joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000183f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x10002dc20]
xor edx, edx
xor ebx, ebx
call fcn.10001d5d8
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x1000184de
test rbx, rbx
jne 0x1000184ea
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x1000184cd
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10001847a
xor ebx, ebx
jmp 0x1000184c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100018476
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x1000184b7
cmp rdi, r11
jae 0x100018476
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1000184a5
cmp rdi, r11
jae 0x100018476
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1000184ec
lea rcx, [0x10002dc20]
mov edx, ebp
call fcn.10001d5d8
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x100018437
xor esi, esi
test rsi, rsi
jne 0x1000184f5
xor eax, eax
jmp 0x100018503
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.100018654
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100018654
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x1000187ca
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x1000187ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x1000187ca
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100018700
cmp rdi, r11
jae 0x1000187ca
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1000186ea
cmp rdi, r11
jae 0x1000187ca
cmp word [rdi], r13w
je 0x1000187ca
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x100018732
mov edx, ebx
mov rcx, rsi
call fcn.10001880c
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x100018753
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.10001e548
cmp eax, r13d
je 0x1000187a2
cmp eax, 0xc
je 0x100018797
cmp eax, 0x16
je 0x10001878c
cmp eax, 0x22
je 0x10001878c
cmp eax, 0x50
je 0x1000187a2
mov ecx, 0x80004005
call fcn.100018964
int3
mov ecx, 0x80070057
call fcn.100018964
int3
mov ecx, 0x8007000e
call fcn.100018964
int3
cmp ebx, r13d
jl 0x1000187bf
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1000187bf
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x1000187cc
mov ecx, 0x80070057
call fcn.100018964
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x100018cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
mov rbx, rcx
lea r8, [rsp + 0x50]
lea rdx, [0x1000139d0]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, [0x100013a10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100018d31
cmp dword [rsp + 0x40], 3
jne 0x100018d20
mov rcx, rbx
call fcn.100018f74
jmp 0x100018d31
cmp dword [rsp + 0x40], 2
jne 0x100018d31
xor edx, edx
mov rcx, rbx
call fcn.100019194
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [rbx + 0x38]
mov rcx, qword [0x10002ef18]
mov edx, 1
mov dword [rsp + 0x20], edx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x100018d68
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
lea r8, [rax + 0x18]
and qword [rax + 0x18], rdi
and dword [rax + 8], edi
lea rdx, [0x100013a28]
mov rcx, 0xffffffff80000002
mov dword [rax + 0x10], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100018de2
lea rax, [rsp + 0x48]
lea rdx, [0x100013a60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmove edi, dword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x1c], 0
jne 0x100018e00
mov rcx, qword [rbx + 0x28]
lea rdx, [0x10001920c]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov qword [rbx + 0x10], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x38], rax
test dil, 1
je 0x100018e85
lea rax, [0x10002ef18]
lea rdx, [0x1000139d0]
mov r9d, 0x10
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100018e85
mov r9, qword [rbx + 0x38]
mov rcx, qword [0x10002ef18]
lea edx, [rax + 1]
lea r8d, [rax + 5]
mov dword [0x10002ef24], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x100019194
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
and dword [rsp + 0x50], 0
mov ebx, edx
lea rdx, [0x100013a28]
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1000191fe
lea rax, [rsp + 0x50]
mov r9d, 4
lea rdx, [0x100013ad0]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x100019894
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x10002c180]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, qword [rsp + 0x2d0]
xor r12d, r12d
mov ebp, r9d
mov rsi, r8
mov qword [rsp + 0x50], r12
cmp r8, r12
jne 0x1000198d9
mov ebx, 0x80004003
jmp 0x1000199da
cmp rdi, r12
je 0x1000198cf
mov ebx, r12d
lea rcx, [rsp + 0x60]
cmp rdx, r12
je 0x10001990a
mov qword [rsp + 0x20], rdx
lea r9, [0x100013c18]
lea r8, [0x100013c50]
mov edx, 0x104
call fcn.100015be0
jmp 0x10001994f
lea r8, [0x100013c18]
lea rax, [rsp + 0x60]
mov edx, 0x104
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100019942
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x100019942
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10001991e
cmp rdx, r12
jne 0x10001994b
sub rcx, 2
mov word [rcx], r12w
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x1000199bb
mov eax, dword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r12d
je 0x1000199ca
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r12d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x1000199da
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10001dd30
add rsp, 0x280
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10001add8
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x10001af40
lea r12, [0x100013510]
mov r8d, 0x10024
mov rcx, rax
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x10001af0d
lea r8, [rsp + 0x20]
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x10001aebc
lea rcx, [0x100013ff0]
mov rdx, r12
call fcn.10001e018
jmp 0x10001ae65
cmp eax, 3
jne 0x10001ae86
lea rcx, [0x10001400c]
call fcn.10001e018
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
mov eax, dword [rsp + 0x24]
jne 0x10001ae54
mov rdx, r12
cmp eax, 1
jne 0x10001ae9c
lea rcx, [0x100014010]
call fcn.10001e018
jmp 0x10001aebc
lea rcx, [0x100014030]
call fcn.10001e018
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x10001aeda
lea rcx, [0x100014060]
mov rdx, r12
call fcn.10001e018
jmp 0x10001af02
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014080]
mov edx, eax
call fcn.10001e018
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001af35
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000140c0]
mov edx, eax
call fcn.10001e018
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001af68
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000140f8]
mov edx, eax
call fcn.10001e018
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x10001af88
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x10001afd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x10001b04f
lea rdx, [0x100013510]
mov r8d, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10001b011
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x10001b04f
mov r8, rbx
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x10001b039
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10001b03b
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10001b69c
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov qword [rsp + 0x30], rsp
mov rsi, rdx
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x10001b700
mov eax, r14d
jmp 0x10001b8db
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x10001b714
xor eax, eax
jmp 0x10001b8db
mov ebx, dword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x10001b8db
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x10001b792
lea rdx, [0x10001b78b]
mov rcx, qword [rsp + 0x30]
call fcn.100027c20
nop
nop
xor eax, eax
jmp 0x10001b8db
xor ebx, ebx
mov dword [rsp + 0x38], ebx
cmp ebx, dword [rsp + 0xf8]
jae 0x10001b8c4
lea rdx, [rbx + rbx*2]
shl rdx, 4
lea rcx, [rsp + 0x78]
add rdx, rdi
mov r8d, 0x30
call fcn.1000234e0
mov r8d, 0x24
mov rdx, qword [rsp + 0x78]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x10001b7fb
lea rdx, [0x10001b7f4]
mov rcx, qword [rsp + 0x30]
call fcn.100027c20
nop
nop
xor eax, eax
jmp 0x10001b8db
lea r8, [rsp + 0x50]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10001b82b
lea rdx, [0x10001b824]
mov rcx, qword [rsp + 0x30]
call fcn.100027c20
nop
nop
nop
xor eax, eax
jmp 0x10001b8db
cmp dword [rsp + 0x54], r14d
je 0x10001b8af
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0xf0]
mov qword [rsp + 0x20], r11
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10001b87b
lea rdx, [0x10001b877]
mov rcx, qword [rsp + 0x30]
call fcn.100027c20
nop
nop
nop
xor eax, eax
jmp 0x10001b8db
cmp dword [rsp + 0x54], r14d
je 0x10001b8af
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, 0x7530
jbe 0x10001b8aa
lea rdx, [0x10001b8a6]
mov rcx, qword [rsp + 0x30]
call fcn.100027c20
nop
nop
nop
xor eax, eax
jmp 0x10001b8db
jmp 0x10001b82b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add ebx, r14d
mov dword [rsp + 0x38], ebx
jmp 0x10001b798
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r14d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10001d65c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x10002c180]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.10001f020
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x10000f000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.10001f020
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10001d6ef
cmp dword [rsp + 0x24], 5
jb 0x10001d709
jmp 0x10001d705
cmp dword [rsp + 0x30], esi
jne 0x10001d709
cmp dword [rsp + 0x24], 4
ja 0x10001d705
jne 0x10001d709
cmp dword [rsp + 0x28], 0
jbe 0x10001d709
mov byte [rbx + 0x18], sil
lea rax, [0x100010608]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.10001d4b8
movzx ecx, byte [0x10002ef30]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x10002ef30], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10001dd30
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10001dd0c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x7e5f2502
jmp 0x100005a0a
dec rcx
jmp 0x100006872
jne 0x100005a0a
jmp 0x100007e16
jmp 0x100007ef8
jmp 0x100007f5e
jmp 0x100007fa1
jmp 0x100007ffa
jmp 0x100008016
jmp 0x100008075
jmp 0x1000080e0
jmp 0x100008144
jmp 0x100008188
jmp 0x1000081b8
jmp 0x100008208
jmp 0x100008285
jmp 0x1000082a6
jmp 0x1000082e7
jmp 0x100008360
jmp 0x100008381
jmp 0x10000841f
jmp 0x100008449
jmp 0x100008483
jmp 0x1000084c5
xor rcx, rcx
mov rdx, 0x6c91
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call 0x1000084e5
pop rsi
add rsi, 0xe8a
mov rdi, rax
mov rcx, 0x6c91
rep movsb byte [rdi], byte [rsi]
jmp rax
sub rsp, 0x28
call fcn.1000212e8
add rsp, 0x28
xor rcx, rcx
jmp 0x1000024c3
Function at 0x10001dd30
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10002c180]
jne 0x10001dd4b
rol rcx, 0x10
test cx, 0xffff
jne 0x10001dd47
ret 0
ror rcx, 0x10
jmp 0x1000213a4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10002e3e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x10002e4d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100021429
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10002e3e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10002144b
mov rax, qword [rsp + 0x88]
mov qword [0x10002e4d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10002e478], rax
mov rax, qword [0x10002e4d8]
mov qword [0x10002e350], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10002e460], rax
mov dword [0x10002e340], 0xc0000409
mov dword [0x10002e344], 1
mov rax, qword [0x10002c180]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10002c188]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100010ea0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10001f5dc
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x10002c180]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x10001f6e2
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x10001f66a
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x10001f6e2
mov eax, edx
not eax
and ecx, eax
je 0x10001f685
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x10001f6e2
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x10001f6e2
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x10001f6e2
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10001f6e2
mov eax, 1
jmp 0x10001f6e4
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.10001dd30
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret

Function at 0x100020164
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.100023ce8
nop
cmp dword [0x10002ddfc], 1
je 0x100020217
mov dword [0x10002ddf8], 1
mov byte [0x10002ddb4], dil
test ebx, ebx
jne 0x100020203
mov rcx, qword [0x100030190]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x100030188]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1000201f0
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1000201f0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000201ee
call rcx
jmp 0x1000201d6
lea rdx, [0x100010560]
lea rcx, [0x100010548]
call fcn.10001ffb4
lea rdx, [0x100010570]
lea rcx, [0x100010568]
call fcn.10001ffb4
nop
test edi, edi
je 0x100020225
mov ecx, 8
call fcn.100023bd8
test edi, edi
jne 0x10002024d
mov dword [0x10002ddfc], 1
lea ecx, [rdi + 8]
call fcn.100023bd8
mov ecx, r12d
call fcn.10001ff38
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x100020164
Function at 0x10002026c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.100023ce8
nop
cmp dword [0x10002ddfc], 1
je 0x100020217
mov dword [0x10002ddf8], 1
mov byte [0x10002ddb4], dil
test ebx, ebx
jne 0x100020203
mov rcx, qword [0x100030190]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x100030188]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1000201f0
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1000201f0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000201ee
call rcx
jmp 0x1000201d6
lea rdx, [0x100010560]
lea rcx, [0x100010548]
call fcn.10001ffb4
lea rdx, [0x100010570]
lea rcx, [0x100010568]
call fcn.10001ffb4
nop
test edi, edi
je 0x100020225
mov ecx, 8
call fcn.100023bd8
test edi, edi
jne 0x10002024d
mov dword [0x10002ddfc], 1
lea ecx, [rdi + 8]
call fcn.100023bd8
mov ecx, r12d
call fcn.10001ff38
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x100020164

Function at 0x10002027c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x100020164