joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001dc0
Capabilities:
Create restart manager session
Enumerate processes that use resource
Get file attributes
Set file attributes
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
xor r14d, r14d
lea r12, [0x140005ae0]
mov dword [rbp + 0x7f], r14d
mov r15d, r14d
nop word [rax + rax]
mov rcx, qword [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140001f92
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r15d, r15d
jne 0x140001e66
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x140001e66
mov rcx, qword [rbp + 0x67]
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140001f79
inc r15d
jmp 0x140001e00
lea r8, [rbp - 0x29]
xor edx, edx
lea rcx, [rbp + 0x7f]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x140001f79
mov ecx, dword [rbp + 0x7f]
lea r8, [rbp + 0x67]
mov qword [rsp + 0x30], r14
lea edx, [rax + 1]
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov qword [rsp + 0x20], r14
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x140001f79
mov ecx, dword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov r9, r12
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x77]
mov dword [rbp + 0x6f], r14d
lea rdx, [rbp - 0x59]
mov dword [rbp + 0x77], 0x10
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x140001f79
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x140001f79
mov esi, r14d
mov rbx, r12
nop dword [rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001f4b
lea rax, [rbp - 0x49]
mov rcx, rdi
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140001f42
mov rax, qword [rbp - 0x51]
cmp qword [rbx + 4], rax
jne 0x140001f42
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add rbx, 0x29c
cmp esi, dword [rbp + 0x77]
jb 0x140001ef0
mov ecx, dword [rbp + 0x7f]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
test eax, eax
jne 0x140001f79
inc r15d
mov dword [rbp + 0x7f], r14d
cmp r15d, 0x10
jl 0x140001e00
jmp 0x140001f7d
mov r14d, dword [rbp + 0x7f]
test r14d, r14d
je 0x140001f8b
mov ecx, r14d
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov rax, 0xffffffffffffffff
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140001fb0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
call fcn.140001470
test eax, eax
jne 0x1400021c3
xor r9d, r9d
lea rdx, [0x140004388]
xor r8d, r8d
lea rcx, [rbp + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x1400021c3
mov rax, qword [rbp + 0x10]
lea rdx, [0x140004390]
xor r9d, r9d
mov qword [rdi + 0x40], rax
xor r8d, r8d
lea rcx, [rbp + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x1400021c3
mov rax, qword [rbp + 0x10]
lea rdx, [0x140004398]
xor r9d, r9d
mov qword [rdi + 0x48], rax
xor r8d, r8d
lea rcx, [rbp + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x1400021c3
mov rcx, qword [rbp + 0x10]
lea r9d, [rax + 0x20]
lea r8, str.ChainingModeCBC
mov dword [rsp + 0x20], eax
lea rdx, str.ChainingMode
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
test eax, eax
jne 0x1400021c3
mov rax, qword [rbp + 0x10]
xor ecx, ecx
mov edx, 0x400
mov qword [rdi + 0x50], rax
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rdi + 0x80], rax
test rax, rax
jne 0x14000209b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400021c3
mov rax, qword [rdi + 0x80]
lea rcx, [rbp - 0x40]
add rax, 0x200
mov qword [rbp - 8], 0
mov qword [rdi + 0x88], rax
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x140002111
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x98]
add rsp, 0x70
pop rbp
ret
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
lea rax, [rax + rax*2]
cqo
and edx, 3
lea rsi, [rdx + rax]
mov eax, 0x80000000
mov qword [rdi + 0x68], rax
sar rsi, 2
nop
cmp rax, rsi
jg 0x140002174
xor ecx, ecx
lea rdx, [rax + rax]
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rdi + 0x70], rax
lea rbx, [rdi + 0x70]
test rax, rax
jne 0x140002190
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140002190
jmp 0x140002178
lea rbx, [rdi + 0x70]
mov rax, qword [rdi + 0x68]
cqo
sub rax, rdx
sar rax, 1
mov qword [rdi + 0x68], rax
cmp rax, 0x100000
jge 0x140002140
mov rcx, qword [rbx]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
test rcx, rcx
jne 0x1400021b9
lea eax, [rcx - 1]
mov rdi, qword [rsp + 0x98]
add rsp, 0x70
pop rbp
ret
add rcx, qword [rdi + 0x68]
mov qword [rdi + 0x78], rcx
xor eax, eax
mov rdi, qword [rsp + 0x98]
add rsp, 0x70
pop rbp
ret
Function at 0x140002cf0
Capabilities:
Create process on windows
Self delete
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r9, str.delete_shadows__all__quiet
mov dword [rsp + 0x28], ebx
lea r8, str.vssadmin
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
ja 0x140002d25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], ebx
lea r9, str.add__HKLMSOFTWAREPoliciesMicrosoftWindows_NTTerminal_Services___v_MaxDisconnectionTime__t_REG_DWORD__d_1209600000__f
lea r8, [0x140004558]
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
ja 0x140002d52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], ebx
lea r9, str.stop_MSSQLSERVER__f__m
lea r8, [0x140004590]
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
ja 0x140002d7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], ebx
lea r9, str.stop_SQLSERVERAGENT__f__m
lea r8, [0x140004590]
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
ja 0x140002dac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], ebx
lea r9, str.stop_MSSQLFDLauncher__f__m
lea r8, [0x140004590]
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
ja 0x140002dd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400030a0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x14000313b
mov ecx, dword [rsp + 0x30]
dec ecx
cmp ecx, 1
ja 0x14000313b
mov qword [rsp + 0x38], rbx
lea r8, str.8DC1F7B9D2F4EA58
mov qword [rsp + 0x40], rdi
xor edx, edx
xor ecx, ecx
xor dil, dil
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400030fd
mov dil, 1
call fcn.140002cf0
mov eax, dword [rsp + 0x30]
xor ebx, ebx
cmp eax, 1
jne 0x14000310f
call fcn.1400021e0
jmp 0x14000311d
cmp eax, 2
jne 0x14000311f
mov rcx, qword [rsi + 8]
call fcn.140002c00
mov ebx, eax
test dil, dil
mov rdi, qword [rsp + 0x40]
je 0x14000312e
call fcn.140002df0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0xffffffff
add rsp, 0x20
pop rsi
ret
Function at 0x40e73c
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0xc], 0x105
mov rbx, rcx
jg 0x40e758
mov edx, 0x105
call fcn.0040139c
mov rcx, qword [rbx]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r8, qword [rbx]
mov r11d, eax
xor eax, eax
cmp word [r8], ax
mov edx, eax
je 0x40e784
mov rcx, r8
add rcx, 2
inc edx
cmp word [rcx], ax
jne 0x40e779
movsxd rcx, edx
mov word [r8 + rcx*2], ax
lea ecx, [r11 - 1]
mov dword [rbx + 8], edx
cmp ecx, 0x103
setbe al
add rsp, 0x20
pop rbx
ret

Function at 0x40e8ac
Capabilities:
Set file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40e8cf
mov al, 1
jmp 0x40e92b
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.0040139c
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.00410ab8
test al, al
je 0x40e91d
mov edx, edi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
jmp 0x40e91f
xor bl, bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x40e954
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40e974
mov al, 1
jmp 0x40e9ce
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.0040139c
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.00410ab8
test al, al
je 0x40e9c0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
jmp 0x40e9c2
xor bl, bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
add rsp, 0x40
pop rbx
ret

Function at 0x40eae8
Capabilities:
Move file

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40eb0f
mov al, 1
jmp 0x40ebb5
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov edx, 3
lea rcx, [rsp + 0x38]
call fcn.0040139c
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.0040139c
nop
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rdi
call fcn.0040e9ec
test al, al
je 0x40eb9c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
nop
jmp 0x40eba9
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
nop
xor bl, bl
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
mov al, bl
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x40ec00
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40ec22
mov al, 1
jmp 0x40ec95
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40ec93
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.0040139c
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.00410ab8
test al, al
je 0x40ec89
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x40ec95
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x40
pop rbx
ret

Function at 0x40ecb8
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
xor edx, edx
call fcn.0040e8ac
test al, al
je 0x40ed40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40ece6
mov al, 1
jmp 0x40ed40
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.0040139c
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.00410ab8
test al, al
je 0x40ed32
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x40ed34
xor bl, bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
add rsp, 0x40
pop rbx
ret

Function at 0x40f0f4
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0xc], 0x105
mov rbx, rcx
jg 0x40f110
mov edx, 0x105
call fcn.0040139c
mov rdx, qword [rbx]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r8, qword [rbx]
mov r11d, eax
xor eax, eax
cmp word [r8], ax
mov edx, eax
je 0x40f13c
mov rcx, r8
add rcx, 2
inc edx
cmp word [rcx], ax
jne 0x40f131
movsxd rcx, edx
mov word [r8 + rcx*2], ax
lea ecx, [r11 - 1]
mov dword [rbx + 8], edx
cmp ecx, 0x103
setbe al
add rsp, 0x20
pop rbx
ret

Function at 0x40f200
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0xc], 0x105
mov rbx, rcx
jg 0x40f21c
mov edx, 0x105
call fcn.0040139c
mov rdx, qword [rbx]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8, qword [rbx]
mov r11d, eax
xor eax, eax
cmp word [r8], ax
mov edx, eax
je 0x40f248
mov rcx, r8
add rcx, 2
inc edx
cmp word [rcx], ax
jne 0x40f23d
movsxd rcx, edx
mov word [r8 + rcx*2], ax
lea ecx, [r11 - 1]
mov dword [rbx + 8], edx
cmp ecx, 0x103
setbe al
add rsp, 0x20
pop rbx
ret
Function at 0x40f268
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov edx, 0x105
mov rbx, r8
cmp dword [r8 + 0xc], edx
mov rsi, rcx
jg 0x40f28c
mov rcx, r8
call fcn.0040139c
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov r8, qword [rbx]
xor r9d, r9d
cmp word [r8], r9w
mov r11d, eax
mov edx, r9d
je 0x40f2bf
mov rcx, r8
add rcx, 2
inc edx
cmp word [rcx], r9w
jne 0x40f2b3
movsxd rax, edx
mov word [r8 + rax*2], r9w
mov dword [rbx + 8], edx
mov eax, r11d
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x41034c
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 8], 0
mov rbx, rdx
je 0x41036b
cmp byte [rcx + 9], 0
je 0x41036b
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x41039f
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x41038e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41038e
xor al, al
jmp 0x4103a1
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x41053c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x410578
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x00442388]
cmp r8d, eax
cmova r8d, eax
jmp fcn.0041053c

Function at 0x410614
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x00442388]
mov rcx, qword [rcx]
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x41065c
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.004103a8
xor ebx, ebx
cmp al, bl
je 0x410684
cmp qword [rsp + 0x50], rdi
je 0x410688
xor al, al
jmp 0x410696
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x4107f0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x78
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rdx
mov rbp, rcx
xor r13d, r13d
mov dword [rdx + 8], r13d
mov rax, qword [rdx]
mov word [rax], r13w
mov edi, r13d
movzx ebx, word [rcx]
cmp bx, r13w
je 0x410835
mov rax, rcx
inc edi
add rax, 2
cmp word [rax], r13w
jne 0x410829
cmp edi, 1
jl 0x410a2a
mov si, 0x5c
cmp bx, si
je 0x410a2a
cmp bx, 0x2e
jne 0x410869
cmp edi, 1
je 0x410a2a
cmp edi, 2
jne 0x410869
cmp word [rcx + 2], bx
je 0x410a2a
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], r13d
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.0040139c
nop
cmp edi, 3
jle 0x4108b8
cmp word [rbp + 2], 0x3a
jne 0x4108b8
cmp word [rbp + 4], si
jne 0x4108b8
cmp bx, 0x61
jb 0x4108aa
cmp bx, 0x7a
jbe 0x41093e
sub bx, 0x41
cmp bx, 0x19
jbe 0x41093e
mov edi, 0x105
cmp dword [rsp + 0x34], edi
jg 0x4108cf
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.0040139c
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r11d, eax
mov eax, r13d
cmp word [rbx], r13w
je 0x4108fa
mov rcx, rbx
inc eax
add rcx, 2
cmp word [rcx], r13w
jne 0x4108ee
movsxd rcx, eax
mov word [rbx + rcx*2], r13w
mov dword [rsp + 0x30], eax
cmp r11d, r13d
je 0x41092f
cmp r11d, 0x104
ja 0x41092f
cmp word [rbx + rcx*2 - 2], si
je 0x410943
movzx edx, si
lea rcx, [rsp + 0x28]
call fcn.00404c04
mov rbx, qword [rsp + 0x28]
jmp 0x410943
mov rcx, rbx
call sub.msvcrt.dll_free
xor al, al
jmp 0x410a2c
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x44], r13d
mov esi, r13d
lea rdi, [0x00431ef0]
mov rax, rdi
inc esi
add rax, 2
cmp word [rax], r13w
jne 0x41095f
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.0040139c
mov rcx, qword [rsp + 0x38]
sub rcx, rdi
movzx eax, word [rdi]
mov word [rcx + rdi], ax
add rdi, 2
cmp ax, r13w
jne 0x41097f
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.0040e544
nop
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.00410738
mov rdi, rax
cmp rax, r12
je 0x4109fd
mov dword [r12 + 8], r13d
mov rax, qword [r12]
mov word [rax], r13w
mov edx, dword [rdi + 8]
mov rcx, r12
call fcn.0040139c
mov r11, qword [r12]
mov rdx, qword [rdi]
movzx eax, word [rdx]
mov word [r11], ax
add r11, 2
add rdx, 2
cmp ax, r13w
jne 0x4109e0
mov eax, dword [rdi + 8]
mov dword [r12 + 8], eax
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, rbx
call sub.msvcrt.dll_free
mov al, 1
jmp 0x410a2c
mov al, 1
add rsp, 0x78
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4115cc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov r11, rsp
sub rsp, 0x40
mov rax, qword [r8]
mov dword [r8 + 8], 0
mov rsi, rcx
mov word [rax], 0
mov rcx, qword [rcx]
lea rax, [r11 + 0x30]
mov rbx, r8
mov qword [r11 - 0x18], rax
lea r9, [r11 + 0x38]
xor r8d, r8d
mov qword [r11 - 0x20], 0
mov rdi, rdx
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x70], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41162b
cmp eax, 0xea
jne 0x411697
mov edx, dword [rsp + 0x70]
cmp edx, dword [rbx + 0xc]
jl 0x41163c
mov rcx, rbx
call fcn.0040139c
mov rax, qword [rbx]
lea rcx, [rsp + 0x70]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8, qword [rbx]
xor ecx, ecx
cmp word [r8], cx
mov r11d, eax
je 0x411687
mov rdx, r8
add rdx, 2
inc ecx
cmp word [rdx], 0
jne 0x41167b
movsxd rax, ecx
mov word [r8 + rax*2], 0
mov dword [rbx + 8], ecx
mov eax, r11d
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x4116b8
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4116e3
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
add rsp, 0x68
ret

Function at 0x41e454
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov r10, rcx
je 0x41e49e
mov r11, rcx
mov ebx, edx
mov r9d, dword [r8]
mov ecx, dword [r8 + 4]
movzx eax, r9w
shr r9d, 0x10
imul eax, eax, 0x9069
add eax, r9d
mov dword [r8], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
mov dword [r8 + 4], eax
mov byte [r11], al
inc r11
dec rbx
jne 0x41e466
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.0041e418

Function at 0x41ea60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ecx, ecx
call fcn.0042d5d0
mov ecx, 0x500
call fcn.0042d5b0
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
setne cl
cmp cl, bl
je 0x41eb65
mov eax, ebx
mov rcx, rdi
mov r9d, 0x100
mov byte [rcx], al
inc eax
inc rcx
cmp eax, r9d
jb 0x41ea9a
mov r8d, 0xffffffff
mov r10, rdi
mov cl, byte [r10]
mov eax, r8d
inc r10
xor cl, r8b
shr eax, 8
movzx edx, cl
lea rcx, [0x00442da0]
mov r8d, dword [rcx + rdx*4]
xor r8d, eax
dec r9
jne 0x41eaaf
not r8d
cmp r8d, 0x29058c73
jne 0x41eb65
mov edx, 0x1f123bb5
mov r9d, 0x159a55e5
lea r8, [rdi + 0x100]
mov r10d, 0x400
movzx ecx, r9w
shr r9d, 0x10
imul ecx, ecx, 0x9069
add r9d, ecx
movzx ecx, dx
shr edx, 0x10
imul ecx, ecx, 0x4650
add edx, ecx
mov byte [r8], dl
inc r8
dec r10
mov dword [rsp + 0x54], edx
mov al, dl
jne 0x41eafc
mov esi, ebx
mov r12d, esi
mov ebp, ebx
add r12, rdi
mov edx, ebp
mov rcx, r12
call fcn.0042d860
mov edx, ebp
mov rcx, r12
mov r11d, eax
call fcn.0041e418
cmp eax, r11d
jne 0x41eb65
inc ebp
cmp ebp, 0x20
jb 0x41eb36
inc esi
cmp esi, 0x4e0
jb 0x41eb2e
mov bl, 1
mov rcx, rdi
call fcn.0042d5d0
mov al, bl
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x426b24
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rbx]
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_free