joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100005fdc
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [0x10001065c], 0
mov rdi, rdx
je 0x100006023
cmp ecx, 3
jne 0x10000601a
mov rcx, qword [rdx + 0x28]
call fcn.100005eb0
or rax, 0xffffffffffffffff
jmp 0x1000061f3
test ecx, ecx
je 0x1000061e9
sub ecx, 1
je 0x1000061a5
sub ecx, 1
je 0x100006134
sub ecx, 1
je 0x10000604c
cmp ecx, 1
je 0x10000601a
jmp 0x1000061a5
mov rsi, qword [rdx + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [0x100010670]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rbx + rax + 1]
cmp ecx, 0x104
jge 0x10000601a
lea rdx, [0x100010670]
lea rcx, [rsp + 0x30]
mov r8, rsi
call fcn.100005884
test eax, eax
je 0x10000601a
mov rbx, qword [rdi + 0x28]
lea rsi, [0x100010f00]
shl rbx, 5
cmp dword [rbx + rsi + 4], 1
je 0x10000601a
movzx edx, word [rdi + 0x32]
movzx ecx, word [rdi + 0x30]
lea r8, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x10000601a
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x10000601a
mov rcx, qword [rbx + rsi + 0x18]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x10000601a
mov rcx, qword [rdi + 0x28]
call fcn.100005eb0
cmp word [rdi + 0x34], 0
jne 0x100006112
mov edx, 0x80
jmp 0x100006118
mov dl, byte [rdi + 0x34]
and edx, 0x27
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb rax, rax
and eax, 2
add rax, 0xffffffffffffffff
jmp 0x1000061f3
mov rcx, qword [0x100010448]
test rcx, rcx
je 0x10000614f
mov r8, qword [rdx + 8]
mov edx, 0x837
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rdi, qword [rdi + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [0x100010670]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rbx + rax + 1]
cmp ecx, 0x104
jge 0x10000601a
lea rdx, [0x100010670]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.100005884
test eax, eax
je 0x10000601a
lea rcx, [rsp + 0x30]
call fcn.100005940
test eax, eax
jne 0x1000061a9
xor eax, eax
jmp 0x1000061f3
lea rcx, [rsp + 0x30]
mov edx, 0x8302
mov r8d, 0x180
call fcn.100005b04
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x10000601a
lea rcx, [rsp + 0x30]
call fcn.1000059ec
test eax, eax
je 0x10000601a
add dword [0x100010880], 1
mov rax, rbx
jmp 0x1000061f3
mov rcx, rdx
call fcn.100006220
cdqe
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1000063e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rcx, [0x1000017f8]
xor r8d, r8d
xor edx, edx
call fcn.1000057d4
lea rdx, [0x1000017f8]
mov r8d, 0xa
xor ecx, ecx
mov dword [0x1000105c8], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov qword [0x1000105c0], rax
je 0x100006568
mov rcx, qword [0x100010448]
test rcx, rcx
je 0x100006483
mov edx, 0x842
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x100010448]
mov edx, 0x841
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x1000105c0]
mov rcx, rax
call fcn.10000632c
test eax, eax
jne 0x100006496
mov edx, 0x4ba
jmp 0x1000064d7
lea rcx, [0x1000105cc]
call fcn.1000083dc
test rax, rax
mov rdi, rax
je 0x1000064cb
lea rcx, [0x1000105c0]
mov rdx, rax
call fcn.100008600
test eax, eax
mov ebx, eax
je 0x1000064f8
mov rcx, rdi
call fcn.1000084c4
test eax, eax
jne 0x1000064f8
mov edx, dword [0x1000105cc]
add edx, 0x514
mov rcx, qword [0x100010448]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
call fcn.100005554
xor ebx, ebx
mov rcx, qword [0x1000105c0]
test rcx, rcx
je 0x100006512
call qword [sym.imp.KERNEL32.dll_FreeResource]
and qword [0x1000105c0], 0
test ebx, ebx
jne 0x10000653c
cmp dword [0x10001065c], ebx
jne 0x10000653c
and dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f8
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005554
test byte [0x100011418], 1
jne 0x100006566
test byte [0x100010ec4], 1
jne 0x100006566
mov rcx, qword [0x100010448]
movsxd r8, ebx
xor r9d, r9d
mov edx, 0xfa1
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x100006764
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x140
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
xor esi, esi
xor ebx, ebx
mov rdi, rdx
mov r12, rcx
sub rbp, rdx
lea r8, [0x100001828]
lea rcx, [rsp + 0x20]
mov r9d, esi
mov edx, 0x104
call fcn.100001aac
add esi, 1
mov edx, 0x104
mov rcx, rdi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1000067de
mov al, byte [rcx + rbp]
test al, al
je 0x1000067de
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x1000067bf
test rdx, rdx
jne 0x1000067e7
sub rcx, 1
mov byte [rcx], bl
lea r8, [rsp + 0x20]
mov edx, 0x104
mov rcx, rdi
call fcn.100007fa4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100006877
cmp esi, 0x190
jl 0x10000679b
lea rdx, [0x100001834]
mov r9, rdi
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x10000684d
mov rcx, rdi
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10000681a
mov dword [0x100011400], 1
mov ebx, 1
jmp 0x10000684d
Function at 0x1000068a0
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x160], rax
test edx, edx
mov esi, r8d
mov r9, rcx
mov ebx, 0x104
je 0x10000699d
lea rdx, [rsp + 0x50]
mov r8d, ebx
call fcn.100006764
test eax, eax
je 0x100006a27
lea rdi, [0x100010670]
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
sub r8, rdi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x100006921
mov al, byte [r8 + rcx]
test al, al
je 0x100006921
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x100006901
test rdx, rdx
jne 0x10000692a
sub rcx, 1
mov byte [rcx], 0
test byte [0x100010ec4], 0x20
je 0x10000698a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r11d, word [rsp + 0x20]
test r11d, r11d
je 0x100006979
sub r11d, 1
je 0x100006970
sub r11d, 1
je 0x100006967
cmp r11d, 1
jne 0x10000698a
lea r8, [0x100001850]
jmp 0x100006980
lea r8, [0x100001848]
jmp 0x100006980
lea r8, [0x100001840]
jmp 0x100006980
lea r8, [0x100001838]
mov edx, ebx
mov rcx, rdi
call fcn.100007fa4
lea r8, [0x1000015b9]
mov edx, ebx
mov rcx, rdi
call fcn.100007fa4
jmp 0x1000069d6
lea rdi, [0x100010670]
mov rcx, rdi
sub r9, rdi
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x1000069ca
mov al, byte [r9 + rcx]
test al, al
je 0x1000069ca
mov byte [rcx], al
add rcx, 1
sub rbx, 1
jne 0x1000069aa
test rbx, rbx
jne 0x1000069d3
sub rcx, 1
mov byte [rcx], 0
mov rcx, rdi
call fcn.100006f64
test eax, eax
jne 0x1000069fb
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100006a2b
mov dword [0x100011400], 1
test esi, esi
je 0x100006a38
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call fcn.1000070b0
test eax, eax
jne 0x100006a38
cmp dword [0x100011400], eax
je 0x100006a27
and dword [0x100011400], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x100006a44
call fcn.100007b04
mov dword [0x100010488], eax
jmp 0x100006a27
and dword [0x100010488], 0
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100006f64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x40
lea ebp, [rax + 0x14]
mov edx, ebp
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rdi, rax
jne 0x100006fdb
and dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b5
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005554
call fcn.100007b04
mov dword [0x100010488], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test ebp, ebp
je 0x100007023
cmp rbx, 0x7fffffff
ja 0x100007023
mov r8d, 0x7ffffffe
mov r9, rsi
mov rcx, rax
sub r8, rbx
sub r9, rax
lea rax, [r8 + rbx]
test rax, rax
je 0x100007017
mov al, byte [r9 + rcx]
test al, al
je 0x100007017
mov byte [rcx], al
add rcx, 1
sub rbx, 1
jne 0x100006ffa
test rbx, rbx
jne 0x100007020
sub rcx, 1
mov byte [rcx], 0
lea r8, [0x100001868]
mov edx, ebp
mov rcx, rdi
call fcn.100007fa4
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbx, 0xffffffffffffffff
je 0x100006fb9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100006fb9
test al, 0x10
je 0x100006fb9
and dword [0x100010488], 0
mov eax, 1
jmp 0x100006fc6
Function at 0x100007b2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r13d, r13d
mov r14, rcx
mov ebp, 1
xor r9d, r9d
jmp 0x100007bb3
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r12, rax
je 0x100007bed
mov esi, dword [rax]
mov edi, dword [rax + 4]
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8, [r12 + 8]
mov edx, edi
movsxd r9, eax
mov ecx, esi
lea r9, [r9 + r12 + 9]
call r14
mov rcx, r12
test eax, eax
je 0x100007be3
call qword [sym.imp.KERNEL32.dll_FreeResource]
add r13d, ebp
mov r9d, r13d
lea r8, [0x1000019a0]
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.100001aac
lea rdx, [rsp + 0x20]
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x100007b61
jmp 0x100007bf9
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x100007bf9
mov dword [0x100010488], 0x80070714
xor ebp, ebp
mov eax, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x100007d9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x148
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea r9, [0x100010670]
lea rax, [rsp + 0x20]
mov edx, 0x104
sub r9, rax
mov r8, rdx
lea rcx, [rsp + 0x20]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x100007df1
mov al, byte [r9 + rcx]
test al, al
je 0x100007df1
mov byte [rcx], al
add rcx, 1
sub r8, 1
jne 0x100007dd1
test r8, r8
jne 0x100007dfa
sub rcx, 1
mov byte [rcx], 0
lea r8, [0x100001660]
lea rcx, [rsp + 0x20]
call fcn.100007fa4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100007e35
test al, 0x10
jne 0x100007e35
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x100007e42
lea rcx, [0x100001660]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10000c850
add rsp, 0x148
ret
Function at 0x100007e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [0x100010ee0]
mov rbp, r8
mov r8d, 5
mov rcx, rbx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x100007ee3
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rdi, rax
je 0x100007ee3
mov rax, qword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
test rax, rax
mov rdx, rdi
mov rcx, rbx
jne 0x100007ec6
and qword [rsp + 0x20], rax
jmp 0x100007ecb
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp rbx, 0xffffffffffffffff
jne 0x100007f07
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4fb
xor ecx, ecx
mov dword [rsp + 0x20], 0x10
call fcn.100005554
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x100008234
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov esi, dword [0x10000f414]
mov dword [rsp + 0x30], 0xc
cmp esi, 0xfffffffe
jne 0x1000083ac
lea rcx, [rsp + 0x50]
xor edi, edi
mov dword [rsp + 0x50], 0x94
mov dword [0x10000f414], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, edi
je 0x1000083a6
lea esi, [rdi + 1]
cmp dword [rsp + 0x60], esi
jne 0x1000083a6
cmp dword [rsp + 0x54], 4
jne 0x1000083a6
cmp dword [rsp + 0x58], 0xa
jae 0x1000083a6
lea ecx, [rdi + 0x4a]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, edi
je 0x1000083a6
lea rax, [rsp + 0x38]
lea rdx, [0x1000019b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x1000083a6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
lea rdx, [0x1000015b9]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x10000833f
mov eax, dword [0x10000f414]
jmp 0x1000083ae
lea rcx, [rsp + 0xf0]
mov al, byte [rcx]
cmp al, 0x30
jl 0x10000835e
cmp al, 0x39
jg 0x10000835e
add edi, 0xfffffffd
movsx eax, al
shl edi, 4
add edi, eax
jmp 0x100008377
cmp al, 0x61
jl 0x100008364
add al, 0xe0
movsx edx, al
sub edx, 0x37
lea eax, [rdx - 0xa]
cmp eax, 5
ja 0x100008382
shl edi, 4
add edi, edx
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
jmp 0x100008347
lea rax, [rsp + 0xf0]
cmp rcx, rax
je 0x1000083a6
and edi, 0x3ff
cmp edi, esi
je 0x10000839e
cmp edi, 0xd
jne 0x1000083a6
mov dword [0x10000f414], esi
jmp 0x1000083ac
mov esi, dword [0x10000f414]
mov eax, esi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10000c4ec
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x100010478], rdi
je 0x10000c545
cmp rax, rdi
jne 0x10000c538
mov esi, 1
jmp 0x10000c545
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000c51f
mov eax, dword [0x100010470]
cmp eax, 1
jne 0x10000c55a
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10000c5bf
mov eax, dword [0x100010470]
test eax, eax
jne 0x10000c5b5
mov dword [0x100010470], 1
lea r12, [0x100001528]
lea rdi, [0x100001510]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10000c5a7
test eax, eax
jne 0x10000c5a7
mov rcx, qword [rdi]
test rcx, rcx
je 0x10000c59c
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10000c585
test eax, eax
je 0x10000c5bf
mov eax, 0xff
jmp 0x10000c70c
mov dword [0x10000f74c], 1
mov eax, dword [0x100010470]
cmp eax, 1
jne 0x10000c5e7
lea rdx, [0x100001508]
lea rcx, [0x1000014f8]
call sub.msvcrt.dll__initterm
mov dword [0x100010470], 2
test esi, esi
jne 0x10000c5f4
xor eax, eax
xchg qword [0x100010478], rax
cmp qword [0x100010480], 0
je 0x10000c61d
lea rcx, [0x100010480]
call fcn.10000ca10
test eax, eax
je 0x10000c61d
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100010480]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x10000c6a9
cmp byte [rdi], 0
je 0x10000c63e
test esi, esi
jne 0x10000c6a9
cmp byte [rdi], 0
je 0x10000c653
cmp byte [rdi], 0x20
ja 0x10000c653
add rdi, 1
mov qword [rsp + 0x28], rdi
jmp 0x10000c63e
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100003488
mov dword [0x10000f748], eax
cmp dword [0x10000f72c], 0
jne 0x10000c692
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10000f74c], 0
jne 0x10000c6a7
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10000f748]
jmp 0x10000c70c
cmp byte [rdi], 0x22
jne 0x10000c6bb
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10000c6d1
add rdi, 1
mov qword [rsp + 0x28], rdi
add rdi, 1
mov qword [rsp + 0x28], rdi
jmp 0x10000c630
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.10000cb54
add rsp, 0x28
jmp 0x10000c4ec
Function at 0x10000cab0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000cafa
cmp rcx, 0xffffffffffffffff
je 0x10000cafa
cmp word [rcx], 0x5a4d
jne 0x10000caf2
cmp dword [rcx + 0x3c], edx
jl 0x10000caf2
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000caf2
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000cafa
mov rax, rdx
add rsp, 0x18
ret

Function at 0x10000ccb7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10000f100]
jne 0x10000c86a
rol rcx, 0x10
test cx, 0xffff
jne 0x10000c866
repz ret
ror rcx, 0x10
jmp 0x10000cc10
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10000f800]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x10000f8f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10000cc95
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10000f800]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10000ccb7
mov rax, qword [rsp + 0x88]
mov qword [0x10000f8f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10000f898], rax
mov rax, qword [0x10000f8f8]
mov qword [0x10000f770], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10000f880], rax
mov dword [0x10000f760], 0xc0000409
mov dword [0x10000f764], 1
mov rax, qword [0x10000f100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10000f108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001550]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400017c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400da080]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [0x1400c3448]
movzx eax, word [0x1400c3458]
xor ebx, ebx
cmp byte [0x1400c3459], bl
mov rdi, rcx
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x60], ax
je 0x1400019cf
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, ebx
jl 0x14000198c
movdqa xmm0, xmmword [0x1400ca800]
lea rdx, [r11 - 0x54]
movdqa xmm5, xmmword [0x1400ca690]
mov eax, 4
movdqa xmm4, xmmword [0x1400cab70]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1400ca6b0]
movd xmm6, eax
mov eax, Ordinal_35
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1400ca720]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400ca720]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
pxor xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140001870
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x12
jge 0x1400019cf
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x34
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0x12
jl 0x1400019a0
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rcx, [rsp + 0x50]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov qword [rdi], rax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400b0640
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret