joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003a8b8
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
sub rsp, 0x468
mov rax, qword [0x1000af140]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ecx, ecx
lea rax, [0x100015168]
cmp word [rax], 0x3a
je 0x10003a9a2
inc ecx
add rax, 2
cmp ecx, 0x1a
jb 0x10003a8da
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
xor r9d, r9d
lea r11, [rsp + 0x240]
lea edx, [r9 + 0x28]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [0x100020260]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x10003a971
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x10003a9ba
lea rcx, [0x10001fa00]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x10003a964
mov rcx, qword [0x1000bafb8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x10003a964
lea rcx, [0x100015168]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10003a964
lea r8, [0x100015168]
lea rdx, [0x10001fb10]
mov ecx, 0x80
call fcn.1000660b0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000a2150
add rsp, 0x468
ret
Function at 0x100040244
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rdx, [0x100020548]
mov ecx, 8
call fcn.1000660b0
cmp dword [0x1000b8904], 0
jne 0x100040297
lea rcx, [0x1000b8918]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x100040297
lea rdx, [0x1000204e0]
lea ecx, [rax + 8]
call fcn.1000660b0
mov ecx, 0x21
mov dword [0x1000b8904], 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [0x1000b8904], 1
jne 0x1000402ac
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x1000b8918], eax
add rsp, 0x28
jmp 0x100050a20
sub rsp, 0x28
cmp dword [0x1000b8904], 0
jne 0x100050a7d
lea rcx, [0x1000b8910]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100050a57
mov rax, qword [0x1000b8918]
cmp rax, qword [0x1000b8910]
jle 0x100050a7d
mov qword [0x1000b8910], rax
jmp 0x100050a7d
lea rdx, [0x1000204e0]
mov ecx, 8
call fcn.1000660b0
mov ecx, 0x21
mov dword [0x1000b8904], 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [0x1000b8904], 1
jne 0x100050a92
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x1000b8910], eax
add rsp, 0x28
ret

Function at 0x1000402bc
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
cmp byte [0x1000bae9c], 0
je 0x100040386
lea r9, [0x10001c168]
lea r8, [0x10001c190]
mov edx, 0x244
mov ecx, 0x10
call fcn.100065cf8
cmp byte [0x1000bb01d], 0
jne 0x100040366
mov edx, 0x373
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 0x12]
mov r9d, 0xfffe
mov r8d, 1
call fcn.100068ab8
mov rcx, qword [0x1000bafc8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x1000b6e58]
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x1000bafc8]
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], eax
mov eax, dword [0x1000b6e54]
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x100040374
mov rcx, qword [0x1000bb010]
mov byte [rcx + 0xa5], 0
xor ecx, ecx
call fcn.10004eb88
test al, al
je 0x100040386
mov al, 1
add rsp, 0x58
ret
lea r9, [0x10001c1a0]
lea r8, [0x10001c190]
mov edx, 0x25d
mov ecx, 0x10
call fcn.100065cf8
mov edx, 0x37d
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 8]
mov r9d, 0xfffe
mov r8d, 1
call fcn.100068ab8
mov cl, byte [0x1000bb01d]
call fcn.100067fdc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10004eb88
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov dil, cl
cmp cl, byte [0x1000bae9c]
je 0x10004ed24
mov rcx, qword [0x1000bafd0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov cl, 1
call fcn.10004b578
mov rcx, qword [0x1000bafc8]
mov r9d, 0x107
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rbx, qword [0x1000bb0e8]
mov byte [0x1000bae9c], dil
test rbx, rbx
je 0x10004ec37
xor esi, esi
cmp dword [rbx + 0x18], esi
jbe 0x10004ec18
xor ebp, ebp
mov rax, qword [rbx + 0x10]
mov dl, dil
mov rcx, qword [rax + rbp]
mov rax, qword [rcx]
call qword [rax + 0x40]
inc esi
add rbp, 8
cmp esi, dword [rbx + 0x18]
jb 0x10004ebf5
mov rbx, qword [0x1000bb0e8]
mov rcx, rbx
call fcn.1000514a4
mov rcx, qword [0x1000bb0e8]
call fcn.1000513e4
test al, al
jne 0x10004ec37
xor al, al
jmp 0x10004ed26
mov rbx, qword [0x1000bb010]
test rbx, rbx
je 0x10004ecbc
cmp dword [rbx + 0xd4], 0
je 0x10004ecbc
lea r9, [0x10001d2b8]
lea r8, [0x10001cba0]
mov edx, 0x201
mov ecx, 2
call fcn.100065cf8
mov rcx, rbx
call fcn.100043bcc
mov rcx, rbx
call fcn.100043a48
test al, al
je 0x10004ec30
cmp dword [0x1000bb090], 0
jne 0x10004ecad
cmp byte [0x1000bae9c], 0
mov r8d, dword [0x1000b63c8]
mov edx, dword [0x1000b63c4]
mov rcx, qword [0x1000bb010]
je 0x10004eca8
add r8d, r8d
add edx, edx
call fcn.1000450a4
mov rax, qword [0x1000bb010]
mov byte [rax + 0x14], 1
mov byte [rax + 0x58], 1
call fcn.10004ed44
mov rcx, qword [0x1000bafd0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1000bafc8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
cmp qword [0x1000bb010], 0
je 0x10004ed24
mov ecx, 0x25
call fcn.100051b84
mov rcx, qword [0x1000bb010]
mov rcx, qword [rcx + 0x78]
mov rdx, rax
mov rbx, rax
mov r8, qword [rcx]
call qword [r8 + 0x18]
test rbx, rbx
je 0x10004ed24
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x10004f3f0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
cmp byte [0x1000bb01d], 0
mov rbp, rcx
lea rax, [0x10001f580]
mov rsi, rdx
lea rcx, [0x10001f558]
mov dl, 1
cmove rcx, rax
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 0x1c]
call fcn.10004fe74
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x10004f699
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov edi, eax
int3
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100067fdc
Capabilities:
Check if file exists
Create process on windows
Query environment variable

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1000af140]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebx, ebx
cmp byte [0x1000bb01d], bl
jne 0x100068008
xor al, al
jmp 0x10006808a
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
lea rdx, [0x100024d70]
mov r8d, 0x3e
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x100068001
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x100068001
lea r8, [rsp + 0x70]
lea rdx, [0x100002950]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1000a2150
add rsp, 0x290
pop rbx
ret

Function at 0x10006837c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
movzx ebx, ax
shr ebx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
movzx edi, ax
shr edi, 0xf
and edi, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [rsp + 0x30]
movzx eax, ax
shr eax, 0xf
and eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x10006864c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, 1
cmp dword [rsp + 0x38], ebx
mov r8d, ebx
jle 0x1000686a8
lea rdx, [rax + 8]
mov rsi, qword [rdx]
lea rdi, [0x10001a3a8]
mov ecx, 9
repe cmpsw word [rsi], word [rdi]
je 0x1000686aa
add r8d, ebx
add rdx, 8
cmp r8d, dword [rsp + 0x38]
jl 0x100068686
xor bl, bl
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x40]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000686cc
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8d, 1
cmp dword [rsp + 0x40], r8d
mov rbx, rax
jle 0x10006872b
lea rdx, [rax + 8]
mov rcx, qword [rdx]
cmp word [rcx], 0x2f
je 0x10006871d
cmp word [rcx], 0x2d
jne 0x10006873d
inc r8d
add rdx, 8
cmp r8d, dword [rsp + 0x40]
jl 0x10006870e
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rdi, rdi
je 0x100068754
movsxd r8, r8d
mov rdx, rsi
mov rcx, rdi
mov r8, qword [rax + r8*8]
call sub.msvcrt.dll_wcscpy_s
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x10006872d
Function at 0x100068800
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1000af140]
xor rax, rsp
mov qword [rsp + 0x150], rax
test rcx, rcx
jne 0x100068825
xor al, al
jmp 0x10006894d
cmp qword [0x1000bb458], 0
mov qword [0x1000bb430], rcx
mov qword [0x1000bb428], rdx
mov byte [0x1000bb126], r8b
jne 0x10006894b
lea rcx, [0x100024db0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1000bb458], rax
test rax, rax
je 0x100068906
lea rdx, [0x100024dc8]
mov rcx, rax
call fcn.1000a1ba6
mov rcx, qword [0x1000bb458]
lea rdx, [0x100024dd8]
mov qword [0x1000bb438], rax
call fcn.1000a1ba6
cmp qword [0x1000bb438], 0
mov qword [0x1000bb448], rax
jne 0x1000688a4
test rax, rax
je 0x100068906
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100068906
cmp dword [rsp + 0x34], 6
jb 0x100068906
cmp dword [rsp + 0x38], 0
jne 0x100068906
cmp dword [rsp + 0x40], 2
jne 0x100068906
cmp dword [rsp + 0x3c], 0x147c
jae 0x100068906
mov rax, qword [0x1000bb438]
and qword [0x1000bb438], 0
mov qword [0x1000bb440], rax
mov rax, qword [0x1000bb448]
and qword [0x1000bb448], 0
mov qword [0x1000bb450], rax
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
mov r11b, byte [rsp + 0x20]
mov edx, 0xbb8
and r11b, 1
mov ecx, 0x40
mov dword [0x1000bb4e8], edx
mov byte [0x1000b8866], r11b
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
and qword [0x1000b8998], 0
mov qword [0x1000bb4e0], rax
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1000a2150
add rsp, 0x168
ret
Function at 0x10006cdc4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r12, rcx
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
mov r14, rdx
repne scasw ax, word [rdi]
mov eax, 0x40000000
not rcx
dec rcx
cmp ecx, eax
mov rsi, rcx
cmova esi, eax
xor r13d, r13d
cmp esi, 1
jb 0x10006cee2
cmp word [r12], 0x7c
jne 0x10006cee2
lea rcx, [r12 + 2]
lea r8d, [r13 + 0xa]
xor edx, edx
call qword [sym.imp.msvcrt.dll_wcstoul]
mov ebx, eax
cmp eax, r13d
je 0x10006cee2
shr eax, 4
xor ecx, ecx
inc eax
movzx r13d, ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, r13
mov rcx, rax
xor eax, eax
lea edx, [rax + 6]
movzx r9d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rdi, rax
xor eax, eax
cmp rdi, rax
jne 0x10006ce98
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx r9d, di
mov r8, r13
mov edx, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
xor r13d, r13d
mov rdi, rax
cmp rax, r13
je 0x10006cee2
jmp 0x10006ce9b
xor r13d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10006cee2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
cmp rax, r13
je 0x10006cee2
and ebx, 0xf
jbe 0x10006cedb
mov edi, ebx
movzx ecx, word [rdx]
inc ecx
sub rdi, 1
lea rdx, [rdx + rcx*2]
jne 0x10006cecc
movzx esi, word [rdx]
lea r12, [rdx + 2]
lea ecx, [rsi + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
int3

Function at 0x100075270
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
xor edx, edx
cmp dword [rcx], edx
jbe 0x1000752eb
mov r9, qword [rcx + 0x10]
mov r11d, dword [rcx]
mov rax, qword [r9]
mov r8d, edx
cmp dword [rax], 0
jbe 0x1000752db
mov r10, qword [rax + 0x10]
mov edi, dword [rax]
mov rax, qword [r10]
xor ebx, ebx
xor ebp, ebp
mov esi, dword [rax]
test esi, esi
je 0x1000752ca
mov r12, qword [rax + 0x10]
lea ecx, [rbp + 7]
and ecx, 0x1f
rol ebx, cl
movzx ecx, byte [rbp + r12]
inc ebp
xor ebx, ecx
cmp ebp, esi
jb 0x1000752b4
rol r8d, 0x11
add r10, 8
xor r8d, ebx
sub rdi, 1
jne 0x1000752a3
rol edx, 0xb
add r9, 8
xor edx, r8d
sub r11, 1
jne 0x100075292
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov eax, edx
pop r12
ret
Function at 0x100075d0c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1000bbdeb], 0
jne 0x100075d97
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, 1
cmp dword [rsp + 0x30], edx
jle 0x100075d90
add rax, 8
mov rsi, qword [rax]
lea rdi, [0x1000279d0]
mov ecx, 0xd
repe cmpsw word [rsi], word [rdi]
je 0x100075d86
mov rsi, qword [rax]
lea rdi, [0x1000279f0]
mov ecx, 0xa
repe cmpsw word [rsi], word [rdi]
je 0x100075d7d
inc edx
add rax, 8
cmp edx, dword [rsp + 0x30]
jl 0x100075d47
jmp 0x100075d90
and dword [0x1000b8134], 0
jmp 0x100075d90
mov dword [0x1000b8134], 2
mov byte [0x1000bbdeb], 1
mov eax, dword [0x1000b8134]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x10007bfc8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1000bb510]
test rcx, rcx
jne 0x10007bfee
call fcn.10007c07c
test eax, eax
je 0x10007c015
mov rcx, qword [0x1000bb510]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x10007c069
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x10007c019
xor eax, eax
jmp 0x10007c069
mov eax, dword [rax]
mov rcx, qword [0x1000bb510]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x10007c046
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x10007c069
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x1000bb510]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x10007c04d
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100084630
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp qword [0x1000bbdf8], 0
mov esi, dword [0x1000bb4ec]
mov edi, ecx
mov dword [0x1000bb4ec], ecx
jne 0x1000846ce
cmp qword [0x1000bbe00], 0
jne 0x1000846ce
lea rcx, [0x10002b2d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x100084694
lea rcx, [0x10002b2d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x100084694
lea rdx, [0x10002b2e8]
mov rcx, rax
call fcn.1000a1ba6
mov qword [0x1000bbdf8], rax
lea rcx, [0x10002b2f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1000846ce
lea rcx, [0x10002b2f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1000846ce
lea rdx, [0x10002b2e8]
mov rcx, rax
call fcn.1000a1ba6
mov qword [0x1000bbe00], rax
mov eax, dword [0x1000b8138]
cmp eax, 0xffffffff
jne 0x10008477d
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
lea rdx, [0x10002b2b8]
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100084766
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [0x1000b8138]
lea rdx, [0x10002b308]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
test ebx, ebx
jne 0x100084766
cmp dword [rsp + 0x58], 4
jne 0x100084766
mov eax, dword [0x1000b8138]
jmp 0x10008476e
xor eax, eax
mov dword [0x1000b8138], eax
test eax, eax
je 0x100084781
mov eax, 1
mov dword [0x1000b8138], eax
test eax, eax
jne 0x1000847a1
mov rax, qword [0x1000bbdf8]
test rax, rax
je 0x100084791
mov ecx, edi
call rax
mov rax, qword [0x1000bbe00]
test rax, rax
je 0x1000847a1
mov ecx, edi
call rax
mov eax, esi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x100097324
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x18]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rdx
mov rdx, rcx
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rsp + 0x68], 4
call qword [sym.imp.KERNEL32.dll_RegQueryValueExA]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
xor eax, eax
cmp ebx, eax
jne 0x100097377
cmp dword [rsp + 0x30], 4
jne 0x100097377
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1000a201d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rax, rax
sub rcx, 0xd55f
add rax, rcx
add rax, 0xd55f
add rcx, 0xd55f
sub rsp, 0x3f0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
and rcx, 0
add rcx, rsi
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x5aa1
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x441e
lea r9, [0x10009ddfc]
add byte [rax - 0x7d], cl
invalid
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1000a20da
je 0x1000a20f1
insb byte [rdi], dx
cld
add byte [rax], al
je 0x1000a20fb
jne 0x1000a20c5
lea rax, [0x1000a15ee]
add rax, 0xb32
call rax
je 0x1000a2096
push rsp
ror byte [rax - 0x39], cl
shl dword [rsi], 0x3e
add byte [rax], al
mov rcx, 0x3e26
mov r9d, 0x8d68
mov r10d, 0x92819200
lea eax, [rax]
add byte [rcx - 0x46], al
add byte [rdx - 0xb76d7f], dl
leave
dec rcx
xor byte [rax + rcx], r9b
add r9d, r10d
rol r9d, 1
test rcx, rcx
jne 0x1000a2104
add rax, 0x1ebd
mov rsp, rbp
mov rbp, qword [rsp]
add rsp, 8
ret

Function at 0x1000a247c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000a24c9
cmp rcx, 0xffffffffffffffff
je 0x1000a24c9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000a24c1
cmp dword [rcx + 0x3c], edx
jl 0x1000a24c1
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000a24c1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000a24c9
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000a8b0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000a8c0]
mov dword [rax], 1
mov rax, qword [0x14000a8d0]
mov dword [rax], 1
mov rax, qword [0x14000a8a0]
mov dword [rax], 1
mov rax, qword [0x14000a760]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14000a890]
mov dword [0x14000d020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14000a850]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14000a830]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14000a710]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067