joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1087824
Capabilities:
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0x50
lea rax, [r11 + 0x20]
lea rbp, [0x010c1dd0]
lea r9, [r11 + 0x18]
mov qword [r11 - 0x40], rax
lea rdx, [0x01082560]
xor r8d, r8d
mov qword [r11 - 0x48], rbp
mov rbx, rcx
mov dword [r11 + 0x20], 0x104
mov dword [r11 + 0x18], 4
mov byte [0x010c2330], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x108799d
cmp dword [rsp + 0x80], 1
jne 0x108799d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
mov rcx, rbp
je 0x10878e1
and qword [rsp + 0x30], rax
lea r8d, [rax + 3]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov qword [0x010c1dc8], rax
je 0x10879ea
mov byte [0x010c2330], 1
jmp 0x10879ea
lea r8, [0x01082570]
mov edx, 0x104
call fcn.0108f1b4
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 3]
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x010c1dc8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1087962
and qword [rsp + 0x30], 0
lea r8d, [rax + 3]
xor r9d, r9d
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x010c1dc8], rax
jmp 0x1087969
mov rax, qword [0x010c1dc8]
cmp rax, 0xffffffffffffffff
je 0x10879ea
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov r8d, 4
mov rcx, rax
mov byte [rsp + 0x78], 0xff
mov byte [rsp + 0x79], 0xfe
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10878d5
lea r8, [0x010824f0]
mov edx, 0x104
mov rcx, rbp
call fcn.0108f1b4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea rdx, [0x01082560]
lea r9d, [rax + 1]
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
add ecx, 1
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [0x010c2330], 0
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x1087b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x010b7ae0]
xor edx, edx
xor ebx, ebx
call fcn.0108e3d8
lea ebp, [rbx + 1]
jmp 0x1087c4d
test rbx, rbx
jne 0x1087c59
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rbx, rax
je 0x1087c3c
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1087be9
xor ebx, ebx
jmp 0x1087c37
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1087be5
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x1087c26
cmp rdi, r11
jae 0x1087be5
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1087c14
cmp rdi, r11
jae 0x1087be5
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1087c5b
lea rcx, [0x010b7ae0]
mov edx, ebp
call fcn.0108e3d8
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x1087ba6
xor esi, esi
test rsi, rsi
jne 0x1087c64
xor eax, eax
jmp 0x1087c72
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.01087c94
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x1087c94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x1087dfd
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1087dfd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x1087dfd
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1087d35
cmp rdi, r11
jae 0x1087dfd
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1087d1f
cmp rdi, r11
jae 0x1087dfd
cmp word [rdi], 0
je 0x1087dfd
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1087d69
mov edx, ebx
mov rcx, rsi
call fcn.01087440
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1087d86
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.0108f234
test eax, eax
je 0x1087dd4
cmp eax, 0xc
je 0x1087dc9
cmp eax, 0x16
je 0x1087dbe
cmp eax, 0x22
je 0x1087dbe
cmp eax, 0x50
je 0x1087dd4
mov ecx, 0x80004005
call fcn.0108759c
int3
mov ecx, 0x80070057
call fcn.0108759c
int3
mov ecx, 0x8007000e
call fcn.0108759c
int3
test ebx, ebx
js 0x1087df2
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1087df2
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
and word [rdi + rcx], 0
jmp 0x1087dff
mov ecx, 0x80070057
call fcn.0108759c
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x108a460
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, r8
mov r8d, dword [r8]
mov esi, edx
mov r9d, edx
lea ebp, [rbx + 0x1d]
lea rdx, [0x01083ef8]
mov ecx, ebp
mov qword [rax - 0x10], rbx
call fcn.010875cc
lea r8, [rsp + 0x38]
lea rdx, [0x010821e0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x108a574
cmp esi, ebx
lea rdx, [0x01083f30]
je 0x108a4ff
lea r9d, [rbx + 4]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, ebp
cmp eax, ebx
je 0x108a4f1
lea rdx, [0x01083f48]
jmp 0x108a55f
lea rdx, [0x01083f88]
call fcn.010875cc
jmp 0x108a54f
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x108a556
mov r8d, dword [rsp + 0x68]
cmp r8d, ebx
je 0x108a556
lea rdx, [0x01083fb8]
xor ecx, ecx
call fcn.010875cc
mov r11d, dword [rsp + 0x68]
mov dword [rdi], r11d
mov ebx, 1
jmp 0x108a567
lea rdx, [0x01083fd8]
mov ecx, ebp
mov r8d, eax
call fcn.010875cc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x108a585
lea rdx, [0x01084020]
mov r8d, eax
mov ecx, ebp
call fcn.010875cc
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x108a914
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov esi, edx
mov r8d, edx
mov rbx, rcx
lea rdx, [0x010841c8]
mov ecx, 0x1d
call fcn.010875cc
xor edi, edi
lea r8, [rsp + 0x38]
and qword [rsp + 0x38], rdi
and dword [rsp + 0x34], edi
lea rdx, [0x01082528]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x108a9b2
lea rax, [rsp + 0x30]
lea rdx, [0x01083cc0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x108a9a7
mov eax, 0x80070006
jmp 0x108aadf
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.0108add8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbx + 0xb0], rdi
je 0x108a9eb
lea rcx, [0x01083ce8]
xor r8d, r8d
xor edx, edx
call qword [rbx + 0x78]
mov ecx, 0xa
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x010c22e4], 0
je 0x108aa1e
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x108aabd
or r8d, 0xffffffff
test esi, esi
mov rcx, rdi
je 0x108aa15
lea edx, [r8 + 2]
jmp 0x108aa17
xor edx, edx
call rax
jmp 0x108aabd
mov rax, qword [rbx + 0x88]
and dword [rsp + 0x60], 0
or dword [rsp + 0x68], 0xffffffff
test rax, rax
je 0x108aa85
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call rax
test al, al
je 0x108aa85
mov r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
lea rdx, [0x01084130]
mov ecx, 0x1d
call fcn.010875cc
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x108aa96
lea r8, [rbx + 0xcc]
mov edx, 1
mov rcx, rbx
mov dword [r8], r11d
call fcn.0108a460
jmp 0x108aa96
lea rdx, [0x01084180]
mov ecx, 0x1d
call fcn.010875cc
test esi, esi
mov rcx, rbx
je 0x108aaae
call fcn.0108a664
mov r8d, dword [rbx + 0xcc]
mov rcx, rbx
jmp 0x108aab1
xor r8d, r8d
or r9d, 0xffffffff
mov rdx, rdi
call fcn.0108a5a4
mov rax, qword [rbx + 0xa8]
test rax, rax
je 0x108aace
mov rcx, rdi
call rax
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x108aadd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x108add8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x010c22e4], 0
mov rbx, rcx
jne 0x108adfd
cmp dword [0x010c22e8], 0
jne 0x108adfd
mov eax, 0x80070006
jmp 0x108af57
and qword [rcx + 0x78], 0
and qword [rcx + 0x80], 0
and qword [rcx + 0x88], 0
and qword [rcx + 0x90], 0
and qword [rcx + 0x98], 0
and qword [rcx + 0xa0], 0
and qword [rcx + 0xa8], 0
lea rcx, [0x01084290]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 0x58], rax
je 0x108af47
lea rdx, [0x010842c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x010842d8]
mov qword [rbx + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x010c22e8], 0
mov qword [rbx + 0x80], rax
je 0x108af2d
mov rcx, qword [rbx + 0x58]
lea rdx, [0x010842f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01084318]
mov qword [rbx + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01084338]
mov qword [rbx + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01084350]
mov qword [rbx + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x010842c0]
mov qword [rbx + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01084368]
mov qword [rbx + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01084368]
mov qword [rbx + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc0], rax
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01084388]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa8], rax
jmp 0x108af55
lea rdx, [0x010843a0]
xor ecx, ecx
call fcn.010875cc
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x108cee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor r13d, r13d
mov rdi, rcx
cmp qword [rcx + 0x98], r13
mov ebp, r13d
jne 0x108cf44
mov rax, qword [rcx + 0x60]
mov rsi, qword [rax]
mov qword [rax], rax
mov rax, qword [rcx + 0x60]
mov qword [rax + 8], rax
cmp rsi, qword [rcx + 0x60]
mov qword [rcx + 0x68], r13
je 0x108d139
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.0108b3b8
mov rcx, rsi
call fcn.0108e5a4
cmp rbx, qword [rdi + 0x60]
mov rsi, rbx
jne 0x108cf22
jmp 0x108d139
cmp qword [rcx + 0x68], r13
jne 0x108cfe8
mov rax, qword [rcx + 0x90]
mov qword [rsp + 0x78], r13
lea r8, [rsp + 0x78]
mov rcx, qword [rax]
mov rax, qword [rdi + 0x70]
mov rdx, qword [rcx + 0x10]
mov r9, qword [rax]
mov rcx, rax
call qword [r9 + 0x28]
cmp eax, r13d
mov ebp, eax
je 0x108cfcb
mov ecx, eax
call fcn.0109d8f0
lea rcx, [0x010830d0]
lea r8, [0x01084de0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rdx, [0x01081ea0]
xor ecx, ecx
mov r9d, 0x160
mov dword [rsp + 0x20], ebp
call fcn.010875cc
mov rcx, qword [rsp + 0x78]
cmp rcx, r13
je 0x108d139
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x108d139
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.0108c6e4
mov rcx, qword [rsp + 0x78]
cmp rcx, r13
je 0x108cfe8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rdi + 0x60]
mov rbx, qword [rax]
cmp rbx, rax
je 0x108d139
cmp dword [rbx + 0x3c], r13d
jne 0x108d12c
mov r8, qword [rbx + 0x70]
lea rdx, [0x010847b0]
mov ecx, 0x1d
call fcn.010875cc
cmp dword [rbx + 0x3c], r13d
jne 0x108d12c
mov rcx, qword [rbx + 0x28]
cmp rcx, r13
jne 0x108d056
lea rax, [0x010825f0]
lea r8, [0x010847e0]
lea rdx, [0x010825b0]
mov r9d, 0x70
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.010875cc
jmp 0x108d12c
cmp qword [rbx + 0x30], r13
jne 0x108d12c
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x68]
lea r8, [rbx + 0x30]
call qword [rax + 0x28]
cmp qword [rbx + 0x30], r13
je 0x108d12c
cmp qword [rbx + 0x48], r13
jne 0x108d092
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x48], rax
cmp qword [rbx + 0x50], r13
jne 0x108d0ac
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
cmp qword [rbx + 0x20], r13
jne 0x108d12c
lea rax, [rsp + 0x70]
lea r9, [rbx + 0x10]
lea r8, [0x0108b3ac]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
mov qword [rbx + 0x20], rax
jne 0x108d0f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rbx + 0x70]
lea rdx, [0x01084850]
xor ecx, ecx
call fcn.010875cc
jmp 0x108d113
mov r9d, dword [rsp + 0x70]
mov r8, qword [rbx + 0x70]
lea rdx, [0x010848a0]
mov ecx, 0x1d
call fcn.010875cc
mov eax, 1
mov dword [rbx + 0x3c], 1
xchg dword [rbx + 0x18], eax
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x60]
jne 0x108cff8
mov eax, ebp
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x108d8a4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x010c2318]
lea rdx, [0x01085468]
mov ecx, 0x1d
call fcn.010875cc
mov rcx, qword [rbx + 0x48]
xor edi, edi
cmp rcx, rdi
je 0x108d8db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x48], rdi
mov rcx, qword [rbx + 0x50]
cmp rcx, rdi
je 0x108d8ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rcx, qword [rbx + 0x88]
cmp rcx, rdi
je 0x108d907
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x88], rdi
mov rcx, qword [rbx + 0x30]
cmp rcx, rdi
je 0x108d91a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x30], rdi
mov rcx, qword [rbx + 0x38]
cmp rcx, rdi
je 0x108d92d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x38], rdi
cmp qword [rbx + 0x40], rdi
je 0x108d958
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], rdi
mov rcx, qword [rbx + 0x58]
cmp rcx, rdi
je 0x108d96b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx + 0x58], rdi
cmp byte [rbx + 0x7d], dil
je 0x108d9ee
lea rdx, [0x01085850]
mov ecx, 0x1d
call fcn.010875cc
mov rcx, qword [rbx + 0x98]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbx + 0xa0]
lea rdx, [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rbx + 0x90]
cmp rcx, rdi
je 0x108d9bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x90], rdi
mov rcx, qword [rbx + 0x98]
cmp rcx, rdi
je 0x108d9d5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x98], rdi
mov rcx, qword [rbx + 0xa0]
cmp rcx, rdi
je 0x108d9ee
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0xa0], rdi
lea rdx, [0x010854a0]
mov ecx, 0x1d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.010875cc
Function at 0x108e45c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x010b41a0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.0108fac0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x01000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.0108fac0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x108e4ef
cmp dword [rsp + 0x24], 5
jb 0x108e509
jmp 0x108e505
cmp dword [rsp + 0x30], esi
jne 0x108e509
cmp dword [rsp + 0x24], 4
ja 0x108e505
jne 0x108e509
cmp dword [rsp + 0x28], 0
jbe 0x108e509
mov byte [rbx + 0x18], sil
lea rax, [0x010015f8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.0108e288
movzx ecx, byte [0x010c235c]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x010c235c], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.0108eca0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x108fe98
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x010b41a0]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x108ff9e
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x108ff26
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x108ff9e
mov eax, edx
not eax
and ecx, eax
je 0x108ff41
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x108ff9e
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x108ff9e
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x108ff9e
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x108ff9e
mov eax, 1
jmp 0x108ffa0
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.0108eca0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret
Function at 0x1090a78
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.01095330
nop
cmp dword [0x010b7cbc], 1
je 0x1090b2b
mov dword [0x010b7cb8], 1
mov byte [0x010b7c74], dil
test ebx, ebx
jne 0x1090b17
mov rcx, qword [0x010c35b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x010c35a8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1090b04
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1090b04
mov rcx, qword [rbx]
test rcx, rcx
je 0x1090b02
call rcx
jmp 0x1090aea
lea rdx, [0x01001550]
lea rcx, [0x01001538]
call fcn.010908dc
lea rdx, [0x01001560]
lea rcx, [0x01001558]
call fcn.010908dc
nop
test edi, edi
je 0x1090b39
mov ecx, 8
call fcn.010951fc
test edi, edi
jne 0x1090b61
mov dword [0x010b7cbc], 1
lea ecx, [rdi + 8]
call fcn.010951fc
mov ecx, r12d
call fcn.01090860
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x1090a78

Function at 0x1090bb0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1090a78
Function at 0x1090c50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x010b41c0]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x1090c83
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x1090c73
cmp edi, 0x17
jae 0x1090e31
mov ebp, 3
mov ecx, ebp
call fcn.01097280
cmp eax, 1
je 0x1090de9
mov ecx, ebp
call fcn.01097280
test eax, eax
jne 0x1090cb9
cmp dword [0x010b4198], 1
je 0x1090de9
cmp ebx, 0xfc
je 0x1090e31
lea rbx, [0x010b7cc0]
mov ebp, 0x314
lea r8, [0x01001e80]
mov rcx, rbx
mov rdx, rbp
call fcn.01094fc8
test eax, eax
je 0x1090cfc
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01092e58
lea rdx, [0x010b7cd9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x010b7ddd], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1090d4d
lea r8, [0x01001e68]
lea rcx, [0x010b7cd9]
mov edx, 0x2fb
call fcn.01094fc8
test eax, eax
je 0x1090d4d
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01092e58
lea r8, [0x010b7cd9]
mov rdx, rbp
mov rcx, rbx
call fcn.010971ec
test eax, eax
je 0x1090d78
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01092e58
lea r8, [0x01001e60]
mov rdx, rbp
mov rcx, rbx
call fcn.010971ec
test eax, eax
je 0x1090da3
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01092e58
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.010971ec
test eax, eax
je 0x1090dd2
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.01092e58
lea rdx, [0x01001e38]
mov r8d, 0x12010
mov rcx, rbx
call fcn.01096fb8
jmp 0x1090e31
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x1090e31
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x1090e31
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret

Function at 0x10914d4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
jne 0x10914fc
xor eax, eax
jmp 0x1091548
cmp word [rdi], bx
je 0x1091513
add rax, 2
cmp word [rax], bx
jne 0x1091501
add rax, 2
cmp word [rax], bx
jne 0x1091501
sub eax, edi
add eax, 2
movsxd rbp, eax
mov rcx, rbp
call fcn.0108ecc8
cmp rax, rbx
mov rsi, rax
je 0x109153c
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.01094030
mov rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret