joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b87a0
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5b8867
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5b87cc
test r15, r15
je 0x5b88aa
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5b887c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5b87db
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5ba340
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5ba3e7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5ba48a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5ba3e7
cmp r9, 0
je 0x5ba543
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5ba4a0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x616fc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x617095
movdqa xmm0, xmmword [0x00770500]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x617001
movdqa xmm0, xmmword [0x00770510]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x617117
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x6170eb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0076f900]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x007708c0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x6805a0
Capabilities:
Enumerate pe sections

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x680766
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jbe 0x68075d
nop word [rax + rax]
nop
cmp rcx, 1
jbe 0x680753
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
mov word [rsp], cx
call fcn.00680c00
movzx eax, byte [rsp + 8]
movzx ecx, byte [rsp + 9]
mov rdx, qword [rsp + 0x38]
cmp rdx, 2
jbe 0x680746
cmp rdx, 3
jbe 0x680739
mov dword [rsp + 0x1c], eax
mov byte [rsp + 0x13], cl
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax + 2]
mov word [rsp], cx
call fcn.00680c00
movzx eax, byte [rsp + 8]
movzx ecx, byte [rsp + 9]
mov rdx, qword [rsp + 0x38]
cmp rdx, 4
jbe 0x68072c
cmp rdx, 5
jbe 0x68071f
mov dword [rsp + 0x18], eax
mov byte [rsp + 0x12], cl
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax + 4]
mov word [rsp], cx
call fcn.00680c00
movzx eax, byte [rsp + 8]
movzx ecx, byte [rsp + 9]
mov rdx, qword [rsp + 0x38]
cmp rdx, 6
jbe 0x680712
cmp rdx, 7
jbe 0x680705
mov dword [rsp + 0x14], eax
mov byte [rsp + 0x11], cl
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
mov word [rsp], ax
call fcn.00680c00
movzx eax, byte [rsp + 8]
movzx ecx, byte [rsp + 9]
mov edx, dword [rsp + 0x1c]
shl edx, 0x18
mov ebx, dword [rsp + 0x18]
shl ebx, 0x10
or edx, ebx
mov ebx, dword [rsp + 0x14]
shl ebx, 8
or ebx, edx
or ebx, eax
movzx eax, byte [rsp + 0x13]
test al, al
je 0x680701
movzx eax, byte [rsp + 0x12]
test al, al
je 0x680701
movzx eax, byte [rsp + 0x11]
test al, al
je 0x680701
mov dword [rsp + 0x48], ebx
mov byte [rsp + 0x4c], cl
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
nop
ret
xor ecx, ecx
jmp 0x6806ee
mov eax, 7
mov rcx, rdx
call fcn.0046cde0
mov eax, 6
mov rcx, rdx
call fcn.0046cde0
mov eax, 5
mov rcx, rdx
call fcn.0046cde0
mov eax, 4
mov rcx, rdx
call fcn.0046cde0
mov eax, 3
mov rcx, rdx
call fcn.0046cde0
mov eax, 2
mov rcx, rdx
call fcn.0046cde0
mov eax, 1
call fcn.0046cde0
xor eax, eax
nop
call fcn.0046cde0
nop
call fcn.0046ac00
jmp fcn.006805a0
Function at 0x10014c8
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.01002a18
nop
cmp dword [0x0105e43c], 1
je 0x100157b
mov dword [0x0105e438], 1
mov byte [0x0105e3f4], dil
test ebx, ebx
jne 0x1001567
mov rcx, qword [0x01068730]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x01068728]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1001554
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1001554
mov rcx, qword [rbx]
test rcx, rcx
je 0x1001552
call rcx
jmp 0x100153a
lea rdx, [0x010374b0]
lea rcx, [0x01037498]
call fcn.01001338
lea rdx, [0x010374c0]
lea rcx, [0x010374b8]
call fcn.01001338
nop
test edi, edi
je 0x1001589
mov ecx, 8
call fcn.01002918
test edi, edi
jne 0x10015b1
mov dword [0x0105e43c], 1
lea ecx, [rdi + 8]
call fcn.01002918
mov ecx, r12d
call fcn.010012cc
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x10014c8

Function at 0x10015c8
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.01002a18
nop
cmp dword [0x0105e43c], 1
je 0x100157b
mov dword [0x0105e438], 1
mov byte [0x0105e3f4], dil
test ebx, ebx
jne 0x1001567
mov rcx, qword [0x01068730]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x01068728]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1001554
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1001554
mov rcx, qword [rbx]
test rcx, rcx
je 0x1001552
call rcx
jmp 0x100153a
lea rdx, [0x010374b0]
lea rcx, [0x01037498]
call fcn.01001338
lea rdx, [0x010374c0]
lea rcx, [0x010374b8]
call fcn.01001338
nop
test edi, edi
je 0x1001589
mov ecx, 8
call fcn.01002918
test edi, edi
jne 0x10015b1
mov dword [0x0105e43c], 1
lea ecx, [rdi + 8]
call fcn.01002918
mov ecx, r12d
call fcn.010012cc
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x10014c8

Function at 0x10015d4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x10014c8
Function at 0x1001658
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x0104a010]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x100168a
inc edi
add rax, 0x10
cmp edi, 0x17
jb 0x100167b
cmp edi, 0x17
jae 0x1001838
mov ebp, 3
mov ecx, ebp
call fcn.010034b0
cmp eax, 1
je 0x10017f0
mov ecx, ebp
call fcn.010034b0
test eax, eax
jne 0x10016c0
cmp dword [section..data], 1
je 0x10017f0
cmp ebx, 0xfc
je 0x1001838
lea rbx, [0x0105e440]
mov ebp, 0x314
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbx
mov rdx, rbp
call fcn.0100343c
test eax, eax
je 0x1001703
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01002a5c
lea rdx, [0x0105e459]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x0105e55d], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001754
lea r8, str._program_name_unknown_
lea rcx, [0x0105e459]
mov edx, 0x2fb
call fcn.0100343c
test eax, eax
je 0x1001754
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01002a5c
lea r8, [0x0105e459]
mov rdx, rbp
mov rcx, rbx
call fcn.010033b0
test eax, eax
je 0x100177f
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01002a5c
lea r8, [0x01037aa0]
mov rdx, rbp
mov rcx, rbx
call fcn.010033b0
test eax, eax
je 0x10017aa
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01002a5c
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.010033b0
test eax, eax
je 0x10017d9
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01002a5c
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbx
call fcn.0100317c
jmp 0x1001838
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r11, rax
test rax, rax
je 0x1001838
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x1001838
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x1001f50
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r12d, r12d
mov rdi, rax
cmp rax, r12
je 0x1002029
mov rbx, rax
cmp word [rax], r12w
je 0x1001f9b
add rbx, 2
cmp word [rbx], r12w
jne 0x1001f87
add rbx, 2
cmp word [rbx], r12w
jne 0x1001f87
mov qword [rsp + 0x38], r12
sub rbx, rax
mov qword [rsp + 0x30], r12
sar rbx, 1
mov r8, rax
xor edx, edx
lea r9d, [rbx + 1]
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbp, eax
cmp ebp, r12d
je 0x1002020
mov rcx, rbp
call fcn.01004058
mov rsi, rax
cmp rax, r12
je 0x1002020
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, r12d
jne 0x1002012
mov rcx, rsi
call fcn.01003584
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
jmp 0x100202b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x10026f0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0104a270]
jne 0x100270b
rol rcx, 0x10
test cx, 0xffff
jne 0x1002707
ret 0
ror rcx, 0x10
jmp 0x1004524
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0105ec00]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x0105ecf8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10045a9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0105ec00]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10045cb
mov rax, qword [rsp + 0x88]
mov qword [0x0105ecf8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0105ec98], rax
mov rax, qword [0x0105ecf8]
mov qword [0x0105eb70], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0105ec80], rax
mov dword [0x0105eb60], 0xc0000409
mov dword [0x0105eb64], 1
mov rax, qword [0x0104a270]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0104a278]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x01037c28]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1002a5c
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1002ac7
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x1002ae7
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x100317c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.0100230c
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
mov rdi, rax
cmp qword [0x0105eae8], rbp
jne 0x10032b4
lea rcx, str.USER32.DLL
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x10031e0
xor eax, eax
jmp 0x1003394
lea rdx, [0x01037b78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x10031d9
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x0105eae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x0105eaf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x0105eaf8], rax
call fcn.0100136c
test eax, eax
je 0x1003267
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01002a5c
cmp dword [rsp + 0x88], 2
jne 0x10032b4
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x0105eb08], rax
test rax, rax
je 0x10032b4
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x0105eb00], rax
mov rcx, qword [0x0105eb00]
cmp rcx, rdi
je 0x1003346
cmp qword [0x0105eb08], rdi
je 0x1003346
call sub.KERNEL32.dll_DecodePointer
call rax
mov rsi, rax
test rax, rax
je 0x1003311
mov rcx, qword [0x0105eb08]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x1003311
test byte [rsp + 0x40], 1
jne 0x1003346
lea rcx, [rsp + 0x30]
call fcn.010013b0
test eax, eax
je 0x1003333
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01002a5c
cmp dword [rsp + 0x30], 4
jb 0x1003340
bts ebx, 0x15
jmp 0x100337a
bts ebx, 0x12
jmp 0x100337a
mov rcx, qword [0x0105eaf0]
cmp rcx, rdi
je 0x100337a
call sub.KERNEL32.dll_DecodePointer
call rax
mov rbp, rax
test rax, rax
je 0x100337a
mov rcx, qword [0x0105eaf8]
cmp rcx, rdi
je 0x100337a
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x0105eae8]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1005a2c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x0104a270]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1005b32
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x1005aba
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x1005b32
mov eax, edx
not eax
and ecx, eax
je 0x1005ad5
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x1005b32
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x1005b32
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1005b32
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1005b32
mov eax, 1
jmp 0x1005b34
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.010026f0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret
Function at 0x10111c0
Capabilities:
Get system firmware table

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x20], 0x12000e
mov qword [rsp + 0x28], 0
xor eax, eax
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov word [rsp + 0x38], ax
cmp qword [0x0105f958], 0
je 0x1011213
mov rcx, qword [0x0105f958]
call fcn.01027300
movzx ecx, word [rsp + 0x38]
call fcn.01027240
mov qword [0x0105f958], rax
movzx r9d, word [rsp + 0x38]
mov r8, qword [0x0105f958]
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov r11d, eax
movzx eax, word [rsp + 0x38]
cmp r11d, eax
jbe 0x1011253
mov dword [rsp + 0x20], 0
mov rax, qword [0x0105f958]
add rax, 8
mov qword [0x0105f948], rax
mov rax, qword [0x0105f958]
movzx eax, word [rax + 4]
mov word [0x0105f934], ax
mov rax, qword [0x0105f958]
movzx eax, byte [rax + 1]
mov byte [0x0105f921], al
mov rax, qword [0x0105f958]
movzx eax, byte [rax + 2]
mov byte [0x0105f922], al
cmp qword [0x0105f948], 0
je 0x10112ae
movzx eax, word [0x0105f934]
test eax, eax
jne 0x10112b8
mov dword [rsp + 0x20], 0x12000e
jmp 0x10112c0
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x10112fc
xor r8d, r8d
movzx edx, word [0x0105f934]
mov rcx, qword [0x0105f948]
call fcn.01011370
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x10112f4
mov dword [rsp + 0x20], 0
jmp 0x10112fc
mov dword [rsp + 0x20], 0x12000e
cmp dword [rsp + 0x20], 0
jne 0x1011359
mov r8b, 0x7f
movzx edx, word [0x0105f934]
mov rcx, qword [0x0105f948]
call fcn.01011370
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x101133f
mov rax, qword [rsp + 0x28]
add rax, 6
sub rax, qword [0x0105f948]
mov word [0x0105f934], ax
jmp 0x1011359
lea rcx, str.Warning:_DMI_Table_length_has_been_changed._n
call qword [0x010671a8]
lea rcx, str.Please_try_to_reboot_your_system__n_n
call qword [0x010671a8]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret