joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140131b59
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov byte [rbp + rdx - 0x67], cl
mov byte [rsp + rdx + 0x72], r15b
inc rdx
cmp rdx, 0x26
jb fcn.140131b59
mov r9d, 0x10
lea r8, [rsp + 0x36]
je 0x140131721
jne 0x140131721
jmp rax
jmp 0x1401317a3
nop dword [rax + rax]
mov byte [rbp + rax - 0x67], r15b
inc rax
cmp rax, 0x26
jmp 0x140131a57
lea rdx, [rbp - 0x67]
xor ecx, ecx
call rbx
xchg r15, rbx
mov rax, rbx
xchg r15, rbx
nop dword [rax]
je 0x1401317ec
jne 0x1401317ec
mov r8d, 0x38955efa
ror ebp, 0x87
lea esi, [rdx - 0x5ea3]
rcl ebx, 0xe6
test r13, rdx
jmp rcx
jmp 0x14013178a
jb 0x140131792
nop
mov byte [rsp + r15 + 0x36], 0
jmp 0x140131ab0
inc r15
cmp r15, 5
jb 0x140131a5f
mov eax, 0xffffffff
movzx eax, byte [rsp + rdx + 0x72]
movzx ecx, byte [rbp + rdx - 0x67]
add cl, al
je 0x140131b8f
jne 0x140131b8f
je 0x140132242
lea esi, [rdi - 0x5d90]
dec rsi
cmp rdx, rcx
inc rbp
lea esi, [rbx - 0x5a30]
neg rdi
rcl r10d, 0x6c
cpuid
movabs r13, 0x3ba3b6fffffb3ce9
rol edx, 0xb9
lea r9d, [rdi + 0xabd6]
ret 0x20
jmp 0x1401316d0
mov qword [rsp + 0x20], rax
call r12
movzx eax, word [r13 + 6]
jne 0x140131e8b
je 0x140131e8b
mov ebp, 0xadeef06b
jg 0x140130ed8
jmp 0x140132150
lea rdx, [rbp + 0x158]
mov qword [rbp + 0x150], rax
mov r9d, 4
lea rax, [rbp + 0x110]
mov dword [rbp + 0x110], r15d
mov rcx, 0xffffffffffffffff
je 0x140131f60
jne 0x140131f60
lea edx, [rbp + 0xf3ea]
ror r14d, 0x6d
cmp r14, rbx
rcl r13d, 0x8c
jmp rcx
jmp 0x140131e52
mov qword [rbp + 0x238], rax
xchg rdi, r10
mov qword [rbp + 0x158], r10
xchg r10, rdi
lea r8, [rbp + 0x150]
mov eax, dword [r13 + 0x54]
jne 0x140132036
je 0x140132036
or ebp, 0xc2630a7d
add edx, 0x19867c4d
pushf
bswap rdx
jns 0x14013268f
inc r11
ror r11d, 0x65
sub r15d, 0x6fa3e4d4
jmp rax
jmp 0x140131f06
lea rbx, [r13 + 0x108]
lea rcx, [rax + rax*4]
lea rax, [r13 + 0x108]
lea rax, [rax + rcx*8]
jmp 0x140132212
cmp rcx, rdi
jae 0x140131fe4
lea rax, [rcx + rdi]
jmp 0x140131fdd
add dword [rax], eax
add byte [rax + 0x3b], cl
xlatb
jae 0x14013222d
lea rax, [rdx + rdi]
xchg r13, rax
mov qword [rbp + 0x230], r13
xchg r13, rax
jmp 0x14013222d
cmp eax, 0xc000008c
jne 0x140132767
nop
lea esi, [rbp - 0xa785]
jmp 0x1401327bc
xchg rdx, rax
mov qword [rsp + 0x20], rdx
xchg rdx, rax
mov qword [rsp + 0x30], r14
call r12
jmp 0x1401323fc
and al, 0xe9
adc eax, 0x44fffffe
mov dword [rsp + 0x58], edi
lea rax, [rsp + 0x58]
xchg rdi, rsi
mov qword [rsp + 0x40], rdi
xchg rdi, rsi
jmp 0x140132563
lea r9, [rbp + 0x1b0]
mov dword [rsp + 0x20], 2
lea r8, [rbp + 0x230]
mov edx, r14d
mov rcx, rsi
jmp 0x1401324f1
Function at 0x140133ce0
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv

Disassembly:
xchg r9, rdx
mov qword [rsp + 0x20], rdx
xchg r9, rdx
mov qword [rsp + 0x18], r8
jne 0x140133d11
je 0x140133d11
rol r13d, 0xef
rcr ecx, 0xe4
jmp rcx
jmp 0x140133d3a
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rax, [0x140133fb0]
jmp 0x140133d63
xchg rdx, rax
xchg r14, rax
mov qword [rsp + 0x10], r14
xchg r14, rax
jmp 0x140133d8d
mov qword [rsp + 0x18], rax
mov dword [rsp + 8], 0
xchg rdx, rax
mov rdx, qword [rsp + 0x30]
jmp 0x140133d53
Function at 0x401595
Capabilities:
Create thread
Encode data using xor

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov ebx, edx
mov ecx, 0x40000
xor edx, edx
mov rdi, r8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov r8d, 0xa
xor edx, edx
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, rax
test ebx, ebx
jle 0x4015fb
movsxd r9, ebx
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r8, rax
xor eax, eax
mov rdx, rax
and edx, 7
mov dl, byte [rdi + rdx]
xor dl, byte [rsi + rax]
mov byte [r8 + rax], dl
inc rax
cmp ebx, eax
jg 0x4015e4
mov rcx, r8
call fcn.00401563
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov r9, r8
lea r8, [0x00401560]
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x401640
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x4c], 0
mov rsi, rcx
mov ebx, edx
lea rcx, [0x00408980]
mov qword [rsp + 0x38], 0
mov edx, 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov r12, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x4016ec
xor edx, edx
mov rcx, r12
lea rdi, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x4016ec
test ebx, ebx
jle 0x4016d6
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4016e1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4016ec
mov edx, dword [rsp + 0x4c]
add rsi, rdx
sub ebx, edx
jmp 0x4016b3
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x401714
Capabilities:
Read file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov r8d, 3
mov dword [rsp + 0x4c], 0
mov rsi, rcx
mov ebx, edx
lea rcx, [0x00408980]
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea rdi, [rsp + 0x4c]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
xor eax, eax
cmp r12, 0xffffffffffffffff
je 0x4017ac
test ebx, ebx
jle 0x401791
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4017a1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4017ac
mov edx, dword [rsp + 0x4c]
add rsi, rdx
sub ebx, edx
jmp 0x40176e
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x401810
Capabilities:
Create thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x004054b0]
movsxd rcx, dword [rbx + 4]
call sub.msvcrt.dll_malloc
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, rax
mov ecx, 0x400
call rsi
mov edx, dword [rbx + 4]
mov rcx, r12
call fcn.00401714
test eax, eax
je 0x4017d8
mov edx, dword [rbx + 4]
lea r8, [rbx + 8]
mov rcx, r12
call fcn.00401595
mov rcx, r12
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
lea rcx, [0x00408980]
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cnetsvc_d
call sub.msvcrt.dll_sprintf
xor ecx, ecx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
lea r8, [0x004016f6]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x4017b6

Function at 0x401d60
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402ed0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402ed0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x401dd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00408614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x401f78
mov rax, qword [0x00408618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x401e1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x401ea7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x401e00
mov rcx, r12
call fcn.00402b30
mov rbp, rax
test rax, rax
je 0x401fb2
mov rax, qword [0x00408618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00402c60
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401fc1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x401ea0
sub eax, 4
and eax, 0xfffffffb
jne 0x401f30
add dword [0x00408614], 1
cmp ebx, 8
jae 0x401ed8
test bl, 4
jne 0x401f80
test ebx, ebx
je 0x401ec9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x401fa0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x401ec9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x401f0a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00408618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401ea0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401d60
nop dword [rax]
xor edi, edi
jmp 0x401e27
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x401ec9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x401ec9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00401d60
mov rax, qword [0x00408618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00401d60
nop
nop dword [rax]
Function at 0x4027a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x4027f4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4027eb
test r12, r12
je 0x4027eb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4027d0
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402b30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004053b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402ba9
mov rcx, r10
call fcn.00402a00
test eax, eax
je 0x402ba9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402ba6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x402b9d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402ba9
add r8, 0x28
cmp r8, r9
jne 0x402b88
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x14104d0e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14104d0f2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14104d11b
pop rbp
sub rbp, 0x33
sub rbp, 0x104d0e8
sub rsp, 0x20
jmp 0x14104d13a
mov rax, 0x104d0e8
rol byte [rcx + rax], 1
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xf1c4fa9
invalid
xor byte [rax], dl
inc rax
dec rcx
jne 0x14104d159
jmp 0x14104d170
add byte [rax], al
add ch, bh
sbb esi, dword [rax + 0x4020e12d]
and ah, byte [rax]
loope 0x14104d192
and spl, byte [rax]
xchg ebp, eax
test eax, 0x28e1a9a9
push 0xffffffffa9a9a8a1
loope 0x14104d12a
loope 0x14104d1f3
imul ebp, dword [rsi - 0x1e565657], 0xa9816b6e
test eax, 0x4b5ee1a9
loope 0x14104d13e
pop rsi
loope 0x14104d13e
push 0xffffffffa9a52822
test eax, 0x41a8e1a9
stc
stc
loope 0x14104d1b5
jno 0x14104d1c5
invalid
sub byte [rcx - 0x56565657], 0xe1
adc byte [rsi - 0x56568d4d], ah
test eax, 0xa8e1a9a9
loope 0x14104d1ce
test eax, 0xe140a8e1
adc edx, ebp
jg 0x14104d14f
invalid
jne 0x14104d169
test eax, 0xac41a9a9
test eax, 0xbf40a9a9
test eax, 0x4168a9a9
stosd dword [rdi], eax
stosd dword [rdi], eax
cwde
mov eax, 0xad6828e1
test eax, 0x56e1a9a9
invalid
cmpsb byte [rsi], byte [rdi]
mov bl, 0x72
test eax, 0xa9a9a9a9
loope 0x14104d1a5
jb 0x14104d1a0
test eax, 0xe1a9a9a9
test al, 0x40
lodsb al, byte [rsi]
lodsb al, byte [rsi]
test eax, 0x2440a9a9
stosd dword [rdi], eax
test eax, 0xd441fba9
test eax, 0xfef3a9a9
loope 0x14104d232
jle 0x14104d1f5
cwde
invalid
cmpsb byte [rsi], byte [rdi]
sub eax, 0xa9a9a9b5
sub dword [rdx + 0x40], edx
cmpsb byte [rsi], byte [rdi]
sub eax, 0xa9a9a9ba
iretd
Function at 0x140002370
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400023ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400023ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.KERNEL32.dll_CloseHandle
jne 0x1400023ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400023ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400023ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400023bc
xor al, al
add rsp, 0x28
ret
Function at 0x100bc60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
mov edi, esi
xor eax, eax
lock cmpxchg qword [0x01024400], rbx
je 0x100bca6
cmp rax, rbx
jne 0x100bc99
mov edi, 1
jmp 0x100bca6
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100bc80
mov eax, dword [0x010243fc]
cmp eax, 1
jne 0x100bcbb
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100bcfa
mov eax, dword [0x010243fc]
test eax, eax
jne 0x100bcf0
mov dword [0x010243fc], 1
lea rdx, [0x010014d8]
lea rcx, [0x010014c0]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100bcfa
mov eax, 0xff
jmp 0x100bddb
mov dword [0x010211f4], 1
mov eax, dword [0x010243fc]
cmp eax, 1
jne 0x100bd22
lea rdx, [0x010014b8]
lea rcx, [0x01001498]
call sub.MSVCR80.dll__initterm
mov dword [0x010243fc], 2
test edi, edi
jne 0x100bd2d
xchg qword [0x01024400], rsi
cmp qword [0x01024418], 0
je 0x100bd56
lea rcx, [0x01024418]
call fcn.0100c2a0
test eax, eax
je 0x100bd56
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x01024418]
mov rcx, qword [sym.imp.MSVCR80.dll___initenv]
mov rax, qword [0x010211d8]
mov qword [rcx], rax
mov r8, qword [0x010211d8]
mov rdx, qword [0x010211e0]
mov ecx, dword [0x010211d0]
call fcn.0100b52c
mov dword [0x010211f0], eax
cmp dword [0x010211d4], 0
jne 0x100bd97
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x010211f4], 0
jne 0x100bdac
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x010211f0]
jmp 0x100bddb
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
call fcn.0100c330
add rsp, 0x28
jmp 0x100bc60
Function at 0x100c4a7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x01021130]
jne 0x100bf5a
rol rcx, 0x10
test cx, 0xffff
jne 0x100bf56
repz ret
ror rcx, 0x10
jmp 0x100c400
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x010212b0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rax, qword [0x010213a8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100c485
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x010212b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100c4a7
mov rax, qword [rsp + 0x88]
mov qword [0x010213a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x01021348], rax
mov rax, qword [0x010213a8]
mov qword [0x01021220], rax
mov rax, qword [rsp + 0x90]
mov qword [0x01021330], rax
mov dword [0x01021210], 0xc0000409
mov dword [0x01021214], 1
mov rax, qword [0x01021130]
mov qword [rsp + 0x68], rax
mov rax, qword [0x01021138]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x010212a8], eax
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x01001510]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x010212a8], 0
jne 0x100c52e
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100cb80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor eax, eax
cmp qword [0x01021790], rax
mov qword [rsp + 0x30], rax
jne 0x100cbf5
xor ecx, ecx
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x100cbc4
lea rdx, [0x01001608]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x100cbc4
lea rcx, [rsp + 0x30]
call rax
jmp 0x100cbd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100cbd8
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100cc12
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x100cc07
mov rax, qword [rsp + 0x30]
mov qword [0x01021790], rax
lea rcx, [fcn.0100c8e0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
add rsp, 0x28
ret
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea r8, [0x010017f8]
lea rdx, [0x010016b0]
mov r9d, 0x210010
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.MSVCR80.dll_exit]
int3
Function at 0x100cc70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x268
mov rax, qword [0x01021130]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rcx, qword [rcx]
mov rsi, rdx
mov rax, r8
lea rdx, [rsp + 0x34]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x34], 0x104
mov qword [rsp + 0x20], rdx
mov rdx, rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x100cd31
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x100cd0e
cmp ecx, 2
jbe 0x100cd18
cmp ecx, 7
jne 0x100cd0e
test al, 1
jne 0x100cd0e
mov ecx, eax
shr ecx, 1
cmp ecx, 1
jb 0x100cd0e
mov rdx, rax
shr rdx, 1
cmp word [rsp + rdx*2 + 0x3e], 0
jne 0x100cd0e
cmp ecx, 1
jbe 0x100cd38
cmp word [rsp + rdx*2 + 0x3c], 0
je 0x100cd38
mov eax, 0xd
jmp 0x100cdca
test al, 1
jne 0x100cd27
shr rax, 1
cmp word [rsp + rax*2 + 0x3e], 0
je 0x100cd38
mov eax, 0xd
jmp 0x100cdca
mov word [rsp + 0x40], 0
test ebx, ebx
jne 0x100cde4
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x260], rdi
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
mov rdi, rcx
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
test rax, rax
mov rdx, rax
mov qword [rsi], rax
je 0x100cdc0
test rdi, rdi
je 0x100cdc0
cmp rdi, 0x7fffffff
ja 0x100cdc0
lea r8, [rsp + 0x40]
mov ecx, 0x7ffffffe
sub rcx, rdi
sub r8, rax
nop
lea rax, [rcx + rdi]
test rax, rax
je 0x100cdb2
movzx eax, word [r8 + rdx]
test ax, ax
je 0x100cdb2
mov word [rdx], ax
add rdx, 2
sub rdi, 1
jne 0x100cd90
jmp 0x100cdb7
test rdi, rdi
jne 0x100cdbb
sub rdx, 2
mov word [rdx], 0
mov rdi, qword [rsp + 0x260]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.0100bf40
add rsp, 0x268
pop rsi
pop rbx
ret
mov eax, ebx
jmp 0x100cdca
Function at 0x100d730
Capabilities:
Get file size
Persist via application shimming
Write file on windows

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x70
mov rbp, rcx
mov rcx, qword [rcx + 0x70]
mov r12d, r8d
mov rsi, rdx
call fcn.0100c7b0
cmp dword [rbp], 0
je 0x100d970
mov eax, dword [rbp + 0x30]
test dword [rsp + 0xb0], eax
je 0x100d970
mov qword [rsp + 0x98], rbx
xor ebx, ebx
test rsi, rsi
jne 0x100d781
lea rax, [0x01001c28]
mov qword [rbp + 0x60], rax
jmp 0x100d7db
or rcx, 0xffffffffffffffff
mov qword [rsp + 0xa0], rdi
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0xa0]
not rcx
lea rax, [rsi + rcx*2 - 4]
mov ecx, ebx
cmp rax, rsi
jbe 0x100d7d7
nop
cmp ecx, 3
jge 0x100d853
nop
nop
sub rax, 2
cmp word [rax], 0x5c
je 0x100d7cf
cmp rax, rsi
ja 0x100d7c0
add ecx, 1
cmp rax, rsi
ja 0x100d7b0
mov qword [rbp + 0x60], rsi
cmp dword [rbp + 0x18], ebx
mov rax, qword [rsp + 0xb8]
mov dword [rbp + 0x58], r12d
mov qword [rbp + 0x68], rax
mov eax, dword [rsp + 0xc0]
mov dword [rbp + 0x54], eax
je 0x100d961
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x30], rbx
lea rcx, [0x01004cd8]
test rax, rax
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x100080
cmovne rcx, rax
xor r9d, r9d
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov qword [rbp + 8], rax
jne 0x100d869
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x01001b90]
jmp 0x100d956
cmp rax, rsi
jbe 0x100d7d7
add rax, 2
mov qword [rbp + 0x60], rax
jmp 0x100d7db
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea edx, [r9 + 1]
mov rcx, rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x64], ebx
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
test eax, eax
jne 0x100d8cc
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x01001ac0]
jmp 0x100d956
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100d918
cmp qword [rsp + 0x48], rbx
jne 0x100d918
mov rcx, qword [rbp + 8]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x90]
mov r8d, 2
mov byte [rsp + 0x90], 0xff
mov byte [rsp + 0x91], 0xfe
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 8]
mov r9d, 2
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100d961
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x010019f0]
mov r8d, eax
mov rcx, rbp
call fcn.0100d240
mov rbx, qword [rsp + 0x98]
mov dword [rbp + 0x50], 1
xor eax, eax
add rsp, 0x70
pop r12
pop rsi
pop rbp
ret