x100092c77
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x100092c4f
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100092d64
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x100092e8f
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x100092e75
mov esi, 0xf0f
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
mov edx, 0xf0f0
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 4
and eax, edx
add r12, 4
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x2020]
mov ecx, r10d
mov eax, r8d
and eax, esi
and ecx, esi
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, esi
add ecx, eax
mov eax, r11d
and eax, esi
lea ecx, [rcx + rax + 0x202]
mov eax, 0xf0f0
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dx, cx
add r10d, r9d
and dx, si
lea eax, [r10 + r11 + 0x2020]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x100092dcf
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x100092da7
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100092ebc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x100092fd2
mov r12d, dword [rdx + 0x88]
mov r13d, dword [rdx + 0x80]
mov r15, rbp
add r12, rbx
add r13, rbx
mov r14, rbx
cmp rbx, r12
jae 0x100092fb8
movzx r8d, byte [r13]
movzx r10d, byte [r14]
movzx r9d, byte [r14 + 1]
movzx r11d, byte [r13 + 1]
mov edx, 0xe3
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 2
and eax, edx
add r13, 2
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x42]
mov ecx, r10d
mov eax, r8d
and eax, 0x1c
and ecx, 0x1c
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, 0x1c
add ecx, eax
mov eax, r11d
and eax, 0x1c
lea ecx, [rcx + rax + 8]
mov eax, 0xe3
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dl, cl
add r10d, r9d
and dl, 0x1c
lea eax, [r10 + r11 + 0x42]
shr eax, 2
xor dl, al
mov byte [r15], dl
inc r15
cmp r14, r12
jb 0x100092f21
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x100092efe
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
ret