joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ad9
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
push rdi
sub rsp, 0x458
mov dword [rbp + 0x10], ecx
lea rax, [rbp - 0x30]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
lea rax, [rbp - 0x430]
mov r8, rax
mov eax, 0
mov edx, pe_nt_image_headers64
mov rdi, r8
mov rcx, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x434], 0
cmp dword [rbp + 0x10], 1
jne 0x10008b40
nop
mov dword [rbp - 0x434], 0x10
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 2
jne 0x10008b57
nop
mov dword [rbp - 0x434], 0x19
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 3
jne 0x10008b6b
nop
mov dword [rbp - 0x434], 0x25
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 4
jne 0x10008b7f
nop
mov dword [rbp - 0x434], 0x29
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 5
jne 0x10008b93
nop
mov dword [rbp - 0x434], 5
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 6
jne 0x10008ba7
nop
mov dword [rbp - 0x434], 7
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 7
jne 0x10008bbb
nop
mov dword [rbp - 0x434], 0x15
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 8
jne 0x10008bcf
nop
mov dword [rbp - 0x434], 0x1c
jmp 0x10008be6
nop
cmp dword [rbp + 0x10], 9
jne 0x10008be3
nop
mov dword [rbp - 0x434], 0x1a
jmp 0x10008be6
nop
jmp 0x10008c2c
mov edx, dword [rbp - 0x434]
lea rax, [rbp - 0x430]
mov r9d, 0
mov r8d, edx
mov rdx, rax
mov ecx, 0
call sub.SHELL32.dll_SHGetSpecialFolderPathW
lea rdx, [rbp - 0x430]
lea rax, [rbp - 0x30]
mov r9d, 0
mov r8, rdx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.100c1470
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.100c0ec0
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
add rsp, 0x458
pop rdi
pop rbp
ret

Function at 0x1000a067
Capabilities:
Check mutex on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x64], 0
lea rax, [rbp - 0x60]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
lea rax, [rbp - 0x40]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, qword [rbp + 0x10]
mov r8d, 8
lea rdx, str.Global_
mov rcx, rax
call fcn.100bf700
mov qword [rbp - 8], rax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x60]
mov dword [rsp + 0x20], 0
mov r9, 0xffffffffffffffff
mov r8, rdx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.100bf4b0
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x60]
mov rax, qword [rax]
mov r8, rax
mov edx, 0
mov ecx, 0
call sub.KERNEL32.dll_CreateMutexA
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x18]
mov qword [rax], rdx
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.100c0370
call sub.KERNEL32.dll_GetLastError
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0xb7
setne al
movzx eax, al
neg eax
mov edx, eax
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
test rax, rax
setne al
movzx eax, al
neg eax
and eax, edx
test eax, eax
je 0x1000a17c
mov dword [rbp - 0x64], 1
jmp 0x1000a18c
nop
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [rbp - 0x64]
leave
ret
Function at 0x1000a90f
Capabilities:
Read file via mapping

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x2c], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rcx, rax
call fcn.100c1a60
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov r8, rax
mov edx, 0xffffffff
mov ecx, 4
call sub.KERNEL32.dll_OpenFileMappingW
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.100c1d30
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x1000aa1f
nop
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
call sub.KERNEL32.dll_MapViewOfFile
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp + 0x18]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.100bf4b0
mov rax, qword [rbp - 0x40]
mov rcx, rax
call sub.KERNEL32.dll_UnmapViewOfFile
mov rax, qword [rbp - 0x38]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rbp + 0x18]
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.100c0bb0
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov dword [rbp - 0x2c], eax
jmp 0x1000aa20
nop
mov eax, dword [rbp - 0x2c]
leave
ret
Function at 0x1000c941
Capabilities:
Get disk information

Disassembly:
push rbp
mov rbp, rsp
push rdi
sub rsp, 0x298
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x28], 0
lea rax, [rbp - 0x130]
mov r8, rax
mov eax, 0
mov edx, 0x20
mov rdi, r8
mov rcx, rdx
rep stosq qword [rdi], rax
lea rax, [rbp - 0x230]
mov r8, rax
mov eax, 0
mov edx, 0x20
mov rdi, r8
mov rcx, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x234], 0
mov dword [rbp - 0x238], 0
mov dword [rbp - 0x23c], 0
mov dword [rbp - 0x240], 0
mov dword [rbp - 0x23c], 0
mov eax, dword [rbp - 0x23c]
cdqe
add rax, 0x41
mov rdx, rax
mov ecx, 1
call fcn.100bf4f0
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x260]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov rdx, qword [rbp - 0x18]
lea rax, [rbp - 0x260]
mov qword [rsp + 0x20], 2
lea r9, [0x100c7038]
mov r8, 0xffffffffffffffff
mov rcx, rax
call fcn.100bf700
mov qword [rbp - 0x20], rax
mov rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x130]
mov r9, 0xffffffffffffffff
mov r8, rdx
mov edx, pe_nt_image_headers64
mov rcx, rax
call fcn.100c1240
lea rdx, [rbp - 0x230]
lea rax, [rbp - 0x130]
mov r8d, pe_nt_image_headers64
mov rcx, rax
call sub.KERNEL32.dll_QueryDosDeviceW
mov dword [rbp - 0x24], eax
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0x238], eax
mov eax, dword [rbp - 0x238]
test eax, eax
je 0x1000cb94
mov eax, dword [rbp - 0x240]
cdqe
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, 0xffffffff
mov edx, 0x18
mov rcx, qword [rbp + 0x10]
call fcn.100be5c0
mov eax, dword [rbp - 0x240]
movsxd rdx, eax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, 0xffffffff
mov edx, 0x18
mov rcx, rax
call fcn.100be5c0
mov eax, dword [rbp - 0x240]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
add rax, rdx
mov rcx, rax
lea rax, [rbp - 0x130]
mov r9d, 0
mov r8, rax
mov rdx, 0xffffffffffffffff
call fcn.100c1470
mov eax, dword [rbp - 0x240]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
add rax, rdx
mov rcx, rax
lea rax, [rbp - 0x230]
mov r9d, 0
mov r8, rax
mov rdx, 0xffffffffffffffff
call fcn.100c1470
mov eax, dword [rbp - 0x240]
add eax, 1
mov dword [rbp - 0x240], eax
jmp 0x1000cb95
nop
mov eax, dword [rbp - 0x23c]
add eax, 1
mov dword [rbp - 0x23c], eax
mov eax, dword [rbp - 0x23c]
cmp eax, 0x19
jg 0x1000cbb4
jmp 0x1000c9c8
nop
mov eax, dword [rbp - 0x240]
mov dword [rbp - 0x28], eax
mov eax, dword [rbp - 0x28]
add rsp, 0x298
pop rdi
pop rbp
ret
Function at 0x1000e416
Capabilities:
Get graphical window text

Disassembly:
push rbp
mov rbp, rsp
push rdi
sub rsp, 0x468
mov dword [rbp + 0x10], ecx
lea rax, [rbp - 0x40]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov dword [rbp - 0x44], 0
lea rax, [rbp - 0x450]
mov r8, rax
mov eax, 0
mov edx, pe_nt_image_headers64
mov rdi, r8
mov rcx, rdx
rep stosq qword [rdi], rax
mov eax, dword [rbp + 0x10]
cdqe
mov rcx, rax
lea rax, [rbp - 0x450]
mov r8d, 0x200
mov rdx, rax
call sub.USER32.dll_GetWindowTextW
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
test eax, eax
jle 0x1000e4b6
lea rdx, [rbp - 0x450]
lea rax, [rbp - 0x40]
mov r9d, 0
mov r8, rdx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.100c1470
jmp 0x1000e4b7
nop
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.100c0ec0
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
add rsp, 0x468
pop rdi
pop rbp
ret

Function at 0x1001121a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov dword [rbp - 0xc], 0
call sub.KERNEL32.dll_GetTickCount
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov dword [rbp - 0xc], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov edx, dword [rbp - 0xc]
mov edx, edx
sub rax, rdx
mov rdx, rax
mov eax, dword [rbp + 0x10]
cdqe
cmp rdx, rax
jge 0x10011266
mov ecx, 1
call fcn.100beb00
jmp 0x1001123a
nop
nop
leave
ret
Function at 0x100164c7
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x2c], 0
mov dword [rbp - 0x30], 0
call sub.KERNEL32.dll_GetTickCount
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov dword [rbp - 0x2c], eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
mov dword [rbp - 0x30], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [rbp - 8], eax
mov edx, dword [rbp - 8]
mov eax, dword [rbp - 0x2c]
cdqe
sub rdx, rax
mov eax, dword [rbp - 0x30]
cdqe
cmp rdx, rax
jge 0x10016524
mov ecx, 1
call fcn.100beb00
jmp 0x100164fb
nop
lea rax, [0x100d8e68]
mov eax, dword [rax]
cmp eax, 1
jne 0x10016606
lea rax, [rbp - 0x70]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov eax, dword [rbp - 0x30]
mov ecx, eax
call fcn.100bfc60
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x20], 0
mov r9, 0xffffffffffffffff
mov r8, rdx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.100bf4b0
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x50]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
lea rax, [rbp - 0x50]
mov dword [rsp + 0x20], 0
mov r9d, 0x12
lea r8, str.KillMeThread_Over
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.100bf4b0
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x70]
lea rax, [rbp - 0x50]
mov r8, rdx
mov rdx, rax
mov ecx, 2
call fcn.1001126a
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.100c0370
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.100c0370
jmp 0x10016607
nop
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
call sub.KERNEL32.dll_TerminateProcess
nop
leave
ret
Function at 0x100bc030
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebp, 5
mov ebx, ecx
mov edi, edx
lea rax, [rbx*8]
shl rbx, 6
sub rbx, rax
add rbx, qword [0x100d9950]
test byte [rbx + 0x20], 1
mov rsi, qword [rbx]
je 0x100bc06d
sub rsi, 5
mov ebp, 7
lea r13, [rsp + 0x2c]
mov rdx, rbp
mov rcx, rsi
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r13
mov r8d, 0x40
call r12
mov edx, 0xa
test eax, eax
jne 0x100bc0a3
mov eax, edx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test edi, edi
jne 0x100bc120
test byte [rbx + 0x20], 1
je 0x100bc150
mov edx, dword [rbx + 0x18]
mov dword [rsi], edx
movzx edx, word [rbx + 0x1c]
mov word [rsi + 4], dx
movzx eax, byte [rbx + 0x1e]
mov byte [rsi + 6], al
mov r9, r13
mov r8d, dword [rsp + 0x2c]
mov rdx, rbp
mov rcx, rsi
call r12
and edi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rsi
mov r8, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, byte [rbx + 0x20]
lea edx, [rdi + rdi]
lea eax, [rdi*4]
and ecx, 0xfffffff9
mov edi, ecx
or edi, edx
xor edx, edx
or edi, eax
mov eax, edx
mov byte [rbx + 0x20], dil
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov byte [rsi], 0xe9
mov rdx, qword [rbx + 8]
lea rax, [rsi + 5]
sub rdx, rax
mov dword [rsi + 1], edx
test byte [rbx + 0x20], 1
je 0x100bc0c5
mov rax, qword [rbx]
mov byte [rax], 0xeb
mov byte [rax + 1], 0xf9
jmp 0x100bc0c5
mov eax, dword [rbx + 0x18]
mov dword [rsi], eax
movzx eax, byte [rbx + 0x1c]
mov byte [rsi + 4], al
jmp 0x100bc0c5

Function at 0x100bc170
Capabilities:
Resume thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r8, qword [rcx]
test r8, r8
mov rdi, rcx
je 0x100bc1f0
mov eax, dword [rcx + 0xc]
test eax, eax
je 0x100bc1d3
mov rbp, qword [sym.imp.KERNEL32.dll_OpenThread]
xor ebx, ebx
mov r13, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
xor edx, edx
mov ecx, 0x5a
mov r8d, dword [r8 + rax*4]
call rbp
test rax, rax
mov rsi, rax
je 0x100bc1c8
mov rcx, rax
call r13
mov rcx, rsi
call r12
add ebx, 1
cmp dword [rdi + 0xc], ebx
mov r8, qword [rdi]
ja 0x100bc1a5
mov rcx, qword [0x100cd0c0]
xor edx, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x100bc200
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rcx], 0
mov rdi, rcx
mov r12d, edx
xor edx, edx
mov dword [rcx + 8], 0
mov r13d, r8d
mov dword [rcx + 0xc], 0
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov eax, 9
cmp rbx, 0xffffffffffffffff
je 0x100bc318
lea rsi, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0x1c
mov rdx, rsi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100bc30a
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x100bc297
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], 0x1c
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x100bc2e1
cmp dword [rsp + 0x20], 0xf
jbe 0x100bc280
mov r15d, dword [rsp + 0x2c]
call rbp
cmp r15d, eax
jne 0x100bc280
mov r15d, dword [rsp + 0x28]
call r14
cmp r15d, eax
je 0x100bc280
mov r8, qword [rdi]
test r8, r8
je 0x100bc3d5
mov edx, dword [rdi + 0xc]
mov eax, dword [rdi + 8]
cmp edx, eax
jae 0x100bc3a3
lea eax, [rdx + 1]
mov dword [rdi + 0xc], eax
mov eax, dword [rsp + 0x28]
mov dword [r8 + rdx*4], eax
jmp 0x100bc280
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100bc329
mov r8, qword [rdi]
test r8, r8
je 0x100bc30a
xor edx, edx
mov rcx, qword [0x100cd0c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 9
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r14
mov rax, qword [rdi]
test rax, rax
je 0x100bc39c
mov edx, dword [rdi + 0xc]
test edx, edx
je 0x100bc39c
xor ebx, ebx
mov rbp, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r15, qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x100bc363
mov rax, qword [rdi]
mov edx, ebx
mov ecx, 0x5a
mov r8d, dword [rax + rdx*4]
xor edx, edx
call rbp
test rax, rax
mov rsi, rax
je 0x100bc394
mov rcx, rax
call r15
mov rcx, rsi
mov r8d, r13d
mov edx, r12d
call fcn.100bbe30
mov rcx, rsi
call r14
add ebx, 1
cmp ebx, dword [rdi + 0xc]
jb 0x100bc360
xor eax, eax
jmp 0x100bc318
lea r9d, [rax + rax]
xor edx, edx
mov rcx, qword [0x100cd0c0]
mov dword [rdi + 8], r9d
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x100bc2ec
mov qword [rdi], rax
mov edx, dword [rdi + 0xc]
mov r8, rax
jmp 0x100bc2d1
xor edx, edx
mov dword [rdi + 8], pe_nt_image_headers64
mov r8d, 0x200
mov rcx, qword [0x100cd0c0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [rdi], rax
jne 0x100bc3ca
jmp 0x100bc30a
Function at 0x100bd4b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov r12, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp r12, 0x40000000
mov rsi, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
jbe 0x100bd4f3
lea rdx, [r12 - 0x40000000]
cmp rsi, rdx
cmovb rsi, rdx
lea r13, [r12 + 0x40000000]
cmp rax, r13
cmova rax, r13
lea r13, [rax - 0xfff]
mov rax, qword [0x100d9960]
test rax, rax
je 0x100bd534
cmp rax, rsi
jb 0x100bd52c
cmp rax, r13
jae 0x100bd52c
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x100bd6a2
mov rax, qword [rax]
test rax, rax
jne 0x100bd515
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualQuery]
lea rbp, [rsp + 0x50]
mov r15, r12
mov r14, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop word [rax + rax]
cmp rsi, r15
ja 0x100bd5a6
mov ebx, dword [rsp + 0x48]
mov rax, r15
xor edx, edx
div rbx
mov rax, r15
sub rax, rdx
jmp 0x100bd59e
mov r15, rax
mov r8d, 0x30
mov rdx, rbp
mov rcx, rax
call rdi
test rax, rax
je 0x100bd5a6
cmp dword [rsp + 0x70], 0x10000
je 0x100bd634
mov rax, qword [rsp + 0x58]
cmp rbx, rax
ja 0x100bd5a6
sub rax, rbx
cmp rsi, rax
jbe 0x100bd570
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualQuery]
lea rdi, [rsp + 0x50]
cmp r13, r12
jb 0x100bd61e
mov ebx, dword [rsp + 0x48]
mov rax, r12
xor edx, edx
lea rcx, [r12 + rbx]
div rbx
sub rcx, rdx
cmp r13, rcx
mov r12, rcx
jb 0x100bd61e
lea ebp, [rbx - 1]
jmp 0x100bd60b
cmp dword [rsp + 0x70], 0x10000
je 0x100bd6b5
mov r12, rbp
add r12, qword [rsp + 0x50]
xor edx, edx
add r12, qword [rsp + 0x68]
mov rax, r12
div rbx
sub r12, rdx
cmp r13, r12
jb 0x100bd61e
mov r8d, 0x30
mov rdx, rdi
mov rcx, r12
call rsi
test rax, rax
jne 0x100bd5e0
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x100bd5a6
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, r15
call r14
test rax, rax
je 0x100bd550
lea rdx, [rax + 0x40]
mov dword [rax + 0x10], 0
xor r8d, r8d
lea r9, [rax + 0x1000]
jmp 0x100bd677
mov rdx, rcx
lea rcx, [rdx + 0x40]
mov qword [rdx], r8
mov r8, rdx
cmp rcx, r9
mov qword [rax + 8], rdx
jne 0x100bd674
mov rdx, qword [0x100d9960]
mov qword [rax], rdx
lea rdx, [rax + 0xfc0]
mov qword [0x100d9960], rax
mov rcx, qword [rdx]
add dword [rax + 0x10], 1
mov qword [rax + 8], rcx
mov rax, rdx
jmp 0x100bd620
test r12, r12
je 0x100bd61e
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x100bd5b2
jmp 0x100bd65d
Function at 0x100bea90
Capabilities:
Delete file

Disassembly:
push rdi
mov rdi, rcx
push rsi
push rbx
sub rsp, 0x20
mov rcx, qword [rcx]
test rcx, rcx
je 0x100beae2
call sub.msvcrt.dll_remove
mov ebx, eax
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, rdi
mov esi, dword [rax]
call fcn.100c0300
test ebx, ebx
je 0x100bead4
lea eax, [rsi - 1]
mov ebx, 1
cmp eax, 0xc
ja 0x100bead4
lea rdx, [0x100c8b40]
mov ebx, dword [rdx + rax*4]
add rsp, 0x20
mov ecx, ebx
pop rbx
pop rsi
pop rdi
jmp fcn.100be9b0
mov rcx, rdi
xor ebx, ebx
call fcn.100c0300
add rsp, 0x20
mov ecx, ebx
pop rbx
pop rsi
pop rdi
jmp fcn.100be9b0

Function at 0x100c2220
Capabilities:
Create thread

Disassembly:
push r12
mov r12, rcx
mov ecx, 8
push rbp
mov rbp, rdx
push rdi
mov rdi, r8
push rsi
push rbx
sub rsp, 0x40
call sub.msvcrt.dll_malloc
test rax, rax
je 0x100c22a0
mov ecx, 0x10
mov rbx, rax
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x100c22a4
mov qword [rax], r12
xor ecx, ecx
mov r9, rsi
mov edx, edi
mov qword [rax + 8], rbp
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r8, [0x100c21f0]
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
je 0x100c22b0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
jmp 0x100c228f
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100c228f
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100c228f

Function at 0x100c2310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rdx
push rdi
lea rdi, [0x100d0700]
push rsi
push rbx
movsxd rbx, ecx
sub rsp, 0x28
mov ecx, dword [rdi + rbx*4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rsi, rax
je 0x100c2342
add rsp, 0x28
mov rax, rsi
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rbp
mov ecx, 1
call sub.msvcrt.dll_calloc
mov ecx, dword [rdi + rbx*4]
mov rsi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
mov rax, rsi
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x100c2370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
movsxd rsi, ecx
push rbx
lea rbx, [0x100d0700]
sub rsp, 0x30
mov ecx, dword [rbx + rsi*4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100c23c5
cmp esi, 4
je 0x100c23b0
mov rcx, rax
call sub.msvcrt.dll_free
mov ecx, dword [rbx + rsi*4]
add rsp, 0x30
xor edx, edx
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x28], rax
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x28]
jmp 0x100c2394
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x100c23f0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
lea rdi, [0x100d0714]
push rsi
push rbx
lea rbx, [0x100d0700]
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rsi
add rbx, 4
mov dword [rbx - 4], eax
cmp rbx, rdi
jne 0x100c240c
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x100c3400
Capabilities:
Log keystrokes

Disassembly:
push r12
movzx r10d, dx
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r9d, 0x100
je 0x100c3460
test cl, cl
jne 0x100c3460
lea r8, [0x100c8f60]
mov ecx, 0x1c
xor eax, eax
mov rdx, r8
jmp 0x100c3433
movzx ecx, word [rdx]
cmp r10w, cx
je 0x100c3520
add rax, 1
add rdx, 0xa
cmp rax, 0xc
jne 0x100c3430
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp dx, 0x58
mov edi, r9d
mov esi, ecx
jbe 0x100c3483
mov eax, dword [rsp + 0x70]
test eax, eax
jne 0x100c344b
test sil, sil
movzx eax, sil
jne 0x100c3450
mov eax, 0xffffffff
jmp 0x100c3450
lea rax, [0x100c8c80]
movzx ecx, r8w
mov edx, 2
lea r12, [rax + r10*8]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebp, ax
mov ecx, ebp
mov ebx, ebp
call qword [sym.imp.msvcrt.dll_isupper]
mov ecx, ebp
test eax, eax
jne 0x100c3500
call qword [sym.imp.msvcrt.dll_islower]
mov edx, ebp
test eax, eax
je 0x100c34c6
mov ecx, ebp
call qword [sym.imp.msvcrt.dll_toupper]
mov edx, eax
test dil, 3
je 0x100c350e
movzx ebx, word [r12 + 6]
cmp ebx, 0xff
jle 0x100c346b
movzx eax, sil
cmp eax, ebp
je 0x100c34e6
cmp edx, eax
jne 0x100c346b
and ebx, 0xff00
lea eax, [rbx + 0xff]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.msvcrt.dll_tolower]
test dil, 3
mov edx, eax
jne 0x100c34cc
test dil, 0xc
je 0x100c3563
movzx ebx, word [r12 + 4]
jmp 0x100c34d2
lea rax, [rax + rax*4]
test r9b, 3
lea rax, [r8 + rax*2]
jne 0x100c3580
test r9b, 0xc
je 0x100c35a0
movzx ebx, word [rax + 6]
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x100c344b
cmp ebx, 0xff
mov eax, ebx
jle 0x100c3450
and ebx, 0xff00
lea eax, [rbx + 0xff]
jmp 0x100c34f2
and edi, 0x10
jne 0x100c3590
test sil, sil
jne 0x100c34d2
movzx ebx, word [r12]
jmp 0x100c34d2
movzx ebx, word [rax + 8]
xor eax, eax
test ebx, ebx
setne al
jmp 0x100c353f
movzx ebx, word [r12 + 2]
jmp 0x100c34d2
and r9d, 0x10
je 0x100c35b3
movzx ebx, word [rax + 4]
xor eax, eax
test ebx, ebx
setne al
jmp 0x100c353f
movzx ebx, word [rax + 2]
jmp 0x100c3547