joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003375c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rdi, qword [0x1000b0fb8]
mov rcx, qword [rdi + 0xb0]
call fcn.10006a68c
mov rax, qword [rdi + 0xe0]
mov ebp, 4
mov rbx, qword [rax]
mov esi, 0x10000
lea rdx, [0x100025a20]
mov r8d, ebp
mov ecx, esi
call fcn.10005e464
lea r13d, [rbp + 0x30]
lea rdx, [0x100025a80]
mov r8d, r13d
mov ecx, esi
call fcn.10005e464
mov edx, ebp
mov rcx, rbx
call fcn.10006f850
xor esi, esi
mov r12, rsi
mov rcx, qword [rdi + 0xe0]
mov rcx, qword [rcx]
call fcn.100070998
xor r8d, r8d
mov dl, 1
mov rcx, rax
mov rbx, rax
call fcn.10006db6c
mov rcx, qword [rdi + 0xf8]
mov r11, r12
and r11d, 3
mov rdx, rbx
mov rcx, qword [rcx + r11*8]
call fcn.100070914
inc r12
sub r13, 1
jne 0x1000337d0
mov rcx, qword [rdi + 0xe0]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call fcn.10006ea44
mov rcx, qword [rdi + 0xf8]
mov rax, rsi
xor r8d, r8d
and eax, 3
xor edx, edx
mov rcx, qword [rcx + rax*8]
call fcn.10006ea44
inc rsi
sub rbp, 1
jne 0x100033826
xor edx, edx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp fcn.10002fdb0
Function at 0x100036db0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
and dword [rax + 0x10], 0
mov esi, edx
mov rdi, rcx
test edx, edx
jne 0x100036ee3
and qword [rax - 0x48], 0
mov dword [rax - 0x50], 0x80
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rax - 0x58], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x100036e14
lea rdx, [0x1000175b0]
mov r8, rdi
mov ecx, 0x10000001
call fcn.10005e464
jmp 0x100037042
mov rcx, rax
call fcn.100048c78
test eax, eax
jne 0x100036e42
lea rdx, [0x100017600]
mov r8, rdi
mov ecx, 0x80
call fcn.10005e464
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100037042
and dword [rsp + 0x90], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100036ed7
cmp dword [rsp + 0x90], 4
jne 0x100036ed7
mov ecx, dword [rsp + 0x88]
call fcn.100099170
mov esi, dword [rsp + 0x88]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
mov r8d, esi
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100036ecb
cmp dword [rsp + 0x98], esi
jne 0x100036ecb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100036fb2
lea rdx, [0x100017720]
jmp 0x100036e02
lea rdx, [0x100017690]
jmp 0x100036e27
mov r9b, 1
mov r8d, edx
mov dword [rsp + 0x20], 0x65
mov dl, r9b
call fcn.10004840c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x100036dfb
mov rcx, rax
call fcn.100048c78
test eax, eax
jne 0x100036f1e
lea rdx, [0x100017600]
jmp 0x100037028
and dword [rsp + 0x90], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100037021
cmp dword [rsp + 0x90], 4
jne 0x100037021
mov ecx, dword [rsp + 0x88]
call fcn.100099170
mov r12d, dword [rsp + 0x88]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, r12d
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100036ecb
cmp dword [rsp + 0x40], r12d
jne 0x100036ecb
mov r8b, 1
mov edx, esi
mov rcx, rbx
call fcn.1000480f8
mov ecx, 0x98
call fcn.1000990c0
test rax, rax
je 0x100036fce
mov rcx, rax
call fcn.100065368
mov rsi, rax
jmp 0x100036fd0
xor esi, esi
mov r8d, dword [rsp + 0x88]
mov rdx, rbp
mov rcx, rsi
call fcn.100065770
mov rcx, rbp
mov bl, al
call sub.msvcrt.dll_free
test bl, bl
jne 0x10003701c
lea rdx, [0x100017790]
mov r8, rdi
mov ecx, 0x10000001
call fcn.10005e464
test rsi, rsi
je 0x100037042
mov rcx, rsi
call fcn.1000653f4
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x100037042
mov rax, rsi
jmp 0x100037044
lea rdx, [0x100017690]
mov r8, rdi
mov ecx, 0x80
call fcn.10005e464
mov r8b, 1
mov edx, esi
mov rcx, rbx
call fcn.1000480f8
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100038cc8
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rdx, [0x10001c118]
mov ecx, 8
call fcn.10005e464
cmp dword [0x1000ae8e8], 0
jne 0x100038d1b
lea rcx, [0x1000ae900]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x100038d1b
lea rdx, [0x10001c0b0]
lea ecx, [rax + 8]
call fcn.10005e464
mov ecx, 0x21
mov dword [0x1000ae8e8], 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [0x1000ae8e8], 1
jne 0x100038d30
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x1000ae900], eax
add rsp, 0x28
jmp fcn.100048fb8

Function at 0x100038d40
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
cmp byte [0x1000b0f59], 0
je 0x100038e0a
lea r9, [0x100017c70]
lea r8, [0x100017c98]
mov edx, 0x244
mov ecx, 0x10
call fcn.10005e0ac
cmp byte [0x1000b10f2], 0
jne 0x100038dea
mov edx, 0x373
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 0x12]
mov r9d, 0xfffe
mov r8d, 1
call fcn.1000609d4
mov rcx, qword [0x1000b1078]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x1000acdfc]
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x1000b1078]
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], eax
mov eax, dword [0x1000acdf8]
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x100038df8
mov rcx, qword [0x1000b10c0]
mov byte [rcx + 0xa5], 0
xor ecx, ecx
call fcn.100046ea0
test al, al
je 0x100038e0a
mov al, 1
add rsp, 0x58
ret
lea r9, [0x100017cb0]
lea r8, [0x100017c98]
mov edx, 0x25d
mov ecx, 0x10
call fcn.10005e0ac
mov edx, 0x37d
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 8]
mov r9d, 0xfffe
mov r8d, 1
call fcn.1000609d4
mov cl, byte [0x1000b10f2]
call fcn.10005ffcc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100046ea0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov dil, cl
cmp cl, byte [0x1000b0f59]
je 0x10004703c
mov rcx, qword [0x1000b1080]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov cl, 1
call fcn.100043840
mov rcx, qword [0x1000b1078]
mov r9d, 0x107
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rbx, qword [0x1000b1198]
mov byte [0x1000b0f59], dil
test rbx, rbx
je 0x100046f4f
xor esi, esi
cmp dword [rbx + 0x18], esi
jbe 0x100046f30
xor ebp, ebp
mov rax, qword [rbx + 0x10]
mov dl, dil
mov rcx, qword [rax + rbp]
mov rax, qword [rcx]
call qword [rax + 0x40]
inc esi
add rbp, 8
cmp esi, dword [rbx + 0x18]
jb 0x100046f0d
mov rbx, qword [0x1000b1198]
mov rcx, rbx
call fcn.10004a0f0
mov rcx, qword [0x1000b1198]
call fcn.10004a030
test al, al
jne 0x100046f4f
xor al, al
jmp 0x10004703e
mov rbx, qword [0x1000b10c0]
test rbx, rbx
je 0x100046fd4
cmp dword [rbx + 0xd4], 0
je 0x100046fd4
lea r9, [0x100018dc8]
lea r8, [0x1000186b0]
mov edx, 0x201
mov ecx, 2
call fcn.10005e0ac
mov rcx, rbx
call fcn.10003c5e4
mov rcx, rbx
call fcn.10003c460
test al, al
je 0x100046f48
cmp dword [0x1000b1138], 0
jne 0x100046fc5
cmp byte [0x1000b0f59], 0
mov r8d, dword [0x1000abbac]
mov edx, dword [0x1000ab6ac]
mov rcx, qword [0x1000b10c0]
je 0x100046fc0
add r8d, r8d
add edx, edx
call fcn.10003dabc
mov rax, qword [0x1000b10c0]
mov byte [rax + 0x14], 1
mov byte [rax + 0x58], 1
call fcn.10004705c
mov rcx, qword [0x1000b1080]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1000b1078]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
cmp qword [0x1000b10c0], 0
je 0x10004703c
mov ecx, 0x25
call fcn.100047e78
mov rcx, qword [0x1000b10c0]
mov rcx, qword [rcx + 0x78]
mov rdx, rax
mov rbx, rax
mov r8, qword [rcx]
call qword [r8 + 0x18]
test rbx, rbx
je 0x10004703c
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x100048b60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r12, qword [rsp + 0xa0]
mov r13, rcx
mov r14d, 0x2028
mov rcx, r14
mov rbp, r9
mov rsi, r8
mov rbx, rdx
call fcn.1000990c0
mov r8, r14
mov rcx, rax
xor edx, edx
mov rdi, rax
call sub.msvcrt.dll_memset
mov dword [rdi], 0x484d4752
mov dword [rdi + 4], 1
mov dword [rdi + 8], r14d
movdqu xmm0, xmmword [rbx]
xor ebx, ebx
movdqu xmmword [rdi + 0x18], xmm0
cmp rsi, rbx
je 0x100048bcb
mov qword [rdi + 0xc], rbx
mov eax, dword [rsi]
mov dword [rdi + 0x14], eax
mov r14d, 0x3ff
cmp rbp, rbx
je 0x100048be5
lea rcx, [rdi + 0x28]
mov r8, rbp
mov rdx, r14
call sub.msvcrt.dll_wcscpy_s
cmp r12, rbx
je 0x100048bfc
lea rcx, [rdi + 0x828]
mov r8, r12
mov rdx, r14
call sub.msvcrt.dll_wcscpy_s
lea r9, [rsp + 0x30]
mov r8d, 0x2028
mov rdx, rdi
mov rcx, r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x100048c2c
mov rcx, rdi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100048c62
cmp rsi, rbx
je 0x100048c53
mov r8d, dword [rsi]
mov rdx, qword [rsi + 0x10]
lea r9, [rsp + 0x30]
mov rcx, r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x100048c58
mov ebx, 1
mov rcx, rdi
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x100048c78
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov r12, rcx
mov ecx, 0x2028
call fcn.1000990c0
mov rbx, rax
jmp 0x100048cb2
xor edi, edi
cmp rbx, rdi
jne 0x100048cc0
xor eax, eax
jmp 0x100048db5
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
mov r8d, 0x2028
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x100048dab
cmp dword [rsp + 0x58], 0x2028
jne 0x100048dab
cmp dword [rbx], 0x484d4752
jne 0x100048d9f
cmp dword [rbx + 4], 1
jne 0x100048d11
cmp dword [rbx + 8], 0x2028
je 0x100048d66
cmp dword [rbx + 8], 0x2030
jne 0x100048d9f
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0xc]
mov r8d, 0x2018
call sub.msvcrt.dll_memmove
mov dword [rbx + 8], 0x2028
mov word [rbx + 0x2024], di
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 7]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100048d66
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100048db5
mov edx, dword [rbx + 0x14]
cmp edx, edi
je 0x100048d90
mov r9d, 1
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100048d90
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100048db5
mov rcx, rbx
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x100048db5
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100048db5
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x100049bc0
Capabilities:
Get common file path
Set current directory
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x20
mov rbx, qword [0x1000b1198]
mov r13d, 4
lea rdx, [0x10001c2a0]
mov ecx, r13d
call fcn.10005e464
xor esi, esi
cmp dword [rbx + 0x18], esi
jbe 0x100049c66
xor ebp, ebp
mov rax, qword [rbx + 0x10]
mov rdi, qword [rax + rbp]
cmp dword [rdi + 0x18], 1
je 0x100049c12
cmp dword [rdi + 0x18], 3
jne 0x100049c5b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x100049c5b
cmp dword [rdi + 0x18], 1
jne 0x100049c32
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x50]
test al, al
jne 0x100049c5b
cmp byte [rdi + 0x14], 0
mov r9, qword [rdi + 0x20]
lea rax, [0x10001c320]
lea r8, [0x1000028d4]
lea rdx, [0x100015b60]
mov ecx, r13d
cmovne r8, rax
call fcn.10005e464
inc esi
add rbp, 8
cmp esi, dword [rbx + 0x18]
jb 0x100049bfe
lea rdx, [0x10001c340]
mov ecx, r13d
call fcn.10005e464
xor edi, edi
cmp dword [rbx + 0x18], edi
jbe 0x100049cbe
xor esi, esi
mov rax, qword [rbx + 0x10]
mov rbp, qword [rsi + rax]
cmp dword [rbp + 0x18], 1
je 0x100049c92
cmp dword [rbp + 0x18], 3
jne 0x100049cb3
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 8]
test al, al
jne 0x100049cb3
mov r8, qword [rbp + 0x20]
lea rdx, [0x10001c3bc]
mov ecx, r13d
call fcn.10005e464
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x18]
jb 0x100049c7e
lea rdx, [0x10001c3d0]
mov ecx, r13d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r13
jmp fcn.10005e464
Function at 0x10004e96c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov r12b, r9b
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov dword [rcx + 0x10], edi
mov dword [rcx + 8], 1
mov dword [rcx + 0xc], edi
mov dword [rcx + 0x28], edi
mov qword [rcx + 0x20], rdi
mov byte [rcx + 0x14], dil
mov dword [rcx + 0x18], 3
lea rax, [0x10001d8a0]
mov qword [rcx], rax
lea eax, [rdi + 2]
mul r13
lea r14, [rdi - 1]
cmovo rax, r14
mov rcx, rax
call fcn.100099170
mov qword [rbx + 0x68], rax
cmp rax, rdi
je 0x10004e9f4
mov r8, rbp
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_wcscpy_s
mov dword [rbx + 0x70], r13d
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x88], rdi
mov qword [rbx + 0x80], rdi
mov qword [rbx + 0x98], rdi
mov byte [rbx + 0x34], r12b
mov qword [rbx + 0x78], rdi
mov byte [rbx + 0x90], dil
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x38], edi
mov dword [rbx + 0x40], edi
movzx ecx, r12b
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.100099170
mov qword [rbx + 0x48], rax
cmp rax, rdi
je 0x10004ea70
cmp byte [rbx + 0x34], dil
jbe 0x10004ea70
mov rcx, rdi
mov rax, qword [rbx + 0x48]
mov dword [rcx + rax], 0x64
inc edi
add rcx, 4
movzx eax, byte [rbx + 0x34]
cmp edi, eax
jb 0x10004ea57
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x100050974
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x20
mov rbx, rcx
mov r13d, 0x40
mov rcx, r13
call fcn.1000990c0
xor edi, edi
lea r12, [0x10001fd78]
cmp rax, rdi
je 0x1000509d0
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], edi
mov qword [rax], r12
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
jmp 0x1000509d3
mov rax, rdi
mov rcx, r13
mov qword [rbx + 0x60], rax
call fcn.1000990c0
cmp rax, rdi
je 0x100050a0c
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], edi
mov qword [rax], r12
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
jmp 0x100050a0f
mov rax, rdi
mov rcx, rax
mov qword [rbx + 0x68], rax
call fcn.10005f7ec
mov rcx, r13
call fcn.1000990c0
cmp rax, rdi
je 0x100050a57
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
lea rcx, [0x10001fda0]
mov dword [rax + 0x20], edi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
mov qword [rax], rcx
jmp 0x100050a5a
mov rax, rdi
mov rcx, rax
mov qword [rbx + 0x70], rax
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
add rsp, 0x20
pop r13
jmp fcn.10005f7ec
Function at 0x10005e78c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1000a5140]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov bpl, r8b
mov edi, edx
mov rsi, rcx
lea rbx, [rsp + 0x60]
cmp edx, 0x40
ja 0x10005e839
je 0x10005e82d
mov eax, edx
sub eax, 1
je 0x10005e821
sub eax, 1
je 0x10005e815
sub eax, 2
je 0x10005e809
sub eax, 4
je 0x10005e7fd
sub eax, 8
je 0x10005e7f1
cmp eax, 0x10
jne 0x10005e865
lea rbx, [0x100020480]
jmp 0x10005e8cc
lea rbx, [0x100020458]
jmp 0x10005e8cc
lea rbx, [0x100020438]
jmp 0x10005e8cc
lea rbx, [0x100020468]
jmp 0x10005e8cc
lea rbx, [0x100020420]
jmp 0x10005e8cc
lea rbx, [0x100020410]
jmp 0x10005e8cc
lea rbx, [0x1000204a8]
jmp 0x10005e8cc
cmp edx, 0x80
je 0x10005e8c5
cmp edx, 0x100
je 0x10005e8bc
cmp edx, 0x200
je 0x10005e8b3
cmp edx, 0x400
je 0x10005e8aa
cmp edx, 0x800
je 0x10005e8a1
mov rax, qword [0x1000ae910]
test rax, rax
je 0x10005e882
mov ecx, edx
call rax
mov rbx, rax
test rax, rax
jne 0x10005e8cc
lea rbx, [rsp + 0x60]
or r8, 0xffffffffffffffff
lea r9, [0x100020518]
lea rcx, [rsp + 0x60]
lea edx, [r8 + 0x11]
mov dword [rsp + 0x20], edi
call sub.msvcrt.dll__snwprintf_s
jmp 0x10005e8cc
lea rbx, [0x100020508]
jmp 0x10005e8cc
lea rbx, [0x1000204f8]
jmp 0x10005e8cc
lea rbx, [0x1000204e0]
jmp 0x10005e8cc
lea rbx, [0x1000204d0]
jmp 0x10005e8cc
lea rbx, [0x1000204b8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
test bpl, bpl
je 0x10005e988
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x10005e96c
and qword [rsp + 0x30], 0
and qword [rsp + 0x50], 0
lea r9, [rsp + 0x48]
lea rcx, [0x100020400]
mov edx, 0xc0000000
mov r8d, 2
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x48], 0x18
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
je 0x10005e9a3
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10005e9a3
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x10005e9a3
and qword [rsp + 0x20], rax
lea r8d, [rcx + rcx - 2]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1000995a0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret

Function at 0x10005f7ec
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
test rcx, rcx
jne 0x10005f82c
lea rax, [0x100020860]
mov byte [rsp + 0x30], 1
lea r8d, [rcx + 1]
mov qword [rsp + 0x28], rax
lea rax, [0x100020880]
xor edx, edx
mov r9d, 0xfffe
mov qword [rsp + 0x20], rax
call fcn.1000609d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x48
ret
Function at 0x10005fcb4
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
and dword [rax + 0x18], 0
lea rdx, [0x1000028d4]
lea rcx, [rax - 0x30]
call fcn.100064ac8
nop
mov esi, 0x100
mov dword [rsp + 0x68], esi
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1000990c0
mov rbx, rax
test rax, rax
jne 0x10005fd36
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.100064a54
mov dword [rsp + 0x70], 1
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
mov rax, rdi
jmp 0x10005fda8
lea r8, [rsp + 0x68]
mov rdx, rax
mov ecx, 3
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x10005fd5b
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.100064cfc
jmp 0x10005fd7e
mov dword [rsp + 0x68], esi
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10005fd7e
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.100064cfc
mov rcx, rbx
call sub.msvcrt.dll_free
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.100064a54
mov dword [rsp + 0x70], 1
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
mov rax, rdi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x10005ffcc
Capabilities:
Check if file exists
Create process on windows
Query environment variable

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1000a5140]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebx, ebx
cmp byte [0x1000b10f2], bl
jne 0x10005fff8
xor al, al
jmp 0x10006007a
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x30]
lea rdx, [0x1000208a0]
mov r8d, 0x3e
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x10005fff1
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x10005fff1
lea r8, [rsp + 0x70]
lea rdx, [0x1000024c8]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1000995a0
add rsp, 0x290
pop rbx
ret

Function at 0x1000605e8
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8d, 1
cmp dword [rsp + 0x40], r8d
mov rbx, rax
jle 0x100060647
lea rdx, [rax + 8]
mov rcx, qword [rdx]
cmp word [rcx], 0x2f
je 0x100060639
cmp word [rcx], 0x2d
jne 0x100060659
inc r8d
add rdx, 8
cmp r8d, dword [rsp + 0x40]
jl 0x10006062a
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rdi, rdi
je 0x100060670
movsxd r8, r8d
mov rdx, rsi
mov rcx, rdi
mov r8, qword [rax + r8*8]
call sub.msvcrt.dll_wcscpy_s
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x100060649
Function at 0x10006071c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1000a5140]
xor rax, rsp
mov qword [rsp + 0x150], rax
test rcx, rcx
jne 0x100060741
xor al, al
jmp 0x100060869
cmp qword [0x1000b1500], 0
mov qword [0x1000b14d8], rcx
mov qword [0x1000b14d0], rdx
mov byte [0x1000b111f], r8b
jne 0x100060867
lea rcx, [0x1000208e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1000b1500], rax
test rax, rax
je 0x100060822
lea rdx, [0x1000208f8]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov rcx, qword [0x1000b1500]
lea rdx, [0x100020908]
mov qword [0x1000b14e0], rax
call sub.KERNEL32.dll_GetProcAddress
cmp qword [0x1000b14e0], 0
mov qword [0x1000b14f0], rax
jne 0x1000607c0
test rax, rax
je 0x100060822
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100060822
cmp dword [rsp + 0x34], 6
jb 0x100060822
cmp dword [rsp + 0x38], 0
jne 0x100060822
cmp dword [rsp + 0x40], 2
jne 0x100060822
cmp dword [rsp + 0x3c], 0x147c
jae 0x100060822
mov rax, qword [0x1000b14e0]
and qword [0x1000b14e0], 0
mov qword [0x1000b14e8], rax
mov rax, qword [0x1000b14f0]
and qword [0x1000b14f0], 0
mov qword [0x1000b14f8], rax
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
mov r11b, byte [rsp + 0x20]
mov edx, 0xbb8
and r11b, 1
mov ecx, 0x40
mov dword [0x1000b11dc], edx
mov byte [0x1000ae8ed], r11b
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
and qword [0x1000ae980], 0
mov qword [0x1000b1588], rax
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1000995a0
add rsp, 0x168
ret