joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
mov rbx, rcx
lea r8, [rsp + 0x50]
lea rdx, [0x100013a60]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, [0x100013aa0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100019051
cmp dword [rsp + 0x40], 3
jne 0x100019040
mov rcx, rbx
call fcn.100019294
jmp 0x100019051
cmp dword [rsp + 0x40], 2
jne 0x100019051
xor edx, edx
mov rcx, rbx
call fcn.1000194b4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [rbx + 0x38]
mov rcx, qword [0x100033218]
mov edx, 1
mov dword [rsp + 0x20], edx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x100019088
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
lea r8, [rax + 0x18]
and qword [rax + 0x18], rdi
and dword [rax + 8], edi
lea rdx, [0x100013730]
mov rcx, 0xffffffff80000002
mov dword [rax + 0x10], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100019102
lea rax, [rsp + 0x48]
lea rdx, [0x100013ab8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmove edi, dword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x1c], 0
jne 0x100019120
mov rcx, qword [rbx + 0x28]
lea rdx, [0x10001952c]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov qword [rbx + 0x10], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x38], rax
test dil, 1
je 0x1000191a5
lea rax, [0x100033218]
lea rdx, [0x100013a60]
mov r9d, 0x10
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000191a5
mov r9, qword [rbx + 0x38]
mov rcx, qword [0x100033218]
lea edx, [rax + 1]
lea r8d, [rax + 5]
mov dword [0x100033224], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1000194b4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
and dword [rsp + 0x50], 0
mov ebx, edx
lea rdx, [0x100013730]
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10001951e
lea rax, [rsp + 0x50]
mov r9d, 4
lea rdx, [0x100013b30]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x100019bb4
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x100030180]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, qword [rsp + 0x2d0]
xor r12d, r12d
mov ebp, r9d
mov rsi, r8
mov qword [rsp + 0x50], r12
cmp r8, r12
jne 0x100019bf9
mov ebx, 0x80004003
jmp 0x100019cfa
cmp rdi, r12
je 0x100019bef
mov ebx, r12d
lea rcx, [rsp + 0x60]
cmp rdx, r12
je 0x100019c2a
mov qword [rsp + 0x20], rdx
lea r9, [0x100013c88]
lea r8, [0x100013cc0]
mov edx, 0x104
call fcn.100015ca0
jmp 0x100019c6f
lea r8, [0x100013c88]
lea rax, [rsp + 0x60]
mov edx, 0x104
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x100019c62
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x100019c62
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100019c3e
cmp rdx, r12
jne 0x100019c6b
sub rcx, 2
mov word [rcx], r12w
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
and al, 0x28
invalid
add byte [rdx], al
add byte [rcx + rcx*4 + 0x64], al
and al, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x100019cdb
mov eax, dword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r12d
je 0x100019cea
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r12d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x100019cfa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10001e0c0
add rsp, 0x280
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10001b1cc
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x10001b334
lea r12, [0x100013520]
mov r8d, 0x10024
mov rcx, rax
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x10001b301
lea r8, [rsp + 0x20]
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x10001b2b0
lea rcx, [0x100014060]
mov rdx, r12
call fcn.10001e3a8
jmp 0x10001b259
cmp eax, 3
jne 0x10001b27a
lea rcx, [0x10001407c]
call fcn.10001e3a8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
mov eax, dword [rsp + 0x24]
jne 0x10001b248
mov rdx, r12
cmp eax, 1
jne 0x10001b290
lea rcx, [0x100014080]
call fcn.10001e3a8
jmp 0x10001b2b0
lea rcx, [0x1000140a0]
call fcn.10001e3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x10001b2ce
lea rcx, [0x1000140d0]
mov rdx, r12
call fcn.10001e3a8
jmp 0x10001b2f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000140f0]
mov edx, eax
call fcn.10001e3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001b329
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014130]
mov edx, eax
call fcn.10001e3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001b35c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014168]
mov edx, eax
call fcn.10001e3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x10001b37c
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x10001b3c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x10001b443
lea rdx, [0x100013520]
mov r8d, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10001b405
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x10001b443
mov r8, rbx
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x10001b42d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10001b42f
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10001ba90
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov qword [rsp + 0x30], rsp
mov rsi, rdx
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x10001baf4
mov eax, r14d
jmp 0x10001bccf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x10001bb08
xor eax, eax
jmp 0x10001bccf
mov ebx, dword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x10001bccf
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x10001bb86
lea rdx, [0x10001bb7f]
mov rcx, qword [rsp + 0x30]
call fcn.100028180
nop
nop
xor eax, eax
jmp 0x10001bccf
xor ebx, ebx
mov dword [rsp + 0x38], ebx

Function at 0x10001d9e0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x100030180]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.10001f590
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x10000f000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.10001f590
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10001da73
cmp dword [rsp + 0x24], 5
jb 0x10001da8d
jmp 0x10001da89
cmp dword [rsp + 0x30], esi
jne 0x10001da8d
cmp dword [rsp + 0x24], 4
ja 0x10001da89
jne 0x10001da8d
cmp dword [rsp + 0x28], 0
jbe 0x10001da8d
mov byte [rbx + 0x18], sil
lea rax, [0x100010608]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.10001d83c
movzx ecx, byte [0x100033230]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x100033230], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10001e0c0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10001de60
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x100030180]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10001dea0
mov eax, 0xff
jmp 0x10001e067
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x10001debc
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x10003209c], r9d
mov dword [0x1000320a4], ecx
mov dword [0x1000320a8], edx
mov dword [0x1000320ac], eax
mov dword [0x1000320a0], r8d
mov eax, 0x5a4d
cmp word [0x10000f000], ax
jne 0x10001df4f
movsxd rax, dword [0x10000f03c]
lea rcx, [0x10000f000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x10001df1a
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x10001df55
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x10001df2d
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x10001df55
cmp dword [rax + 0x84], 0xe
ja 0x10001df3e
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x10001df55
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x20], ebx
jmp 0x10001df55
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.1000217e4
test eax, eax
jne 0x10001df87
cmp dword [0x100032088], 2
je 0x10001df73
call fcn.100020a88
mov ecx, 0x1c
call fcn.10002088c
mov ecx, 0xff
call fcn.1000204e8
call fcn.10002175c
test eax, eax
jne 0x10001dfb3
cmp dword [0x100032088], 2
je 0x10001df9e
call fcn.100020a88
mov ecx, 0x10
call fcn.10002088c
mov ecx, 0xff
call fcn.1000204e8
nop
call fcn.10002117c
test eax, eax
jns 0x10001dfc6
mov ecx, 0x1b
call fcn.100020474
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x1000344d0], rax
call fcn.1000210dc
mov qword [0x100032080], rax
call fcn.100020fe4
test eax, eax
jns 0x10001dff1
mov ecx, 8
call fcn.100020474
call fcn.100020ca8
test eax, eax
jns 0x10001e004
mov ecx, 9
call fcn.100020474
mov ecx, edi
call fcn.1000205fc
test eax, eax
je 0x10001e016
mov ecx, eax
call fcn.100020474
mov r8, qword [0x1000320d8]
mov qword [0x1000320e0], r8
mov rdx, qword [0x1000320c0]
mov ecx, dword [0x1000320b0]
call fcn.100014f28
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x10001e047
mov ecx, eax
call fcn.1000207dc
call fcn.100020800
jmp 0x10001e065
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10001e0c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.100021858
add rsp, 0x28
jmp 0x10001de60
Function at 0x10001e0c0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100030180]
jne 0x10001e0db
rol rcx, 0x10
test cx, 0xffff
jne 0x10001e0d7
ret 0
ror rcx, 0x10
jmp 0x100021914
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1000326e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1000327d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100021999
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1000326e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1000219bb
mov rax, qword [rsp + 0x88]
mov qword [0x1000327d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100032778], rax
mov rax, qword [0x1000327d8]
mov qword [0x100032650], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100032760], rax
mov dword [0x100032640], 0xc0000409
mov dword [0x100032644], 1
mov rax, qword [0x100030180]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100030188]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100010ea0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10001fb4c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x100030180]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x10001fc52
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x10001fbda
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x10001fc52
mov eax, edx
not eax
and ecx, eax
je 0x10001fbf5
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x10001fc52
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x10001fc52
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x10001fc52
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10001fc52
mov eax, 1
jmp 0x10001fc54
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.10001e0c0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret

Function at 0x1000206d4
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.100024258
nop
cmp dword [0x1000320fc], 1
je 0x100020787
mov dword [0x1000320f8], 1
mov byte [0x1000320b4], dil
test ebx, ebx
jne 0x100020773
mov rcx, qword [0x1000344b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x1000344a8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x100020760
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x100020760
mov rcx, qword [rbx]
test rcx, rcx
je 0x10002075e
call rcx
jmp 0x100020746
lea rdx, [0x100010568]
lea rcx, [0x100010550]
call fcn.100020524
lea rdx, [0x100010578]
lea rcx, [0x100010570]
call fcn.100020524
nop
test edi, edi
je 0x100020795
mov ecx, 8
call fcn.100024148
test edi, edi
jne 0x1000207bd
mov dword [0x1000320fc], 1
lea ecx, [rdi + 8]
call fcn.100024148
mov ecx, r12d
call fcn.1000204a8
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x1000206d4
Function at 0x1000207dc
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.100024258
nop
cmp dword [0x1000320fc], 1
je 0x100020787
mov dword [0x1000320f8], 1
mov byte [0x1000320b4], dil
test ebx, ebx
jne 0x100020773
mov rcx, qword [0x1000344b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x1000344a8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x100020760
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x100020760
mov rcx, qword [rbx]
test rcx, rcx
je 0x10002075e
call rcx
jmp 0x100020746
lea rdx, [0x100010568]
lea rcx, [0x100010550]
call fcn.100020524
lea rdx, [0x100010578]
lea rcx, [0x100010570]
call fcn.100020524
nop
test edi, edi
je 0x100020795
mov ecx, 8
call fcn.100024148
test edi, edi
jne 0x1000207bd
mov dword [0x1000320fc], 1
lea ecx, [rdi + 8]
call fcn.100024148
mov ecx, r12d
call fcn.1000204a8
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x1000206d4

Function at 0x1000207ec
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1000206d4
Function at 0x10002088c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x1000208be
inc edi
add rax, 0x10
cmp edi, 0x17
jb 0x1000208af
cmp edi, 0x17
jae 0x100020a6c
mov ebp, 3
mov ecx, ebp
call fcn.100025f30
cmp eax, 1
je 0x100020a24
mov ecx, ebp
call fcn.100025f30
test eax, eax
jne 0x1000208f4
cmp dword [0x100030170], 1
je 0x100020a24
cmp ebx, 0xfc
je 0x100020a6c
lea rbx, [0x100032100]
mov ebp, 0x314
lea r8, [0x100010e80]
mov rcx, rbx
mov rdx, rbp
call fcn.100023e40
test eax, eax
je 0x100020937
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10002274c
lea rdx, [0x100032119]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x10003221d], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100020988
lea r8, [0x100010e68]
lea rcx, [0x100032119]
mov edx, 0x2fb
call fcn.100023e40
test eax, eax
je 0x100020988
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10002274c
lea r8, [0x100032119]
mov rdx, rbp
mov rcx, rbx
call fcn.100025ea0
test eax, eax
je 0x1000209b3
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10002274c
lea r8, [0x100010e60]
mov rdx, rbp
mov rcx, rbx
call fcn.100025ea0
test eax, eax
je 0x1000209de
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10002274c
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.100025ea0
test eax, eax
je 0x100020a0d
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10002274c
lea rdx, [0x100010e38]
mov r8d, 0x12010
mov rcx, rbx
call fcn.100025c68
jmp 0x100020a6c
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r11, rax
test rax, rax
je 0x100020a6c
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x100020a6c
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x10002274c
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1000227b7
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x1000227d7
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100010f38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret