joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b5fe0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1800b60ac
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1800b60ac
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1800b60c5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1800b609c
cmp byte [rax], 0x5c
jne 0x1800b6096
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x1800b6096
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1800b6082
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x1800b6093
test r8b, 0x10
jne 0x1800b6096
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x1800b6096
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1800b2970
test edi, edi
jne 0x1800b6000
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1800b2960
int3

Function at 0x1800b81a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800b81da
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800b81df
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800b8228
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800c29a0]
cmp byte [rcx + rax], 0
je 0x1800b8228
dec r8
sub rdx, 1
jne 0x1800b820e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x4035d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
test rdx, rdx
je 0x4035fc
add rdx, rcx
mov eax, 0x1505
nop dword [rax]
mov r8d, eax
add rcx, 1
shl r8d, 5
add eax, r8d
movsx r8d, byte [rcx - 1]
xor eax, r8d
cmp rcx, rdx
jne 0x4035e0
ret
mov eax, 0x1505
ret

Function at 0x4062a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
test rdx, rdx
mov rsi, rcx
je 0x4062b9
cmp word [rdx], 0
jne 0x4062c5
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8, qword [0x00826960]
lea rcx, [rsp + 0x20]
mov r9, rdx
mov qword [rsp + 0x28], 0
lea rax, [rcx + 0x22]
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x30], rax
lea rax, [0x00840bc0]
mov qword [rsp + 0x20], rax
xor eax, eax
add r8, 0xe000
mov word [rsp + 0x42], ax
lea rdx, str._s_themes_s
mov qword [rsp + 0x38], pe_nt_image_headers64
call fcn.00403810
lea rdx, [0x007f6ab6]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov rbx, rax
je 0x4063f0
mov r8d, 2
xor edx, edx
mov rcx, rax
call fcn.0067f720
mov rcx, rbx
call fcn.0067f4d0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rbp, rax
call fcn.0067f720
mov rcx, rbp
call fcn.007da080
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
mov rdi, rax
call sub.msvcrt.dll_fread
test rax, rax
mov rbp, rax
je 0x4063d0
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.00406020
mov rcx, rdi
call fcn.007da030
mov rcx, qword [rsp + 0x28]
lea rax, [0x008407e0]
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x4062b9
call fcn.007da030
nop
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8, qword [rsp + 0x30]
lea rdx, str.ERROR_in_image_loadFile__:_cannnot_read_from_file__S_n
mov rcx, qword [0x00826910]
call fcn.0041db00
jmp 0x40639c
mov r8, qword [rsp + 0x30]
lea rdx, str.ERROR_in_image_loadFile__:_file__S_not_found_n
mov rcx, qword [0x00826910]
call fcn.0041db00
jmp 0x4063a4

Function at 0x407cd0
Capabilities:
Hide graphical window

Disassembly:
xor edx, edx
mov byte [rcx + 0x14], 0
mov rcx, qword [rcx + 0x20]
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x408980
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13, qword [rsp + 0xb0]
mov rdi, rdx
mov rbx, r9
mov r12, r8
mov dword [r13], 0
lea rbp, [rsp + 0x4c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x28], rbp
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call rsi
cmp eax, 2
je 0x408a12
test eax, eax
mov dword [rsp + 0x3c], eax
je 0x408a20
mov rcx, qword [0x00826910]
mov r8, rbx
lea rdx, str.Key__S_n
call fcn.0041db00
mov eax, dword [rsp + 0x3c]
lea r8, str.RegQueryValueEx__
mov rcx, qword [0x00826910]
mov edx, eax
call fcn.0041e530
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rsp + 0x4c]
lea rcx, [r12 + 0x828]
call fcn.00403070
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov dword [r13], eax
lea r9, [rsp + 0x48]
mov eax, eax
add rax, qword [r12 + 0x860]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call rsi
test eax, eax
mov esi, eax
je 0x408a12
mov rcx, qword [0x00826910]
mov r8, rbx
lea rdx, str.Key__S_n
call fcn.0041db00
mov rcx, qword [0x00826910]
lea r8, str.read_reg_val__
mov edx, esi
call fcn.0041e530
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x40ac60
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x00826960]
mov ebx, dword [rax + 0x1c000]
mov rsi, rcx
mov rdi, rdx
mov dword [rsp + 0x2c], 0x102
and ebx, 0x1000
je 0x40aca0
xor ebx, ebx
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [0x00826910]
mov r8, rdx
lea rdx, str.Saving_state_in__S...
call fcn.0041e020
mov rcx, qword [0x00826970]
mov rdx, rdi
call fcn.0043f1c0
test eax, eax
je 0x40ae80
lea rdx, [0x007f7376]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov r12, rax
je 0x40aeb0
mov rdx, qword [rsi + 0x818]
mov rax, qword [rsi + 0x800]
sub rdx, qword [rsi + 0x810]
sub rax, qword [rsi + 0x7f8]
mov rdi, qword [rsi + 0x868]
sub rdi, qword [rsi + 0x860]
lea rax, [rdx + rax + 0x80c]
add rdi, rax
mov rcx, rdi
call fcn.007da080
mov r9, r12
mov r8d, 1
mov edx, 3
lea rcx, [0x007f73ab]
mov rbp, rax
call sub.msvcrt.dll_fwrite
lea rcx, [rsp + 0x2c]
mov r9, r12
mov r8d, 1
mov edx, 4
call sub.msvcrt.dll_fwrite
mov r8d, 0x7f4
mov rdx, rsi
mov rcx, rbp
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsi + 0x7f8]
movabs rcx, 0xcccccccccccccccd
mov r13, qword [rsi + 0x800]
lea r9, [rbp + 0x7fc]
sub r13, rdx
mov rax, r13
mov r8, r13
mov dword [rbp + 0x7f4], r13d
sar rax, 4
imul rax, rcx
mov rcx, r9
mov dword [rbp + 0x7f8], eax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsi + 0x810]
movabs r8, 0x86bca1af286bca1b
lea rcx, [rax + r13]
mov r13, qword [rsi + 0x818]
lea r9, [rcx + 8]
sub r13, rdx
mov rax, r13
mov dword [rcx], r13d
sar rax, 2
imul rax, r8
mov r8, r13
mov dword [rcx + 4], eax
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsi + 0x860]
mov r8, qword [rsi + 0x868]
lea rcx, [rax + r13]
add rcx, 8
sub r8, rdx
mov dword [rcx - 8], r8d
mov dword [rcx - 4], r8d
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call fcn.007da080
mov r9, rdi
mov r8, rbp
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.00403f20
mov r9, r12
mov r8d, 1
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll_fwrite
mov rcx, rsi
call fcn.007da030
mov rcx, r12
call sub.msvcrt.dll_fclose
mov rcx, qword [0x00826910]
lea rdx, [0x007f73af]
call fcn.0041e020
mov rcx, rbp
call fcn.007da030
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [0x00826910]
mov r8, rdi
mov ebx, 1
lea rdx, str.ERROR_in_state_save__:_Write_protected__S_n
call fcn.0041db00
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call fcn.0041e2a0
mov rcx, qword [0x00826910]
mov ebx, 1
lea rdx, str.ERROR_in_state_save__:_failed__wfopen__S__n
mov r8, rax
call fcn.0041db00
jmp 0x40ac91
Function at 0x40b580
Capabilities:
Read file on windows

Disassembly:
push rbp
mov eax, 0x3028
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
mov rdi, rdx
mov edx, dword [rcx + 0x138]
mov rsi, rcx
mov byte [rsp + 0x20], 0
add rdx, qword [rcx + 0x860]
lea rbx, [rsp + 0x1020]
mov rcx, rbx
call fcn.0068bb48
mov edi, dword [rdi + 0x14]
mov rcx, rbx
add rdi, qword [rsi + 0x860]
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax*2 - 8]
lea rdx, str.system32CatRootF750E6C3_38EE_11D1_85E5_00C04FC295EE_ws
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rdx, [0x007f75c0]
lea rcx, [rbx + rax*2 - 6]
call fcn.0068bb48
lea rdx, [0x007f75c8]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov rbx, rax
je 0x40b678
mov r8d, 2
xor edx, edx
mov rcx, rax
call fcn.0067f720
mov rcx, rbx
call fcn.0067f4d0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rdi, rax
call fcn.0067f720
mov rcx, rdi
call fcn.007da080
mov r9, rbx
mov r8d, 1
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call sub.msvcrt.dll_fread
mov rcx, rbx
call sub.msvcrt.dll_fclose
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbp
call fcn.00411650
mov rcx, rbp
call fcn.007da030
xor eax, eax
cmp byte [rsp + 0x20], 0
je 0x40b692
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x828]
call fcn.00402970
add rsp, 0x3028
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x411570
Capabilities:
Read file on windows

Disassembly:
push rsi
mov eax, 0x2038
push rbx
call fcn.0067cdd0
sub rsp, rax
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
lea rbx, [rsp + 0x30]
mov r8, rbx
call fcn.004113e0
lea rdx, [0x007f8332]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov rbx, rax
je 0x41160b
lea rsi, [rsp + 0x20]
mov r9, rax
mov r8d, 1
mov edx, 3
mov rcx, rsi
call sub.msvcrt.dll_fread
mov r9, rbx
mov r8d, 1
mov edx, 4
lea rcx, [rsp + 0x2c]
call sub.msvcrt.dll_fread
mov rcx, rbx
call sub.msvcrt.dll_fclose
lea rdx, [0x007f8338]
mov r8d, 3
mov rcx, rsi
call sub.msvcrt.dll_memcmp
mov edx, dword [rsp + 0x2c]
test eax, eax
je 0x411620
cmp edx, 0x204
je 0x411635
xor eax, eax
add rsp, 0x2038
pop rbx
pop rsi
ret
cmp edx, 0x205
mov eax, 1
je 0x41160d
cmp edx, 0x204
jne 0x41160b
mov eax, 1
add rsp, 0x2038
pop rbx
pop rsi
ret
Function at 0x412070
Capabilities:
Write file on windows

Disassembly:
push r13
mov eax, 0x2038
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax]
lea rbx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x2c], 0x205
mov r8, rbx
call fcn.004113e0
mov rcx, qword [0x00826970]
mov rdx, rbx
call fcn.0043f1c0
test eax, eax
je 0x412320
lea rdx, [0x007f83a0]
mov rcx, rbx
movabs r13, 0xaaaaaaaaaaaaaaab
call qword [sym.imp.msvcrt.dll__wfopen]
mov rdx, qword [rdi + 0x80]
mov rsi, rax
sub rdx, qword [rdi + 0x78]
mov rax, qword [rdi + 0x98]
sub rax, qword [rdi + 0x90]
mov rbp, qword [rdi + 0x118]
sub rbp, qword [rdi + 0x110]
lea r8, [rdx + rax + 0x34]
mov rdx, qword [rdi + 0xc8]
sub rdx, qword [rdi + 0xc0]
mov rax, qword [rdi + 0xb0]
sub rax, qword [rdi + 0xa8]
lea rcx, [r8 + rdx]
lea rdx, [rcx + rax]
lea rax, [rdx + rbp]
mov rbp, qword [rdi + 0x30]
movabs rdx, 0xffffffff0
sub rbp, qword [rdi + 0x28]
and rbp, rdx
add rbp, rax
mov rcx, rbp
call fcn.007da080
mov r9, rsi
mov r8d, 1
mov edx, 3
lea rcx, [0x007f8338]
mov rbx, rax
call sub.msvcrt.dll_fwrite
lea rcx, [rsp + 0x2c]
mov r9, rsi
mov r8d, 1
mov edx, 4
call sub.msvcrt.dll_fwrite
mov rdx, qword [rdi + 0x78]
lea r9, [rbx + 8]
movabs rcx, 0xf83e0f83e0f83e1
mov r12, qword [rdi + 0x80]
sub r12, rdx
mov rax, r12
mov r8, r12
mov dword [rbx], r12d
sar rax, 2
imul rax, rcx
mov rcx, r9
mov dword [rbx + 4], eax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rdi + 0x90]
lea rcx, [rax + r12]
mov r12, qword [rdi + 0x98]
lea r9, [rcx + 8]
sub r12, rdx
mov rax, r12
mov dword [rcx], r12d
mov r8, r12
sar rax, 4
mov dword [rcx + 4], eax
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov rdx, qword [rdi + 0xa8]
lea rcx, [rax + r12]
mov r12, qword [rdi + 0xb0]
lea r9, [rcx + 8]
sub r12, rdx
mov rax, r12
mov dword [rcx], r12d
mov r8, r12
sar rax, 3
imul rax, r13
mov dword [rcx + 4], eax
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov rdx, qword [rdi + 0xc0]
lea rcx, [rax + r12]
mov r12, qword [rdi + 0xc8]
lea r9, [rcx + 8]
sub r12, rdx
mov rax, r12
mov dword [rcx], r12d
mov r8, r12
sar rax, 2
imul rax, r13
mov dword [rcx + 4], eax
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov rdx, qword [rdi + 0x110]
lea rcx, [rax + r12]
mov r12, qword [rdi + 0x118]
lea r9, [rcx + 8]
sub r12, rdx
mov dword [rcx], r12d
mov r8, r12
mov dword [rcx + 4], r12d
mov rcx, r9
call sub.msvcrt.dll_memcpy
lea rcx, [rdi + 0x18]
lea rdx, [rax + r12]
call fcn.00403610
mov rax, qword [0x00826960]
test byte [rax + 0x1c000], 2
jne 0x4122e0
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call fcn.007da030
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov dword [rdi + 8], 1
add rsp, 0x2038
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbp
call fcn.007da080
mov r9, rbp
mov r8, rbx
mov rdx, rbp
mov rcx, rax
mov r12, rax
call fcn.00403f20
mov rcx, r12
mov r9, rsi
mov r8d, 1
mov rdx, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call fcn.007da030
jmp 0x4122b0
mov rcx, qword [0x00826910]
mov r8, rbx
lea rdx, str.ERROR_in_driverpack_saveindex__:_Write_protected__S_n
call fcn.0041db00
nop
add rsp, 0x2038
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x4139f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x508
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x550], rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
lea rax, [rsp + 0x72]
mov word [rsp + 0x72], r8w
mov r8, rdx
mov qword [rsp + 0x558], rdx
lea rdx, str._s.
mov qword [rsp + 0x60], rax
lea rax, [0x00840bc0]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], pe_nt_image_headers64
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x50], rax
call fcn.00403810
lea r12, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x60]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rsi, [r12 + 0x2c]
mov r13, rax
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0x180]
mov r15, qword [sym.imp.KERNEL32.dll_lstrcmpW]
mov qword [rsp + 0x38], rax
mov rax, qword [0x00826960]
mov qword [rsp + 0x48], rax
mov rdx, r12
mov rcx, r13
call r14
test eax, eax
je 0x413c20
test byte [rsp + 0x2b0], 0x10
je 0x413b20
lea rdx, [0x007f85f4]
mov rcx, rsi
call r15
test eax, eax
je 0x413ab2
mov rcx, qword [rsp + 0x30]
mov r9, rsi
mov r8, qword [rsp + 0x558]
lea rdx, str._s_ws
call fcn.00403810
mov eax, dword [0x008b90b0]
test eax, eax
jne 0x413ab2
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x550]
call fcn.004139f0
add dword [rsp + 0x44], eax
jmp 0x413ab2
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
mov rbp, rax
jbe 0x413ab2
lea rdi, str.DP_Video_Server_1
xor ebx, ebx
nop word [rax + rax]
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.SHELL32.dll_StrStrIW
test rax, rax
jne 0x413bc4
add rbx, 1
cmp rbx, 6
jne 0x413b40
lea rcx, [rsi + rbp*2 - 6]
lea rdx, [0x007f8644]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x413ab2
mov r9, qword [rsp + 0x550]
mov r8, rsi
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rsp + 0x38]
call fcn.004137c0
mov rax, qword [0x00826960]
test byte [rax + 0x1c000], 1
jne 0x413bb0
cmp word [rax + 0xa000], 0
je 0x413c5c
add dword [rsp + 0x44], 1
mov rcx, qword [rsp + 0x38]
call fcn.00698fd0
jmp 0x413ab2
mov rax, qword [rsp + 0x48]
test byte [rax + 0x1c000], 0x90
jne 0x413ab2
mov rax, qword [rsp + 0x550]
lea rdx, str.__c_del___s_s.7z___Q__F
mov r9, qword [rdi + rbx*8]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rax + 0x28]
call fcn.00403810
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov rcx, qword [0x00826970]
lea rdx, [0x007f863c]
call fcn.0043f4d0
jmp 0x413ab2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x58]
lea rax, [0x008407e0]
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x413c44
call fcn.007da030
mov eax, dword [rsp + 0x44]
add rsp, 0x508
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x38]
call fcn.00411570
test eax, eax
je 0x413bb0
jmp 0x413bb5
Function at 0x41be60
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push r15
mov eax, 0x2278
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
mov rbp, rcx
mov rbx, rcx
jmp 0x41be92
mov rcx, rbx
mov edx, 0x5c
call sub.msvcrt.dll_wcschr
lea rbx, [rax + 2]
mov edx, 0x5c
mov rcx, rbx
call sub.msvcrt.dll_wcschr
test rax, rax
jne 0x41be81
lea r13, [rsp + 0x270]
sub rbx, rbp
mov rdx, rbp
lea rsi, [rsp + 0x20]
mov rcx, r13
add rbx, r13
call fcn.0068bb48
lea rdx, str..inF
mov rcx, rbx
call fcn.0068bb48
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x41bf4e
lea r14, [rsi + 0x2c]
mov r15, qword [0x00826910]
jmp 0x41bf0d
mov rdx, rsi
mov rcx, rdi
call r12
test eax, eax
je 0x41bf4e
test byte [rsp + 0x20], 0x10
jne 0x41bf00
mov rdx, r14
mov rcx, rbx
call fcn.0068bb48
mov rdx, r14
mov rcx, rbp
call sub.SHELL32.dll_StrStrIW
test rax, rax
je 0x41bf62
lea rdx, str.keeping___S_n
mov r8, r13
mov rcx, r15
call fcn.0041e020
mov rdx, rsi
mov rcx, rdi
call r12
test eax, eax
jne 0x41bf0d
add rsp, 0x2278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x00826910]
mov r8, r13
lea rdx, str.deleting__S___d__n
mov r9d, eax
call fcn.0041e020
jmp 0x41bf00

Function at 0x41d930
Capabilities:
Get hostname

Disassembly:
push rdi
mov eax, 0x2060
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
lea rbx, [rsp + 0x58]
mov rdi, rcx
mov dword [rsp + 0x54], 0x1000
lea rsi, [rsp + 0x60]
lea rdx, [rsp + 0x54]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__time64]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__localtime64]
mov rdx, qword [0x00826960]
test byte [rdx + 0x1c001], 0x20
je 0x41d995
xor eax, eax
mov word [rdi], ax
add rsp, 0x2060
pop rbx
pop rsi
pop rdi
ret
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0x14]
mov qword [rsp + 0x40], rsi
mov r8d, dword [rax]
lea r9d, [rcx + 1]
mov rcx, rdi
mov dword [rsp + 0x38], r8d
mov r8d, dword [rax + 4]
mov dword [rsp + 0x30], r8d
mov r8d, dword [rax + 8]
mov dword [rsp + 0x28], r8d
mov eax, dword [rax + 0xc]
lea r8d, [rdx + 0x76c]
lea rdx, str._4d__02d__02d___02d__02d__02d___s_
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
nop
add rsp, 0x2060
pop rbx
pop rsi
pop rdi
ret
Function at 0x41db90
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
lea rbx, [rsp + 0x20]
mov rsi, rcx
mov rdi, rdx
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x28], 0
lea rax, [rbx + 0x22]
mov qword [rsp + 0x30], rax
lea rax, [0x00840bc0]
mov qword [rsp + 0x20], rax
xor eax, eax
mov word [rsp + 0x42], ax
mov rax, qword [0x00826960]
mov qword [rsp + 0x38], pe_nt_image_headers64
test byte [rax + 0x1c001], 8
je 0x41dbf5
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [0x007fd134]
xor ecx, ecx
call sub.msvcrt.dll_setlocale
mov rcx, rsi
call fcn.0041d930
mov r9, rsi
mov r8, rdi
mov rcx, rbx
lea rdx, str._s_slog.txt
call fcn.00403810
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x00826970]
call fcn.0043f1c0
test eax, eax
je 0x41dca0
mov rcx, rdi
call fcn.0043f300
lea rdx, [0x007fd19a]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [sym.imp.msvcrt.dll__wfopen]
call rbp
test rax, rax
mov qword [rsi + 0x2000], rax
je 0x41dd20
test byte [rsi + 0x2011], 8
je 0x41dd00
mov rcx, qword [rsp + 0x28]
lea rax, [0x008407e0]
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x41dbe9
call fcn.007da030
nop
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8, qword [rsp + 0x30]
lea rdx, str.ERROR_in_log_start__:_Write_protected__S_n
lea rcx, [0x008bb1a0]
call fcn.0041db00
mov r8d, 0x1000
mov rdx, rdi
lea rcx, [0x007fd17c]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.SDI_logs
mov rcx, rdi
call fcn.0068bb68
mov r9, rsi
mov r8, rdi
mov rcx, rbx
lea rdx, str._s_slog.txt
call fcn.00403810
jmp 0x41dc35
lea r8, str.1.23.9
lea rdx, str.start_logging_n_s_n_n
lea rcx, [0x008bb1a0]
call fcn.0041da10
jmp 0x41dc6f
mov r8, qword [rsp + 0x30]
lea rdx, str.ERROR_in_log_start__:_Write_protected__S_n
lea rcx, [0x008bb1a0]
call fcn.0041db00
mov r8d, 0x1000
mov rdx, rdi
lea rcx, [0x007fd17c]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.SDI_logs
mov rcx, rdi
call fcn.0068bb68
mov r9, rsi
mov r8, rdi
mov rcx, rbx
lea rdx, str._s_slog.txt
call fcn.00403810
mov rcx, rdi
call fcn.0043f300
lea rdx, [0x007fd1a0]
mov rcx, qword [rsp + 0x30]
call rbp
mov qword [rsi + 0x2000], rax
jmp 0x41dc62
Function at 0x424160
Capabilities:
Accept command line arguments

Disassembly:
push r13
mov eax, 0x4048
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
mov rsi, qword [0x008d9308]
test rsi, rsi
lea rbx, [rsp + 0x2040]
mov rbp, rcx
mov r12d, edx
je 0x4241ce
xor eax, eax
mov ecx, 0xa
mov rdi, rbx
rep stosq qword [rdi], rax
xor r8d, r8d
mov r9, rbx
mov edx, 0x14
mov dword [rsp + 0x2040], 0x50
mov rcx, rsi
mov dword [rsp + 0x2044], 1
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
jne 0x4242e0
mov rdi, qword [0x008275b0]
lea rsi, [rsp + 0x40]
mov rcx, rbp
mov edx, dword [rdi]
call fcn.00423f50
lea rdx, [0x008c3200]
mov rcx, rsi
call fcn.0068bb48
lea rdx, [0x007fdf7c]
mov rcx, rsi
call fcn.0068bb68
lea rdx, [0x008c9200]
mov rcx, rbx
call fcn.0068bb48
lea rdx, [0x007fdf7c]
mov rcx, rbx
call fcn.0068bb68
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rcx, qword [0x00826970]
mov edx, 0x20
call fcn.00440690
mov r13d, eax
mov eax, dword [0x008d9200]
test eax, 0x40000000
je 0x424290
mov rdx, qword [0x008269c0]
mov rcx, qword [rdx]
test rcx, rcx
je 0x424279
and eax, 0xbfffffff
mov dword [0x008d9200], eax
mov rax, qword [rcx]
call qword [rax + 0x90]
nop
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp dword [0x008d92f0], 1
jne 0x424279
mov rcx, qword [0x00826970]
mov rdx, rsi
call fcn.0043e770
test al, al
je 0x424330
mov eax, r12d
sar eax, 8
cmp eax, r13d
jg 0x424320
test r12b, r12b
jne 0x424320
cmp dword [rdi], 1
jne 0x424279
mov edx, 2
mov rcx, rbp
mov dword [0x008d92f0], 0
call fcn.00423b70
jmp 0x424279
mov r9, rbx
xor r8d, r8d
mov edx, 0x14
mov dword [rsp + 0x2048], 0
mov dword [rsp + 0x204c], 0
mov rcx, rsi
mov qword [rsp + 0x2078], 0
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
jmp 0x4241ce
mov dword [0x008d92f0], 0
jmp 0x424279
mov rcx, qword [0x00826970]
mov rdx, rbx
call fcn.0043e770
test al, al
jne 0x4242b0
cmp dword [rsp + 0x3c], 1
jg 0x4242b0
mov qword [rsp + 0x20], 0
lea r9, [0x0041edc0]
mov r8, qword [0x008d9290]
mov edx, 0x384
mov rcx, qword [0x008d9348]
mov dword [0x008d92f0], 0
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x424279
Function at 0x42d160
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov rax, qword [0x00828c00]
xor r9d, r9d
xor ecx, ecx
lea r8, [0x0041bf90]
mov dword [rax], edx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
add rsp, 0x38
ret