joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000db468
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
and qword [rcx], 0
and dword [rax + 8], 0
mov edi, 3
mov rbp, rcx
mov esi, edi
mov ecx, edi
jmp 0x1000db4c5
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
cmp eax, 0x80070002
jne 0x1000db504
cmp esi, edi
jne 0x1000db50b
xor r9d, r9d
mov edx, 0x9f401c9
xor ecx, ecx
mov r8d, eax
call fcn.1000b51b8
xor esi, esi
and dword [rsp + 0x30], esi
xor ecx, ecx
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1000db492
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov edx, eax
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1000db525
mov ebx, 0x8007000e
mov edx, 0xa0701c9
mov r8d, ebx
jmp 0x1000db54f
cmp eax, 0x800700ea
je 0x1000db51f
xor r9d, r9d
mov r8d, eax
mov edx, 0x9fa01c9
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000db571
mov eax, dword [rsp + 0x30]
jmp 0x1000db4e0
lea r8, [rsp + 0x30]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1000db55b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa0d01c9
mov ebx, eax
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000db563
mov qword [rbp], rdi
xor edi, edi
xor ebx, ebx
test rdi, rdi
je 0x1000db571
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1000db590
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
mov r12, rcx
mov qword [rcx], rdi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rbx, [0x10000d4b0]
cmp rax, rdi
lea edx, [rdi + 0x20]
cmovne rbx, rax
lea eax, [rdi + 0x22]
cmp ax, word [rbx]
jne 0x1000db5ec
mov dx, ax
add rbx, 2
jmp 0x1000db5ec
cmp dx, ax
je 0x1000db5f7
mov ecx, 0x5c
add rbx, 2
cmp cx, ax
jne 0x1000db5ef
mov rsi, rbx
movzx eax, word [rbx]
cmp di, ax
jne 0x1000db5d9
sub rbx, rsi
xor ecx, ecx
shr rbx, 1
lea edx, [rbx + 1]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
cmp rax, rdi
jne 0x1000db62c
mov edi, 0x8007000e
xor r9d, r9d
mov edx, 0xa4401c9
mov r8d, edi
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000db648
mov ecx, ebx
mov rdx, rsi
lea rbx, [rcx + rcx]
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov word [rbx + rbp], di
mov qword [r12], rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1000dc21c
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
and qword [r11 - 0x10], 0
and qword [r11 - 0x18], 0
lea rax, [r11 - 0x18]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x28], rax
call fcn.1000dc060
mov ebx, eax
test eax, eax
je 0x1000dc253
mov edx, 0x8b01b5
jmp 0x1000dc2a7
mov rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x1000dc285
mov edx, 0x9801b5
jmp 0x1000dc2a7
mov rcx, qword [rsp + 0x38]
lea rdx, [0x100026d30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp eax, 2
je 0x1000dc2b6
test eax, eax
je 0x1000dc2b6
mov edx, 0x9d01b5
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000dc2b8
xor ebx, ebx
cmp qword [rsp + 0x30], 0
je 0x1000dc2cb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1000dc2db
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
add rsp, 0x40
pop rbx
jmp fcn.1000b7bec
Function at 0x1000dc2f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r13
sub rsp, 0x60
mov rsi, qword [rsp + 0xa0]
and qword [r11 - 0x18], 0
and qword [r11 - 0x10], 0
and qword [r11 + 0x38], 0
mov edi, dword [rsp + 0xa8]
lea rcx, [r11 + 0x38]
mov rax, rdx
mov qword [r11 - 0x48], rcx
mov r9d, 1
mov rcx, rax
xor r8d, r8d
xor edx, edx
call fcn.1000dc060
mov r13, 0xffffffff80000002
mov ebx, eax
test eax, eax
je 0x1000dc358
mov edx, 0x17401b5
jmp 0x1000dc415
mov rdx, qword [rsp + 0xa0]
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, r13
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
mov qword [rsp + 0x58], r13
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x1000dc3ab
mov edx, 0x18901b5
jmp 0x1000dc415
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x1000dc424
mov r9d, dword [rsp + 0x98]
test rsi, rsi
je 0x1000dc3c9
test edi, edi
jne 0x1000dc3f3
test r9d, r9d
je 0x1000dc3f3
cmp r9d, 2
jbe 0x1000dc3e7
cmp r9d, 7
jne 0x1000dc3f3
lea rsi, [0x100027934]
lea edi, [r9 - 3]
jmp 0x1000dc3f3
lea rsi, [0x10000d4b0]
mov edi, 2
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x1000dc424
mov edx, 0x1a301b5
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000dc426
xor ebx, ebx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1000dc43b
cmp rcx, r13
je 0x1000dc43b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsp + 0xa0], 0
je 0x1000dc454
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000dc464
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r13
jmp fcn.1000b7bec
Function at 0x1000dc488
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rsp + 0x80]
mov r15, rcx
xor ecx, ecx
mov r14, r9
mov rsi, r8
mov r13, rdx
mov rdi, rcx
mov r12d, ecx
mov qword [r9], rcx
cmp rbp, rcx
je 0x1000dc4cb
mov dword [rbp], ecx
cmp r8, rcx
je 0x1000dc4d3
mov dword [r8], ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
jmp 0x1000dc53c
test rdi, rdi
jne 0x1000dc5a0
cmp dword [rsp + 0x80], 7
mov eax, dword [rsp + 0x70]
je 0x1000dc505
cmp dword [rsp + 0x80], 1
jne 0x1000dc516
mov r12d, 4
test al, 1
lea ecx, [r12 + 1]
cmovne r12d, ecx
lea edx, [r12 + rax]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1000dc58f
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1000dc4e4
mov r9d, 2
mov edx, 0x1f501b5
mov rcx, r13
mov r8d, ebx
call fcn.1000b51b8
mov ecx, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1000b7bec
xor r9d, r9d
mov ebx, 0x8007000e
mov edx, 0x20c01b5
xor ecx, ecx
jmp 0x1000dc564
mov ecx, dword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
add rcx, rdi
call sub.msvcrt.dll_memset
test rsi, rsi
je 0x1000dc5bf
mov eax, dword [rsp + 0x80]
mov dword [rsi], eax
test rbp, rbp
je 0x1000dc5cb
mov eax, dword [rsp + 0x70]
mov dword [rbp], eax
mov qword [r14], rdi
xor ebx, ebx
jmp 0x1000dc56c
Function at 0x1000e12dc
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x260
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r14d, r14d
mov rbp, r9
mov r12, r8
mov r13b, dl
mov rsi, rcx
mov qword [rsp + 0x30], r14
mov rdi, r14
mov qword [rsp + 0x38], r14
cmp r8, r14
je 0x1000e1324
mov qword [r8], r14
cmp r9, r14
je 0x1000e132c
mov qword [r9], r14
cmp rcx, r14
je 0x1000e1427
cmp r14w, word [rcx]
je 0x1000e1427
lea rdx, [0x100019150]
mov r8d, 8
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r14d
jne 0x1000e1427
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1000b1254
mov ebx, eax
cmp eax, r14d
je 0x1000e137e
mov edx, 0x3701ce
mov r8d, eax
xor ecx, ecx
jmp 0x1000e1437
lea rax, [rsp + 0x40]
neg r13b
sbb edx, edx
xor r9d, r9d
xor r8d, r8d
and edx, 7
xor ecx, ecx
mov qword [rsp + 0x20], rax
add edx, 0x1c
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
cmp eax, r14d
je 0x1000e13af
mov edx, 0x4101ce
jmp 0x1000e1374
lea r9, [rsp + 0x38]
lea rdx, [0x10002c080]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.1000b2490
mov ebx, eax
cmp eax, r14d
je 0x1000e13e8
xor r9d, r9d
mov r8d, eax
mov edx, 0x4801ce
xor ecx, ecx
call fcn.1000b51b8
mov rdi, qword [rsp + 0x38]
jmp 0x1000e143f
mov rdi, qword [rsp + 0x38]
cmp rbp, r14
je 0x1000e1416
mov rdx, qword [rsp + 0x30]
mov r9, rbp
xor r8d, r8d
mov rcx, rdi
call fcn.1000b2490
mov ebx, eax
cmp eax, r14d
je 0x1000e1416
mov edx, 0x4f01ce
jmp 0x1000e1374
cmp r12, r14
je 0x1000e1422
mov qword [r12], rdi
mov rdi, r14
mov ebx, r14d
jmp 0x1000e143f
mov ebx, 0x80070057
mov edx, 0x3101ce
mov rcx, rsi
mov r8d, ebx
xor r9d, r9d
call fcn.1000b51b8
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x1000e144f
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rdi, r14
je 0x1000e145d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x260
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000e3b50
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
lea rax, [r11 - 0x24]
xor edi, edi
mov rbp, r8
and dword [r11 + 0x20], edi
and dword [rsp + 0x40], edi
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x28]
xor r8d, r8d
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], rdi
xor ecx, ecx
mov r12, rdx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
je 0x1000e3bc5
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x19a01c0
mov r8d, eax
xor ecx, ecx
mov edi, eax
call fcn.1000b51b8
jmp 0x1000e3c9a
mov edx, dword [rsp + 0x88]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x1000e3bfc
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x1a301c0
xor ecx, ecx
mov edi, r8d
call fcn.1000b51b8
jmp 0x1000e3c8c
mov edx, dword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
mov rbx, rax
test rax, rax
jne 0x1000e3c25
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x1ac01c0
mov edi, r8d
jmp 0x1000e3c71
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov r8, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov rdx, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1000e3c78
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x1b901c0
mov edi, eax
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000e3c7e
mov qword [rbp], rbx
xor ebx, ebx
test rbx, rbx
je 0x1000e3c8c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x1000e3c9a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x1000e9838
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x58], 0
mov rsi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x1000
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1000e9930
lea r8, [rsp + 0x58]
lea edx, [rbx + 0xa]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000e9919
mov rcx, qword [rsp + 0x58]
and dword [rsp + 0x50], ebx
lea rax, [rsp + 0x50]
lea edx, [rbx + 1]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1000e9919
mov edx, dword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x1000e98d2
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1000e9919
mov r9d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r8, rbx
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000e9919
mov rdx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1000e9919
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x58], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1000e9930
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1000ea1a4
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
shr ecx, 0x10
mov r10, rdx
test rdx, rdx
jne 0x1000ea2dd
lea eax, [rdx + 1]
ret
mov edx, 0x15b0
cmp r8d, edx
cmovb edx, r8d
sub r8d, edx
cmp edx, 0x10
jl 0x1000ea2a1
mov r11d, edx
shr r11, 4
mov eax, r11d
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [r10]
add r10, 0x10
add r9d, eax
movzx eax, byte [r10 - 0xf]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add ecx, r9d
add r9d, eax
add ecx, r9d
sub r11, 1
jne 0x1000ea1e4
test edx, edx
je 0x1000ea2b7
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub edx, 1
jne 0x1000ea2a5
mov eax, 0x80078071
mul r9d
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
test r8d, r8d
jne 0x1000ea1bb
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret
Function at 0x1000eb0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x38]
mov rdi, rcx
mov edx, dword [rdi + 0x8c]
mov ebx, dword [rdi + 0x50]
mov eax, dword [rdi + 0x94]
sub ebx, edx
sub ebx, eax
jne 0x1000eb122
test edx, edx
jne 0x1000eb131
test eax, eax
jne 0x1000eb131
mov ebx, ebp
jmp 0x1000eb1b7
cmp ebx, 0xffffffff
jne 0x1000eb131
mov ebx, 0xfffffffe
jmp 0x1000eb1b7
mov eax, dword [rdi + 0x38]
lea ecx, [rbp + rax - 0x106]
cmp edx, ecx
jb 0x1000eb1b7
mov rcx, qword [rdi + 0x48]
mov r8, rbp
lea rdx, [rcx + rbp]
call sub.msvcrt.dll_memcpy
mov r9d, dword [rdi + 0x6c]
mov rax, qword [rdi + 0x60]
sub dword [rdi + 0x90], ebp
sub dword [rdi + 0x8c], ebp
sub dword [rdi + 0x7c], ebp
lea r8, [rax + r9*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x1000eb16a
mov rax, qword [rdi + 0x58]
mov r9d, ebp
lea r8, [rax + rbp*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x1000eb195
add ebx, ebp
mov rsi, qword [rdi]
cmp dword [rsi + 8], 0
je 0x1000eb276
mov eax, dword [rdi + 0x8c]
mov r13d, dword [rdi + 0x94]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rdi + 0x48]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x1000eb222
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
cmp dword [rax + 0x2c], 0
jne 0x1000eb20a
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.1000ea1a4
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call sub.msvcrt.dll_memcpy
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rdi + 0x94], r12d
mov r9d, dword [rdi + 0x94]
cmp r9d, 3
jb 0x1000eb260
mov eax, dword [rdi + 0x8c]
mov rdx, qword [rdi + 0x48]
mov ecx, dword [rdi + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x74]
mov dword [rdi + 0x68], r8d
cmp r9d, 0x106
jae 0x1000eb276
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1000eb0fe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1000ee5e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1000ee6a6
test rdx, rdx
je 0x1000ee6a6
xor r9d, r9d
lea rdx, [0x10002d618]
lea esi, [r9 + 1]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x1000ee627
xor ebx, ebx
jmp 0x1000ee636
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea rdx, [0x10002d618]
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1000ee65d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rbx, rbx
je 0x1000ee69b
test rax, rax
je 0x1000ee69b
mov ecx, 0xfecdfecd
cmp dword [rbx], ecx
jne 0x1000ee695
cmp dword [rax], ecx
jne 0x1000ee695
mov rdx, qword [rbx + 0x1c]
cmp rdx, qword [rax + 0x1c]
jne 0x1000ee68c
mov rdx, qword [rbx + 0x24]
cmp rdx, qword [rax + 0x24]
jne 0x1000ee68c
xor eax, eax
jmp 0x1000ee691
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000ee697
xor esi, esi
mov eax, esi
jmp 0x1000ee6a8
mov ecx, reloc.WLDAP32.dll_Ordinal_13
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1000ee78c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x10011c314]
test eax, eax
jne 0x1000ee891
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000ee7ef
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
mov dword [0x10011c314], eax
sub ecx, r8d
je 0x1000ee871
cmp ecx, r8d
jne 0x1000ee891
cmp edx, 5
jne 0x1000ee85f
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1000ee858
sub ecx, r8d
je 0x1000ee843
cmp ecx, r8d
je 0x1000ee82d
lea eax, [rdx + 0xf]
jmp 0x1000ee88b
cmp word [rsp + 0x134], r8w
mov ecx, reloc.WLDAP32.dll_Ordinal_16
cmovae eax, ecx
or eax, 4
jmp 0x1000ee88b
mov edx, 8
lea ecx, [rdx - 6]
cmp word [rsp + 0x134], cx
cmovae eax, edx
jmp 0x1000ee83e
mov eax, 4
jmp 0x1000ee88b
cmp edx, 4
ja 0x1000ee8a9
mov ecx, 2
mov eax, ecx
mov dword [0x10011c314], ecx
cmp edx, 4
jne 0x1000ee891
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1000ee888
cmp ecx, 0xa
je 0x1000ee888
cmp ecx, 0x5a
jne 0x1000ee891
mov eax, r8d
mov dword [0x10011c314], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x158
ret
mov eax, Ordinal_36
jmp 0x1000ee88b
Function at 0x1000ef870
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10010f190]
jne 0x1000ef88b
rol rcx, 0x10
test cx, 0xffff
jne 0x1000ef887
ret 0
ror rcx, 0x10
jmp 0x1000efe5c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10011a4f0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x10011a5e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000efee1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10011a4f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x1000eff03
mov rax, qword [rsp + 0x88]
mov qword [0x10011a5e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10011a588], rax
mov rax, qword [0x10011a5e8]
mov qword [0x10011a460], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10011a570], rax
mov dword [0x10011a450], 0xc0000409
mov dword [0x10011a454], 1
mov rax, qword [0x10010f190]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10010f198]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100002508]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1000efcf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000efd45
cmp rcx, 0xffffffffffffffff
je 0x1000efd45
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000efd3d
cmp dword [rcx + 0x3c], edx
jl 0x1000efd3d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000efd3d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000efd45
mov rax, rdx
add rsp, 0x18
ret