joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44feb7
movzx edx, byte [rax]
test edx, edx
jne 0x44fd74
nop dword [rax]
test r8b, r8b
jne 0x44fd74
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44fd87
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44fe77
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44fe65
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44fe57
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44fddd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44fe20
mov eax, 1
cmp rax, rbx
ja 0x44fe0b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00462960
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44fe4f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44fe13
mov rcx, r11
mov eax, r12d
jmp 0x44fde2
mov rcx, rbx
call fcn.004628a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004628a0
mov eax, r8d
mov rcx, rbx
call fcn.00462960
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44fead
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44fe70
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44fd8d
mov eax, edx
mov rcx, rbx
call fcn.004628a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004628a0
nop
int3

Function at 0x455a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455b35
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00453700
nop
test bl, bl
je 0x455b2f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00455b80]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004604a0
xorps xmm15, xmm15
mov r14, qword [0x005c7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004605c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455a80
Function at 0x458aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458b4f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458ba0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004604a0
xorps xmm15, xmm15
mov r14, qword [0x005c7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004605c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00458aa0
Function at 0x4623c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403d43
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409ae0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004605c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403d20
cmp byte [0x005c748b], 0
je 0x4623d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f600
jmp 0x403d20

Function at 0x4623e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c7760]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005c748b], 0
je 0x462415
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c7a80]
aesenc xmm0, xmmword [0x005c7a90]
aesenc xmm0, xmmword [0x005c7aa0]
movq rax, xmm0
ret
jmp 0x409d00

Function at 0x462420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c7760]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005c748b], 0
je 0x462456
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c7a80]
aesenc xmm0, xmmword [0x005c7a90]
aesenc xmm0, xmmword [0x005c7aa0]
movq rax, xmm0
ret
jmp 0x409d60

Function at 0x4641e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x464214
mov rcx, 0x28
jmp 0x46421f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005c7690], rcx
pop rbp
ret
Function at 0x47b8e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b9aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x005c7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47b98f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00493d20]
xor ebx, ebx
mov rcx, rdx
call fcn.00449100
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047bec0
inc rbx
cmp rcx, rbx
jae 0x47b97e
mov edi, 1
lea rsi, [0x00493d20]
call fcn.004491e0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004cb0d8]
lea rsi, [0x004caab0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004605c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047b8e0
Function at 0x100003b44
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
and qword [r11 - 0x10], 0
lea rcx, [r11 - 0x10]
mov rax, rdx
mov qword [r11 - 0x28], rcx
lea rdx, [0x100001f30]
mov r9d, 0x20019
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100003bf6
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x100001f88]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100003be8
cmp dword [rsp + 0x30], 4
jne 0x100003be8
test eax, eax
jne 0x100003be8
cmp dword [rsp + 0x60], eax
sete dil
test rbx, rbx
je 0x100003be3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
jmp 0x100003bf8
test rbx, rbx
je 0x100003bf6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1000046b0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, r9d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rcx, [0x100001ec0]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100004710
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SwitchToThisWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x10000484a
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rbx, [0x100015cb0]
mov rdx, 0xffffffff80000001
mov rcx, rbx
call fcn.100003b44
test al, al
je 0x100004743
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.100003b44
jmp 0x100004745
xor al, al
test al, al
je 0x10000478f
cmp byte [0x100015d80], 0
je 0x100004757
or ebx, 0xffffffff
jmp 0x100004788
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call fcn.100003ce0
cmp al, 1
jne 0x100004784
mov edx, edi
mov rcx, rbx
call fcn.100004e10
mov ebx, eax
jmp 0x100004788
mov ebx, dword [rsp + 0x20]
mov eax, ebx
jmp 0x10000484c
mov rax, qword [0x100015100]
lea rcx, [0x100015100]
call qword [rax + 0x18]
mov rdx, qword [0x100015570]
lea rcx, [rsp + 0x28]
add rax, 0x18
mov r8d, 0xd9
mov qword [rsp + 0x28], rax
call fcn.100004860
mov rax, qword [0x100015100]
lea rcx, [0x100015100]
call qword [rax + 0x18]
mov rdx, qword [0x100015570]
lea rcx, [rsp + 0x30]
add rax, 0x18
mov r8d, 0x64
mov qword [rsp + 0x30], rax
call fcn.100004860
call fcn.10000e354
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov r9d, eax
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x10000482b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x28]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x10000484a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100004860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x1000049d6
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x1000049d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x1000049d6
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x10000490c
cmp rdi, r11
jae 0x1000049d6
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1000048f6
cmp rdi, r11
jae 0x1000049d6
cmp word [rdi], r13w
je 0x1000049d6
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x10000493e
mov edx, ebx
mov rcx, rsi
call fcn.100005cf4
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x10000495f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x1000049ae
cmp eax, 0xc
je 0x1000049a3
cmp eax, 0x16
je 0x100004998
cmp eax, 0x22
je 0x100004998
cmp eax, 0x50
je 0x1000049ae
mov ecx, 0x80004005
call fcn.100006d54
int3
mov ecx, 0x80070057
call fcn.100006d54
int3
mov ecx, 0x8007000e
call fcn.100006d54
int3
cmp ebx, r13d
jl 0x1000049cb
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1000049cb
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x1000049d8
mov ecx, 0x80070057
call fcn.100006d54
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100005060
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor esi, esi
add rcx, 8
mov dword [rcx + 0x60], esi
call fcn.100008094
mov rax, qword [0x100015100]
lea rcx, [0x100015100]
call qword [rax + 0x18]
lea rcx, [0x100015100]
add rax, 0x18
mov qword [rdi + 0x70], rax
mov dword [rdi + 0x78], esi
mov dword [rdi + 0x7c], esi
mov dword [rdi + 0x80], esi
mov dword [rdi + 0x84], esi
mov dword [rdi + 0x88], esi
mov dword [rdi + 0x8c], esi
mov qword [rdi + 0x90], rsi
mov dword [rdi + 0x98], esi
mov qword [rdi + 0xa8], rsi
mov qword [rdi + 0xc8], rsi
mov qword [rdi + 0xd0], rsi
mov dword [rdi + 0xd8], esi
mov qword [rdi + 0xe0], rdi
mov dword [rdi + 0xe8], esi
mov dword [rdi + 0xec], esi
lea rax, [0x1000039c0]
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xf8], rsi
mov qword [rdi + 0x100], rsi
mov qword [rdi + 0x108], rsi
mov qword [rdi + 0x110], rsi
mov qword [rdi + 0x118], rsi
mov qword [rdi + 0x120], rsi
mov qword [rdi + 0x128], rsi
mov qword [rdi + 0x130], rsi
mov qword [rdi + 0x138], rsi
mov qword [rdi + 0x140], rsi
mov qword [rdi + 0x148], rsi
mov rax, qword [0x100015100]
call qword [rax + 0x18]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
add rax, 0x18
lea edx, [rsi + 0x25]
mov ecx, 0x400
mov qword [rdi + 0x150], rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [rsp + 0x30], 0x31
sete al
mov byte [rdi + 0xf0], al
mov dword [rdi + 0x15c], esi
mov dword [rdi + 0x160], esi
mov dword [rdi + 0x164], 1
mov qword [rdi + 0x538], rsi
mov qword [rdi + 0x540], rsi
mov qword [rdi + 0x548], rsi
mov qword [rdi + 0x550], rsi
mov qword [rdi + 0x558], rsi
mov qword [rdi + 0x560], rsi
mov qword [rdi + 0x568], rsi
mov qword [rdi + 0x570], rsi
mov qword [rdi + 0x578], rsi
mov qword [rdi + 0x580], rsi
mov qword [rdi + 0x588], rsi
mov qword [rdi + 0x590], rsi
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rdi + 0x538], rax
lea rax, [0x1000020a0]
mov qword [rdi], rax
lea rax, [0x100002158]
mov qword [rdi + 8], rax
mov rcx, qword [0x100015d88]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x100006e2c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x100006f30
test rcx, rcx
je 0x100006ea6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x100006ecc
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.100006e2c
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x100006f30
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x100006eb4
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x100006f1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.100006f68
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x100006f3b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1000115c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100007c00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebp, ebp
mov rax, rdx
mov rbx, r8
mov qword [rsp + 0x38], rcx
lea r8d, [rbp + 2]
xor edx, edx
mov rcx, rax
mov rsi, r9
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
cmp rax, rbp
jne 0x100007c5e
call fcn.1000063e8
mov ebx, eax
jmp 0x100007d6b
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
cmp rax, rbp
jne 0x100007c7f
call fcn.1000063e8
jmp 0x100007d60
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
cmp rax, rbp
je 0x100007c75
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
inc eax
cmp eax, ebx
jae 0x100007cc7
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x100007cbd
lea rcx, [rsp + 0x40]
call fcn.1000063d8
mov eax, 0x8007000e
jmp 0x100007d83
mov ecx, eax
cmp rcx, rbp
je 0x100007d06
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x100007cfb
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x100007d06
lea rcx, [rsp + 0x40]
call fcn.1000068dc
mov r11, qword [rsp + 0x40]
jmp 0x100007d10
mov ecx, 0x80070057
call fcn.100006d54
int3
lea r11, [rsp + 0x48]
mov qword [rsp + 0x40], r11
cmp r11, rbp
jne 0x100007d1c
mov ebx, 0x8007000e
jmp 0x100007d62
xor edx, edx
mov r9d, ebx
mov r8, rsi
lea ecx, [rdx + 3]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebp
je 0x100007c75
mov r8d, dword [rsp + 0x4a0]
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov word [rax + rcx*2], bp
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.100007a40
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x100007d81
lea rcx, [rsp + 0x40]
call fcn.1000063d8
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000115c0
mov rbx, qword [rsp + 0x480]
add rsp, 0x460
pop rdi
pop rsi
pop rbp
ret
Function at 0x100008094
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x270
mov rax, qword [0x100015138]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r13d, r13d
lea rax, [0x100002528]
mov rdi, rcx
mov qword [rcx], rax
mov eax, 0xffff
mov dword [rcx + 8], r13d
mov word [rcx + 0x10], r13w
mov qword [rcx + 0x18], r13
mov dword [rcx + 0x20], r13d
mov word [rcx + 0xc], ax
mov word [rcx + 0xe], ax
mov rax, qword [0x100015100]
lea rbp, [0x100015100]
mov rcx, rbp
call qword [rax + 0x18]
mov rcx, rbp
add rax, 0x18
mov qword [rdi + 0x28], rax
mov rax, qword [0x100015100]
call qword [rax + 0x18]
mov rcx, rbp
add rax, 0x18
mov qword [rdi + 0x30], rax
or qword [rdi + 0x48], 0xffffffffffffffff
mov dword [rdi + 0x3c], r13d
mov dword [rdi + 0x40], r13d
mov rax, qword [0x100015100]
call qword [rax + 0x18]
mov rcx, rbp
add rax, 0x18
mov qword [rdi + 0x50], rax
mov rax, qword [0x100015100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x58], rax
call qword [sym.imp.WINMM.dll_timeGetTime]
lea r8d, [r13 + 0x64]
mov dword [rdi + 0x38], eax
mov rdx, qword [0x100015570]
lea rcx, [rdi + 0x58]
call fcn.100004860
mov rax, qword [0x100015100]
mov rcx, rbp
call qword [rax + 0x18]
mov rdx, qword [0x100015570]
lea r8d, [r13 + 0x64]
add rax, 0x18
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.100004860
lea rdx, [0x100002470]
lea rcx, [rsp + 0x48]
call fcn.10000885c
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x48]
mov r8d, dword [rdx - 0x10]
call fcn.100008a14
mov rbx, qword [rsp + 0x48]
lea r11, [rsp + 0x40]
lea r9d, [r13 + 2]
mov rdx, rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x100008270
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r13d
jbe 0x100008265
mov rcx, qword [rsp + 0x40]
inc eax
lea r9d, [r13 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
lea rdx, [0x1000024e0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r13d
jne 0x100008265
mov rcx, qword [rsp + 0x40]
lea r9d, [r13 + 4]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], r9d
lea rdx, [0x100002508]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r13d
jg 0x10000828c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, r13d
jg 0x1000082ae
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1000115c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x100008574
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x50
mov esi, edx
mov rdx, qword [rcx + 0x58]
movzx edi, r9w
cmp dword [rdx - 0x10], 0
mov rbx, rcx
je 0x10000860a
cmp r9w, 1
je 0x1000085a8
cmp dword [rcx + 0x3c], 0
je 0x10000860a
cmp qword [rcx + 0x18], 0
jne 0x1000085c0
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r8, qword [rsp + 0x70]
mov qword [rbx + 0x18], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10000860a
mov rax, r8
mov r9d, esi
neg rax
lea rax, [rsp + 0x70]
sbb rdx, rdx
and rdx, rax
xor eax, eax
test r8, r8
setne al
xor r8d, r8d
and qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
and dword [rsp + 0x30], r8d
mov word [rsp + 0x28], ax
and qword [rsp + 0x20], r8
movzx edx, di
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x100008620
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
shr r8, 1
mov rsi, rdx
mov rbx, rcx
mov r9, rbp
cmp rdx, rbp
je 0x100008679
cmp r8, 0x7fffffff
ja 0x100008679
mov r10, r8
mov rcx, rdx
mov eax, ebp
cmp r8, rbp
je 0x100008679
cmp word [rcx], bp
je 0x10000866c
add rcx, 2
sub r10, 1
jne 0x10000865d
cmp r10, rbp
je 0x100008679
mov r9, r8
sub r9, r10
jmp 0x10000867e
mov eax, 0x80070057
cmp eax, ebp
lea rdi, [r9 + r9]
jge 0x100008689
mov rdi, rbp
cmp rdi, rbp
jbe 0x1000086e3
cmp dword [rbx + 0x3c], ebp
je 0x1000086e3
cmp qword [rbx + 0x48], 0xffffffffffffffff
jne 0x1000086a2
mov rcx, rbx
call fcn.100008700
mov rcx, qword [rbx + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x1000086e3
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbx + 0x48]
lea r9, [rsp + 0x48]
lea rdx, [0x100002434]
mov r8d, 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret