joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006bc0
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x298
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [r11 + 0x18], rbx
mov rbx, rcx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
mov qword [r11 + 0x20], rdi
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016670]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rbx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x10006c40
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rbx, qword [rsp + 0x2b0]
cmp eax, 0xffffffff
jne 0x10006d1d
lea rcx, [rsp + 0x170]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR80.dll_memset
mov rcx, qword [0x10035610]
lea rdx, [rsp + 0x170]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x170]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.10006ab0
test eax, eax
je 0x10006d1d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000100
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x298
ret
Function at 0x10007570
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x100075c1
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x2bc
mov ebx, eax
jae 0x100075f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret
xor r9d, r9d
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
mov rsi, rax
je 0x1000764a
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov rbp, rax
jne 0x10007657
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10007682
mov edx, ebx
mov rcx, rax
call fcn.10007260
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x10007760
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
cmp ecx, dword [0x10035610]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov edi, ecx
mov rbx, rdx
jne 0x10007805
cmp edx, 0x1000
jbe 0x10007805
mov edx, 4
lea r9, [rsp + 0x30]
mov rcx, rbx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100077d8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, 4
mov rcx, rbx
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x10035610]
call fcn.100076a0
test rax, rax
je 0x1000793d
mov edx, 0x14
mov ecx, edx
call rax
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
cmp ecx, 0x14
mov qword [rsp + 0x60], rsi
mov esi, 1
jne 0x10007825
mov eax, dword [0x1003561c]
cmp edx, ecx
cmove eax, esi
mov dword [0x1003561c], eax
lea rcx, [0x1000c500]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.MSVCR80.dll__beginthread]
test edi, edi
je 0x10007938
cmp edi, 0x14
jae 0x10007938
cmp ebx, 0x1000
jbe 0x10007938
test rbx, rbx
je 0x10007938
mov dword [0x10035620], esi
mov rcx, qword [rbx]
lea rdx, [0x10007210]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
test rax, rax
mov qword [0x100355f8], rax
je 0x10007915
xor edx, edx
mov r9d, esi
xor r8d, r8d
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], 0x1388
call fcn.10007160
test eax, eax
je 0x10007915
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [0x10035600], rax
je 0x10007915
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, r9d
mov dword [rsp + 0x20], 0x3e8
call fcn.10007160
test eax, eax
je 0x10007915
xor edx, edx
mov r9d, 3
xor r8d, r8d
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], 0x1388
call fcn.10007160
test eax, eax
je 0x10007915
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
mov dword [rsp + 0x20], 0
call fcn.10007160
test eax, eax
jne 0x1000791f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x10007933
mov rcx, qword [0x10035600]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
call fcn.100071c0
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x10007950
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x360
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rcx, qword [0x10035610]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR80.dll__strlwr]
lea rcx, [rsp + 0x130]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x130]
call qword [sym.imp.MSVCR80.dll__strlwr]
xor eax, eax
lea rdi, [rsp + 0x130]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR80.dll_strncmp]
test eax, eax
je 0x10007a4f
lea rcx, [rsp + 0x244]
xor edx, edx
mov r8d, 0x100
mov dword [rsp + 0x240], 0x5c2e2e
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call qword [sym.imp.MSVCR80.dll_strrchr]
lea rdi, [rsp + 0x240]
mov rcx, 0xffffffffffffffff
mov r11, rax
xor eax, eax
repne scasb al, byte [rdi]
xor edx, edx
nop
nop
movzx ecx, byte [r11 + rdx + 1]
add rdx, 1
test cl, cl
mov byte [rdi + rdx - 2], cl
jne 0x10007a30
lea rcx, [rsp + 0x240]
call fcn.10006bc0
call fcn.10007ae0
lea rcx, [0x1001f284]
call fcn.10006bc0
cmp byte [0x1001f2c4], 0
je 0x10007a75
lea rcx, [0x1001f2c4]
call fcn.10006d40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x10007a93
call fcn.100101d0
xor edx, edx
xor ecx, ecx
call sym.S.dll_ServiceMain
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x360
pop rdi
ret

Function at 0x10007cf0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
lea rax, [0x1001f035]
lea rdx, [0x1001f235]
nop
mov ecx, 0x20
nop
nop
nop
xor byte [rax - 1], 0x41
xor byte [rax], 0x41
add rax, 2
sub rcx, 1
jne 0x10007d10
cmp rax, rdx
jl 0x10007d00
ret
Function at 0x10008ba0
Capabilities:
Get proxy
Get session user name
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x2d8
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rsi, rcx
mov rbx, 0xffffffff80000001
call fcn.10007c20
test eax, eax
je 0x10008c8a
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x30], 0x40
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor r11d, r11d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x78], r11
mov dword [rsp + 0x48], 0x38
mov dword [rsp + 0x4c], 1
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rax, qword [0x10035660]
test rax, rax
jne 0x10008c74
lea rcx, str.USERENV.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.LoadUserProfileA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x10035660], rax
je 0x10008c8a
mov rcx, qword [0x10035628]
lea rdx, [rsp + 0x48]
call rax
test eax, eax
cmovne rbx, qword [rsp + 0x78]
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, rbx
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10008df9
lea rcx, [rsp + 0xc1]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0xc0], al
call sub.MSVCR80.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea rdx, str.ProxyServer
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x200
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10008dee
lea rdx, str.http
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x2f8], rdi
call qword [sym.imp.MSVCR80.dll_strstr]
test rax, rax
mov rbx, rax
je 0x10008d7e
add rbx, 5
mov edx, 0x3a
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_strchr]
test rax, rax
mov rdi, rax
je 0x10008d7e
cmp rax, rbx
je 0x10008d7e
lea rcx, [rax + 1]
call qword [sym.imp.MSVCR80.dll_atoi]
test eax, eax
mov dword [rsi + 0x44], eax
js 0x10008d77
sub rdi, rbx
lea rcx, [rsi + 0x24]
mov rdx, rbx
mov r8, rdi
call qword [sym.imp.MSVCR80.dll_strncpy]
jmp 0x10008d7e
mov dword [rsi + 0x44], 0
lea rdx, str.socks
lea rcx, [rsp + 0xc0]
call qword [sym.imp.MSVCR80.dll_strstr]
test rax, rax
mov rbx, rax
je 0x10008de6
add rbx, 6
mov edx, 0x3a
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_strchr]
test rax, rax
mov rdi, rax
je 0x10008de6
cmp rax, rbx
je 0x10008de6
lea rcx, [rax + 1]
call qword [sym.imp.MSVCR80.dll_atoi]
test eax, eax
mov dword [rsi + 0x20], eax
js 0x10008ddf
sub rdi, rbx
mov rdx, rbx
mov rcx, rsi
mov r8, rdi
call qword [sym.imp.MSVCR80.dll_strncpy]
jmp 0x10008de6
mov dword [rsi + 0x20], 0
mov rdi, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2f0]
mov rbx, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x2d8
ret
Function at 0x10008e30
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x140
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [0x10035668]
test rax, rax
jne 0x10008ebe
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx ecx, word [0x10016878]
mov rax, qword [str.winmm.dll]
mov qword [rdi - 1], rax
mov word [rdi + 7], cx
movzx ecx, byte [0x1001687a]
mov byte [rdi + 9], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.timeGetTime
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x10035668], rax
je 0x10008ec0
call rax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x140
pop rdi
ret

Function at 0x10008ee0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, rcx
lea r8, [rsp + 0x58]
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x58], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10008f46
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.ProcessorNameString
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x10008f50
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [rsp + 0x58]
lea rdx, str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10008fbd
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.PortNumber
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x10008fd0
Capabilities:
Get common file path
Get memory capacity
Get session user name

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rbx + 0x36c]
xor ecx, ecx
mov r8d, 0x80
mov dword [rbx + 0x368], eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x7f
mov r8d, edi
sub r8d, eax
test r8d, r8d
jle 0x1000902f
mov rcx, qword [0x10035610]
test rcx, rcx
je 0x1000902f
cdqe
lea rdx, [rax + rbx + 0x36d]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbx + 0x3ec]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x20
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rbx + 0x40c]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
sub edi, eax
test edi, edi
jle 0x10009073
cdqe
mov edx, edi
lea rcx, [rax + rbx + 0x40d]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r11, qword [rsp + 0x28]
lea rcx, [rbx + 0x494]
mov edx, 0x78
mov qword [rbx + 0x48c], r11
call fcn.10008ee0
call fcn.10008f50
mov rdi, qword [rsp + 0x88]
mov word [rbx + 0x50c], ax
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
ret
Function at 0x10009570
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 0x18], rbx
mov rbx, rcx
mov qword [r11 + 0x20], rdi
xor ecx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x100095eb
test byte [rsp + 0x20], 0x10
je 0x100095cd
lea rcx, [rsp + 0x4c]
call fcn.10009550
test eax, eax
jne 0x100095d0
add edi, 1
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100095b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x190]
mov eax, edi
mov rdi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x178
ret
Function at 0x10009980
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov r11, rsp
sub rsp, 0x1a8
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp byte [rdx], 0
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov rsi, rcx
mov rbp, r8
mov qword [rsp + 0x30], rdx
je 0x10009bc9
cmp byte [r8], 0
je 0x10009bc9
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x18], rdi
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp ecx, 0x104
mov rbx, rcx
jge 0x10009bb9
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x104
jae 0x10009bb9
mov ecx, 0x400
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdx, rbp
mov r8, rax
mov qword [rsp + 0x20], rax
sub rax, rbp
nop
nop
nop
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
mov byte [rax + rdx - 1], cl
jne 0x10009a30
movsxd rax, ebx
mov qword [rsp + 0x38], rax
cmp byte [rax + r8 - 1], 0x5c
je 0x10009a68
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016670]
mov word [rdi - 1], ax
mov rdx, qword [rsp + 0x30]
mov rdi, r8
xor eax, eax
mov rcx, 0xffffffffffffffff
mov r8, rbp
repne scasb al, byte [rdi]
movzx eax, word [0x1001692c]
mov rcx, rsi
mov word [rdi - 1], ax
call fcn.10009620
mov rbx, qword [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
mov qword [rsp + 0x28], rax
je 0x10009bb1
cmp dword [rsi + 0x64], 0
je 0x10009ba3
mov rcx, rsi
call fcn.10004a20
test eax, eax
jne 0x10009ba3
cmp dword [rsi + 0x28], eax
jne 0x10009ba3
lea rcx, [rsp + 0x6c]
call fcn.10009550
test eax, eax
jne 0x10009b8d
test byte [rsp + 0x40], 0x10
je 0x10009b8d
mov ecx, 0x400
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdx, rbp
mov rbx, rax
sub rax, rbp
nop
nop
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
mov byte [rax + rdx - 1], cl
jne 0x10009b10
mov rax, qword [rsp + 0x38]
cmp byte [rax + rbx - 1], 0x5c
je 0x10009b44
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016670]
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x6c]
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x10009b60
mov rdx, qword [rsp + 0x30]
mov r8, rbx
mov rcx, rsi
call fcn.10009980
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rdi, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009ab6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x1a8
ret
Function at 0x10009d70
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
lea eax, [rdx + 1]
mov qword [rsp + 0x40], rsi
movsxd rbp, eax
mov qword [rsp + 0x48], rdi
mov rdi, rcx
mov rcx, rbp
mov esi, edx
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
je 0x10009dfa
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.MSVCR80.dll_memset
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.10004db0
cmp eax, esi
je 0x10009dcc
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x10009dfa
mov ecx, 0x218
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [0x10009c00]
xor edx, edx
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov r8, rax
mov dword [rdi + 0x64], 1
call qword [sym.imp.MSVCR80.dll__beginthread]
mov qword [rdi + 0x50], rax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x1000a840
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x32]
mov byte [rsp + 0x31], 0x5c
mov byte [rsp + 0x30], 0x5c
mov dword [rsp + 0x20], 0x7c
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll__stricmp]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0xc0
pop rbx
ret

Function at 0x1000acf0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov rbx, rcx
mov ecx, 0x218
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, edx
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
xor edx, edx
mov r8d, 0x218
mov rcx, rax
mov rsi, rax
call sub.MSVCR80.dll_memset
test edi, edi
lea rdx, [rsi + 0x10]
mov byte [rdx], 0
mov qword [rsi], rbx
je 0x1000ad42
mov r8d, edi
mov rcx, rbx
call fcn.10004db0
cmp eax, edi
jne 0x1000ad58
lea rcx, [0x1000ab90]
mov r8, rsi
xor edx, edx
call qword [sym.imp.MSVCR80.dll__beginthread]
mov qword [rbx + 0x58], rax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x1000ad70
Capabilities:
Create directory

Disassembly:
mov r11, rsp
sub rsp, 0x148
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [r11 + 0x18], rbx
mov rbx, rcx
mov qword [r11 + 0x20], rdi
mov edi, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
xor edx, edx
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, edi
mov rcx, rbx
call fcn.10004db0
mov rbx, qword [rsp + 0x160]
cmp eax, edi
mov rdi, qword [rsp + 0x168]
je 0x1000adec
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x148
ret
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x148
ret