joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e80
Capabilities:
Terminate thread

Disassembly:
mov r11, rsp
sub rsp, 0x48
lea rax, [rcx + 0x3c]
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], rax
lea rax, [0x00402dc0]
xor edi, edi
lea rcx, [r11 - 0x28]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x10], rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
lea rdx, str.CApplicationService::ApplicationServiceMainFunction
lea rcx, [0x0042b6ec]
call fcn.0040a0c0
mov rbx, qword [0x00437fa0]
test rbx, rbx
jne 0x402f0b
mov ecx, 0x248
call fcn.0040bd30
test rax, rax
mov rbx, rax
je 0x402f01
lea rcx, [rax + 0x3c]
xor edx, edx
mov r8d, 0x208
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], edi
call fcn.0040bb30
jmp 0x402f04
mov rbx, rdi
mov qword [0x00437fa0], rbx
lea rdx, str.CApplicationService::ServiceMainFunction111
lea rcx, [0x0042b6ec]
call fcn.0040a0c0
mov rcx, rbx
call fcn.00402c10
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov dword [rbx + 0x14], 1
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x402f50
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbx + 0x30], rdi
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret

Function at 0x405090
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
lea rcx, [0x0042b7c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx], rax
je 0x40517a
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.IsWow64Process
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.Wow64DisableWow64FsRedirection
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.Wow64RevertWow64FsRedirection
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetSystemWow64DirectoryW
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.advapi32.dll
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 8], rax
je 0x40517a
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.Wow64RevertWow64FsRedirection
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x406ba0
Capabilities:
Delete service
Stop service

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov rbx, rdx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
jne 0x406bd8
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
mov r8d, 0x10020
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rsi, rax
jne 0x406c16
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x68]
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x40]
xor eax, eax
test ebx, ebx
mov rbx, qword [rsp + 0x60]
setne al
add rsp, 0x48
ret

Function at 0x406c70
Capabilities:
Start service

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x48], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x406cef
cmp qword [rbx + 0x28], 8
jb 0x406ca6
mov rdx, qword [rbx + 0x10]
jmp 0x406caa
lea rdx, [rbx + 0x10]
mov r8d, 0xf003f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x406cef
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x406ce6
lea rdx, str.CRunServiceOperate::StartService
lea rcx, [0x0042b6ec]
call fcn.0040a0c0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, str.CRunServiceOperate::DoStartService
lea rcx, [0x0042b6ec]
call fcn.0040a0c0
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x28
ret
Function at 0x4086a0
Capabilities:
Get common file path
Get disk information

Disassembly:
push rbx
sub rsp, 0x6b0
mov rax, qword [0x004364e0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
xor eax, eax
mov rbx, rdx
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], 0
mov qword [rsp + 0x52], rax
mov qword [rsp + 0x5a], rax
mov word [rsp + 0x62], ax
mov word [rsp + 0x70], ax
call fcn.0040bb30
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8d, 3
call fcn.0040d6e0
lea rcx, [rsp + 0x492]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x490], 0
call fcn.0040bb30
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x280], 0
call fcn.0040bb30
xor r11d, r11d
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x280]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x490]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov r8d, 0x104
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x44], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4087c3
mov r8d, dword [rsp + 0x40]
lea rdx, str._08X
mov rcx, rbx
call fcn.0040ca60
jmp 0x4087e1
lea rcx, [0x0042b614]
sub rbx, rcx
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rbx + rcx - 2], ax
jne 0x4087d0
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.0040bd10
add rsp, 0x6b0
pop rbx
ret

Function at 0x409310
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x004364e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs rax, 0x3030303030303030
xor r9d, r9d
mov r10, rdx
mov qword [rsp], rax
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rax
mov word [rsp + 0x28], ax
mov byte [rsp + 0x2a], al
mov rdi, r9
mov ecx, 5
nop
cmp ecx, 9
jg 0x40936b
lea r8d, [rcx + 0x30]
jmp 0x40938b
mov eax, 0x66666667
mov r8d, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
add r8d, 0x30
mov word [rsp + rdi*2], r8w
add rdi, 1
add ecx, 1
cmp rdi, 0xa
jl 0x409360
mov edi, 0x11
mov ecx, 0x4e
cmp ecx, 0x5a
mov r8d, ecx
jle 0x4093cc
mov eax, 0xb40b40b5
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x5b
sub r8d, edx
add r8d, 0x41
mov word [rsp + rdi*2], r8w
add rdi, 1
add ecx, 1
cmp rdi, 0x2b
jl 0x4093a7
xor eax, eax
lea rdi, [rsp]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rdi, r10
not rcx
lea r8, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x40944b
mov rdx, r10
nop
movzx eax, word [rdx]
sub eax, 0x30
movsxd rcx, eax
cmp rcx, r8
jae 0x409425
movzx eax, word [rsp + rcx*2]
mov word [rdx], ax
xor eax, eax
add r9d, 1
mov rcx, 0xffffffffffffffff
mov rdi, r10
add rdx, 2
repne scasw ax, word [rdi]
mov eax, r9d
not rcx
sub rcx, 1
cmp rax, rcx
jb 0x409410
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.0040bd10
add rsp, 0x70
pop rdi
ret
Function at 0x409de0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x8c0
mov rax, qword [0x004364e0]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.0040bb30
xor eax, eax
lea rdx, [0x0042b6ec]
lea rcx, [rsp + 0xe0]
mov r8, rbx
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.0040ca60
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409e9a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.0040bd10
add rsp, 0x8c0
pop rbx
ret
Function at 0x409ec0
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
mov r11, rsp
sub rsp, 0x668
mov rax, qword [0x004364e0]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov qword [r11 + 0x20], rsi
mov rsi, rcx
mov qword [r11 - 8], rdi
mov rdi, rdx
lea rcx, [r11 - 0x436]
mov r8d, 0x206
xor edx, edx
mov word [rsp + 0x230], 0
call fcn.0040bb30
lea rcx, [rsp + 0x442]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x440], 0
call fcn.0040bb30
lea rcx, [rsp + 0x230]
mov r11, rsi
sub rcx, rsi
movzx eax, word [r11]
add r11, 2
test ax, ax
mov word [rcx + r11 - 2], ax
jne 0x409f35
lea rdx, [rsp + 0x440]
mov rcx, rdi
sub rdx, rdi
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rdx + rcx - 2], ax
jne 0x409f60
lea rcx, [rsp + 0x230]
call fcn.0040dd40
lea rcx, [rsp + 0x440]
call fcn.0040dd40
lea r11, [rsp + 0x230]
lea rdx, [rsp + 0x440]
sub rdx, r11
nop
movzx ecx, word [r11]
movzx eax, word [r11 + rdx]
sub ecx, eax
jne 0x409fb5
add r11, 2
test eax, eax
jne 0x409fa0
test ecx, ecx
je 0x40a096
mov qword [rsp + 0x680], rbx
xor ebx, ebx
nop
nop
nop
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], 0
call fcn.0040bb30
test ebx, ebx
jne 0x40a003
lea rdx, str._s.bak
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.0040ca60
jmp 0x40a01a
lea rdx, str._s.bak_d
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov r8, rdi
call fcn.0040ca60
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a034
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.0040de80
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40a07d
lea r8d, [rax + 5]
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebx, 0xa
jge 0x40a08e
add ebx, 1
jmp 0x409fd0
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rbx, qword [rsp + 0x680]
mov rdi, qword [rsp + 0x660]
mov rsi, qword [rsp + 0x688]
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.0040bd10
add rsp, 0x668
ret
Function at 0x40a100
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x004364e0]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x114
xor ebx, ebx
call fcn.0040bb30
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a1dd
cmp dword [rsp + 0x54], 5
jbe 0x40a1dd
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a1dd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, str.EnableLUA
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a1d2
cmp dword [rsp + 0x30], ebx
setne bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.0040bd10
add rsp, 0x180
pop rbx
ret

Function at 0x40a200
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov rbx, rcx
mov qword [rsp + 0x58], rdi
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x58]
not rcx
cmp rcx, 1
je 0x40a25d
lea rdx, str.open
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40a25d
mov rcx, rbx
call fcn.00409de0
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x40ae80
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov byte [rcx + 0x68], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, rcx
mov dword [rcx + 0x14], edi
mov dword [rcx + 0x10], edi
cmp qword [rdx + 0x20], 0x10
mov rsi, qword [rdx + 0x18]
jb 0x40aed3
mov rbp, qword [rdx + 8]
jmp 0x40aed7
lea rbp, [rdx + 8]
mov byte [rcx + 0x68], dil
lea ecx, [rsi*8]
lea eax, [rsi*8]
cmp ecx, eax
mov dword [rbx + 0x10], ecx
jae 0x40aef7
mov dword [rbx + 0x14], 1
mov eax, esi
shr eax, 0x1d
add dword [rbx + 0x14], eax
cmp rsi, 0x40
jb 0x40af78
mov rax, qword [rbp]
lea rdx, [rbx + 0x18]
mov rcx, rbx
mov qword [rdx], rax
mov rax, qword [rbp + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbp + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rbp + 0x18]
mov qword [rdx + 0x18], rax
mov rax, qword [rbp + 0x20]
mov qword [rdx + 0x20], rax
mov rax, qword [rbp + 0x28]
mov qword [rdx + 0x28], rax
mov rax, qword [rbp + 0x30]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp + 0x38]
mov qword [rdx + 0x38], rax
call fcn.0040a2a0
cmp rsi, 0x7f
mov edi, 0x40
jbe 0x40af78
nop
nop
mov edx, edi
mov rcx, rbx
add rdx, rbp
call fcn.0040a2a0
add edi, 0x40
lea ecx, [rdi + 0x3f]
cmp rcx, rsi
jb 0x40af60
mov eax, edi
lea rcx, [rbx + 0x18]
sub rsi, rax
lea rdx, [rax + rbp]
mov r8, rsi
call fcn.0040edd0
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x40de80
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40dea9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40dea9
mov ecx, eax
call fcn.004101c0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x410517
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004364e0]
jne 0x40bd2a
rol rcx, 0x10
test cx, 0xffff
jne 0x40bd26
repz ret
ror rcx, 0x10
jmp 0x410470
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00438260]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x00438358]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x4104f5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00438260]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x410517
mov rax, qword [rsp + 0x88]
mov qword [0x00438358], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x004382f8], rax
mov rax, qword [0x00438358]
mov qword [0x004381d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x004382e0], rax
mov dword [0x004381c0], 0xc0000409
mov dword [0x004381c4], 1
mov rax, qword [0x004364e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004364e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x00438258], eax
mov ecx, 1
call fcn.00410710
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0042cf80]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x00438258], 0
jne 0x41059e
mov ecx, 1
call fcn.00410710
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x41ced0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00410790
xor ebx, ebx
cmp qword [0x004390f8], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x41d001
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x41cf33
xor eax, eax
jmp 0x41d0e1
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x41cf2c
mov rcx, rax
call fcn.00410720
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x004390f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00410720
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x00439100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00410720
lea rcx, [rsp + 0x30]
mov qword [0x00439108], rax
call fcn.004166a0
test eax, eax
je 0x41cfb7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040beb0
cmp dword [rsp + 0x30], 2
jne 0x41d001
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00410720
test rax, rax
mov qword [0x00439118], rax
je 0x41d001
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00410720
mov qword [0x00439110], rax
mov rcx, qword [0x00439110]
cmp rcx, rsi
je 0x41d093
cmp qword [0x00439118], rsi
je 0x41d093
call fcn.004107f0
call rax
test rax, rax
mov rbp, rax
je 0x41d05e
mov rcx, qword [0x00439118]
call fcn.004107f0
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x41d05e
test byte [rsp + 0x48], 1
jne 0x41d093
lea rcx, [rsp + 0x34]
call fcn.004166f0
test eax, eax
je 0x41d080
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040beb0
cmp dword [rsp + 0x34], 4
jb 0x41d08d
bts edi, 0x15
jmp 0x41d0c7
bts edi, 0x12
jmp 0x41d0c7
mov rcx, qword [0x00439100]
cmp rcx, rsi
je 0x41d0c7
call fcn.004107f0
call rax
test rax, rax
mov rbx, rax
je 0x41d0c7
mov rcx, qword [0x00439108]
cmp rcx, rsi
je 0x41d0c7
call fcn.004107f0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x004390f8]
call fcn.004107f0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1405f6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405f61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405f6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f606f
add dl, dl
jne 0x1405f6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f60f6
xor eax, eax
add dl, dl
jne 0x1405f60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f61ad
add dl, dl
jne 0x1405f60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405f60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405f607e
mov eax, 1
add dl, dl
jne 0x1405f6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f60fb
sub eax, ebx
mov ebx, 1
jne 0x1405f614c
mov ecx, 1
add dl, dl
jne 0x1405f612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405f6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f615d
cmp eax, 0x7d00
jae 0x1405f619b
cmp eax, 0x500
jb 0x1405f6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f607e
cmp eax, 0x7f
ja 0x1405f619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405f61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405f607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
Function at 0x140007008
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140007036
xor eax, eax
jmp 0x14000711c
cmp qword [rcx + 0x68], 0
je 0x140007047
call fcn.140007138
jmp 0x14000711c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000705e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140007060
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140007092
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400291a0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140007116
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400070c9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400070f2
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400114b8
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140007116
cmp rsi, rbx
ja 0x1400070d0
test rsi, rsi
je 0x140007116
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400114b8
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140008f50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008f9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008f9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008f9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008f9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140008f9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008f9c
xor al, al
add rsp, 0x28
ret