joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ddc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5db8], 0
lea rbx, [rcx + 0x5dc0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001de67
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001de1a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140020370
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400041f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5db8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5dc8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400c7468]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001de6f
mov rcx, rbx
call fcn.1400041f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e340
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400c7470]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001e3a3
mov qword [rsp], rbx
lea rbx, [0x14005c160]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001e383
cmp byte [r8], r9b
jne 0x14001e383
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001e370
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5d28]
not eax
mov r8, qword [r10 + 0x5d30]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001e3cf
cmp dword [r8 + 8], eax
je 0x14001e3d6
add r8, 0x48
cmp r8, rcx
jne 0x14001e3c0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140049d30
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140049d61
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1400c7978]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1400c7988]
lea rdx, [rdi + rdi]
call fcn.140049180
mov rax, qword [0x1400c7978]
lea r9, [rdi - 1]
mov qword [0x1400c79a0], r9
mov qword [0x1400c79a8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140049ed4
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1400c7988]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140049e20
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140049e95
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140049e5d
mov r10, qword [rdx]
cmp r10, rax
je 0x140049e57
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140049e95
cmp r9, rdx
je 0x140049e71
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140049ea9
cmp r9, rdx
jne 0x140049e62
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140049ecf
mov r9, qword [0x1400c79a0]
jmp 0x140049dd1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140049e95
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140054490
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400544da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400544da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400544da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400544da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400544da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400544dc
xor al, al
add rsp, 0x28
ret
Function at 0x40673c
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x40674a
and edx, 0x3fff
jmp fcn.00406694

Function at 0x406750
Capabilities:
Delete directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a514
mov ebx, eax
cmp eax, 1
je 0x406780
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406780
mov al, 1
jmp 0x4067d1
test ebx, ebx
je 0x4067cf
lea rcx, [rsp + 0x28]
call fcn.004032ec
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040ab90
test al, al
je 0x4067c5
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x4067d1
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x4067f8
Capabilities:
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
call fcn.0040a514
mov esi, eax
mov rcx, rbp
call fcn.0040a514
mov edi, eax
mov ebx, 1
cmp esi, ebx
je 0x406847
cmp eax, ebx
je 0x406847
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x406847
mov al, bl
jmp 0x4068d5
test esi, esi
jne 0x406853
test edi, edi
je 0x4068d3
lea rcx, [rsp + 0x48]
call fcn.004032ec
nop
lea rcx, [rsp + 0x38]
call fcn.004032ec
nop
cmp esi, ebx
je 0x406871
cmp edi, ebx
jne 0x406873
xor bl, bl
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rcx, r12
call fcn.0040abd8
test al, al
je 0x4068be
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x4068d5
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x406a78
Capabilities:
Create directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a514
mov ebx, eax
cmp eax, 1
je 0x406ab7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x406aaa
mov al, 1
jmp 0x406b0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406b08
test ebx, ebx
je 0x406b08
lea rcx, [rsp + 0x28]
call fcn.004032ec
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040ab90
test al, al
je 0x406afe
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406b0a
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x406b3c
Capabilities:
Delete file

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.00407bac
cmp eax, 0xffffffff
je 0x406b72
test al, 0x10
jne 0x406b72
test al, 1
je 0x406b72
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call fcn.00406694
test al, al
je 0x406be3
mov rcx, rbx
call fcn.0040a514
mov edi, eax
cmp eax, 1
je 0x406b92
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406b92
mov al, 1
jmp 0x406be3
test edi, edi
je 0x406be1
lea rcx, [rsp + 0x28]
call fcn.004032ec
nop
cmp edi, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.0040ab90
test al, al
je 0x406bd7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406be3
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x406c0c
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x406cf0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.00403480
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
Function at 0x406d48
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rbp, r9
mov rsi, r8
mov r12b, dl
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
shl ebx, 2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edi, ebx
shl edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
xor r13d, edi
xor edi, edi
lea r15d, [rdi + 1]
mov ebx, edi
mov rdx, r14
mov rcx, rsi
call fcn.00403480
cmp r12b, dil
je 0x406e2b
mov r10d, r13d
mov r9, rdi
mov r11d, 8
mov r8d, r10d
shr r10d, 4
and r8d, 0xf
cmp r8d, 0xa
lea eax, [r8 + 0x37]
lea edx, [r8 + 0x30]
movzx ecx, al
movzx eax, dl
cmovb ecx, eax
mov byte [rsp + r9 + 0x20], cl
add r9, r15
sub r11, r15
jne 0x406db1
cmp rbp, rdi
mov byte [rsp + r9 + 0x20], dil
je 0x406e0e
mov eax, dword [rsi + 8]
cmp dword [rsi + 0xc], eax
jne 0x406df8
mov rcx, rsi
call fcn.004030d0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov word [rcx + rdx*2], 0x2e
add edx, r15d
mov word [rcx + rdx*2], di
mov dword [rsi + 8], edx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.00403754
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 2
cmove eax, r15d
add r13d, eax
cmp rbp, rdi
mov r12b, r15b
je 0x406e42
lea rdx, str..tmp
mov rcx, rsi
call fcn.00403754
mov rcx, qword [rsi]
call fcn.00408750
cmp al, dil
je 0x406e5c
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x406e90
cmp rbp, rdi
je 0x406e71
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbp
call fcn.00409328
jmp 0x406e79
mov rcx, qword [rsi]
call fcn.00406a78
cmp al, dil
jne 0x406eb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x406e90
cmp eax, 0xb7
jne 0x406e9c
add ebx, r15d
cmp ebx, 0x64
jb 0x406d91
mov rax, qword [rsi]
mov dword [rsi + 8], edi
mov word [rax], di
xor al, al
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov al, r15b
jmp 0x406ea7
Function at 0x407bac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a514
mov ebx, eax
cmp eax, 1
je 0x407bd9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407c2a
test ebx, ebx
je 0x407c25
lea rcx, [rsp + 0x28]
call fcn.004032ec
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040ab90
test al, al
je 0x407c1b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x407c2a
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, 0xffffffff
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x408890
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rcx
movsxd rbx, dword [rcx + 8]
mov rdi, rbx
test ebx, ebx
je 0x4088e0
shl rdi, 3
add ebx, 0xffffffff
sub rdi, 8
mov rax, qword [r12]
mov rsi, qword [rdi + rax]
test rsi, rsi
je 0x4088dc
mov rcx, qword [rsi]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x4088b8
mov dword [r12 + 8], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test eax, eax
je 0x4089d4
mov rcx, rdi
xor ebx, ebx
mov qword [rsp + 0x80], rbx
test eax, eax
je 0x408921
add rcx, rcx
call fcn.004021d0
mov rbx, rax
mov qword [rsp + 0x80], rax
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x4089ca
cmp eax, edi
ja 0x4089ca
lea rcx, [rsp + 0x28]
call fcn.004032ec
nop
xor r13d, r13d
xor edi, edi
test esi, esi
je 0x4089ab
mov rbp, rbx
cmp word [rbp], 0
jne 0x4089a1
lea rdx, [rbx + r13*2]
lea rcx, [rsp + 0x28]
call fcn.00403480
lea r13d, [rdi + 1]
mov ecx, 0x10
call fcn.004021d0
mov qword [rsp + 0x88], rax
test rax, rax
je 0x408994
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.004033f8
jmp 0x408996
xor eax, eax
mov rdx, rax
mov rcx, r12
call fcn.004010c0
inc edi
add rbp, 2
cmp edi, esi
jb 0x408955
cmp r13d, esi
sete dil
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
nop
mov rcx, rbx
call sub.msvcrt.dll_free
mov al, dil
jmp 0x4089d4
mov rcx, rbx
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x408aa4
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 9], 0
mov rbx, rdx
je 0x408ac3
cmp byte [rcx + 0xa], 0
je 0x408ac3
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x408af7
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x408ae6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408ae6
xor al, al
jmp 0x408af9
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x408b94
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x408bd0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x400000
cmp r8d, eax
cmova r8d, eax
jmp fcn.00408b94

Function at 0x408c94
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov eax, 0x400000
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x408d3c
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.00408b00
xor ebx, ebx
cmp al, bl
je 0x408d64
cmp qword [rsp + 0x50], rdi
je 0x408d68
xor al, al
jmp 0x408d76
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x40a324
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.00403480
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret

Function at 0x40af6c
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x00453980]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40afd2
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call rax
test eax, eax
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rax, qword [rsp + 0x48]
setne bpl
mov qword [rdi], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40b024
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
imul rcx, rax
test bpl, bpl
mov qword [rbx], rcx
jne 0x40b022
mov eax, dword [rsp + 0x38]
imul rax, rcx
mov qword [rsi], rax
mov eax, dword [rsp + 0x3c]
imul rax, qword [rbx]
mov qword [rdi], rax
mov al, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b820
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov r11, rsp
sub rsp, 0x40
mov rax, qword [r8]
mov dword [r8 + 8], 0
mov rsi, rcx
mov word [rax], 0
mov rcx, qword [rcx]
lea rax, [r11 + 0x30]
mov rbx, r8
mov qword [r11 - 0x18], rax
lea r9, [r11 - 0x10]
xor r8d, r8d
mov qword [r11 - 0x20], 0
mov rdi, rdx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x70], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b87f
cmp eax, 0xea
jne 0x40b8f5
mov edx, dword [rsp + 0x70]
cmp edx, dword [rbx + 0xc]
mov dword [rsp + 0x78], edx
jbe 0x40b894
mov rcx, rbx
call fcn.00403048
mov rax, qword [rbx]
lea rcx, [rsp + 0x78]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rbx]
cmp ecx, dword [rsp + 0x78]
cmova ecx, dword [rsp + 0x78]
mov dword [rsp + 0x70], ecx
shr rcx, 1
mov word [rdx + rcx*2], 0
xor ecx, ecx
cmp word [rdx], cx
je 0x40b8f2
add rdx, 2
inc ecx
cmp word [rdx], 0
jne 0x40b8e6
mov dword [rbx + 8], ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x40b95c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov rax, rsp
sub rsp, 0x40
mov dword [r9], 0
mov qword [rax - 0x18], r9
mov r12, rcx
mov rcx, qword [rcx]
mov rsi, r9
mov rbx, r8
lea r9, [rax + 0x48]
xor r8d, r8d
mov rbp, rdx
mov dword [rax + 0x48], 0
mov qword [rax - 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b9ab
cmp eax, 0xea
jne 0x40ba0d
mov edi, dword [rsi]
cmp rdi, qword [rbx + 8]
je 0x40b9e3
mov rcx, qword [rbx]
test rcx, rcx
je 0x40b9c7
call sub.msvcrt.dll_free
mov qword [rbx], 0
test rdi, rdi
mov qword [rbx + 8], 0
je 0x40b9e3
mov rcx, rdi
call fcn.004021d0
mov qword [rbx + 8], rdi
mov qword [rbx], rax
mov rax, qword [rbx]
mov rcx, qword [r12]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x40ba60
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
call fcn.0040ba38
xor r8d, r8d
cmp eax, r8d
je 0x40ba9f
cmp qword [rsp + 0x20], r8
je 0x40ba9f
mov rcx, r8
lea eax, [r8 + 0x40]
mov rdx, qword [rsp + 0x20]
shr rdx, cl
inc rcx
and edx, 1
add r8d, edx
dec rax
jne 0x40ba84
mov eax, r8d
jmp 0x40baae
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x40bab4
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
movabs rax, 0x100000000
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
mov qword [rcx], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40baf6
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x40bff4
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
xor ecx, ecx
mov rax, qword [rbx]
mov dword [rbx + 8], ecx
mov byte [rax], cl
mov rax, qword [rdx]
mov dword [rdx + 8], ecx
mov byte [rax], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.0040bdac
add rsp, 0x50
pop rbx
ret
Function at 0x4193a4
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x419537
mov eax, edx
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
dec rax
jne 0x4193ae
mov eax, ecx
ret