joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ad0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00d56f44], 0
je 0x414b0b
mov ecx, dword [0x00c9f4a4]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x414b1f
call fcn.00414a70
mov ecx, dword [0x00c9f4a4]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x414b1f
mov rax, qword [0x00d56f78]
jmp 0x414b1f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x00c9f4a4]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x42f260
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
nop
mov ecx, 0x104
lea rdx, [rbp + 0x254]
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x42f37c
lea rbx, [rbp + 0x254]
mov word [rbx + 4], 0
mov rcx, rbx
lea rdx, [rbp + 0x48]
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x42f362
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x48]
mov r8d, 0x106
call fcn.004100c0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov r8d, 1
call fcn.004108f0
test eax, eax
jle 0x42f362
xor rsi, rsi
cmp qword [rbp + 0x40], 0
je 0x42f312
mov rax, qword [rbp + 0x40]
mov esi, dword [rax - 4]
xor rdi, rdi
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x42f325
mov rax, qword [rbp + 0x28]
mov edi, dword [rax - 4]
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.00410060
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, esi
add r8d, 1
mov r9d, edi
sub r9d, esi
call fcn.00410630
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.00410420
jmp 0x42f37b
add rbx, 2
cmp word [rbx], 0
jne 0x42f35e
add rbx, 4
test rbx, rbx
je 0x42f37b
cmp word [rbx], 0
jne 0x42f2b2
nop
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.0040e420
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x468]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x42f530
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
sub rsp, 0x2a0
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x2c0], r8
mov dword [rbp + 0x2c8], r9d
nop
mov byte [rbp + 0x28f], 0
mov rcx, qword [rbp + 0x2c0]
call fcn.0040e340
mov dword [rbp + 0x288], 0
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x288]
call sub.kernel32.dll_GetFileSize_1
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
jne 0x42f648
cmp dword [rbp + 0x288], 0
jne 0x42f648
mov ecx, 6
xor rdx, rdx
call fcn.0043e7c0
test al, al
je 0x42f648
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x78]
mov r8d, 0x104
mov r9d, 2
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x42f648
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.004100c0
mov rcx, rbp
lea rdx, [rbp + 0x60]
mov r8, qword [rbp + 0x58]
call fcn.0042f260
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x60]
call fcn.0040e970
mov byte [rbp + 0x28f], 1
jmp 0x42f7b3
cmp dword [rbp + 0x284], 0
jne 0x42f65e
cmp dword [rbp + 0x288], 0
je 0x42f74c
mov rcx, qword [rbp + 0x2b8]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x290], rax
cmp qword [rbp + 0x290], 0x3ee
je 0x42f74c
nop
mov rcx, qword [rbp + 0x290]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 1
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x298], rax
cmp qword [rbp + 0x298], 0
je 0x42f73f
nop
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp + 0x298]
lea r8, [rbp + 0x78]
mov r9d, 0x104
call fcn.0041e390
test eax, eax
jbe 0x42f732
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.004100c0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x48]
call fcn.0042f260
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x50]
call fcn.0040e970
mov byte [rbp + 0x28f], 1
nop
mov rcx, qword [rbp + 0x298]
call sub.kernel32.dll_UnmapViewOfFile
nop
mov rcx, qword [rbp + 0x290]
call sub.kernel32.dll_CloseHandle_1
cmp byte [rbp + 0x28f], 0
jne 0x42f7b2
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x2b8]
call fcn.0042f3d0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x40]
call fcn.0040e970
mov rax, qword [rbp + 0x2c0]
cmp qword [rax], 0
je 0x42f7b2
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0x2c0]
mov r8, qword [rax]
call fcn.0042f260
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x38]
call fcn.0040e970
mov byte [rbp + 0x28f], 1
nop
lea rcx, [rbp + 0x38]
mov edx, 6
call fcn.0040e420
movzx rax, byte [rbp + 0x28f]
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x42f870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x67], 0
mov ecx, 6
xor rdx, rdx
call fcn.0043e7c0
test al, al
je 0x42f987
mov rcx, qword [rbp + 0x80]
xor rdx, rdx
call fcn.00431ee0
test al, al
je 0x42f987
mov rcx, qword [rbp + 0x80]
call fcn.00431ab0
test al, 0x20
je 0x42f987
mov rcx, qword [rbp + 0x80]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], 0xffffffff
je 0x42f987
mov eax, dword [rbp + 0x5c]
test eax, 0x400
je 0x42f987
mov eax, dword [rbp + 0x5c]
test eax, 0x10
je 0x42f914
mov dword [rbp + 0x60], 0x2000000
jmp 0x42f91b
mov dword [rbp + 0x60], 0
mov rcx, qword [rbp + 0x80]
call fcn.0040ffc0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov eax, dword [rbp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x42f987
nop
mov rcx, rbp
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x88]
mov r9d, dword [rbp + 0x60]
call fcn.0042f530
mov byte [rbp + 0x67], al
nop
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle_1
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x431ab0
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x70]
mov rdx, qword [0x00431a28]
mov r8d, 1
mov r9d, 0x104
call fcn.00411e80
lea rcx, [rbp + 0x68]
mov rdx, qword [0x00431a68]
mov r8d, 1
mov r9d, 0x104
call fcn.00411e80
movzx rax, byte [0x00431d5c]
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00431fd0
test al, al
jne 0x431b54
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00431ee0
test al, al
je 0x431c6c
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x48]
call fcn.00432a70
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x58]
call fcn.0043ee50
mov rcx, qword [rbp + 0x88]
call fcn.0040ffc0
mov rcx, rax
mov rdx, qword [rbp + 0x70]
mov r8d, 0x104
lea r9, [rbp + 0x84]
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x104
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x431c67
mov eax, dword [rbp + 0x80]
test eax, 1
je 0x431bde
movzx rax, byte [rbp + 0x47]
or al, 1
mov byte [rbp + 0x47], al
mov eax, dword [rbp + 0x80]
test eax, 2
je 0x431bf7
movzx rax, byte [rbp + 0x47]
or al, 2
mov byte [rbp + 0x47], al
mov eax, dword [rbp + 0x80]
test eax, 0x80
je 0x431c10
movzx rax, byte [rbp + 0x47]
or al, 0x20
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x88]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
test eax, eax
je 0x431c40
sub eax, 1
test eax, eax
je 0x431c4d
sub eax, 1
test eax, eax
je 0x431c5a
sub eax, 1
test eax, eax
jne 0x431c97
movzx rax, byte [rbp + 0x47]
or al, 0x10
mov byte [rbp + 0x47], al
jmp 0x431c97
movzx rax, byte [rbp + 0x47]
or al, 4
mov byte [rbp + 0x47], al
jmp 0x431c97
movzx rax, byte [rbp + 0x47]
or al, 8
mov byte [rbp + 0x47], al
jmp 0x431c97
call fcn.0043fa90
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00d51c10]
call fcn.004146d0
mov rcx, qword [0x004271a0]
mov dl, 1
mov r8, qword [rbp + 0x50]
call fcn.0043d050
mov rcx, rax
call fcn.0040d3b0
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040e420
lea rcx, [rbp + 0x68]
mov rdx, qword [0x00431a68]
call fcn.00412060
lea rcx, [rbp + 0x70]
mov rdx, qword [0x00431a28]
call fcn.00412060
lea rcx, [rbp + 0x88]
call fcn.0040e340
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x431ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x431f92
mov ecx, eax
test ecx, 0x400
je 0x431f87
test sil, sil
jne 0x431f1f
mov al, 1
jmp 0x431fbc
test eax, 0x10
je 0x431f2f
xor rax, rax
jmp 0x431fbc
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
mov edx, 0x80000000
add byte [rax], al
add byte [rcx - 0x39], 0xc0
add dword [rax], eax
add byte [rax], al
test eax, 0x10
sete al
jmp 0x431fbc
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x431fb5
cmp eax, 3
je 0x431fb5
cmp eax, 0x7b
je 0x431fb5
mov rcx, rbp
mov rdx, rbx
call fcn.00431e90
test al, al
jne 0x431fba
xor rax, rax
jmp 0x431fbc
mov al, 1

Function at 0x431fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
xor rdi, rdi
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov r13d, eax
cmp r13d, 0xffffffff
je 0x4320dc
mov eax, r13d
test eax, 0x400
jne 0x43201a
test r13d, 0x10
setne dil
jmp 0x43210f
test sil, sil
je 0x43207a
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
cmp rax, 0xffffffffffffffff
je 0x43210f
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
test r13d, 0x10
setne dil
jmp 0x43210f
test r13d, 0x10
je 0x43208b
mov dil, 1
jmp 0x43210f
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
cmp rax, 0xffffffffffffffff
je 0x4320d7
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
xor rdi, rdi
jmp 0x43210f
mov dil, 1
jmp 0x43210f
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x432107
cmp eax, 3
je 0x432107
cmp eax, 0xa1
je 0x432107
cmp eax, 0x7b
je 0x432107
cmp eax, 0x35
je 0x432107
cmp eax, 0x15
je 0x432107
cmp eax, 0x43
jne 0x43210c
xor rdi, rdi
jmp 0x43210f
mov dil, 1
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x432210
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [rbp + 0x20]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x28]
test eax, 0x400
je 0x4322c3
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x4322c3
or eax, 0xffffffff
mov dword [rbp + 0x28], eax
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.0042f870
test al, al
je 0x4322c3
mov rcx, qword [rbp + 0x48]
call fcn.00432d10
test al, al
je 0x4322af
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00432980
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0043ee50
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.00410420
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e420
lea rcx, [rbp + 0x48]
call fcn.0040e340
mov eax, dword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x432470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
xor rax, rax
mov byte [rbp + 0x2f], al
mov rcx, qword [rbp + 0x20]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x432526
mov eax, ebx
test eax, 0x400
je 0x43251a
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.0042f870
test al, al
je 0x43251a
mov rcx, qword [rbp + 0x48]
call fcn.00432d10
test al, al
je 0x432507
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00432980
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0043ee50
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.00410420
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
test ebx, 1
setne al
mov byte [rbp + 0x2f], al
nop
lea rcx, [rbp + 0x30]
xor r15b, r8b
ret 2
add byte [rax], al
call fcn.0040e420
lea rcx, [rbp + 0x48]
call fcn.0040e340
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x58]
pop rax
Function at 0x43e7e0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
nop
mov dword [rbp + 0x54], 0xffffffff
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x70]
call fcn.0040e9f0
lea rcx, [rbp + 0x48]
call fcn.0040eca0
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
lea rdx, [rbp + 0x40]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x43e891
mov ecx, dword [rbp + 0x44]
call fcn.00406850
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
mov edx, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43e887
mov rcx, qword [rbp + 0x58]
lea rdx, [0x0043e904]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x34]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43e887
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x54], eax
nop
mov rcx, qword [rbp + 0x58]
call fcn.00406880
nop
lea rcx, [rbp + 0x48]
call fcn.0040e340
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x504720
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x00d5bef0], 0
jne 0x5047d5
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x00d5bee8]
mov qword [rbx], rax
lea rcx, [0x00cb0660]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.00406ce0
lea rax, [0x005046e0]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.00504710
mov dword [rsi + 1], eax
mov rax, qword [0x00d5bef0]
mov qword [rsi + 5], rax
mov qword [0x00d5bef0], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x504793
mov qword [0x00d5bee8], rbx
mov rax, qword [0x00d5bef0]
mov rsi, qword [0x00d5bef0]
mov rcx, qword [rsi + 5]
mov qword [0x00d5bef0], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x54d960
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
nop
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xc8]
call fcn.0040e9f0
mov rcx, qword [rbp + 0x78]
call fcn.0054cf30
mov byte [rbp + 0x83], al
cmp byte [rbp + 0x83], 0
jne 0x54d9d5
lea rcx, [rbp + 0x78]
mov edx, 1
mov r8d, 1
call fcn.00410690
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x98], rax
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.0054e250
mov qword [rbp + 0x90], rax
cmp qword [rbp + 0x90], 0
je 0x54db29
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x90]
call fcn.0054d330
mov rcx, qword [rbp + 0xc0]
lea rdx, [rbp + 0x54]
call fcn.0054dcb0
test al, al
je 0x54db09
lea rcx, [rbp + 0x70]
xor rdx, rdx
mov r8d, dword [rbp + 0x58]
add r8d, 1
call fcn.0040e600
mov eax, dword [rbp + 0x54]
sub eax, 1
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x54db08
mov eax, dword [rbp + 0x58]
add eax, 1
mov dword [rbp + 0x88], eax
mov rcx, qword [rbp + 0x70]
call fcn.0040ffc0
mov rcx, qword [rbp + 0x90]
mov edx, dword [rbp + 0x84]
mov r8, rax
lea r9, [rbp + 0x88]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0054d250
test al, al
je 0x54daf4
mov rcx, qword [rbp + 0x70]
call fcn.0040ffc0
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00410060
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x40]
call fcn.0054d960
sub dword [rbp + 0x84], 1
cmp dword [rbp + 0x84], 0xffffffff
jne 0x54da68
nop
nop
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x98]
call fcn.0054d330
mov rcx, qword [rbp + 0x90]
call sub.advapi32.dll_RegCloseKey_1
cmp byte [0x00d5c044], 0
je 0x54db88
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.0054d310
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.0040ffc0
mov rcx, rbx
mov rdx, rax
mov rax, qword [rbp + 0xc0]
mov r8d, dword [rax + 0x2c]
and r8d, 0x300
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0054d250
mov byte [rbp + 0x8f], al
jmp 0x54dbc7
mov rcx, qword [rbp + 0xc0]
movzx rdx, byte [rbp + 0x83]
call fcn.0054d310
mov rbx, rax
mov rcx, qword [rbp + 0x78]
call fcn.0040ffc0
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov rcx, qword [rbp + 0xc0]
mov edx, eax
call fcn.0054d250
mov byte [rbp + 0x8f], al
nop
lea rcx, [rbp + 0x40]
call fcn.0040e340
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.0040e420
movzx rax, byte [rbp + 0x8f]
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret

Function at 0x55a340
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x55a382
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x55a353
nop
ret
Function at 0x6eecb0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6eeee2
mov rcx, qword [0x004b8da8]
mov dl, 1
call fcn.004ed010
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040e340
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x6eeeba
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.005b6740
test al, al
je 0x6eeea4
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x006eef74]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00433420
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6eeea4
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006eefe2]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6eee97
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.004100c0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x6eee97
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.004100c0
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x6eed58
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.004ecec0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040e340
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6f0270
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x00d5c658]
cmp byte [rax + 0x159], 0
jne 0x6f0313
cmp qword [0x00d5c690], 0
jne 0x6f02b6
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x00cd5118]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x00d5c690], rax
cmp qword [0x00d5c688], 0
jne 0x6f02d8
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x00d5c688], rax
cmp qword [0x00d5c698], 0
jne 0x6f0313
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x00cd5110]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x00d5c698], rax
add rsp, 0x48
ret

Function at 0x6f14f0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6f15d6
cmp dword [rbx + 0x128], 0
jne 0x6f15cc
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006f13d0]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6f15cc
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6f157a
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6f15cb
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.004e5ea0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6f158b
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret