joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100034960
Capabilities:
Create process on windows
Parse url

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [rcx + 0x28]
xor ebp, ebp
mov rcx, qword [rax + 0x30]
mov rbx, rbp
mov rax, qword [rcx + 8]
cmp rax, rbp
je 0x100034992
cmp dword [rax], 1
je 0x1000349a0
mov rax, qword [rcx + 0x10]
cmp rax, rbp
je 0x1000349a4
cmp dword [rax], 1
jne 0x1000349a4
mov rbx, qword [rax + 8]
xor edx, edx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0xb0], rbp
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0x68
lea rcx, [rsp + 0xb0]
mov rdx, rbx
cmp rbx, rbp
jne 0x1000349db
lea rdx, [0x1000a9620]
call fcn.100007e60
mov rbx, qword [rsp + 0xb0]
cmp eax, ebp
jl 0x100034adf
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp eax, ebp
je 0x100034a40
cmp dword [rsp + 0x44], 3
je 0x100034a19
cmp dword [rsp + 0x44], 4
jne 0x100034adf
lea rdx, str.open
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100034adf
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, 0x824
add eax, 8
cmp eax, esi
jae 0x100034a61
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
lea esi, [rax + 8]
mov rdi, rbp
cmp esi, ebp
jbe 0x100034a7a
mov edx, esi
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rdi, rax
cmp rax, rbp
je 0x100034adf
movsxd rsi, esi
lea r8, str.http:__
mov rcx, rdi
mov rdx, rsi
call fcn.100001010
cmp eax, ebp
jl 0x100034ad1
cmp rbx, rbp
je 0x100034aaf
cmp word [rbx], bp
je 0x100034aaf
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.100006c24
cmp eax, ebp
jl 0x100034ad1
lea rdx, str.open
xor r9d, r9d
mov r8, rdi
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rdi, rbp
je 0x100034adf
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp rbx, rbp
je 0x100034aed
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100036828
Capabilities:
Create directory
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x360
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x350], rax
xor ebx, ebx
sub ecx, 2
mov rbp, rdx
mov edx, ebx
je 0x100036887
sub ecx, 1
je 0x100036872
cmp ecx, 1
jne 0x1000369f4
or rax, 0xffffffffffffffff
jmp 0x1000369fd
mov ecx, dword [rbp + 0x28]
call qword [sym.imp.msvcrt.dll__close]
mov rax, 1
jmp 0x1000369fd
mov r8, qword [rbp + 8]
mov r12, qword [rbp + 0x20]
lea rax, [rsp + 0x140]
mov edi, 0x104
or r9d, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], edi
lea rsi, [rsp + 0x30]
mov word [rsp + 0x140], bx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x1000369ef
movzx ecx, word [rsp + 0x140]
lea rax, [rsp + 0x140]
jmp 0x1000368f8
cmp cx, 0x3a
je 0x1000368fd
cmp cx, 0x2e
jne 0x1000368f1
cmp word [rax + 2], cx
jne 0x1000368f1
cmp word [rax + 4], 0x5c
je 0x1000368fd
add rax, 2
mov cx, word [rax]
cmp cx, bx
jne 0x1000368d8
cmp word [rax], bx
sete al
cmp al, bl
je 0x1000369ef
lea rcx, [r12 + 0x210]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, ebx
jne 0x100036927
mov edx, 0x8000ffff
jmp 0x1000369f4
mov r8, qword [rbp + 8]
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
sub r8, rax
mov edx, ebx
lea rax, [rdi + 0x7ffffefa]
cmp rax, rbx
je 0x100036959
mov al, byte [r8 + rcx]
cmp al, bl
je 0x100036959
mov byte [rcx], al
inc rcx
sub rdi, 1
jne 0x10003693a
cmp rdi, rbx
jne 0x100036966
dec rcx
mov edx, 0x8007007a
cmp edx, ebx
mov byte [rcx], bl
jl 0x1000369f6
lea rdx, [0x1000b9908]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_strtok]
mov rdi, rax
cmp rax, rbx
je 0x1000369d7
lea rdx, [0x1000b9908]
xor ecx, ecx
mov rsi, rdi
call qword [sym.imp.msvcrt.dll_strtok]
mov rdi, rax
cmp rax, rbx
je 0x1000369d7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
jne 0x1000369c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10003691d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, ebx
je 0x10003691d
jmp 0x10003698a
mov edx, 0x8121
mov r8d, 0x180
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__open]
cdqe
jmp 0x1000369fd
mov edx, 0x80070570
cmp edx, ebx
setge bl
lea rax, [rbx - 1]
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1000031d0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x100036a94
Capabilities:
Create directory
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor r15d, r15d
mov r14, rcx
mov rsi, rdx
lea rcx, [rsp + 0x30]
lea r8d, [r15 + 0x30]
xor edx, edx
mov rbp, r15
mov rdi, r15
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r15
call sub.msvcrt.dll_memset
cmp rsi, r15
jne 0x100036afd
mov ebx, 0x80004003
jmp 0x100036c40
lea r12, [r14 + 0x210]
mov r13d, 0x104
mov ebx, r15d
mov rdx, r12
sub rsi, r12
mov rcx, r13
lea rax, [rcx + 0x7ffffefa]
cmp rax, r15
je 0x100036b39
movzx eax, word [rsi + rdx]
cmp ax, r15w
je 0x100036b39
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x100036b16
mov esi, 0x8007007a
cmp rcx, r15
jne 0x100036b49
sub rdx, 2
mov ebx, esi
cmp ebx, r15d
mov word [rdx], r15w
jl 0x100036c40
mov eax, 0x414
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 3
mov word [rsp + 0x48], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r15d
je 0x100036c3b
lea rcx, [0x1000dd1a0]
call fcn.1000917b8
mov rbp, rax
cmp rax, r15
jne 0x100036baa
mov ebx, 0x8000ffff
jmp 0x100036c40
lea rcx, [r14 + 8]
lea rdx, [rsp + 0x20]
call fcn.10003e4cc
mov rdi, qword [rsp + 0x20]
cmp eax, r15d
mov ebx, eax
jl 0x100036c40
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strrchr]
mov r11, rax
cmp rax, r15
je 0x100036ba0
lea rax, [rsp + 0x60]
lea rdx, [r11 + 1]
lea rcx, [rsp + 0x60]
sub rdx, rax
mov ebx, r15d
lea rax, [r13 + 0x7ffffefa]
cmp rax, r15
je 0x100036c0d
mov al, byte [rdx + rcx]
cmp al, r15b
je 0x100036c0d
mov byte [rcx], al
inc rcx
sub r13, 1
jne 0x100036bee
cmp r13, r15
jne 0x100036c17
dec rcx
mov ebx, esi
cmp ebx, r15d
mov byte [rcx], r15b
jl 0x100036c40
lea rcx, [rsp + 0x60]
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov byte [r11 + 1], r15b
call fcn.1000919e4
cmp eax, r15d
jne 0x100036c69
mov ebx, 0x80004005
lea rax, [r14 + 0x210]
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x38], rax
mov eax, 0x414
mov word [rsp + 0x48], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp rbp, r15
je 0x100036c76
mov rcx, rbp
call fcn.1000918a0
cmp rdi, r15
je 0x100036c84
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1000031d0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100037f08
Capabilities:
Parse url

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x4f0
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rdi, qword [rsp + 0x540]
mov rsi, rdx
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x28]
mov rbp, r9
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x58]
lea rax, [rsp + 0xc0]
lea r13, [rsp + 0xc0]
mov dword [rsp + 0x20], 0x68
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x2d0]
mov dword [rsp + 0x70], 0x105
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x80], 0x104
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbx + 0x58]
lea r9, [rsp + 0x20]
mov r8d, 0x10000000
mov edx, eax
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x100037feb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
test eax, eax
je 0x100037fe1
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x1000380ea
mov eax, 0x80004005
jmp 0x1000380ea
cmp word [rsp + 0xc0], 0x2f
lea r8, [rsp + 0xc2]
mov edx, 0x104
cmovne r8, r13
mov rcx, rsi
call fcn.100001010
test eax, eax
js 0x1000380ea
lea rdx, str.gbackground
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea rsi, str.width
neg eax
mov rdx, rsi
sbb ecx, ecx
and ecx, 3
mov dword [rbp], ecx
and dword [rdi], 0
and dword [rdi + 4], 0
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rbx, rax
test rax, rax
je 0x100038091
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
lea rcx, [rbx + rdx*2]
call qword [sym.imp.msvcrt.dll__wtoi]
test eax, eax
jle 0x10003808d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
call qword [sym.imp.msvcrt.dll__wtoi]
jmp 0x10003808f
xor eax, eax
mov dword [rdi], eax
lea rsi, str.height
lea rcx, [rsp + 0x2d0]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rbx, rax
test rax, rax
je 0x1000380e8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
lea rcx, [rbx + rdx*2]
call qword [sym.imp.msvcrt.dll__wtoi]
test eax, eax
jle 0x1000380e3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rbx + rcx*2]
call qword [sym.imp.msvcrt.dll__wtoi]
jmp 0x1000380e5
xor eax, eax
mov dword [rdi + 4], eax
xor eax, eax
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.1000031d0
add rsp, 0x4f0
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000383d0
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rbp, rdx
mov r13, rcx
mov ecx, dword [0x1000da588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rsi, [rax + 0x550]
and qword [rsp + 0x30], 0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rcx, [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call fcn.1000087d8
test rax, rax
je 0x100038466
lea rdx, [rax + 8]
test rdx, rdx
je 0x100038466
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
call fcn.1000396a8
mov rdi, qword [rsp + 0x38]
lea rcx, [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
jne 0x10003847c
mov esi, 0x80070002
jmp 0x1000384e2
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, eax
test eax, eax
js 0x1000384a3
mov rbx, qword [rsp + 0x30]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x40], rbx
dec dword [rdi + 0x10]
cmp dword [rdi + 0x10], 0
jne 0x1000384e2
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1000384bb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1000384cd
and qword [rdi], 0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1000384fd
and qword [rsp + 0x30], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x100038508
mov rax, qword [rcx]
call qword [rax + 0x10]
test esi, esi
js 0x10003852f
lea r8, str.image_bmp
mov edx, 0x104
mov rcx, r14
call fcn.100001010
mov esi, eax
test eax, eax
js 0x10003852f
mov rcx, rbx
xor ebx, ebx
mov qword [r13 + 0x50], rcx
mov rcx, rbx
test rbx, rbx
je 0x100038545
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
test rbx, rbx
je 0x100038553
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov eax, esi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1000387c4
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x318
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x300], rax
and qword [rsp + 0x40], 0
mov rsi, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r8d, 0x2b0
xor edx, edx
mov rbp, r9
call sub.msvcrt.dll_memset
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
mov r9d, 0x2b8
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], 0x128
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
jne 0x100038850
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100038849
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100038894
mov ebx, 0x80004005
jmp 0x100038894
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rdi]
lea r8, [rsp + 0x30]
call fcn.10003857c
mov rdi, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
js 0x100038882
mov r9d, 0x104
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.1000388d0
mov ebx, eax
test rdi, rdi
je 0x100038894
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1000388a4
call qword [sym.imp.USER32.dll_DestroyIcon]
mov eax, ebx
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1000031d0
add rsp, 0x318
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100039d4c
Capabilities:
Get thread local storage value
Parse url

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rsi, r8
mov rbx, rdx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xor edx, edx
lea r8d, [rbp + 0x60]
lea rcx, [rsp + 0x38]
call sub.msvcrt.dll_memset
mov ecx, dword [0x1000da588]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
cmp rax, rbp
jne 0x100039dcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
je 0x100039dc5
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebp
cmovle ecx, eax
jmp 0x100039ec5
mov ecx, 0x80004005
jmp 0x100039ec5
mov dword [rsp + 0x30], 0x68
mov dword [rsp + 0x80], 1
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp eax, ebp
jne 0x100039e20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
je 0x100039e16
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebp
cmovle ecx, eax
jmp 0x100039ec5
mov ecx, 0x80004005
jmp 0x100039ec5
mov r8d, dword [rsp + 0x80]
mov r9, qword [rsp + 0x78]
mov ecx, ebp
cmp word [r9], 0x2f
jne 0x100039e3d
add r9, 2
dec r8
cmp r8, 0x104
jb 0x100039e4d
mov ecx, 0x80010135
jmp 0x100039e9c
mov rdx, rbp
cmp r8, rbp
jbe 0x100039e94
lea rax, [rsp + 0xa0]
sub r9, rax
lea rax, [r9 + rdx*2]
movzx r10d, word [rsp + rax + 0xa0]
cmp r10w, 0x2f
jne 0x100039e83
mov eax, 0x5c
mov word [rsp + rdx*2 + 0xa0], ax
jmp 0x100039e8c
mov word [rsp + rdx*2 + 0xa0], r10w
inc rdx
cmp rdx, r8
jb 0x100039e60
mov word [rsp + rdx*2 + 0xa0], bp
cmp ecx, ebp
jl 0x100039ec5
mov qword [rsp + 0x20], rbp
lea r8, [rdi + 0x212]
mov r9, rsi
lea rdx, [rsp + 0xa0]
lea rcx, [0x1000da7c0]
call fcn.100013814
mov ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1000031d0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x10003c7b8
Capabilities:
Create process on windows
Parse url

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1100
call fcn.1000044f0
sub rsp, rax
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x10f0], rax
xor esi, esi
mov rdi, rcx
lea rcx, [rsp + 0x38]
lea r8d, [rsi + 0x60]
xor edx, edx
mov ebx, esi
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], 0x68
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp eax, esi
je 0x10003c82f
cmp dword [rsp + 0x44], 3
je 0x10003c82a
cmp dword [rsp + 0x44], 4
jne 0x10003c8c9
mov r8, rdi
jmp 0x10003c8aa
lea rdx, str.http:__
lea rax, [rsp + 0xa0]
mov r9d, 0x824
sub rdx, rax
mov r8, r9
lea rcx, [rsp + 0xa0]
lea rax, [r8 + 0x7ffff7da]
cmp rax, rsi
je 0x10003c874
movzx eax, word [rdx + rcx]
cmp ax, si
je 0x10003c874
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x10003c852
cmp r8, rsi
jne 0x10003c882
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, esi
mov word [rcx], si
jl 0x10003c8c9
lea rcx, [rsp + 0xa0]
mov r8, rdi
mov rdx, r9
call fcn.100006c24
cmp eax, esi
mov ebx, eax
jl 0x10003c8c9
lea r8, [rsp + 0xa0]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, ebx
mov rcx, qword [rsp + 0x10f0]
xor rcx, rsp
call fcn.1000031d0
lea r11, [rsp + 0x1100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10003d930
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
xor edi, edi
lea rax, [r11 - 0x18]
mov rsi, r9
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdi
mov rbp, r8
xor r9d, r9d
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov ebx, edi
mov dword [rsp + 0x20], edi
mov qword [r11 - 0x18], rdi
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10003d9b0
mov eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
lea r9d, [rdi + 1]
add eax, eax
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RegSetValueExW]
cmp eax, edi
je 0x10003d9be
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x10003d9ce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
cmp ebx, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
setge al
mov rsp, r11
pop rdi
ret
Function at 0x10003d9f0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
and qword [rsp + 0x30], 0
mov rsi, r9
mov ebx, 1
mov rbp, r8
lea r9d, [rbx + 0x3f]
mov r8, rsi
mov dword [rsp + 0x28], ebx
and qword [rsp + 0x20], 0
mov r12, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_RegLoadMUIStringW]
cmp eax, 2
jne 0x10003da7a
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x40]
lea r9d, [rbx + 0x3f]
mov qword [rsp + 0x30], r11
mov r8, rsi
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x28], ebx
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_RegLoadMUIStringW]
test eax, eax
je 0x10003da9d
mov r9, rsi
mov r8, rbp
xor edx, edx
mov rcx, rdi
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x20
call fcn.100017508
mov bl, al
mov al, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1000031d0
add rsp, 0x260
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x10003e630
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1000da584]
cmp ecx, 0xffffffff
je 0x10003e666
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
cmp rax, rdx
je 0x10003e666
mov ecx, dword [0x1000da584]
cmp ecx, 0xffffffff
je 0x10003e660
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
mov rax, qword [rdx + 0x30]
jmp 0x10003e668
xor eax, eax
add rsp, 0x28
ret

Function at 0x10003e6b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebp, ecx
call fcn.100001210
xor ebx, ebx
cmp al, bl
je 0x10003e73c
mov edx, dword [0x1000da584]
mov edi, ebx
mov rsi, rbx
cmp edx, 0xffffffff
jne 0x10003e6e6
mov rax, rbx
jmp 0x10003e6f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
mov ecx, edi
cmp rcx, qword [rax + 0xb0]
jae 0x10003e73c
cmp edx, 0xffffffff
jne 0x10003e709
mov rax, rbx
jmp 0x10003e717
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [0x1000da584]
mov rax, qword [rax + 0xa8]
movdqu xmm0, xmmword [rax + rsi]
movdqu xmmword [rsp + 0x20], xmm0
cmp dword [rsp + 0x28], ebp
je 0x10003e737
inc edi
add rsi, 0x10
jmp 0x10003e6dc
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x10003ed68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xc0
test dword [rcx + 0x44], 0xc0000000
mov rbx, rcx
je 0x10003efb5
xorps xmm2, xmm2
movd xmm0, dword [rcx + 0x24]
movd xmm1, dword [rcx + 0x28]
xor eax, eax
xor ebp, ebp
movss dword [rsp + 0x64], xmm2
mov qword [rsp + 0x40], rbp
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x78], rax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x68], xmm2
movss dword [rsp + 0x6c], xmm2
mov qword [r11 - 0x70], rax
movss dword [rsp + 0x74], xmm2
movss dword [rsp + 0x78], xmm2
movss dword [rsp + 0x7c], xmm2
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [0x1000ac158]
cvtdq2ps xmm1, xmm1
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x70], xmm0
movss dword [rsp + 0x30], xmm2
or dword [r11 - 0x44], 3
movss dword [rsp + 0x34], xmm2
movss dword [rsp + 0x3c], xmm1
movss dword [r11 - 0x48], xmm0
cmp qword [rcx + 0x128], rax
jne 0x10003efb5
lea ecx, [rbp + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov rsi, rax
test rax, rax
je 0x10003ee78
mov edx, dword [rbx + 0x28]
mov ecx, dword [rbx + 0x24]
and qword [rsp + 0xd0], rbp
lea rax, [0x1000a9918]
mov r9d, 0x26200a
xor r8d, r8d
mov qword [rsi], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbp
call sub.gdiplus.dll_GdipCreateBitmapFromScan0
mov dword [rsi + 0x10], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 8], rax
jmp 0x10003ee7a
xor esi, esi
mov qword [rbx + 0x128], rsi
test rsi, rsi
je 0x10003ef18
mov ecx, 0x10
call sub.gdiplus.dll_GdipAlloc
mov rdi, rax
test rax, rax
je 0x10003eec5
mov rcx, qword [rsi + 8]
and qword [rsp + 0xd0], rbp
lea rdx, [rsp + 0xd0]
call sub.gdiplus.dll_GdipGetImageGraphicsContext
mov rcx, qword [rsp + 0xd0]
mov qword [rdi], rcx
mov dword [rdi + 8], eax
jmp 0x10003eec7
xor edi, edi
mov qword [rbx + 0x130], rdi
test rdi, rdi
je 0x10003eefb
and dword [rsp + 0x48], 0
and dword [rsp + 0x4c], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rbp, rdi
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x59], 0
jmp 0x10003ef18
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x10003ef18
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rbx + 0x128], rbp
and dword [rsp + 0x98], 0
and dword [rsp + 0xa0], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb0], rax
mov rax, qword [rbx]
mov rcx, rbx
mov dword [rsp + 0x88], 0x38
mov dword [rsp + 0x8c], 0x8002
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xb8], rbp
mov dword [rsp + 0xa4], 1
call qword [rax + 0x18]
mov r11d, dword [rbx + 0x90]
sub r11d, 1
movsxd rdi, r11d
js 0x10003efb5
mov rax, qword [rbx + 0x88]
mov rcx, qword [rax + rdi*8]
test byte [rcx + 0x44], 2
je 0x10003efaf
lea rdx, [rsp + 0x40]
call fcn.10000c440
sub rdi, 1
jns 0x10003ef94
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret