joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015db0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140015dc8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140015dd0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140015de0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x140015e2d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140015e24
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140015e2f
add rax, 0x28
cmp rax, r9
jne 0x140015e10
xor eax, eax
ret

Function at 0x140015e30
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140015ec0
mov rdx, qword [0x14001ea90]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x140015eae
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140015eae
cmp word [rax + 0x18], 0x20b
jne 0x140015eae
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140015ec0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140015e99
add rbx, 0x28
cmp rbx, rdi
je 0x140015ec0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140015e90
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140015ed0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14001ea90]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140015ef0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140015ef8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140015ef0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140015f4d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140015f44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140015ef0
add rax, 0x28
cmp rax, r9
jne 0x140015f30
xor eax, eax
ret

Function at 0x140015f50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001ea90]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140015f6f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140015f78
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140015f6f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140015f90
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14001ea90]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140015fb0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140015fb8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140015fb0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140016000
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140015ff7
test rcx, rcx
je 0x140015fb0
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140015fe8
xor eax, eax
ret

Function at 0x140016010
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001ea90]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14001602f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140016038
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140016050
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14001ea90]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140016070
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140016078
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140016070
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140016070
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400160c4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400160d0
add rdx, 0x28
cmp rdx, r9
jne 0x1400160b0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400160e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14001ea90]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140016102
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140016110
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140016102
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140016102
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140016102
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140016165
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140016178
add rdx, 0x28
cmp r10, rdx
jne 0x140016150
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140016187
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140016197
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14001616e
test ecx, ecx
jg 0x140016180
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400162e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14001ea60]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x140016318
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140016380
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x140016390
mov esi, dword [0x140024588]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1400163e8
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x140016430
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x140016307
mov rcx, rbx
call fcn.140016240
mov qword [rsi + r12*8 + 8], rax
jmp 0x140016307
call fcn.140016240
mov qword [rbx + 0x10], rax
jmp 0x140016307
mov r10d, dword [rsi]
test r10d, r10d
je 0x1400164c1
mov r9d, dword [0x14001c4d0]
test r9d, r9d
je 0x1400164e9
lea rcx, [0x1400245a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x1400164ce
mov eax, dword [rsi]
test eax, eax
je 0x140016321
lea rcx, [0x1400245a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140016321
lea rcx, [r12 + 0x21]
mov edx, 8
lea rdi, [r12 + 0x20]
call sym.calloc
mov rsi, rax
test rax, rax
je 0x140016524
mov qword [rax], rdi
mov ecx, dword [0x140024588]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14001635b
call r13
jmp 0x14001635b
lea rdi, [rbp + rbp]
lea rax, [r12 + 0x20]
mov rcx, rsi
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sym.realloc
mov rsi, rax
test rax, rax
je 0x140016524
mov qword [rax], rdi
sub rdi, rbp
lea rcx, [rax + rbp*8 + 8]
xor edx, edx
lea r8, [rdi*8]
call sym.memset
jmp 0x14001640b
lea rcx, [0x1400245a0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14001651c
lea rdx, [0x1400161f0]
mov ecx, eax
mov dword [0x140024588], eax
call dbg.__mingwthr_key_dtor
test eax, eax
jne 0x140016524
mov dword [0x14001c4d0], 1
mov edx, dword [rsi]
test edx, edx
jne 0x1400163ac
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x140016321
mov rax, qword [0x140024580]
lea r12, [rax + 1]
mov qword [0x140024580], r12
mov qword [rbx + 0x10], r12
jmp 0x1400163c6
lock add dword [0x14001c4d4], 1
je 0x140016479
mov r8d, dword [0x14001c4d0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdi, [0x14001c4d0]
test r8d, r8d
jne 0x1400164b7
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x140016510
jmp 0x1400164b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400164a9
call sym.abort
nop
nop word [rax + rax]
Function at 0x100059814
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100059882
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100059872
mov ebx, 0x80004005
jmp 0x10005989f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10005989b
cmp dword [rsp + 0x30], 2
jne 0x100059897
cmp dword [rsp + 0x24], 6
jb 0x100059897
mov eax, 1
jmp 0x100059899
xor eax, eax
mov dword [rdi], eax
test ebx, ebx
jns 0x1000598d0
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x1000598d0
test byte [rcx + 0x3c], 2
je 0x1000598d0
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003fa10]
mov edx, 0x27
mov r9d, ebx
call fcn.10005c358
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10027d5f4
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x10005a3e4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x160
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, 0x11c
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8, rdi
xor ebx, ebx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rbp, [0x1004a9500]
lea edi, [rbx + 2]
test eax, eax
jne 0x10005a45c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10005a44c
mov ebx, 0x80004005
jmp 0x10005a48d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10005a489
cmp dword [rsp + 0x34], 6
jae 0x10005a47e
cmp dword [rsp + 0x34], 5
jne 0x10005a47a
cmp dword [rsp + 0x38], edi
jne 0x10005a47a
cmp word [rsp + 0x144], di
jae 0x10005a47e
xor eax, eax
jmp 0x10005a483
mov eax, 1
mov dword [0x1004c6578], eax
test ebx, ebx
jns 0x10005a4b7
mov rcx, qword [0x1004a9500]
cmp rcx, rbp
je 0x10005a4be
test byte [rcx + 0x3c], dil
je 0x10005a4be
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003f9b0]
mov edx, 0xe
mov r9d, ebx
call fcn.10005c358
mov rcx, qword [0x1004a9500]
test ebx, ebx
js 0x10005a56e
xor r9d, r9d
lea r8, [0x100040608]
lea rcx, [0x100040648]
lea edx, [r9 + 0x64]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
test eax, eax
je 0x10005a4ff
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10005a567
lea rax, [0x10005a5cc]
lea rcx, [0x100040140]
mov r9d, 0x21
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x4d2
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
je 0x10005a549
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10005a567
lea rcx, [0x1004c6548]
call fcn.10005bc8c
mov ebx, eax
test eax, eax
js 0x10005a567
mov dword [0x1004c657c], 1
jmp 0x10005a591
mov rcx, qword [0x1004a9500]
cmp rcx, rbp
je 0x10005a591
test byte [rcx + 0x3c], dil
je 0x10005a591
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003f9b0]
mov edx, 0xa
mov r9d, ebx
call fcn.10005c358
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10027d5f4
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10005b6f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x40
xor r13d, r13d
mov r12, r9
mov rbp, r8
lea r9, [rax - 0x20]
lea r8d, [r13 + 1]
mov qword [rax - 0x20], r13
mov rbx, r13
call fcn.10005b8bc
cmp eax, r13d
mov esi, eax
lea r14, [0x1004a9500]
jl 0x10005b84b
mov dword [rsp + 0x60], r13d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
je 0x10005b787
movzx esi, ax
or esi, 0x80070000
cmp eax, r13d
cmovle esi, eax
cmp esi, r13d
jne 0x10005b849
cmp rbx, r13
jne 0x10005b7cb
mov eax, dword [rsp + 0x60]
cmp eax, r13d
jbe 0x10005b7c1
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r13
jne 0x10005b745
mov rbx, r13
mov esi, 0x8007000e
jmp 0x10005b846
mov esi, 0x8000ffff
jmp 0x10005b84b
cmp dword [rsp + 0x30], 4
je 0x10005b7d9
mov esi, 0x8007000d
jmp 0x10005b84b
mov edx, dword [rsp + 0x60]
mov ebp, r13d
cmp edx, 4
je 0x10005b820
mov esi, 0x8007000d
mov ebp, esi
mov rcx, qword [0x1004a9500]
cmp rcx, r14
je 0x10005b81a
test byte [rcx + 0x3c], 2
je 0x10005b81a
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003fa30]
mov edx, 0xd
mov r9d, esi
call fcn.10005c358
mov edx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x60]
jmp 0x10005b829
mov eax, dword [rbx]
mov dword [r12], eax
mov eax, r13d
cmp ebp, r13d
mov esi, ebp
jl 0x10005b84b
cmp eax, r13d
mov rax, qword [rsp + 0x80]
cmovne rbx, r13
cmp rax, r13
je 0x10005b846
mov dword [rax], edx
cmp esi, r13d
jge 0x10005b875
mov rcx, qword [0x1004a9500]
cmp rcx, r14
je 0x10005b875
test byte [rcx + 0x3c], 2
je 0x10005b875
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003fa30]
mov edx, 0x22
mov r9d, esi
call fcn.10005c358
cmp rbx, r13
je 0x10005b88e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x38], r13
je 0x10005b8a0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov eax, esi
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x100060cfc
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x20], 0
xor eax, eax
mov rsi, rcx
and dword [rcx + 8], eax
and qword [r11 + 8], rax
lea ebp, [rax + 1]
lea r8, [r11 + 8]
lea rcx, [0x100041148]
mov edx, ebp
xor r9d, r9d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
xor ebx, ebx
xor edi, edi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x100060d70
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100060d5d
mov edi, 0x80004005
jmp 0x100060e14
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x100060e10
mov rax, qword [rsp + 0x50]
and dword [rsp + 0x30], ebx
lea r8, [0x100042200]
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
jne 0x100060dc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100060d5d
lea r8, [0x100042200]
xor edx, edx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
test rax, rax
je 0x100060d49
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100060df4
cmp eax, 0x80
je 0x100060ded
cmp eax, 0x102
jne 0x100060df7
mov edi, 0x800705b4
jmp 0x100060e14
mov edi, 0x8000ffff
jmp 0x100060e14
mov dword [rsi + 8], ebp
mov rcx, qword [rsi]
mov rbp, rbx
xor ebx, ebx
test rcx, rcx
je 0x100060e0d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsi], rbx
mov qword [rsi], rbp
test edi, edi
jns 0x100060e53
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x100060e45
test byte [rcx + 0x3c], 2
je 0x100060e45
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003f7d0]
mov edx, 0xb
mov r9d, edi
call fcn.10005c358
test rbx, rbx
je 0x100060e53
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100060e63
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x100064bf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x118
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x180]
xor r12d, r12d
mov r15, r8
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x188]
mov rdi, rdx
mov qword [rsp + 0x80], rdx
mov rsi, rcx
mov qword [rsp + 0xa8], rcx
lea rcx, [r11 - 0x88]
lea rdx, [0x1004c6420]
lea r8d, [r12 + 0x28]
mov rbx, r12
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], r9
mov r14, r12
mov rbp, r12
mov qword [r11 - 0xd0], r12
mov qword [r11 - 0x60], rbx
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x40], r12
call sub.msvcrt.dll_memcpy
call fcn.100308588
nop
insb byte [rdi], dx
add byte [rax], al
pop rdx
ror byte [r8 + 0x5a], 0x49
and byte [rbp + rdx*8 + 0x32], cl
or byte [rbp - 0x75], 0xec
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov dword [rsp + 0xa0], eax
cmp qword [rsp + 0x68], rcx
jne 0x100064f2a
mov esi, 0x80070057
mov r15, qword [rsp + 0x40]
lea rdi, [0x1004a9500]
mov rax, qword [0x1004a9500]
cmp rax, rdi
je 0x100064d71
test byte [rax + 0x3c], 2
je 0x100064d0d
mov rcx, qword [rax + 0x30]
lea r8, [0x10003f820]
mov edx, 0x16
mov r9d, esi
call fcn.10005c358
mov rax, qword [0x1004a9500]
cmp rax, rdi
je 0x100064d71
call fcn.10004c370
nop
invalid
test r12, r12
je 0x100064d80
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100064d96
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x100064da6
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.10042aabc
nop
or eax, 0xb0700000
test byte [rdx - 0x40], cl
and al, 0x13
or byte [rax - 0x4c], dh
test byte [rdx + 0x40], cl
call fcn.100427050
nop
mov eax, 0x90600caf
invalid
cmp qword [rsp + 0x70], rcx
je 0x100064cce
call fcn.10004c370
nop
cdq
pop rcx
adc eax, 0x4a729c80
rcr byte [rax + rax], 1
rcr byte [rax - 0x17efb58e], 0x28
movsb byte [rdi], byte [rsi]
sub byte [rax], al
nop
pop rcx
xchg edx, eax
add byte [rax], dh
adc ecx, dword [rcx + 0x70]
add qword [rax], rax
nop
invalid

Function at 0x100068860
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
call fcn.10004c370
nop
xchg rdi, rax
sbb eax, eax
jo 0x1000688e4
movabs al, byte [0x604a5f6c3000009c]
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.10004c370
nop
mov dl, 0xc6
shr ah, 0x10
adc byte [rcx + r8 + 0x10e85000], 0x4a
xor al, ch
invalid
call fcn.100399660
nop
invalid
Function at 0x100068d0c
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x18], esi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
call fcn.10004c460
nop
push rax
jo 0x100068d7a
mov al, 0x4c
jo 0x100068d7e
adc byte [rax + rbx*4], 5
fild word [rax]
add byte [rax - 0x18], ah
jl 0x100068d5b
cmp al, 0
nop
sbb dword [rax], eax
add byte [rax], al
invalid
jg 0x100068da7
shr byte [rdi], 1
add byte [rax], al
loopne 0x100068d18
jrcxz 0x100068d96
xor al, ch
in al, 0xe2
cmp eax, dword [rax]
nop
cmp al, 0xcc
xor dword [rax], esi
sub byte [rcx + rcx*2 + 0x40], ch
and al, 0x6c
and byte [r8 + rax], dl
add byte [rax], al
loopne 0x100068d66
sbb bh, ah
sub al, byte [rax]
nop
cmp al, 0x49
sub byte [rax - 0x1f], 0x3d
adc ch, bh
add dword [rax], eax
loopne 0x100068dd8
cmp al, 0x49
nop
mov rbx, r9
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.10042aabc
nop
imul eax, dword [rcx], 0x6ec0a000
xor byte [rcx - 0x3b7ff4ea], cl
outsb dx, byte [rsi]
loopne 0x100068da4
invalid
sbb eax, 0x6990003c
add dword [rax], eax
movabs al, byte [0x800b1689304a6ec0]
invalid
enter 0x29f7, 0
nop
or dword [rax], eax
add byte [rax + 0x68], dl
xchg ebp, eax
and byte [r13 + rdx*4 + 0x49], 0x20
sar byte [rdi], 1
invalid
add byte [rax], al
adc byte [rax - 0x6b9fb69b], bl
sal r8b, 1
sbb eax, 0x74e8a032
or byte [rbx], dh
add byte [rax - 0x3fcd7714], dl
cld
pop rsi
and r8b, dil
pop rsi
adc byte [r15], dl
add byte [rax], al
or byte [rax - 0x75], 0xd
insb byte [rdi], dx
mov dl, 0x45
add byte [rbx + rcx*4 + 0x11], cl
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov r12d, eax
mov qword [rsp + 0x20], rbx
call qword [r10 + 0x18]
call fcn.100118cac
nop
and byte [rdi + 7], bl
xor byte [rcx + rcx*4], bh
invalid
Function at 0x10006fa34
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
and qword [r11 - 0x50], 0
xor eax, eax
xor edi, edi
and qword [r11 + 0x20], rdi
and qword [r11 - 0x48], rdi
mov rsi, rdx
mov qword [rsp + 0x30], rdi
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov r12, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.10042aabc
nop
jae 0x10006fa84
add byte [rax + 0x4049ebb0], dl
mov word [rdx + 0x29], es
nop
mov al, 0xeb
mov word [rdx + 0x29], es
push rax
mov ah, 0xeb
add byte [r8 - 0x73], cl
push rsp
and al, 0x38
mov rcx, rsi
mov r13d, eax
call fcn.10005e7bc
call fcn.10009bd44
nop
push 0xfffffffff7c04a0d
out 0x1f, al
invalid
Function at 0x100073a34
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov ebp, r8d
mov r12, rdx
mov r13d, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.100427050
nop
add byte [rdi + 0x68ac200b], bl
mov al, 0xa8
push 0x1aa604a
add byte [rax + 0x27b8f9e8], ah
add byte [rax + 0x20942711], dl
mov word [rbx], ss
jo 0x100073a88
inc dword [rcx]
add byte [rax + 1], dl
call 0xcbf00aae
pop rbx
xor al, byte [rax]
add dword [rax], eax
push rax
add eax, ebp
sbb al, 0xd0
call fcn.100399660
nop
test al, 0x1a
sub dh, al
rcr ah, 0x49
push rax
mov esp, 0x9b049dc
add byte [rax], al
adc al, ch
fisttp qword [rdx + 0x29]
add byte [rax - 0x2ffffe03], dl
sub al, 0x5c
mov r8b, 0x28
pop rsp
loopne 0x100073a39
mov ch, 0x32
and byte [rbp + rcx*4 + 0x3d], cl
cmp eax, 0x4400435a
mov esi, eax
test rsi, rsi
je 0x100073cb3
call fcn.10042aabc
nop
add dword [rax], r8d
and byte [rax + 0x73], al
adc spl, sil
movabs eax, dword [0x8ee8304a7344600a]
mov eax, 0x41900027
adc edx, dword [rbx + 0x4989a460]
invalid
mov edi, 0x80070057
test edi, edi
jns 0x100073d88
call fcn.100399660
nop
adc al, 0x4c
sub dword [rax], esp
or al, 0xeb
and byte [r8], cl
jmp 0x100073d1a
add byte [rax + 0x6049bf44], dh
mov edi, 0x3bd4e049
sub al, 0x40
call fcn.1002ef378
nop
mov byte [rdx - 0x6d], ch
add byte [rax - 0x4b], cl
add qword [rax], r8
and byte [rcx + rbx*8 + 0x69e8a02c], dl
or r8b, byte [r8]
nop
in al, 0xc2
sub eax, 0x49a9f8d0
sar ah, 0xa9
mov r8b, 0x36
add byte [rax], al
test byte [rax + 0x3c], 2
je 0x100073da5
call fcn.10031899c
nop
and dh, 0x49
sbb byte [rax + rcx*4 + 0x2f2029], 0
movabs al, byte [0x30488b483049e67c]
lea r8, [0x10003f820]
mov edx, 0x3e
mov r9d, edi
call fcn.10005c358
call fcn.10009bd44
nop
hlt
call fcn.100308588
nop
retf 1