joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f8cb0
Capabilities:
Read http header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov rbp, rcx
mov ebx, 0x80070057
test r8, r8
je 0x1000f8dab
test r9, r9
je 0x1000f8dab
cmp dword [r9], 2
jb 0x1000f8dab
call fcn.1000f71a4
mov rcx, qword [rbp + 0x10]
and qword [rsp + 0x28], 0
mov r9, rsi
mov r8, r12
mov edx, 0xffff
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1000f8d69
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f8da1
test byte [rcx + 0x1c], 1
je 0x1000f8da1
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x44
mov r9, r12
mov dword [rsp + 0x20], ebx
call fcn.10009b2f4
jmp 0x1000f8da1
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f8d9f
test byte [rcx + 0x1c], 4
je 0x1000f8d9f
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x45
mov r9, r12
mov qword [rsp + 0x20], rsi
call fcn.10003b380
xor ebx, ebx
mov rcx, rbp
call fcn.1000f71f4
jmp 0x1000f8dd9
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f8dd9
test byte [rcx + 0x1c], 1
je 0x1000f8dd9
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001db30]
mov edx, 0x43
call fcn.100034764
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret

Function at 0x1000f9864
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1000f98bc
mov rax, qword [0x100152eb8]
lea rcx, [0x100152eb8]
cmp rax, rcx
je 0x1000f98bc
test byte [rax + 0x1c], 1
je 0x1000f98bc
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100152eb8]
lea r8, [0x10001db30]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x7f
call fcn.100036328
lea rcx, [rbx + 0x88]
call fcn.1000fa1c0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000f98da
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and qword [rbx], 0
lea rcx, [rbx + 0x88]
call fcn.1000fa22c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1000f9900
Function at 0x1000f9e30
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edi, edi
mov rbx, rcx
mov word [rsp + 0x30], di
cmp rcx, rdi
je 0x1000f9fe9
mov word [rcx], di
mov rdx, rcx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
je 0x1000f9f8b
cmp word [rbx], di
je 0x1000f9f8b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000f9e97
and eax, 0x10
jne 0x1000f9edf
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, edi
jne 0x1000f9edf
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f9ed7
test byte [rcx + 0x1c], 1
je 0x1000f9ed7
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0x13
mov r9, rbx
call fcn.100034788
mov word [rbx], di
jmp 0x1000f9fc8
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, edi
jne 0x1000f9f3c
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f9fe5
test byte [rcx + 0x1c], 1
je 0x1000f9fe5
mov edx, 0x14
jmp 0x1000f9f72
lea r8, [rsp + 0x30]
mov edx, 0x104
mov rcx, rbx
call fcn.10006a9f0
cmp eax, edi
mov ebx, eax
jge 0x1000f9f87
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f9fe5
test byte [rcx + 0x1c], 1
je 0x1000f9fe5
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov r9d, ebx
call fcn.100036328
jmp 0x1000f9fe5
mov ebx, edi
jmp 0x1000f9fe5
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f9fc8
test byte [rcx + 0x1c], 1
je 0x1000f9fc8
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x100152eb8]
lea r8, [0x10001dba8]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x12
call fcn.100036328
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, edi
cmovge ebx, eax
mov eax, ebx
jmp 0x1000fa01c
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fa017
test byte [rcx + 0x1c], 1
je 0x1000fa017
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0x11
call fcn.100034764
mov eax, 0x80070057
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10011b980
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1000fa044
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
mov ecx, edi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000fa0c3
test byte [rcx + 0x1c], 4
je 0x1000fa0c3
cmp eax, esi
jb 0x1000fa0a3
sub eax, esi
jmp 0x1000fa0a7
sub eax, esi
dec eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0x18
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10009b2f4
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1000fc018
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x80070057
test rcx, rcx
jne 0x1000fc05d
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fc14e
test byte [rcx + 0x1c], 1
je 0x1000fc14e
lea edx, [rdi + 0xc]
jmp 0x1000fc088
test rdx, rdx
jne 0x1000fc09d
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fc14e
test byte [rcx + 0x1c], 1
je 0x1000fc14e
mov edx, 0xd
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034764
jmp 0x1000fc14e
lea r8, [0x1000021e8]
mov edx, 0x104
call fcn.10006aa64
mov ebx, eax
test eax, eax
jns 0x1000fc0d8
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fc14e
test byte [rcx + 0x1c], 1
je 0x1000fc14e
mov edx, 0xe
jmp 0x1000fc10c
mov r8, rsi
mov edx, 0x104
mov rcx, rdi
call fcn.10006aa64
mov ebx, eax
test eax, eax
jns 0x1000fc121
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fc14e
test byte [rcx + 0x1c], 1
je 0x1000fc14e
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036328
jmp 0x1000fc14e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000fc14c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x1000fc14c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000fc14e
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000fc9bc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, r8
mov rdi, rcx
mov esi, edx
lea rcx, [rsp + 0x92]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x90], bp
call sub.msvcrt.dll_memset
xor eax, eax
lea r8, [0x100027480]
lea rcx, [rsp + 0x90]
mov r9, rdi
mov edx, 0x104
mov word [rsp + 0x68], bp
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0x82], eax
mov word [rsp + 0x86], ax
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], eax
call fcn.1000f1884
cmp eax, ebp
mov edi, eax
jge 0x1000fca89
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000fcbb2
test byte [rcx + 0x1c], 1
je 0x1000fcbb2
lea edx, [rbp + 0x22]
mov r9d, eax
jmp 0x1000fcba2
lea r8, [0x1000203d0]
lea rcx, [rsp + 0x68]
mov r9d, esi
mov edx, 0x10
call fcn.1000f1884
cmp eax, ebp
mov edi, eax
jge 0x1000fcad0
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000fcbb2
test byte [rcx + 0x1c], 1
je 0x1000fcbb2
mov edx, 0x23
jmp 0x1000fca81
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x1000fcb73
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x1000fcb73
mov eax, dword [rsp + 0x64]
lea rdx, [rsp + 0x68]
mov r9d, 0xb
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebp
je 0x1000fcb6f
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000fcbb2
test byte [rcx + 0x1c], 1
je 0x1000fcbb2
mov edx, 0x25
jmp 0x1000fcb91
mov edi, ebp
jmp 0x1000fcbb2
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000fcbb2
test byte [rcx + 0x1c], 1
je 0x1000fcbb2
mov edx, 0x24
movzx r9d, ax
or r9d, 0x80070000
cmp eax, ebp
cmovle r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100036328
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x1000fcbc2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.10011b980
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x100101bd8
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, rcx
add rcx, 0x40
mov ebp, r8d
mov ebx, edx
mov esi, 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x100101c2b
cmp qword [rax + 0x18], 0
je 0x100101c2b
cmp qword [rax], 0
je 0x100101c2b
mov rdx, qword [rax]
mov r8d, ebx
mov ecx, ebp
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x100101c5e
mov rcx, qword [rcx]
test rcx, rcx
je 0x100101c5e
test ebp, ebp
js 0x100101c5e
cmp ebx, 0xc8
je 0x100101c58
cmp ebx, 0x193
je 0x100101c58
cmp ebx, 0xc9
jne 0x100101c5e
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret
Function at 0x100107ea8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov rbx, rcx
mov qword [rcx], rdi
mov dword [rcx + 8], edi
mov word [rcx + 0xc], di
cmp dword [0x100157b8c], edi
jne 0x100107f3f
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [0x100157b8c], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, edi
je 0x100107f3f
cmp dword [rsp + 0x24], 5
jb 0x100107f1f
cmp dword [rsp + 0x28], 1
jae 0x100107f26
cmp dword [rsp + 0x24], 6
jb 0x100107f3f
mov ecx, dword [0x100152ecc]
cmp dword [rsp + 0x30], 2
mov eax, 0x7f
cmove ecx, eax
mov dword [0x100152ecc], ecx
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10011b980
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x10010b4ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x70
cmp dword [0x100157bb8], 0
mov rbx, rdx
mov rdi, rcx
lea r12, [0x100155290]
jne 0x10010b5a3
test r12, r12
je 0x10010b511
and dword [0x100155298], 0
and dword [0x1001552a0], 0
mov dword [0x100155290], 0x1423
mov dword [0x100155294], 0x100
mov dword [0x10015529c], 7
mov dword [0x1001552a4], 1
lea rax, [rsp + 0x60]
lea rdx, [0x10002efe0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0x50
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10010b599
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [0x100155240]
lea rdx, [0x10002efd8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x100157bb8], 1
test rdi, rdi
je 0x10010b5c5
test rbx, rbx
je 0x10010b5c5
mov r8d, dword [rbx]
test r8d, r8d
je 0x10010b5c5
test r12, r12
je 0x10010b5c5
mov rdx, qword [rdi]
mov rcx, r12
call fcn.10010c73c
lea r11, [rsp + 0x70]
mov eax, 1
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x10010fc44
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x20
mov rax, qword [rsp + 0x60]
xor ebp, ebp
mov rbx, rcx
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rcx + 8], r9
mov qword [rcx + 0x30], rax
mov eax, dword [rsp + 0x50]
mov word [rcx + 0x18], bp
mov qword [rcx + 0x20], rdx
mov dword [rcx + 0x3c], r8d
mov dword [rcx + 0x40], ebp
mov dword [rcx + 0x1c], eax
mov r12d, 0x8000
cmp byte [rsp + 0x68], bpl
jne 0x10010fca6
lea rcx, [rdx + 0x8000]
mov r8, r12
call sub.msvcrt.dll_memcpy
mov rcx, rbx
mov word [rbx + 0x44], bp
mov dword [rbx + 0x48], ebp
call fcn.1001100cc
mov rdx, qword [rbx + 0x20]
mov r13d, 2
mov word [rbx + 0x54], r12w
mov dword [rbx + 0x4c], r12d
mov dword [rbx + 0x38], ebp
add rdx, r12
mov r8, r13
movzx eax, byte [rdx]
mov ecx, dword [rbx + 0x38]
inc rdx
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
sub r8, 1
mov dword [rbx + 0x38], ecx
jne 0x10010fcd1
cmp byte [rsp + 0x68], bpl
je 0x10010fd4f
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x28]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
sub r9, 1
jne 0x10010fcfb
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x30]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
sub r9, 1
jne 0x10010fd27
jmp 0x10010fd66
mov rcx, rbp
mov rdx, r12
mov rax, qword [rbx + 0x28]
mov word [rcx + rax], bp
add rcx, r13
sub rdx, 1
jne 0x10010fd55
mov edx, 0x43
mov rcx, rbx
lea r8d, [rdx - 0x3b]
call fcn.10010fde0
mov edx, 0x4b
mov rcx, rbx
lea r8d, [rdx - 0x43]
call fcn.10010fde0
mov rcx, rbx
call fcn.100111290
add ax, r13w
movzx ecx, ax
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
cmp byte [rsp + 0x68], bpl
je 0x10010fdb8
mov rcx, qword [rbx + 0x20]
mov r8, r12
lea rdx, [rcx + 0x8000]
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx + 0x40]
mov rbp, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 3
add rsp, 0x20
pop r13
ret
Function at 0x10011b5ec
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10011b67f
cmp dword [rsp + 0x24], 5
jb 0x10011b699
jmp 0x10011b695
cmp dword [rsp + 0x30], esi
jne 0x10011b699
cmp dword [rsp + 0x24], 4
ja 0x10011b695
jne 0x10011b699
cmp dword [rsp + 0x28], 0
jbe 0x10011b699
mov byte [rbx + 0x18], sil
lea rax, [0x100001db8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1000356ac
movzx ecx, byte [0x100158de0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x100158de0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10011b980
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10011b980
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100151198]
jne 0x10011b99b
rol rcx, 0x10
test cx, 0xffff
jne 0x10011b997
ret 0
ror rcx, 0x10
jmp 0x10011be60
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100154540]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100154638]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10011bee5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100154540]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10011bf07
mov rax, qword [rsp + 0x88]
mov qword [0x100154638], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1001545d8], rax
mov rax, qword [0x100154638]
mov qword [0x1001544b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1001545c0], rax
mov dword [0x1001544a0], 0xc0000409
mov dword [0x1001544a4], 1
mov rax, qword [0x100151198]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1001511a0]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001e68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10011bfb8
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10011c023
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x10011c043
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001e78]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x10011ea50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov r13, r8
mov r14, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r12d, 0x50
lea edx, [r12 - 0x48]
mov rcx, rax
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x10011ebd0
mov rdi, rax
xor eax, eax
mov rcx, r12
rep stosb byte [rdi], al
xor edi, edi
lea ebp, [rax + 0x14]
mov eax, edi
mov ecx, edi
add edi, 1
shr eax, 2
mov edx, eax
shl eax, 2
sub ecx, eax
movzx eax, byte [rsi]
add rsi, 1
shl ecx, 3
shl eax, cl
or dword [rbx + rdx*4], eax
cmp edi, ebp
jb 0x10011eaa3
xor edx, edx
lea rcx, [rsp + 0x5c]
mov dword [rsp + 0x40], 0x123174bb
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x44], 0x86521ff8
mov dword [rsp + 0x48], 0x98d2438b
mov dword [rsp + 0x4c], 0x7966ce12
mov dword [rsp + 0x50], 0xc5d92014
mov dword [rsp + 0x58], 0
call sub.msvcrt.dll_memset
lea rdi, [rsp + 0x58]
lea rsi, [0x10015234c]
mov rcx, rbp
rep movsb byte [rdi], byte [rsi]
xor esi, esi
lea rdi, [rsp + 0x58]
lea r8d, [rsi + 5]
mov rcx, rsi
movabs rax, 0xcccccccccccccccd
mul rsi
add rsi, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x40]
xor dword [rdi], eax
add rdi, 4
sub r8, 1
jne 0x10011eb23
mov r9d, dword [0x100152360]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r8
lea rax, [0x100152e90]
lea rdi, [rsp + 0x70]
lea rsi, [rsp + 0x58]
mov rcx, rbp
lea r8, [rsp + 0x70]
rep movsb byte [rdi], byte [rsi]
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1001265f0
lea rax, [rsp + 0x70]
mov edx, 0xffffffff
mov byte [rax], 0
add rax, 1
add ebp, edx
jne 0x10011eb9d
mov rcx, rbx
mov byte [rcx], 0
add rcx, 1
add r12d, edx
jne 0x10011ebab
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [r12 + 1]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10011fca0
Capabilities:
Encode data using xor

Disassembly:
or edx, edx
je 0x10011fcf4
movzx r10, byte [rcx + 0x100]
movzx r11, byte [rcx + 0x101]
add r8, rdx
neg rdx
xor r9d, r9d
nop dword [rax]
inc r10b
mov al, byte [r10 + rcx]
add r11b, al
mov r9b, byte [r11 + rcx]
mov byte [r10 + rcx], r9b
add r9b, al
mov byte [r11 + rcx], al
mov al, byte [r9 + rcx]
xor byte [rdx + r8], al
inc rdx
jne 0x10011fcc0
mov byte [rcx + 0x100], r10b
mov byte [rcx + 0x101], r11b
ret
Function at 0x100120c20
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, r9
xor r10d, r10d
mov r11, rdx
cmp rbx, r10
mov r9, rcx
je 0x100120c64
sub r9, rdx
sub r8, rdx
mov ecx, dword [r9 + r11]
mov edx, dword [r11]
lea eax, [rdx + rcx]
add r10d, eax
mov eax, edx
or edx, ecx
mov dword [r8 + r11], r10d
xor eax, ecx
add r11, 4
and r10d, eax
xor r10d, edx
shr r10d, 0x1f
sub rbx, 1
jne 0x100120c39
mov eax, r10d
pop rbx
ret

Function at 0x100120c70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov r12, qword [rsp + 0x50]
xor eax, eax
mov rdi, r9
cmp r12, rax
mov rsi, r8
mov r11, rdx
mov rbp, rcx
mov ebx, eax
je 0x100120ce8
sub rbp, rdx
sub rsi, rdx
sub rdi, rdx
mov r8d, dword [r11 + rbp]
mov edx, dword [r11]
mov r9d, dword [rsi + r11]
lea r10d, [rdx + r8]
add r10d, eax
mov eax, r10d
mov ecx, r10d
sub eax, r9d
xor ecx, edx
sub eax, ebx
mov ebx, eax
mov dword [rdi + r11], eax
mov eax, r10d
xor eax, r8d
xor ebx, r10d
add r11, 4
or eax, ecx
mov ecx, r10d
xor ecx, r9d
xor eax, r10d
or ebx, ecx
shr eax, 0x1f
xor ebx, r10d
shr ebx, 0x1f
sub r12, 1
jne 0x100120c9a
sub eax, ebx
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x100120dc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, r9
xor r10d, r10d
mov r11, rdx
cmp rbx, r10
mov r9, rcx
je 0x100120e03
sub r9, rdx
sub r8, rdx
mov ecx, dword [r9 + r11]
mov eax, dword [r11]
mov edx, ecx
sub edx, eax
xor eax, ecx
sub edx, r10d
mov dword [r8 + r11], edx
xor edx, ecx
add r11, 4
or edx, eax
xor edx, ecx
shr edx, 0x1f
sub rbx, 1
mov r10d, edx
jne 0x100120dd9
mov eax, r10d
pop rbx
ret