joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19d0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.019d01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x19d0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x19d006f
add dl, dl
jne 0x19d0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x19d00f6
xor eax, eax
add dl, dl
jne 0x19d00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x19d01ad
add dl, dl
jne 0x19d00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x19d00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x19d007e
mov eax, 1
add dl, dl
jne 0x19d0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19d0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x19d00fb
sub eax, ebx
mov ebx, 1
jne 0x19d014c
mov ecx, 1
add dl, dl
jne 0x19d012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19d013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x19d0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x19d007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x19d0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19d0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x19d015d
cmp eax, 0x7d00
jae 0x19d019b
cmp eax, 0x500
jb 0x19d0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x19d007e
cmp eax, 0x7f
ja 0x19d019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x19d007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x19d01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x19d007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x100114e
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs rax, 0xb2d05e00
mov rbx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, rbx
jb 0x1001167
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x100118e
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1001187
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x100f16c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rsi
mov rsi, rcx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x100f2cf
lea rdx, [0x010054c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x268], rax
test rax, rax
jne 0x100f1d2
and dword [rsp + 0x20], eax
lea rdx, [0x01042108]
lea rcx, [rsp + 0x20]
call fcn.01036158
lea rdx, [0x010054d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x270], rax
test rax, rax
jne 0x100f203
and dword [rsp + 0x24], eax
lea rdx, [0x01042108]
lea rcx, [rsp + 0x24]
call fcn.01036158
lea rdx, [0x010054e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x278], rax
test rax, rax
jne 0x100f234
and dword [rsp + 0x28], eax
lea rdx, [0x01042108]
lea rcx, [rsp + 0x28]
call fcn.01036158
lea rdx, [0x010054f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x280], rax
test rax, rax
jne 0x100f265
and dword [rsp + 0x2c], eax
lea rdx, [0x01042108]
lea rcx, [rsp + 0x2c]
call fcn.01036158
lea rdx, [0x01005500]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x288], rax
test rax, rax
jne 0x100f296
and dword [rsp + 0x30], eax
lea rdx, [0x01042108]
lea rcx, [rsp + 0x30]
call fcn.01036158
lea rdx, [0x01005518]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x290], rax
test rax, rax
jne 0x100f2c8
and dword [rsp + 0x34], eax
lea rdx, [0x01042108]
lea rcx, [rsp + 0x34]
call fcn.01036158
nop
mov rax, rdi
jmp 0x100f2cf
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x100f674
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x01045880]
lea rcx, [r11 - 0x18]
mov rbp, r8
mov qword [r11 - 0x18], rax
mov rbx, rdx
call fcn.0100f8bc
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x100f703
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x100f703
mov edi, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.0100fe90
lea r8, [0x010053c0]
lea rdx, [0x01005430]
mov rcx, rbp
mov r9, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
or edx, 0xffffffff
call fcn.0100ff00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.0100f74c
lea rcx, [rsp + 0x30]
call fcn.0100f940
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x101093c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x20
mov rax, qword [0x01045850]
lea rsi, [0x01005540]
xor ebp, ebp
mov qword [rcx], rax
mov rax, rsi
mov rdi, rcx
shr rax, 0x10
cmp ax, bp
jne 0x10109be
movzx ebx, si
xor r8d, r8d
mov edx, ebx
call fcn.010111b4
cmp eax, ebp
jne 0x10109e7
mov rax, qword [0x01045850]
lea rdx, [0x01005548]
lea rcx, [rsp + 0x38]
mov r8d, ebx
mov qword [rsp + 0x38], rax
call fcn.010110b8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x38]
call fcn.01010894
jmp 0x10109e7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebp
je 0x10109e7
movsxd rbx, eax
mov rcx, rdi
mov rdx, rbx
call fcn.01010728
mov rcx, qword [rdi]
mov r8, rbx
mov rdx, rsi
call fcn.01029120
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x10112b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
test r8d, r8d
je 0x1011378
test r9, r9
je 0x1011378
call fcn.01011478
test eax, eax
je 0x1011378
and qword [rsp + 0x40], 0
xor r9d, r9d
lea r8, [rsp + 0x40]
lea edx, [r9 + 1]
lea rcx, [0x01005580]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov r8, qword [rsp + 0x40]
mov rcx, qword [rbx + 0x10]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
cmp qword [rsp + 0x40], 0
je 0x101133f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x30], 0
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x101138f
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
and qword [rsp + 0x20], 0
mov r9, rdi
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x10113b5
mov rcx, rbx
call fcn.010113f8
mov rcx, rbx
call fcn.010113c8
mov eax, edi
jmp 0x101137a

Function at 0x10113f8
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x01044480]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
call fcn.010113c8
test eax, eax
jne 0x1011423
xor eax, eax
jmp 0x1011459
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1011454
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1011454
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x101141f
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.01028cb0
add rsp, 0x280
pop rbx
ret
Function at 0x1011478
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
mov rbx, rcx
cmp qword [rcx + 0x28], r13
je 0x10114ac
cmp dword [rcx + 0x30], r13d
je 0x10114ac
call fcn.010115e0
jmp 0x1011533
call fcn.010113c8
mov rcx, rbx
call fcn.01011718
lea rdx, [rsp + 0x40]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r12d, eax
cmp eax, r13d
je 0x1011531
mov rdi, r12
add rdi, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, r13
je 0x1011531
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapSize]
mov rdx, rsi
shr rax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r13d
jne 0x101154c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov ebp, r13d
lea edi, [r12 + r12 + 0x208]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x10], rax
cmp rax, r13
je 0x10115b1
lea rdx, [0x01005600]
mov r9, rax
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, r13d
jbe 0x10115b1
mov rdi, qword [rbx + 0x10]
cmp r13w, word [rdi]
je 0x10115b1
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
lea ebp, [rax + 1]
not rcx
dec rcx
mov dword [rbx + 8], ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, r13d
jne 0x10115d2
mov rcx, rbx
call fcn.01011718
mov eax, ebp
jmp 0x1011533
Function at 0x10115e0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
call fcn.010113c8
mov rcx, rbp
call fcn.01011718
mov r8d, dword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
lea rcx, [rsp + 0x38]
call fcn.01020550
mov rdi, qword [rsp + 0x38]
xor esi, esi
cmp qword [rdi - 0x10], rsi
je 0x10116f4
mov rax, qword [0x01045880]
lea rdx, [0x01005608]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x30], rax
call fcn.01010648
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [0x01005620]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.01010648
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdi, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx + 0x206]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rsi + 8]
mov rcx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x10], rax
cmp rax, rsi
je 0x10116e2
mov rcx, qword [rsp + 0x30]
lea rdx, [0x01005600]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, esi
jbe 0x10116e2
mov rdi, qword [rbp + 0x10]
cmp si, word [rdi]
je 0x10116e2
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
lea esi, [rax + 1]
not rcx
dec rcx
mov dword [rbp + 8], ecx
jmp 0x10116ea
mov rcx, rbp
call fcn.01011718
lea rcx, [rsp + 0x30]
call fcn.0100f940
lea rcx, [rsp + 0x38]
call fcn.0100f940
mov rbp, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1011840
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x80
xor ebx, ebx
mov ebp, r9d
mov r12, r8
mov r13, rcx
cmp rdx, rbx
je 0x1011873
or eax, 0xffffffff
jmp 0x1011a75
lea r8, [0x01005640]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20019
mov dword [0x01046b6c], ebx
mov dword [rsp + 0x20], ebx
call fcn.01020df8
cmp dword [rsp + 0x40], ebx
je 0x10118c4
lea rdx, [0x01005668]
lea rcx, [rsp + 0x30]
call fcn.010213e4
mov ecx, ebx
cmp eax, ebx
setne cl
mov dword [0x01046b6c], ecx
lea rdi, [0x01046b90]
xor edx, edx
mov r8d, 0x222
mov rcx, rdi
call fcn.01034300
mov esi, 0x111
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x1011903
lea r8, [0x01005678]
mov rdx, rsi
mov rcx, rdi
call fcn.01011774
jmp 0x101193b
lea rcx, [0x01005698]
sub rcx, rdi
lea rax, [rsi + 0x7ffffeed]
cmp rax, rbx
je 0x101192f
movzx eax, word [rcx + rdi]
cmp ax, bx
je 0x101192f
mov word [rdi], ax
add rdi, 2
sub rsi, 1
jne 0x101190d
cmp rsi, rbx
jne 0x1011938
sub rdi, 2
mov word [rdi], bx
lea rcx, [0x010056b8]
call fcn.01011d38
lea rdx, [0x010056e0]
lea rcx, [0x010056f0]
call fcn.01011d38
lea r8, [0x010057c0]
mov edx, 1
xor ecx, ecx
mov qword [0x01046db8], r13
mov qword [0x01046b78], r12
mov dword [0x01046b80], ebx
mov dword [0x01046b84], ebx
mov dword [0x01046db4], ebx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x01046b70], rax
cmp rax, rbx
je 0x10119af
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x01046b68], ebx
cmp eax, ebx
je 0x10119b9
mov dword [0x01046b68], 1
mov ecx, ebp
call fcn.01011a98
cmp rax, rbx
jne 0x1011a0b
mov rcx, qword [0x01046b88]
cmp rcx, rbx
je 0x10119e2
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x01046b88], rbx
lea rcx, [0x01005720]
call fcn.01011d38
jmp 0x1011a5d
cmp eax, 0xffffffff
je 0x1011a24
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebx
jne 0x10119f0
jmp 0x1011a30
lea rcx, [0x01005770]
call fcn.01011d38
mov rcx, qword [0x01046b88]
cmp rcx, rbx
je 0x1011a4d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x01046b88], rbx
lea rcx, [0x01005798]
call fcn.01011d38
mov ebx, dword [rsp + 0x58]
lea rax, [0x0100d8d8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.01020f9c
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1011d38
Capabilities:
Get file size
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
sub rsp, 0x68
cmp dword [0x01046b6c], 0
je 0x1011e5f
mov eax, 0x30
lea rbp, [r11 + 0x10]
cmp ax, word [0x01046b90]
je 0x1011e5f
and qword [r11 - 0x48], 0
lea r8d, [rax - 0x2f]
lea rcx, [0x01046b90]
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1011e5f
and dword [rsp + 0x44], 0
and dword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x1011df2
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8d, [rax + 2]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov byte [rsp + 0x40], 0xff
mov byte [rsp + 0x41], 0xfe
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1011e56
mov rax, qword [0x01045880]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x50]
mov r8, rbp
mov qword [rsp + 0x50], rax
call fcn.01010218
mov rdx, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
mov r8d, dword [rdx - 0x10]
lea r9, [rsp + 0x44]
mov rcx, rbx
add r8d, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x50]
call fcn.0100f940
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x68
pop rbp
pop rbx
ret
Function at 0x1011e6c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x150
mov rax, qword [0x01044480]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r12d, ecx
mov rbp, rdx
mov ebx, 0x114
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rbx
xor edi, edi
call fcn.01034300
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, edi
je 0x1012069
cmp dword [rsp + 0x30], 2
jne 0x1012069
cmp dword [rsp + 0x24], 5
jb 0x1012069
lea r14d, [rbx - 0x2c]
mov rbx, qword [0x01046dd0]
mov esi, edi
cmp r12d, 1
jne 0x1011f66
cmp rbx, rdi
jne 0x1011f2a
mov rcx, r14
call fcn.01028e1c
cmp rax, rdi
je 0x1011f1b
mov rcx, rax
call fcn.01026684
mov rbx, rax
mov qword [0x01046dd0], rax
jmp 0x1011f25
mov rbx, rdi
mov qword [0x01046dd0], rbx
cmp rbx, rdi
je 0x1011f66
cmp rbp, rdi
je 0x1011f66
mov rcx, rbx
call fcn.010267dc
cmp eax, 1
jne 0x1011f5f
lea rcx, [rbx + 0x80]
mov rdx, rbp
call fcn.01027074
mov esi, eax
cmp eax, 1
jne 0x1011f5f
lea rcx, [rbx + 8]
xor edx, edx
call fcn.01026b2c
mov esi, eax
mov rbx, qword [0x01046dd0]
cmp r12d, 2
jne 0x1011fdf
cmp rbx, rdi
jne 0x1011f9c
mov rcx, r14
call fcn.01028e1c
cmp rax, rdi
je 0x1011f92
mov rcx, rax
call fcn.01026684
mov rbx, rax
mov qword [0x01046dd0], rax
jmp 0x1011f9c
mov rbx, rdi
mov qword [0x01046dd0], rbx
mov esi, edi
cmp rbx, rdi
je 0x1011fdf
cmp rbp, rdi
je 0x1011fdf
mov rcx, rbx
call fcn.010267dc
cmp eax, 1
jne 0x1011fd8
lea rcx, [rbx + 0x80]
mov rdx, rbp
call fcn.0102716c
mov esi, eax
cmp eax, 1
jne 0x1011fd8
lea rcx, [rbx + 8]
xor edx, edx
call fcn.01026ac0
mov esi, eax
mov rbx, qword [0x01046dd0]
cmp r12d, 3
jne 0x1012051
cmp rbx, rdi
jne 0x1012015
mov rcx, r14
call fcn.01028e1c
cmp rax, rdi
je 0x101200b
mov rcx, rax
call fcn.01026684
mov rbx, rax
mov qword [0x01046dd0], rax
jmp 0x1012015
mov rbx, rdi
mov qword [0x01046dd0], rbx
mov esi, edi
cmp rbx, rdi
je 0x1012051
cmp rbp, rdi
je 0x1012051
mov rcx, rbx
call fcn.010267dc
cmp eax, 1
jne 0x1012051
lea rcx, [rbx + 0x80]
mov rdx, rbp
call fcn.01027264
mov esi, eax
cmp eax, 1
jne 0x1012051
lea rcx, [rbx + 8]
xor edx, edx
call fcn.01026b2c
mov esi, eax
cmp esi, edi
je 0x1012066
mov dword [0x01046dc4], 1
mov edi, 1
jmp 0x1012069
or edi, 0xffffffff
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.01028cb0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x10126e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
lea rcx, [0x01005880]
mov edi, r8d
mov rbx, rdx
call fcn.01011d38
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.01034300
mov eax, 1
xor r9d, r9d
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rbx
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor ecx, ecx
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
jne 0x1012773
lea rcx, [0x010058b0]
call fcn.01011d38
jmp 0x10127cf
lea rcx, [0x01005920]
call fcn.01011d38
test edi, edi
je 0x10127b9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x01005990]
mov edx, eax
call fcn.01011d38
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x01005a00]
mov edx, eax
call fcn.01011d38
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
Function at 0x10127e8
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xf0
mov rbx, rcx
lea rcx, [0x01005a70]
mov rdi, rdx
call fcn.01011d38
mov esi, 0x68
lea rcx, [rsp + 0x80]
mov r8, rsi
xor edx, edx
call fcn.01034300
lea eax, [rsi - 0x67]
lea rcx, [rbx + 0x10]
mov word [rsp + 0xc0], ax
xor eax, eax
lea rdx, [0x01005540]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x80], esi
call fcn.0100fba4
lea rcx, [rbx + 0x18]
lea rdx, [0x01005540]
call fcn.0100fba4
mov rcx, rbx
call fcn.01012a28
xor esi, esi
cmp eax, esi
je 0x10128dd
lea rcx, [0x01005ac0]
call fcn.01011d38
lea r11, [rsp + 0x60]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
cmp eax, esi
jne 0x10128d1
lea rcx, [0x01005b40]
call fcn.01011d38
jmp 0x10129fb
lea rcx, [0x01005bc0]
jmp 0x10129a1
lea rcx, [0x01005d40]
call fcn.01011d38
lea r11, [rsp + 0x60]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call fcn.0101317c
mov ebx, eax
cmp eax, esi
jne 0x101299a
lea rcx, [0x01005dc0]
call fcn.01011d38
lea rcx, [0x01005e40]
call fcn.01011d38
lea r11, [rsp + 0x60]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
cmp eax, esi
jne 0x1012991
lea rcx, [0x01005ec0]
jmp 0x10128c7
lea rcx, [0x01005f40]
jmp 0x10129a1
lea rcx, [0x01005fc0]
call fcn.01011d38
cmp dword [rsp + 0x120], esi
je 0x10129e5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x01005c40]
mov edx, eax
call fcn.01011d38
mov rcx, qword [rsp + 0x60]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x01005cc0]
mov edx, eax
call fcn.01011d38
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x01006050]
mov edx, ebx
call fcn.01011d38
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret