joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x40149b
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x48
ret
mov rcx, rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x4014b5
xor eax, eax
jmp 0x4014f3
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x4014e2
nop
cmp rbx, r11
jae 0x4014b1
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x4014d0
cmp rbx, r11
jae 0x4014b1
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x48
ret

Function at 0x401b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov eax, r8d
mov qword [rsp + 0x60], rsi
mov rsi, rdx
shr eax, 4
inc ax
mov ebx, r8d
mov rbp, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov r12, rax
je 0x401bb1
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x401bb1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x401bb1
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x401ba4
cmp rdi, r11
jae 0x401bb1
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x401b92
cmp rdi, r11
jae 0x401bb1
movzx eax, word [rdi]
test ax, ax
jne 0x401bd1
xor eax, eax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 0x48], r13
movzx ebx, ax
call qword [0x0045f0b8]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x401c2c
mov edx, esi
mov rcx, rbp
call fcn.00401870
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x0045f0b8]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x48]
js 0x401c83
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x401c83
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x401bb3
mov ecx, 0x80070057
call fcn.00401440
int3
Function at 0x402a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0xb8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rdi
mov rax, qword [0x00460ad8]
mov qword [rsp + 0x98], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x60], rdx
mov dword [rsp + 0x34], 0
call fcn.0043a268
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x34], 1
lea rdx, [rdi + 0x290]
lea r8, str.RealtekInstallShield
lea rcx, [rsp + 0x48]
call fcn.004024c0
lea r8, [rsp + 0x40]
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
sete dil
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x402aae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
test dil, dil
je 0x402b55
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x32
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402b1d
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.00401c90
jmp 0x402b45
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.C:Program_Files
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.C:Program_Files
mov rcx, rbx
call fcn.00401c90
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x402b58
mov rax, rbx
mov rcx, qword [rsp + 0x98]
call fcn.004306c0
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x407f40
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rdi
sub rsp, 0x28
xor ebx, ebx
cmp dword [0x004655f8], ebx
je 0x407f62
cmp qword [0x004655e0], rbx
setne bl
mov eax, ebx
jmp 0x408096
call fcn.00407ee4
lea rcx, str.USER32
mov dword [0x004655fc], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, rbx
mov rdi, rax
je 0x408059
lea rdx, [0x00449340]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov qword [0x004655c0], rax
je 0x408059
lea rdx, str.MonitorFromWindow
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov qword [0x004655c8], rax
je 0x408059
lea rdx, str.MonitorFromRect
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov qword [0x004655d0], rax
je 0x408059
lea rdx, str.MonitorFromPoint
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov qword [0x004655d8], rax
je 0x408059
lea rdx, str.EnumDisplayMonitors
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov qword [0x004655e8], rax
je 0x408059
lea rdx, str.GetMonitorInfoA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov qword [0x004655e0], rax
je 0x408059
lea rdx, str.EnumDisplayDevicesA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov qword [0x004655f0], rax
je 0x408059
mov eax, 1
jmp 0x40808c
mov qword [0x004655c0], rbx
mov qword [0x004655c8], rbx
mov qword [0x004655d0], rbx
mov qword [0x004655d8], rbx
mov qword [0x004655e0], rbx
mov qword [0x004655e8], rbx
mov qword [0x004655f0], rbx
xor eax, eax
mov dword [0x004655f8], 1
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x419270
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0xd0
lea rbp, [rsp + 0x20]
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0x98], rdi
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x78], r15
mov rax, qword [0x00460ad8]
mov qword [rbp + 0x68], rax
sub rsp, 0x10
lea rdx, [rbp + 8]
mov r8d, 0x30
mov eax, dword [rsp + 0x20]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4193cb
mov r14, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x00465ecc]
mov edi, dword [rbp + 0x3c]
xor ebx, ebx
cmp ecx, 2
jne 0x419341
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x41933b
lea rdx, str.SetThreadStackGuarantee
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x41933b
lea rcx, [rbp]
mov dword [rbp], ebx
call rax
cmp eax, 1
jne 0x41933b
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
mov ecx, dword [0x00465ecc]
mov r15d, 1
lea r8d, [rdi - 1]
lea edx, [rbx + rdi - 1]
cmp ecx, r15d
mov eax, r8d
mov esi, 0x104
not eax
cmove esi, r15d
and edx, eax
je 0x419366
add edx, edi
lea eax, [rdi + rdi]
mov ebx, r8d
cmp edx, eax
not rbx
cmovb edx, eax
and rbx, r12
mov eax, 0x11
mov r13d, edx
sub rbx, r13
cmp ecx, r15d
cmove edi, eax
mov eax, edi
add rax, r14
cmp rbx, rax
jb 0x4193cb
mov r9d, 4
mov r8d, 0x1000
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x4193cb
lea r9, [rbp + 4]
mov r8d, esi
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4193cb
mov eax, r15d
jmp 0x4193cd
xor eax, eax
mov rcx, qword [rbp + 0x68]
call fcn.004306c0
mov rbx, qword [rbp + 0xa8]
mov rsi, qword [rbp + 0xa0]
mov rdi, qword [rbp + 0x98]
mov r12, qword [rbp + 0x90]
mov r13, qword [rbp + 0x88]
mov r14, qword [rbp + 0x80]
mov r15, qword [rbp + 0x78]
lea rsp, [rbp + 0xb0]
pop rbp
ret
Function at 0x419410
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xb8
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, DllRegisterServer
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x419479
cmp dword [0x00465f40], 1
jne 0x41945b
call fcn.00421d90
mov ecx, 0x12
call fcn.00421b50
mov ecx, 0xff
call fcn.00418d10
mov eax, 0xff
jmp 0x41969f
mov dword [rax], DllRegisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4194aa
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x41969f
mov eax, dword [rbx + 0x10]
mov dword [0x00465ecc], eax
mov eax, dword [rbx + 4]
mov dword [0x00465ed8], eax
mov eax, dword [rbx + 8]
mov dword [0x00465edc], eax
mov eax, dword [rbx + 0xc]
and eax, 0x7fff
mov dword [0x00465ed0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x00465ecc], 2
je 0x4194f8
bts dword [0x00465ed0], 0xf
mov eax, dword [0x00465ed8]
shl eax, 8
add eax, dword [0x00465edc]
mov dword [0x00465ed4], eax
cmp word [0x00400000], 0x5a4d
jne 0x41956b
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x419539
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x419578
cmp word [rax + 0x18], 0x20b
je 0x419549
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x419578
cmp dword [rax + 0x84], 0xe
ja 0x41955a
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x419578
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x20], ebx
jmp 0x419578
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rdi, [0x00400000]
mov ecx, 1
call fcn.00422160
test eax, eax
jne 0x4195a8
cmp dword [0x00465f40], 1
jne 0x419594
call fcn.00421d90
mov ecx, 0x1c
call fcn.00421b50
mov ecx, 0xff
call fcn.00418d10
call fcn.0041bb90
test eax, eax
jne 0x4195d3
cmp dword [0x00465f40], 1
jne 0x4195bf
call fcn.00421d90
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.00421b50
mov ecx, 0xff
call fcn.00418d10
call fcn.004220c0
nop
call fcn.004212e0
test eax, eax
jns 0x4195ec
mov ecx, 0x1b
call fcn.00418ce0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x00467b48], rax
call fcn.00422910
mov qword [0x00465f30], rax
call fcn.00422810
test eax, eax
jns 0x419618
mov ecx, 8
call fcn.00418ce0
call fcn.00422490
test eax, eax
jns 0x41962b
mov ecx, 9
call fcn.00418ce0
mov ecx, 1
call fcn.00418dc0
test eax, eax
je 0x419640
mov ecx, eax
call fcn.00418ce0
call fcn.00422400
test byte [rsp + 0x6c], 1
je 0x419654
movzx r9d, word [rsp + 0x70]
jmp 0x41965a
mov r9d, 0xa
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.0043068c
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x419678
mov ecx, eax
call fcn.00418f80
call fcn.00418fa0
jmp 0x419696
mov eax, edi
jmp 0x41969f
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x421b50
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
lea r12, reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
xor eax, eax
mov rdx, r12
nop
cmp ecx, dword [rdx]
je 0x421b7f
inc eax
add rdx, 0x10
cmp eax, 0x14
jb 0x421b70
mov qword [rsp + 0x60], rbx
movsxd rbx, eax
add rbx, rbx
cmp ecx, dword [r12 + rbx*8]
jne 0x421d6e
mov ecx, 3
call fcn.0042a8f0
cmp eax, 1
je 0x421d2e
mov ecx, 3
call fcn.0042a8f0
test eax, eax
jne 0x421bc2
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x421d2e
cmp edi, 0xfc
je 0x421d6e
mov qword [rsp + 0x58], rbp
lea rbp, [0x00465ff0]
mov qword [rsp + 0x50], rsi
lea rsi, [0x00400000]
lea rdx, [0x0046600a]
mov r8d, 0x104
mov rax, qword [rsi + 0x4df68]
xor ecx, ecx
mov qword [rbp], rax
mov rax, qword [rsi + 0x4df70]
mov qword [rbp + 8], rax
mov rax, qword [rsi + 0x4df78]
mov qword [rbp + 0x10], rax
movzx eax, word [rsi + 0x4df80]
mov word [rbp + 0x18], ax
mov byte [0x0046610e], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x421c75
mov rax, qword [rsi + 0x4df50]
mov qword [rsi + 0x6600a], rax
mov rax, qword [rsi + 0x4df58]
mov qword [rsi + 0x66012], rax
mov eax, dword [rsi + 0x4df60]
mov dword [rsi + 0x6601a], eax
movzx eax, word [rsi + 0x4df64]
mov word [rsi + 0x6601e], ax
movzx eax, byte [rsi + 0x4df66]
mov byte [rsi + 0x66020], al
mov rsi, qword [rsp + 0x50]
xor eax, eax
lea rdi, [0x0046600a]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x421caa
lea rcx, [rcx + rbp - 0x22]
lea r8d, [rax + 3]
lea rdx, [0x0044df4c]
call fcn.00427460
mov r8, qword [r12 + rbx*8 + 8]
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x0044df48]
mov rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
movzx eax, byte [0x0044df4a]
mov byte [rdi + 1], al
xor eax, eax
mov rdi, rbp
repne scasb al, byte [rdi]
xor edx, edx
nop
nop
nop
nop
movzx eax, byte [r8 + rdx]
inc rdx
test al, al
mov byte [rdi + rdx - 2], al
jne 0x421cf0
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.0042a750
mov rbp, qword [rsp + 0x58]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x421d6e
mov rdx, qword [r12 + rbx*8 + 8]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x422910
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x68
mov eax, dword [0x00466658]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rsi
test eax, eax
mov qword [rsp + 0x48], rdi
jne 0x422967
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x422947
mov dword [0x00466658], 1
jmp 0x422982
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x422961
mov dword [0x00466658], 2
jmp 0x422a66
mov eax, dword [0x00466658]
cmp eax, 1
jne 0x422a5d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x422ab0
cmp word [rdi], 0
mov rbx, rdi
je 0x4229a4
nop
nop
add rbx, 2
cmp word [rbx], 0
jne 0x422990
add rbx, 2
cmp word [rbx], 0
jne 0x422990
sub rbx, rdi
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x40], r12
xor r12d, r12d
sar rbx, 1
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x422a50
mov rcx, rbp
call fcn.0041d6b0
test rax, rax
mov rsi, rax
je 0x422a50
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x422a26
mov rcx, rsi
call fcn.00419090
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x58]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x422a32
cmp eax, 2
je 0x422a66
test eax, eax
jne 0x422ab0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x422ab0
cmp byte [rax], 0
je 0x422a90
nop
nop
inc rax
cmp byte [rax], 0
jne 0x422a80
inc rax
cmp byte [rax], 0
jne 0x422a80
sub eax, ebx
inc eax
movsxd rsi, eax
mov rcx, rsi
call fcn.0041d6b0
test rax, rax
mov rdi, rax
jne 0x422ac6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.004197b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x68
ret
Function at 0x42a750
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
xor esi, esi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
cmp qword [0x004667c8], rsi
mov ebx, r8d
mov rbp, rdx
mov r12, rcx
jne 0x42a832
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x42a7b6
lea rdx, [0x0044f2f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x004667c8], rax
jne 0x42a7bd
xor eax, eax
jmp 0x42a8c3
lea rdx, [0x0044f2e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x0044f2c8]
mov rcx, rdi
mov qword [0x004667d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x00465ecc], 2
mov qword [0x004667d8], rax
jne 0x42a829
lea rdx, str.GetUserObjectInformationA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x004667e8], rax
je 0x42a829
lea rdx, str.GetProcessWindowStation
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x004667e0], rax
jmp 0x42a839
mov rax, qword [0x004667e0]
jmp 0x42a839
mov rax, qword [0x004667e0]
test rax, rax
je 0x42a887
call rax
test rax, rax
je 0x42a872
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call qword [0x004667e8]
test eax, eax
je 0x42a872
test byte [rsp + 0x40], 1
jne 0x42a887
cmp dword [0x00465ed8], 4
jb 0x42a881
bts ebx, 0x15
jmp 0x42a8b1
bts ebx, 0x12
jmp 0x42a8b1
mov rax, qword [0x004667d0]
test rax, rax
je 0x42a8b1
call rax
test rax, rax
mov rsi, rax
je 0x42a8b1
mov rdx, qword [0x004667d8]
test rdx, rdx
je 0x42a8b1
mov rcx, rax
call rdx
mov rsi, rax
mov r9d, ebx
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call qword [0x004667c8]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x42b340
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x00460ad8]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42b383
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
call fcn.004306c0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.0041a520
mov rcx, qword [rsp + 0x28]
call fcn.004306c0
add rsp, 0x38
ret
Function at 0x42c4a0
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov qword [rsp + 0x28], r13
mov esi, ecx
call fcn.0042c3e0
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x42c666
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.0042c3e0
cmp rax, 0xffffffffffffffff
je 0x42c666
mov qword [rsp + 0x50], rbx
mov rbx, rbp
mov qword [rsp + 0x20], r14
sub rbx, rax
test rbx, rbx
jle 0x42c5e6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x42c55f
call fcn.0041aad0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.0041aad0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x58
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x30], r12
call fcn.0042f060
mov r12d, eax
nop
nop
nop
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.00427840
cmp eax, 0xffffffff
je 0x42c5a5
cdqe
sub rbx, rax
test rbx, rbx
jg 0x42c580
jmp 0x42c5c1
call fcn.0041ab00
cmp dword [rax], 5
jne 0x42c5ba
call fcn.0041aad0
mov dword [rax], SafeArrayGetDim
mov rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.0042f060
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x30]
jmp 0x42c63e
test rbx, rbx
jns 0x42c648
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.0042c3e0
cmp rax, 0xffffffffffffffff
je 0x42c535
mov ecx, esi
call fcn.00428a40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
dec rdi
cmp rdi, 0xffffffffffffffff
jne 0x42c648
call fcn.0041aad0
mov dword [rax], SafeArrayGetDim
call fcn.0041ab00
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x42c535
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.0042c3e0
cmp rax, 0xffffffffffffffff
je 0x42c535
xor eax, eax
jmp 0x42c53c
call fcn.0041aad0
mov eax, dword [rax]
jmp 0x42c546
Function at 0x430200
Capabilities:
Check os version

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x00460ad8]
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.00418b40
mov qword [rbx + 0x50], 0
mov dword [rbx + 0x58], 0
mov dword [rbx + 0x5c], 0
lea rax, [0x00400000]
mov esi, DllRegisterServer
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rsi
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.00418b40
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x430292
cmp dword [rsp + 0x24], 5
jb 0x4302ac
jmp 0x4302a8
cmp dword [rsp + 0x30], esi
jne 0x4302ac
cmp dword [rsp + 0x24], 4
ja 0x4302a8
jne 0x4302ac
cmp dword [rsp + 0x28], 0
jbe 0x4302ac
mov byte [rbx + 0x18], sil
lea rax, [0x0044fb88]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.004300e8
movzx ecx, byte [0x00462518]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x00462518], cl
mov rcx, qword [rsp + 0xc0]
call fcn.004306c0
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret

Function at 0x4306c0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00460ad8]
jne 0x4306ca
ret
jmp 0x430710
sub rsp, 0x5a8
mov qword [rsp + 0x5b0], rcx
mov qword [rsp + 0x5b8], rdx
lea rcx, [rsp + 0xd0]
mov qword [rcx + 0x78], rax
call fcn.004275d0
test rax, rax
jne 0x4307cc
lea rcx, [rsp + 0xd0]
mov rax, qword [rcx + 0x78]
call sub.KERNEL32.dll_RtlCaptureContext
lea rax, [rsp + 0xd0]
mov rcx, 0x100001
mov qword [rax + 0x30], rcx
mov rcx, qword [rsp + 0x5b0]
mov qword [rax + 0x80], rcx
mov rdx, qword [rsp + 0x5b8]
mov qword [rax + 0x88], rdx
lea rcx, [rsp + 0x5a8]
mov qword [rax + 0x98], rcx
mov rcx, qword [rsp + 0x5a8]
mov qword [rax + 0xf8], rcx
lea rdx, [rsp + 0x30]
mov qword [rdx + 0x10], rcx
mov dword [rdx], 0xc0000409
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
xor rcx, rcx
call sub.KERNEL32.dll_SetUnhandledExceptionFilter
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_UnhandledExceptionFilter
call sub.KERNEL32.dll_GetCurrentProcess
movabs rdx, 0xc0000409
mov rcx, rax
call sub.KERNEL32.dll_TerminateProcess
add rsp, 0x5a8
ret