joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001be3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x14001be89
cmp rcx, 0xffffffffffffffff
je 0x14001be89
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001be81
cmp dword [rcx + 0x3c], edx
jl 0x14001be81
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14001be81
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14001be89
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000a008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000a008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1013f000
add rsp, 0x28
jmp 0x10007510
Function at 0x140001000
Capabilities:
Encode data using base64

Disassembly:
push rdi
cmp qword [rdx], 0x1d
mov r10, r8
mov r11, rdx
mov rdi, rcx
jae 0x14000101f
mov qword [rdx], 0x1d
mov eax, 0xffffffd6
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov rax, rdi
mov qword [rsp + 0x18], rsi
mov ebx, 6
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax + rax]
movzx edx, byte [r10]
lea rax, [rax + 4]
movzx r9d, byte [r10 + 2]
mov ecx, edx
movzx r8d, byte [r10 + 1]
lea r10, [r10 + 3]
shr rcx, 2
and edx, 3
shl edx, 4
movzx ecx, byte [rcx + rsi]
mov byte [rax - 4], cl
mov ecx, r8d
shr ecx, 4
and r8d, 0xf
add edx, ecx
movzx ecx, byte [rdx + rsi]
mov byte [rax - 3], cl
mov ecx, r9d
shr ecx, 6
and r9d, 0x3f
lea ecx, [rcx + r8*4]
movzx ecx, byte [rcx + rsi]
mov byte [rax - 2], cl
movzx ecx, byte [r9 + rsi]
mov byte [rax - 1], cl
sub rbx, 1
jne 0x140001040
movzx edx, byte [r10]
movzx r8d, byte [r10 + 1]
mov ecx, edx
shr rcx, 2
and edx, 3
shl edx, 4
movzx ecx, byte [rcx + rsi]
mov byte [rax], cl
mov ecx, r8d
shr ecx, 4
and r8d, 0xf
add edx, ecx
shl r8d, 2
movzx ecx, byte [rdx + rsi]
mov byte [rax + 1], cl
movzx ecx, byte [r8 + rsi]
mov byte [rax + 2], cl
lea rcx, [rax + 4]
mov rsi, qword [rsp + 0x18]
mov byte [rax + 3], 0x3d
mov rax, rcx
sub rax, rdi
mov byte [rcx], bl
mov rbx, qword [rsp + 0x10]
mov qword [r11], rax
xor eax, eax
pop rdi
ret
Function at 0x140006bb0
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1d0
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rsi, rdx
mov edi, ecx
lea rdx, [0x140006ba0]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
lea rdx, [0x140006ba0]
mov ecx, recv
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
test eax, eax
je 0x140006c3c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.WSAStartup_failed_with_error:__d_n
mov rcx, rax
call fcn.1400016b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140007760
mov r8, rsi
mov edx, edi
mov rcx, rax
mov rbx, rax
call fcn.1400077a0
mov esi, eax
test eax, eax
je 0x140006c65
xor ecx, ecx
test eax, eax
cmovg ecx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rbx
call fcn.1400074b0
mov rax, qword [rbx + 0x30]
mov rcx, rax
call qword [rax]
test al, al
je 0x140006c84
mov eax, 0xffffffff
jmp 0x140006d3f
cmp dword [0x140017748], 0
mov rdi, qword [rbx + 0x28]
jne 0x140006cb0
mov edx, 2
mov rcx, rdi
call qword [rdi + 0x18]
test eax, eax
js 0x140006cab
cmp dword [0x140017748], 0
je 0x140006c91
jmp 0x140006cb0
mov esi, 0xffffffff
mov rcx, rdi
call qword [rdi + 0x20]
mov rcx, qword [rbx + 0x20]
call fcn.140007c80
mov rcx, qword [rbx + 0x30]
call fcn.1400058b0
mov rdi, qword [rbx + 0x28]
test rdi, rdi
je 0x140006cfd
mov rcx, qword [rdi + 0x58]
call fcn.14000c240
xorps xmm0, xmm0
mov rcx, rdi
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14000ed60
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000abb0
Capabilities:
Connect socket
Get socket status
Resolve dns
Set socket configuration

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x2a0
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov dword [rsp + 0x50], 1
xor r14d, r14d
mov dword [rsp + 0x54], 6
xorps xmm0, xmm0
mov qword [rsp + 0x48], r14
xorps xmm1, xmm1
mov qword [rsp + 0x30], r14
mov r8d, edx
lea rcx, [rsp + 0x30]
lea rdx, [0x1400138a4]
movdqu xmmword [rsp + 0x58], xmm0
movdqu xmmword [rsp + 0x68], xmm1
call fcn.140002190
test eax, eax
jns 0x14000ac21
lea eax, [r14 - 1]
jmp 0x14000ad8e
mov rdx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x2d0], rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
je 0x14000ac6e
lea rcx, str.Unknown_host
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
test edi, edi
mov eax, 0xffffffff
cmovs eax, edi
jmp 0x14000ad86
mov rbx, qword [rsp + 0x40]
mov esi, 0xffffffff
mov edi, r14d
test rbx, rbx
je 0x14000ad70
mov qword [rsp + 0x2d8], rbp
nop dword [rax]
cmp edi, esi
je 0x14000ac9d
movsxd rcx, edi
call qword [sym.imp.WS2_32.dll_closesocket]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp eax, esi
je 0x14000ad4e
movsxd rbp, edi
lea r8, [rsp + 0x30]
mov rcx, rbp
mov dword [rsp + 0x30], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x14000ad4e
mov r8d, dword [rbx + 0x10]
mov rcx, rbp
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, esi
jne 0x14000ad09
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14000ad09
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
jne 0x14000ad4e
xor edx, edx
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], 0x7a120
xor r9d, r9d
mov qword [rsp + 0x88], rbp
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], 1
lea ecx, [rdx + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jge 0x14000ad5d
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x14000ac90
jmp 0x14000ad5f
mov esi, edi
mov rbp, qword [rsp + 0x2d8]
cmp edi, 0xffffffff
je 0x14000ad79
test esi, esi
jg 0x14000ad79
movsxd rcx, edi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, esi
mov rbx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14000ed60
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
Function at 0x140bbd058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140bbd1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140bbd089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bbd06f
add dl, dl
jne 0x140bbd096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bbd0f6
xor eax, eax
add dl, dl
jne 0x140bbd0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bbd1ad
add dl, dl
jne 0x140bbd0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bbd0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bbd0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bbd0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140bbd0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140bbd07e
mov eax, 1
add dl, dl
jne 0x140bbd106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bbd113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bbd0fb
sub eax, ebx
mov ebx, 1
jne 0x140bbd14c
mov ecx, 1
add dl, dl
jne 0x140bbd12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bbd13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bbd123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bbd07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140bbd168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bbd175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bbd15d
cmp eax, 0x7d00
jae 0x140bbd19b
cmp eax, 0x500
jb 0x140bbd196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bbd07e
cmp eax, 0x7f
ja 0x140bbd19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bbd07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140bbd1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140bbd07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x40b5e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rdx
mov r12, rcx
xor r13d, r13d
mov qword [rax - 0x48], r13
mov dword [rax - 0x50], 0x80
mov dword [rax - 0x58], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r13 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.0040d000
nop
lea rcx, [rsp + 0x98]
call fcn.0040cfc0
test al, al
je 0x40b68e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x40b662
movzx ebx, ax
or ebx, 0x80070000
mov r9d, ebx
mov r8, rdi
lea rdx, str.Opening_file__s_for_writing_failed._Error_code:_0x_x_r_n
mov ecx, 2
call fcn.00415890
nop
lea rcx, [rsp + 0x98]
call fcn.0040cfd0
mov eax, ebx
jmp 0x40b859
mov dword [r12 + 0x68], r13d
mov dword [r12 + 0x6c], r13d
mov rax, qword [r12 + 0x50]
mov qword [r12 + 0x60], rax
mov rax, qword [r12 + 0x78]
mov rbx, qword [rax]
cmp rbx, rax
je 0x40b7b4
nop
nop
nop
nop
mov ebp, r13d
mov rsi, r13
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0x10]
sub rcx, qword [rax + 8]
sar rcx, 3
je 0x40b73c
nop
nop
mov rax, qword [rbx + 0x20]
mov rdi, qword [rax + 8]
mov rcx, qword [rax + 0x10]
sub rcx, rdi
sar rcx, 3
cmp rcx, rsi
jbe 0x40b7ae
lea rcx, [rsp + 0x98]
call fcn.0040cfb0
mov rdx, rax
mov r8, qword [rdi + rsi*8]
mov rcx, r12
call fcn.0040a0e0
mov edi, eax
test eax, eax
js 0x40b79a
add ebp, 1
add rsi, 1
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0x10]
sub rcx, qword [rax + 8]
sar rcx, 3
mov eax, ebp
cmp rax, rcx
jb 0x40b6e0
cmp byte [rbx + 0x29], 0
jne 0x40b78e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], 0
jne 0x40b76e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x40b78e
nop
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x40b760
jmp 0x40b78e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], 0
jne 0x40b78b
cmp rbx, qword [rax + 0x10]
jne 0x40b78b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x40b778
mov rbx, rax
cmp rbx, qword [r12 + 0x78]
je 0x40b7b4
jmp 0x40b6c0
lea rcx, [rsp + 0x98]
call fcn.0040cfd0
mov eax, edi
jmp 0x40b859
call fcn.0040a7f0
int3
mov ebx, dword [r12 + 0x58]
lea rcx, [rsp + 0x98]
call fcn.0040cfb0
add rbx, qword [r12 + 0x50]
mov r8d, ebx
sub r8d, dword [r12 + 0x60]
je 0x40b836
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x90]
mov rdx, qword [r12 + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40b836
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
test eax, eax
jle 0x40b80c
movzx r13d, ax
or r13d, 0x80070000
cmp qword [r12 + 0x40], 8
jb 0x40b81b
mov r8, qword [r12 + 0x28]
jmp 0x40b820
lea r8, [r12 + 0x28]
mov r9d, r13d
lea rdx, str.Writing__flushing__config_file__s_failed._Error_code:_0x_x_r_n
mov ecx, 2
call fcn.00415890
jmp 0x40b83b
mov qword [r12 + 0x60], rbx
lea rcx, [rsp + 0x98]
call fcn.0040cfd0
nop
lea rcx, [rsp + 0x98]
call fcn.0040cfd0
mov eax, r13d
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x40b890
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push rbx
sub rsp, 0x440
mov rax, qword [0x0043e2a8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
lea rdx, [rsp + 0x240]
mov ecx, 0xf7
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0xf7
ja 0x40ba84
test eax, eax
je 0x40ba84
lea r9, [rsp + 0x30]
lea rdx, [0x0042e3a8]
lea rcx, [rsp + 0x240]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40b925
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x40b90a
movzx ebx, ax
or ebx, 0x80070000
lea rdx, str.Failed_in_calling_GetTempFileNameW._Error_code:_0x_x_r_n
mov r8d, ebx
mov ecx, 2
call fcn.00415890
mov eax, ebx
jmp 0x40ba6b
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x468], rdi
call fcn.0040b5e0
test eax, eax
mov edi, eax
js 0x40ba63
cmp qword [rbx + 0x40], 8
jb 0x40b951
mov rdx, qword [rbx + 0x28]
jmp 0x40b955
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40ba56
mov qword [rsp + 0x458], rbp
mov qword [rsp + 0x460], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40b98d
movzx eax, ax
or eax, 0x80070000
cmp qword [rbx + 0x40], 8
jb 0x40b99a
mov r9, qword [rbx + 0x28]
jmp 0x40b99e
lea r9, [rbx + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.Copying_file_from__s_to__s_failed_with_error_code:_0x_x._Trying_again_..._r_n
mov ecx, 1
mov dword [rsp + 0x20], eax
call fcn.00415890
xor edi, edi
mov esi, edi
mov bpl, 1
nop
cmp esi, 0x1e
jge 0x40ba01
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbx + 0x40], 8
jb 0x40b9dd
mov rdx, qword [rbx + 0x28]
jmp 0x40b9e1
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
movzx ebp, bpl
test eax, eax
cmovne ebp, edi
add esi, 1
cmp bpl, 1
je 0x40b9c0
mov rsi, qword [rsp + 0x460]
test bpl, bpl
mov rbp, qword [rsp + 0x458]
je 0x40ba56
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, eax
jle 0x40ba2b
movzx edi, ax
or edi, 0x80070000
cmp qword [rbx + 0x40], 8
jb 0x40ba38
mov r9, qword [rbx + 0x28]
jmp 0x40ba3c
lea r9, [rbx + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.Copying_file_from__s_to__s_failed_with_error_code_0x_x._r_n
mov ecx, 1
mov dword [rsp + 0x20], edi
call fcn.00415890
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
mov rdi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.0041b280
add rsp, 0x440
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x40ba99
movzx ebx, ax
or ebx, 0x80070000
lea rdx, str.Failed_in_calling_GetTempPathW._Error_code:_0x_x_r_n
mov r8d, ebx
mov ecx, 2
call fcn.00415890
mov eax, ebx
jmp 0x40ba6b
Function at 0x40d1c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov r12, rdx
mov rbp, rcx
mov ecx, 0x20
call fcn.0041bf00
mov rdi, rax
test rax, rax
je 0x40d219
xor esi, esi
mov dword [rax + 8], esi
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], esi
lea rax, [0x0042e598]
mov qword [rdi], rax
mov rcx, qword [0x0043f7e8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x40d21e
xor esi, esi
mov rdi, rsi
mov qword [rsp + 0x38], rdi
test rdi, rdi
je 0x40d232
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test rdi, rdi
jne 0x40d241
mov eax, 0x8007000e
jmp 0x40d317
mov dword [rsp + 0x70], esi
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rdi + 0x18], eax
cmp eax, 0xffffffff
jne 0x40d276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x40d2f4
movzx ebx, ax
or ebx, 0x80070000
jmp 0x40d2f4
cmp dword [rsp + 0x70], 0
je 0x40d287
mov ebx, 0x80070032
jmp 0x40d30c
test eax, eax
je 0x40d2f8
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x40d2c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x40d2f4
movzx ebx, ax
or ebx, 0x80070000
jmp 0x40d2f4
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x78]
mov r8d, dword [rdi + 0x18]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d2f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x40d2f4
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x40d30c
mov rax, qword [rdi]
mov r8, r12
lea rdx, str.rGwe
mov rcx, rdi
call qword [rax]
mov ebx, eax
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x40ec90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r12d, ecx
movzx r13d, dx
lea rcx, [0x004407a0]
xor r14d, r14d
xor edx, edx
mov rbx, r14
call fcn.0042a3a0
lea ebp, [r14 + 1]
test rax, rax
mov rsi, rax
je 0x40eda6
nop
nop
test rbx, rbx
jne 0x40eda6
mov eax, r12d
lea edx, [rbx + 6]
movzx r9d, r13w
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
mov rdi, rax
jne 0x40ed14
mov rbx, r14
jmp 0x40ed89
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x40ed2a
mov rbx, r14
jmp 0x40ed84
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x40ed40
mov rbx, r14
jmp 0x40ed84
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x40ed72
nop
nop
cmp rbx, r11
jae 0x40ed77
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x40ed60
cmp rbx, r11
jb 0x40ed7c
mov rbx, r14
jmp 0x40ed84
cmp word [rbx], r14w
cmove rbx, r14
test rbx, rbx
jne 0x40edc7
lea rcx, [0x004407a0]
mov edx, ebp
call fcn.0042a3a0
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x40ece0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov rax, rsi
jmp 0x40eda8

Function at 0x40f5b0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x40f5f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
test r8, r8
mov rsi, r8
mov rbp, rdx
mov r12, rcx
jne 0x40f619
mov ecx, 0x80004005
call fcn.00401050
int3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
nop
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov ecx, eax
add edi, eax
add rbx, rcx
cmp eax, 1
jne 0x40f630
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret