joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039440
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140039475
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140039450
and r10, 0xf
je 0x1400394a5
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140039480
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140039499
mov rax, r8
repz ret

Function at 0x1400394b0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400394ed
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1400394c0
pxor xmm1, xmm1
and r10, 0xf
je 0x140039523
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x1400394fb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140039517
mov rax, r8
repz ret
Function at 0x140075550
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xc8
xor edi, edi
lea rcx, [0x140244f50]
xorps xmm0, xmm0
mov dword [rbp + 3], edi
mov dword [rbp + 0x1b], edi
movups xmmword [rbp - 0x29], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140075631
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.KnownDlls_ntdll.dll
lea rcx, [rbp - 0x29]
call rax
lea rax, [rbp - 0x29]
mov dword [rbp - 1], gethostbyname
xorps xmm0, xmm0
mov qword [rbp + 0xf], rax
lea r8, [rbp - 1]
mov qword [rbp + 7], rdi
lea edx, [rdi + 0xc]
mov dword [rbp + 0x17], 0x40
lea rcx, [rbp + 0x6f]
mov qword [rbp + 0x6f], rdi
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.140076fc0
mov rcx, qword [rbp + 0x6f]
test eax, eax
js 0x14007562b
mov dword [rsp + 0x48], 2
lea rax, [rbp - 0x31]
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x77]
mov dword [rsp + 0x38], 1
lea rdx, [rdi - 1]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov qword [rbp + 0x77], rdi
mov qword [rbp - 0x31], rdi
call fcn.140077000
test eax, eax
jns 0x14007563f
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0xc8
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
lea r8, [rbp - 0x19]
xorps xmm0, xmm0
mov qword [rbp - 9], rax
mov rdx, rbx
movups xmmword [rbp - 0x19], xmm0
lea r9d, [rax + 0x18]
lea rcx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140075631
mov r10, qword [rbp - 0x19]
mov r8, rdi
movsxd rcx, dword [r10 + 0x3c]
movzx r9d, word [rcx + r10 + 6]
test r9, r9
je 0x140075736
movzx eax, word [rcx + r10 + 0x14]
lea rdx, [r10 + 0x18]
add rdx, rcx
lea r11, [0x140244fa4]
add rdx, rax
nop word [rax + rax]
mov rax, rdi
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r11 + rax - 1]
jne 0x140075766
cmp rax, 6
jne 0x1400756a3
mov ecx, dword [rdx + 0xc]
lea rax, [rbp + 0x67]
mov edi, dword [rdx + 8]
lea r8, [rbp + 0x7f]
mov rsi, qword [rbp + 0x77]
lea rdx, [rbp - 0x39]
add rsi, rcx
mov qword [rbp + 0x7f], rdi
lea rbx, [rcx + r10]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov qword [rbp - 0x39], rbx
mov r9d, 0x40
call fcn.140076dc0
test eax, eax
js 0x140075631
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140199f60
mov r9d, dword [rbp + 0x67]
lea rax, [rbp + 0x67]
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x39]
mov rcx, 0xffffffffffffffff
call fcn.140076dc0
test eax, eax
js 0x140075631
mov rdx, qword [rbp + 0x77]
mov rcx, 0xffffffffffffffff
call fcn.140077040
test eax, eax
js 0x140075631
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xc8
pop rdi
pop rsi
pop rbx
pop rbp
ret
inc r8
add rdx, 0x28
cmp r8, r9
jb 0x1400756a0
jmp 0x140075736
Function at 0x140076760
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x1402725e0], 0
jne 0x14007695e
mov rax, qword gs:[0x60]
xor r12d, r12d
mov edx, r12d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14007696a
nop word [rax + rax]
mov r11, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400767dd
lea rdx, [r11 + rcx]
mov ecx, dword [r11 + rcx + 0xc]
mov eax, dword [rcx + r11]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400767dd
mov eax, dword [rcx + r11 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400767e9
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x1400767a0
test rdx, rdx
je 0x14007696a
mov qword [rsp + 0x30], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x38], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x40], rsi
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x18], rdi
add rsi, r11
mov qword [rsp + 0x10], r13
mov r13d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
mov edx, r12d
add r14, r11
mov qword [rsp], r15
add rbp, r11
lea r15, [0x1402725e0]
nop word [rax + rax]
dec ebx
mov r10d, dword [rsi + rbx*4]
add r10, r11
cmp word [r10], r13w
jne 0x1400768a3
mov r9d, r12d
mov r8d, 0x769430a3
mov rax, r10
nop dword [rax + rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor r8d, ecx
cmp byte [rax], r12b
jne 0x140076860
mov ecx, edx
inc edx
add rcx, rcx
mov dword [r15 + rcx*8 + 8], r8d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [r15 + rcx*8 + 0xc], eax
mov qword [r15 + rcx*8 + 0x10], r12
cmp edx, 0x1f4
je 0x1400768a7
test ebx, ebx
jne 0x140076840
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r13, qword [rsp + 0x10]
mov r11d, r12d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov dword [0x1402725e0], edx
test eax, eax
je 0x140076950
nop
mov ecx, edx
mov eax, r12d
sub ecx, r11d
cmp ecx, 1
je 0x140076945
nop dword [rax]
lea r10d, [rax + 1]
mov r9d, eax
add r9, r9
mov r8d, r10d
add r8, r8
mov edi, dword [r15 + r9*8 + 0xc]
mov ebx, dword [r15 + r8*8 + 0xc]
cmp edi, ebx
jbe 0x140076936
mov edx, dword [r15 + r9*8 + 8]
mov eax, dword [r15 + r8*8 + 8]
mov rcx, qword [r15 + r9*8 + 0x10]
mov dword [r15 + r9*8 + 8], eax
mov rax, qword [r15 + r8*8 + 0x10]
mov qword [r15 + r9*8 + 0x10], rax
mov dword [r15 + r9*8 + 0xc], ebx
mov dword [r15 + r8*8 + 8], edx
mov dword [r15 + r8*8 + 0xc], edi
mov qword [r15 + r8*8 + 0x10], rcx
mov edx, dword [0x1402725e0]
mov ecx, edx
mov eax, r10d
sub ecx, r11d
dec ecx
cmp r10d, ecx
jb 0x1400768e0
inc r11d
lea eax, [rdx - 1]
cmp r11d, eax
jb 0x1400768d0
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x20
pop r12
ret
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x140076dc0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc0603a1d
call fcn.140076980
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140076fc0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x64ce6a2f
call fcn.140076980
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140077000
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x508a5019
call fcn.140076980
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140077040
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xdf54dbce
call fcn.140076980
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400782d0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401bc730
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400808b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401bc730
sub rsp, rax
lea rcx, [0x140270a48]
add rsp, 0x28
jmp fcn.140078130
Function at 0x14008a450
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, gethostbyname
call fcn.1401bc730
sub rsp, rax
xor esi, esi
lea edx, [rax - 0x2f]
mov ebx, esi
mov rdi, rcx
call fcn.14007bb10
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.14007b980
mov r14, rax
test rax, rax
je 0x14008a4fa
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14008a4d3
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.14007ba10
mov rcx, rdi
call fcn.14007bc10
mov rbx, rax
test rax, rax
jne 0x14008a596
mov edx, 1
mov rcx, rdi
call fcn.14007bb10
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.14007b980
mov r14, rax
test rax, rax
je 0x14008a584
mov r9d, reloc.OLEAUT32.dll_SafeArrayAccessData
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14008a566
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.14007ba10
mov rcx, rdi
call fcn.14007bc10
mov rbx, rax
test rbx, rbx
je 0x14008a58e
mov rax, rbx
jmp 0x14008a596
mov rcx, rdi
call fcn.14007bc10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1400c7070
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1401bc730
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1400c7099
lea rax, [0x1400c56e0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1400bdbe0
lea rax, [0x1400c48a0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1400bd930
Function at 0x1400ced09
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400ceefa
push rbx
mov eax, 0xd0
call fcn.1401bc730
sub rsp, rax
mov rax, qword [0x14025e008]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1400b3370
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1400b2d10
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1400afa50
mov rcx, r15
call fcn.1400b3370
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1400b2d10
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400afa50
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1400ced70
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401bc1d0
add rsp, 0xd0
pop rbx
ret

Function at 0x1401a3820
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401a364c

Function at 0x1401b34d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401b34ad
call fcn.1401a5630
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.1401a34a4
or eax, 0xffffffff
jmp 0x1401b34ca
sub dword [rcx + 0x10], 1
jns 0x1401b34bc
add rsp, 0x28
jmp fcn.1401b1f64
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401b348c
Function at 0x14045472a
Capabilities:
Encode data using xor

Disassembly:
call fcn.140482492
add r10, 2
inc qword [rsp]
xor bp, r11w
inc dword [rsp + 3]
call fcn.140475b22
mov qword [rsp], rsi
push r10
mov r10d, 0x3b0c37af
sub r10w, r10w
lea rsi, [0x140470218]
movzx r10d, byte [rcx]
xor r10d, r8d
and r10d, 0xff
push 0xfffffffffc1d7b8a
mov r10d, dword [rsi + r10*4]
shr r8d, 8
xor r8d, r10d
not byte [rsp + 4]
inc rcx
xor r8d, 0xac91ac86
not byte [rsp + 7]
inc dword [rsp + 4]
dec rbx
not qword [rsp]
lea rsp, [rsp + 8]
jne 0x140454741
mov esi, 0x882ac92f
jmp 0x1404456a1
Function at 0x1086a8c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
mov qword [0x010c1cf8], rcx
mov ecx, 0x220
call fcn.0108e628
xor ebp, ebp
cmp rax, rbp
je 0x1086ad5
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov dword [rax + 0x218], 5
mov qword [0x010c2280], rax
jmp 0x1086adc
mov qword [0x010c2280], rbp
mov edi, 0xd8
mov rcx, rdi
call fcn.0108e628
cmp rax, rbp
je 0x1086aff
mov rcx, rax
call fcn.0108a1c4
mov qword [0x010c2288], rax
jmp 0x1086b06
mov qword [0x010c2288], rbp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov eax, 0x80000000
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], eax
lea r8, [0x010c1d00]
lea rdx, [0x010c1c30]
mov r9d, 0xcf0000
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
cmp rax, rbp
mov rsi, rax
jne 0x1086b5a
xor eax, eax
jmp 0x1086c84
cmp dword [0x010c2270], ebp
je 0x1086c09
mov rcx, rdi
call fcn.0108e628
cmp rax, rbp
mov rdi, rax
je 0x1086be1
lea rax, [0x01084f98]
lea rcx, [rdi + 0x58]
mov qword [rdi], rax
lea rax, [0x01084fd0]
mov qword [rdi + 8], rax
call fcn.0108d3c0
mov qword [rdi + 0x68], rbp
mov qword [rdi + 0x60], rax
lea rcx, [rdi + 0x88]
mov qword [rdi + 0x70], rbp
mov qword [rdi + 0x78], rbp
call fcn.01087fb8
mov qword [rdi + 0x98], rbp
mov qword [rdi + 0x90], rax
lea rcx, [rdi + 0xa0]
mov qword [rdi + 0xc8], rsi
mov dword [rdi + 0xd0], ebp
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [0x010c2298], rdi
jmp 0x1086beb
mov rdi, rbp
mov qword [0x010c2298], rbp
cmp rdi, rbp
jne 0x1086c00
lea rdx, [0x01081f90]
xor ecx, ecx
call fcn.010875cc
jmp 0x1086c09
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rbx, qword [0x010c2280]
mov rcx, rsi
mov qword [rbx], rsi
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, ebp
je 0x1086c74
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
mov eax, 2
mov ecx, edi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.0108e6c8
cmp rax, rbp
mov qword [rbx + 8], rax
je 0x1086c61
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
lea rdx, [rbx + 0x10]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetClassNameW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1086e70
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub rsp, 0x198
mov rax, qword [0x010b41a0]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp dword [0x010c22ac], 0
jne 0x108700d
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x114
mov dword [0x010c22ac], 1
call fcn.0108fac0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1086edc
lea rdx, [0x01082038]
xor ecx, ecx
call fcn.010875cc
jmp 0x108700d
cmp dword [rsp + 0x44], 5
jne 0x1086f15
cmp dword [rsp + 0x48], 0
mov ecx, 0xe
jne 0x1086f02
mov dword [0x010c22ac], 2
lea rdx, [0x01082070]
jmp 0x1086f32
mov dword [0x010c22ac], 3
lea rdx, [0x010820b8]
jmp 0x1086f32
cmp dword [rsp + 0x44], 6
jb 0x1086f37
mov dword [0x010c22ac], 4
lea rdx, [0x01082100]
mov ecx, 0xe
call fcn.010875cc
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [0x01082160]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x108700d
xor eax, eax
lea r9, [rsp + 0x3c]
lea rdx, [0x010821c0]
mov qword [rsp + 0x161], rax
mov qword [rsp + 0x169], rax
mov qword [rsp + 0x171], rax
mov dword [rsp + 0x179], eax
mov word [rsp + 0x17d], ax
mov byte [rsp + 0x17f], al
lea rax, [rsp + 0x38]
xor r8d, r8d
mov byte [rsp + 0x160], 0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1087002
lea rcx, [rsp + 0x160]
call fcn.0108ee60
lea rcx, [rsp + 0x164]
mov dword [0x010c22b0], eax
call fcn.0108ee60
mov dword [0x010c22b4], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x010c22ac]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.0108eca0
add rsp, 0x198
ret

Function at 0x1087208
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
cmp ecx, 2
mov dword [0x010c1c0c], ecx
setne al
cmp ecx, 4
mov dword [0x010c1c14], edx
mov dword [0x010c1c10], eax
mov dword [0x010c1c20], r8d
je 0x1087250
cmp ecx, 1
je 0x1087250
mov eax, dword [0x010b7a48]
mov dword [0x010c1c1c], eax
add eax, 1
mov dword [0x010b7a48], eax
jmp 0x1087257
and dword [0x010c1c1c], 0
mov rcx, qword [0x010c1c00]
lea rdx, [0x010c1c08]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
mov ebx, eax
jne 0x108727e
lea rcx, [0x01082468]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x10875cc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xff0
mov rax, qword [0x010b41a0]
xor rax, rsp
mov qword [rsp + 0xfe0], rax
mov qword [rsp + 0x38], rsp
mov ebx, ecx
lea rcx, [0x010c1fe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp ebx, dword [0x010c2008]
jb 0x108761b
xor al, al
jmp 0x1087635
mov rcx, qword [0x010c1fd8]
test rcx, rcx
jne 0x108762b
mov al, 1
jmp 0x1087635
mov rax, rbx
cmp byte [rbx + rcx], 0
setne al
movzx eax, al
test eax, eax
jne 0x108764d
lea rdx, [0x0108772a]
mov rcx, qword [rsp + 0x38]
call fcn.01099490
lea r13, [rsp + 0x1030]
lea r8, [0x010c2010]
mov esi, 0x7d0
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.0108f1b4
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r12, eax
mov rdx, qword [0x010c2328]
test rdx, rdx
je 0x10876d0
mov rcx, rbx
imul rcx, rcx, 0x84
lea rdi, [rcx + rdx + 4]
call qword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, eax
sub ebx, dword [0x010c1c24]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov ecx, esi
sub ecx, r12d
movsxd rdx, ecx
lea rcx, [rsp + r12*2 + 0x40]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
lea r8, [0x010824f8]
call fcn.0108f3d8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, eax
movsxd rdx, esi
cdqe
lea rcx, [rsp + rax*2 + 0x40]
mov r9, r13
mov r8, qword [rsp + 0x1028]
call fcn.0108f370
cmp byte [0x010c2330], 0
je 0x108770c
lea rcx, [rsp + 0x40]
call fcn.01087770
jmp 0x1087717
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
and qword [rsp + 0x30], 0
lea rcx, [0x010c1fe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xfe0]
xor rcx, rsp
call fcn.0108eca0
add rsp, 0xff0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x1087770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x010b41a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov rcx, qword [0x010c1dc8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rcx, 0xffffffffffffffff
xor eax, eax
and qword [rsp + 0x20], rax
mov rdi, rbx
lea r9, [rsp + 0x30]
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, qword [0x010c1dc8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x010c1dc8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov word [rsp + 0x38], 0xd
mov word [rsp + 0x3a], 0xa
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.0108eca0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret