joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ee90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x10003d110]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov rbp, rdx
mov rsi, rcx
mov rbx, rdi
mov r12d, 0x5a4d
mov edx, 1
lea rcx, [rsp + 0x20]
mov r9, rsi
lea r8d, [rdx + 0x3f]
call sub.msvcrt.dll_fread
cmp rax, 0x40
jne 0x10001ef1b
mov eax, dword [rsp + 0x20]
cmp ax, r12w
jne 0x10001ef4e
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
call fcn.10001ec30
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x10001ef47
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x10001ef40
inc rbx
cmp rbx, 2
jbe 0x10001eec2
or eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.10002eee0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov eax, 0xfffffffb
jmp 0x10001ef1e
mov eax, 0xfffffffc
jmp 0x10001ef1e
mov ecx, dword [rsp + 0x30]
mov dword [rbp], eax
mov eax, dword [rsp + 0x24]
mov dword [rbp + 4], eax
mov eax, dword [rsp + 0x28]
add ecx, edi
mov dword [rbp + 8], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbp + 0x10], ecx
mov ecx, dword [rsp + 0x38]
mov dword [rbp + 0xc], eax
mov eax, dword [rsp + 0x34]
mov dword [rbp + 0x14], eax
mov eax, dword [rsp + 0x3c]
add ecx, edi
mov dword [rbp + 0x1c], eax
mov eax, dword [rsp + 0x40]
mov dword [rbp + 0x18], ecx
mov dword [rbp + 0x20], eax
mov eax, dword [rsp + 0x44]
mov dword [rbp + 0x24], eax
mov eax, dword [rsp + 0x48]
mov dword [rbp + 0x28], eax
mov eax, dword [rsp + 0x4c]
mov dword [rbp + 0x2c], eax
mov eax, dword [rsp + 0x50]
mov dword [rbp + 0x30], eax
mov eax, dword [rsp + 0x54]
mov dword [rbp + 0x34], eax
mov eax, dword [rsp + 0x58]
mov dword [rbp + 0x38], eax
mov eax, dword [rsp + 0x5c]
mov dword [rbp + 0x3c], eax
xor eax, eax
jmp 0x10001ef1e
Function at 0x10001fb54
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov r13, rcx
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
xor r15d, r15d
cmp rbx, rsi
je 0x10001fd4a
or qword [rax + 0x20], 0xffffffffffffffff
lea rbp, [rbx + 8]
lea r14, [0x10003d610]
cmp qword [rbx + 0x20], 8
jb 0x10001fba7
mov r12, qword [rbp]
jmp 0x10001fbaa
mov r12, rbp
or qword [rsp + 0xa0], 0xffffffffffffffff
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 7
mov r8d, 0x80000000
mov rdx, r12
lea rcx, [rsp + 0xa0]
call fcn.1000241c4
mov edi, eax
test eax, eax
js 0x10001fd14
xor r14d, r14d
lea rdx, [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10001fc53
call fcn.100027b98
mov r12d, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x10001fc65
test byte [rcx + 0x1c], 1
je 0x10001fc65
lea edx, [r14 + 0x2b]
mov r9d, r12d
lea r8, [0x100006160]
mov rcx, qword [rcx + 0x10]
call fcn.10001550c
mov rcx, qword [0x10003d610]
jmp 0x10001fc65
mov r14, qword [rsp + 0xb0]
xor r12d, r12d
mov rcx, qword [0x10003d610]
test r12d, r12d
js 0x10001fd0b
cmp rdi, 0xffffffffffffffff
je 0x10001fc84
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x10003d610]
lea eax, [r14 + r15]
cmp eax, dword [rsp + 0xa8]
ja 0x10001fca5
mov r15d, eax
add rbx, 0x28
add rbp, 0x28
lea r14, [0x10003d610]
jmp 0x10001fd00
lea r14, [0x10003d610]
cmp rcx, r14
je 0x10001fcdc
test byte [rcx + 0x1c], 1
je 0x10001fcdc
cmp qword [rbx + 0x20], 8
jb 0x10001fcc4
mov r9, qword [rbp]
jmp 0x10001fcc7
mov r9, rbp
mov edx, 0x14
lea r8, [0x100006190]
mov rcx, qword [rcx + 0x10]
call fcn.10001179c
lea rcx, [r13 + 0x20]
mov rdx, rbx
call fcn.100021c24
mov r8, rbx
add rbx, 0x28
add rbp, 0x28
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.100021ce4
cmp rbx, rsi
jne 0x10001fb9a
jmp 0x10001fd4a
mov ecx, r12d
call fcn.100025514
int3
mov rcx, qword [0x10003d610]
cmp rcx, r14
je 0x10001fd42
test byte [rcx + 0x1c], 1
je 0x10001fd42
mov edx, 0xc
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x100006180]
mov rcx, qword [rcx + 0x10]
call fcn.10001f0d4
mov ecx, edi
call fcn.100025514
nop
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100022644
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rdi
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov bpl, r8b
mov rsi, rdx
mov rdi, rcx
or r13, 0xffffffffffffffff
mov qword [rax + 0x20], r13
mov qword [rax - 0x48], r13
and qword [rax - 0x50], 0
and qword [rax - 0x58], 0
and dword [rax - 0x60], 0
mov dword [rax - 0x68], 3
lea r9d, [r13 + 6]
mov r8d, 0x80000000
mov rdx, rcx
lea rcx, [rax - 0x48]
call fcn.1000241c4
mov ebx, eax
test eax, eax
jns 0x1000226e7
lea rdx, [0x10003d610]
mov rcx, qword [0x10003d610]
cmp rcx, rdx
je 0x1000226df
test byte [rcx + 0x1c], 1
je 0x1000226df
lea edx, [r13 + 0xf]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x100006180]
mov rcx, qword [rcx + 0x10]
call fcn.10001f0d4
mov ecx, ebx
call fcn.100025514
int3
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0x48], r13
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov r9d, 1
mov r8d, 0x40000000
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1000241c4
mov ebx, eax
test eax, eax
jns 0x10002276c
lea rdx, [0x10003d610]
mov rcx, qword [0x10003d610]
cmp rcx, rdx
je 0x100022764
test byte [rcx + 0x1c], 1
je 0x100022764
mov edx, 0xf
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x100006180]
mov rcx, qword [rcx + 0x10]
call fcn.10001f0d4
mov ecx, ebx
call fcn.100025514
int3
mov r14d, 0x1000
mov rcx, r14
call fcn.10001d304
mov rsi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xa8], r14
mov r8, rax
lea rdx, [rsp + 0xa8]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.100024358
test eax, eax
js 0x100022843
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x100022815
xor r8d, r8d
test rdx, rdx
je 0x1000227dd
mov rcx, rsi
xor byte [rcx], bpl
inc r8d
inc rcx
mov eax, r8d
cmp rax, rdx
jb 0x1000227cc
mov r8, rsi
mov rcx, rbx
call fcn.100024290
test eax, eax
js 0x10002280d
mov qword [rsp + 0xa8], r14
mov r8, rsi
lea rdx, [rsp + 0xa8]
mov rcx, rdi
call fcn.100024358
test eax, eax
jns 0x1000227b4
jmp 0x100022843
mov ecx, eax
call fcn.100025514
nop
test rsi, rsi
je 0x100022824
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop
cmp rbx, r13
je 0x100022833
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rdi, r13
je 0x10002284b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10002284b
mov ecx, eax
call fcn.100025514
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x1000228a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1000228f7
call fcn.100027b98
mov ebx, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x1000228f3
test byte [rcx + 0x1c], 1
je 0x1000228f3
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006180]
mov edx, 0x10
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.10001f0d4
mov eax, ebx
jmp 0x1000228f9
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100022d48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r13, qword [r9]
mov rdi, r9
mov r14, r8
mov eax, r13d
mov rbp, rdx
mov dword [rsp + 0x68], eax
mov eax, r13d
cmp rax, r13
je 0x100022d9d
mov ebx, 0x80070057
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
mov r12, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov r9, r8
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x100022df3
test r12, r12
je 0x100022de7
mov eax, dword [rsp + 0x68]
cmp rax, qword [rdi]
jbe 0x100022de7
mov qword [rdi], rax
mov ebx, 0x800700ea
jmp 0x100022d81
mov eax, dword [rsp + 0x68]
mov qword [rdi], rax
jmp 0x100022eb0
cmp ebx, 0x80070002
jne 0x100022e36
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100022e2c
test byte [rcx + 0x1c], 4
je 0x100022e2c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006170]
mov edx, 0xd
mov r9, rbp
call fcn.10001179c
mov ebx, 0x80070002
jmp 0x100022d81
cmp ebx, 0x800700ea
je 0x100022e75
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100022e90
test byte [rcx + 0x1c], 1
je 0x100022e90
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006170]
mov edx, 0xe
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001f0d4
jmp 0x100022e90
mov eax, dword [rsp + 0x68]
cmp qword [rdi], rax
jb 0x100022e88
mov ebx, 0x8000ffff
jmp 0x100022d81
mov qword [rdi], rax
mov ebx, 0x800700ea
cmp ebx, 0x800700ea
je 0x100022d81
cmp ebx, 0x80070002
je 0x100022d81
test ebx, ebx
js 0x100022d81
mov r8d, dword [r14]
mov r9, rdi
mov rdx, r13
mov rcx, rbp
mov qword [rsp + 0x20], r12
call fcn.100022c74
jmp 0x100022d83
Function at 0x1000231f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, r9d
mov rdi, rdx
cmp rax, r9
je 0x10002320c
mov eax, 0x80070057
jmp 0x100023275
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r9d
mov r9d, r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x100023273
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100023262
test byte [rcx + 0x1c], 1
je 0x100023262
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006170]
mov edx, 0x10
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.100015e2c
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
test eax, eax
js 0x100023275
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100023c48
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov edx, 0x104
mov rbx, rcx
mov word [rcx + 0x206], di
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
jne 0x100023ca7
call fcn.100027b98
mov ebx, eax
mov rcx, qword [0x10003d610]
lea rdx, [0x10003d610]
cmp rcx, rdx
je 0x100023ca3
test byte [rcx + 0x1c], 1
je 0x100023ca3
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x17]
lea r8, [0x100006160]
mov r9d, eax
call fcn.10001550c
mov eax, ebx
jmp 0x100023ce7
cmp word [rbx + 0x206], di
je 0x100023ce5
mov rcx, qword [0x10003d610]
lea rdx, [0x10003d610]
cmp rcx, rdx
je 0x100023cde
test byte [rcx + 0x1c], 1
je 0x100023cde
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x18
call fcn.1000154e8
mov eax, 0x80004005
jmp 0x100023ce7
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100024290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x1000242b9
mov eax, 0x80070057
jmp 0x10002433f
mov r8d, edx
jmp 0x1000242d9
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x10002433d
test eax, eax
je 0x100024336
cmp eax, ebx
ja 0x100024336
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
and dword [rsp + 0x48], 0
lea r9, [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000242be
call fcn.100027b98
mov ebx, eax
test ebx, ebx
jns 0x10002433d
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100024332
test byte [rcx + 0x1c], 1
je 0x100024332
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x29
mov r9d, ebx
call fcn.10001550c
mov eax, ebx
jmp 0x10002433f
mov ebx, 0x8000ffff
jmp 0x1000242fd
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x100024358
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x100024376
mov eax, 0x80070057
jmp 0x1000243ec
and qword [rdx], 0
and dword [rsp + 0x48], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000243d6
call fcn.100027b98
mov ebx, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x1000243d2
test byte [rcx + 0x1c], 1
je 0x1000243d2
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x2a
mov r9d, ebx
call fcn.10001550c
mov eax, ebx
jmp 0x1000243ec
cmp dword [rsp + 0x48], edi
jbe 0x1000243e3
mov eax, 0x8000ffff
jmp 0x1000243ec
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1000249fc
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xe0
xor r13d, r13d
cmp word [rdx], 0x22
mov rsi, rdx
mov rbx, r13
mov r12, rcx
mov qword [rax + 0x28], rbx
je 0x100024acc
lea edx, [r13 + 0x2e]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, r13
je 0x100024ad9
mov rbp, rsi
cmp word [rsi], r13w
je 0x100024a6d
movzx ecx, word [rbp]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r13d
jne 0x100024a6d
add rbp, 2
cmp word [rbp], r13w
jne 0x100024a53
cmp rbp, rdi
ja 0x100024ad9
jmp 0x100024a86
movzx ecx, word [rdi]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r13d
jne 0x100024a8c
add rdi, 2
cmp word [rdi], r13w
jne 0x100024a74
mov rax, rdi
sub rax, rsi
sar rax, 1
cmp eax, r13d
jge 0x100024aa1
mov edi, 0x80070057
jmp 0x100024af8
lea rdx, [0x10000b900]
lea rcx, [rsp + 0x120]
mov r9, rsi
mov r8d, eax
mov qword [rsp + 0x20], rdi
call fcn.100027324
mov rbx, qword [rsp + 0x120]
mov edi, eax
jmp 0x100024acf
mov edi, r13d
cmp edi, r13d
jl 0x100024afd
cmp rbx, r13
jne 0x100024af5
lea rcx, [rsp + 0x120]
mov rdx, rsi
call fcn.1000253cc
mov rbx, qword [rsp + 0x120]
mov edi, eax
jmp 0x100024af8
mov edi, r13d
cmp edi, r13d
jge 0x100024b12
cmp rbx, r13
je 0x100024b0b
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x100024bed
xor eax, eax
lea rcx, [rsp + 0x78]
xor edx, edx
lea r8d, [rax + 0x60]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r13d
jne 0x100024bc5
call fcn.100027b98
mov edi, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100024afd
test byte [rcx + 0x1c], 1
je 0x100024afd
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x2e
mov r9, rbx
mov dword [rsp + 0x20], edi
call fcn.10001f0d4
jmp 0x100024afd
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x100024bd4
call fcn.100023bac
mov rax, qword [rsp + 0x50]
mov qword [r12], rax
cmp rbx, r13
je 0x100024beb
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100024dbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100024e1b
call fcn.100027b98
mov ebx, eax
cmp eax, 0x80070002
je 0x100024e17
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100024e17
test byte [rcx + 0x1c], 1
je 0x100024e17
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x36
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.10001f0d4
mov eax, ebx
jmp 0x100024e59
test al, 0x10
je 0x100024e57
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100024e50
test byte [rcx + 0x1c], 1
je 0x100024e50
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x37
mov r9, rdi
call fcn.10001179c
mov eax, 0x800700b7
jmp 0x100024e59
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100024e6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100024ecb
call fcn.100027b98
mov ebx, eax
cmp eax, 0x80070002
je 0x100024ec7
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100024ec7
test byte [rcx + 0x1c], 1
je 0x100024ec7
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x38
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.10001f0d4
mov eax, ebx
jmp 0x100024f09
test al, 0x10
jne 0x100024f07
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100024f00
test byte [rcx + 0x1c], 1
je 0x100024f00
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x39
mov r9, rdi
call fcn.10001179c
mov eax, 0x800700b7
jmp 0x100024f09
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100024f1c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r11d, eax
cmp eax, edx
jne 0x100024f90
call fcn.100027b98
mov ebx, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100024f8c
test byte [rcx + 0x1c], 1
je 0x100024f8c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006160]
mov edx, 0x3a
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001f0d4
mov eax, ebx
jmp 0x100024fb2
cmp r11d, ebx
ja 0x100024fa6
lea eax, [r11 - 1]
cmp word [rdi + rax*2], dx
je 0x100024fad
mov eax, 0x8000ffff
jmp 0x100024fb2
cmp ebx, edx
jbe 0x100024fad
mov word [rdi], dx
mov qword [rsi], r11
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x10002685c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rdx]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov ebx, 0x2db39507
repne scasw ax, word [rdi]
mov rdi, rax
not rcx
sub rcx, 1
mov rbp, rcx
je 0x1000268de
movzx ecx, word [rsi + rdi*2]
call qword [sym.imp.msvcrt.dll_towlower]
xor edx, edx
mov word [rsp + 0x38], ax
movzx ecx, byte [rsp + rdx + 0x38]
shl rbx, 4
movabs r8, 0xf000000000000000
add rcx, rbx
inc rdx
mov rax, rcx
and rax, r8
mov rbx, rax
shr rbx, 0x38
xor rbx, rax
xor rbx, rcx
cmp rdx, 2
jb 0x1000268a4
inc rdi
cmp rdi, rbp
jb 0x100026893
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100027bf0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x60], 0
mov rbp, rdx
mov rdi, rcx
lea rdx, [rsp + 0x60]
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x100027c5d
call fcn.100027b98
mov ebx, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100027c56
test byte [rcx + 0x1c], 2
je 0x100027c56
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006110]
mov edx, 0xa
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001f0d4
mov eax, ebx
jmp 0x100027cf6
and qword [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.100025318
mov ebx, eax
test eax, eax
jns 0x100027c88
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x100027c56
call qword [sym.imp.msvcrt.dll_free]
jmp 0x100027c56
mov rbx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov r8d, esi
mov r9, rbx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x100027cf1
call fcn.100027b98
mov edi, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x100027cdf
test byte [rcx + 0x1c], 1
je 0x100027cdf
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006110]
mov edx, 0xb
mov r9, rbp
mov dword [rsp + 0x20], edi
call fcn.10001f0d4
test rbx, rbx
je 0x100027ced
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x100027cf6
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000280d0
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
xor r9d, r9d
mov dword [rax - 0x18], esi
mov dword [rax - 0x20], esi
mov dword [rax - 0x28], esi
mov dword [rax - 0x30], esi
mov dword [rax - 0x38], esi
mov byte [rcx], sil
mov dword [rax - 0x40], esi
lea edx, [rsi + 1]
lea r8d, [rsi + 0x12]
lea rcx, [rax + 8]
mov qword [rax - 0x48], rsi
mov qword [rax + 8], rsi
call fcn.100027f98
cmp eax, esi
mov ebx, eax
jge 0x100028133
mov rcx, qword [rsp + 0x70]
cmp rcx, rsi
je 0x10002812f
call qword [sym.imp.msvcrt.dll_free]
mov eax, ebx
jmp 0x1000281b1
mov rbx, qword [rsp + 0x70]
lea r8, [rsp + 0x88]
xor ecx, ecx
mov rdx, rbx
mov byte [rdi], sil
mov dword [rsp + 0x88], esi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp eax, esi
jne 0x100028193
call fcn.100027b98
mov edi, eax
mov rcx, qword [0x10003d610]
lea rax, [0x10003d610]
cmp rcx, rax
je 0x1000281a1
test byte [rcx + 0x1c], 1
je 0x1000281a1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006100]
mov edx, 0x1a
mov r9d, edi
call fcn.10001550c
jmp 0x1000281a1
cmp dword [rsp + 0x88], esi
setne al
mov byte [rdi], al
mov edi, esi
cmp rbx, rsi
je 0x1000281af
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret