joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55cb24
Capabilities:
Write clipboard data

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, 0x11c
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.006aba40
mov dword [rsp + 0x60], ebx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor esi, esi
cmp eax, esi
jne 0x55cb8d
mov dword [rsp + 0x60], 0x114
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, esi
je 0x55cc85
cmp dword [rsp + 0x70], 1
jne 0x55cc85
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.00545fc0
nop
mov rdx, qword [rsp + 0x40]
sub rdx, qword [rsp + 0x48]
inc rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
cmp rax, rsi
jne 0x55cc0e
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
je 0x55cced
cmp rcx, rsi
je 0x55cced
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x55cc04
call fcn.006a4944
jmp 0x55cced
call fcn.006a3610
jmp 0x55cced
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, qword [rsp + 0x48]
mov dl, byte [r8]
mov byte [rax], dl
inc r8
inc rax
cmp dl, sil
jne 0x55cc1c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
je 0x55cced
cmp rcx, rsi
je 0x55cced
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x55cc7e
call fcn.006a4944
jmp 0x55cced
call fcn.006a3610
jmp 0x55cced
mov rdx, qword [rdi + 0x40]
sub rdx, qword [rdi + 0x48]
sar rdx, 1
lea rdx, [rdx + rdx + 2]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
cmp rax, rsi
jne 0x55ccb0
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x55cced
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, qword [rdi + 0x48]
movzx ecx, word [rdx]
mov word [rax], cx
add rdx, 2
add rax, 2
cmp cx, si
jne 0x55ccbd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x561a5c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
sub rsp, 0x78
lea r8, [rax + 8]
lea rdx, str.greylink.dcls
lea rcx, [rax - 0x58]
call fcn.004023b4
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x20]
cmp rcx, r11
je 0x561ac0
test rcx, rcx
je 0x561ac0
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x561abb
call fcn.006a4944
jmp 0x561ac0
call fcn.006a3610
lea r8, [rsp + 0x80]
lea rdx, str.SoftwareClassesgreylink.dcls
lea rcx, [rsp + 0x20]
call fcn.004023b4
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x20]
cmp rcx, r11
je 0x561b22
test rcx, rcx
je 0x561b22
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x561b1d
call fcn.006a4944
jmp 0x561b22
call fcn.006a3610
add rsp, 0x78
ret

Function at 0x562214
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
sub rsp, 0x78
lea r8, [rax + 8]
lea rdx, str.dchub
lea rcx, [rax - 0x58]
call fcn.004023b4
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x20]
cmp rcx, r11
je 0x562278
test rcx, rcx
je 0x562278
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x562273
call fcn.006a4944
jmp 0x562278
call fcn.006a3610
lea r8, [rsp + 0x80]
lea rdx, str.SoftwareClassesdchub
lea rcx, [rsp + 0x20]
call fcn.004023b4
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x20]
cmp rcx, r11
je 0x5622da
test rcx, rcx
je 0x5622da
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x5622d5
call fcn.006a4944
jmp 0x5622da
call fcn.006a3610
add rsp, 0x78
ret
Function at 0x568a04
Capabilities:
Check os version
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov ebx, ecx
lea rcx, [rsp + 0x40]
xor edi, edi
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x568ac0
cmp dword [rsp + 0x50], 2
jne 0x568ac0
mov edi, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x178]
lea edx, [rdi + 0x18]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x180]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x178]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
test ebx, ebx
je 0x568b2e
sub ecx, 1
je 0x568b2a
sub ecx, 1
je 0x568b23
sub ecx, 1
je 0x568b13
sub ecx, 1
je 0x568b0a
cmp ecx, 1
jne 0x568b33
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x568b1f
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.LockWorkStation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
jmp 0x568b1f
xor r8d, r8d
mov cl, 1
xor edx, edx
jmp 0x568b1a
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.POWRPROF.dll_SetSuspendState
mov al, 1
jmp 0x568b44
mov ebx, 2
jmp 0x568b33
xor ebx, ebx
jmp 0x568b33
mov ebx, 8
or edi, ebx
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x5692b8
Capabilities:
Enumerate process modules
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
sub rsp, 0x460
lea rbp, [rsp + 0x20]
lea rcx, str.wl_hook.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
test rax, rax
je 0x5693d4
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 8
mov edx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
test rax, rax
je 0x5693d2
lea rdx, [rbp]
mov rcx, rax
mov dword [rbp], 0x438
call sub.KERNEL32.dll_Module32FirstW
jmp 0x5693c1
cmp qword [rbp + 0x28], rsi
jne 0x5693b5
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x230]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r8d, eax
test eax, eax
je 0x5693b5
lea rax, [r8 + 0xf]
cmp rax, r8
ja 0x569353
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.006e5e00
mov edx, dword [rbp + 0x470]
sub rsp, rax
lea r12, [rsp + 0x20]
lea rcx, [rbp + 0x230]
mov r9, r12
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x5693b5
lea r9, [rbp + 0x478]
lea r8, [rbp + 0x480]
lea rdx, [0x00799028]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x5693b5
mov rax, qword [rbp + 0x480]
movzx ebx, bl
mov ecx, 1
cmp word [rax + 0xa], 4
cmove ebx, ecx
lea rdx, [rbp]
mov rcx, rdi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x56931c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
lea rsp, [rbp + 0x440]
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x572024
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2b0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x572050
xor eax, eax
jmp 0x57210f
lea rcx, [rsp + 0x74]
xor edx, edx
mov r8d, 0x234
xor ebx, ebx
mov dword [rsp + 0x70], 0x238
call fcn.006aba40
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x572104
lea r8, [rsp + 0x2c0]
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x20]
call fcn.004023b4
mov rcx, qword [rsp + 0x68]
lea rdx, str.foobar2000.exe
call fcn.006e454c
mov rcx, qword [rsp + 0x68]
cmp eax, ebx
lea rax, [rsp + 0x20]
sete sil
cmp rcx, rax
je 0x5720e9
cmp rcx, rbx
je 0x5720e9
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x5720e4
call fcn.006a4944
jmp 0x5720e9
call fcn.006a3610
cmp sil, bl
jne 0x572100
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
jmp 0x572079
mov ebx, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x572248
Capabilities:
Enumerate gui resources

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
and dword [r11 + 0x18], 0
lea rax, [r11 - 0x38]
mov qword [r11 - 0x18], rax
lea rax, [r11 - 0x38]
mov qword [r11 - 0x10], rax
mov byte [rsp + 0x60], 0
mov dword [rsp + 0x58], edx
lea rax, [r11 - 0x70]
mov qword [r11 - 0x50], rax
lea rax, [r11 - 0x70]
mov qword [r11 - 0x48], rax
mov byte [rsp + 0x28], 0
lea rdx, [r11 - 0x40]
lea rcx, [0x00572124]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.004029b4
mov dword [rsp + 0xb0], 1
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x5722f1
test rcx, rcx
je 0x5722f1
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x5722eb
call fcn.006a4944
jmp 0x5722f1
call fcn.006a3610
nop
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x572325
test rcx, rcx
je 0x572325
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x572320
call fcn.006a4944
jmp 0x572325
call fcn.006a3610
mov rax, rbx
add rsp, 0x90
pop rbx
ret
Function at 0x572334
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x430
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
call fcn.00572024
test eax, eax
je 0x57257b
mov r8d, eax
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x57257b
mov r9d, 0x104
lea r8, [rsp + 0x220]
xor edx, edx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x5723aa
xor al, al
jmp 0x57257b
mov dword [rsp + 0x1b0], WSAGetLastError
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x1b8]
call fcn.006aba40
lea r8, [rsp + 0x448]
lea rdx, [0x0079ea88]
lea rcx, [rsp + 0xc0]
call fcn.004023b4
nop
lea r8, [rsp + 0x220]
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.0040fd24
nop
lea r8, [0x0079fce0]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.0040fd24
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.0040fc8c
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x40], rcx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
lea rax, [rsp + 0x110]
mov edi, 0x100
mov rcx, qword [rsp + 0x158]
cmp rcx, rax
je 0x5724a9
test rcx, rcx
je 0x5724a9
mov rdx, qword [rsp + 0x110]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rdi
jbe 0x5724a3
call fcn.006a4944
jmp 0x5724a9
call fcn.006a3610
nop
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0xb8]
cmp rcx, rax
je 0x5724e1
test rcx, rcx
je 0x5724e1
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x5724db
call fcn.006a4944
jmp 0x5724e1
call fcn.006a3610
nop
lea rax, [rsp + 0x160]
mov rcx, qword [rsp + 0x1a8]
cmp rcx, rax
je 0x57251f
test rcx, rcx
je 0x57251f
mov rax, qword [rsp + 0x160]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x572519
call fcn.006a4944
jmp 0x57251f
call fcn.006a3610
nop
lea rax, [rsp + 0xc0]
mov rcx, qword [rsp + 0x108]
cmp rcx, rax
je 0x57255b
test rcx, rcx
je 0x57255b
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rdi
jbe 0x572556
call fcn.006a4944
jmp 0x57255b
call fcn.006a3610
test ebx, ebx
je 0x572579
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x57257b
xor al, al
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x58a7b4
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x180
and dword [rsp + 0x190], 0
mov rbx, rcx
mov r9, rdx
lea rcx, [rsp + 0x100]
lea r8, [0x0078dc38]
mov edx, 0x80
call fcn.006a52b0
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x1a0]
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x58]
mov edx, r9d
mov ecx, 0x400
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x1a0], gethostbyname
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rcx, [rsp + 0x58]
call fcn.006a5e3c
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x58]
lea edx, [r9 - 1]
mov ecx, 0x400
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x100]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x40
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov r11, qword [0x00868cd8]
lea r9, [rsp + 0x80]
lea r8, str._s__s
lea rcx, [rsp + 0x80]
mov edx, 0x80
mov qword [rsp + 0x20], r11
call fcn.006a52b0
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.004023b4
mov rax, rbx
add rsp, 0x180
pop rbx
ret
Function at 0x58ba90
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, rcx
and dword [rax + 8], 0
mov rax, qword [rcx + 0x28]
cmp rax, qword [rcx + 0x20]
jne 0x58bac8
xor al, al
jmp 0x58bc1a
mov r9d, 2
lea r8d, [r9 - 1]
lea rdx, [rsp + 0x28]
call fcn.00420df8
mov rcx, qword [rax + 0x28]
mov ebx, 1
mov dword [rsp + 0xc0], ebx
mov rax, qword [rax + 0x20]
sub rax, rcx
cmp rax, 2
jne 0x58bb05
mov ax, word [rcx]
cmp ax, word [0x007b3e88]
je 0x58bb3d
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.00420df8
mov ebx, 3
mov rcx, qword [rax + 0x20]
mov rax, qword [rax + 0x28]
sub rcx, rax
cmp rcx, 2
jne 0x58bb42
mov ax, word [rax]
cmp ax, word [0x007b3cd4]
jne 0x58bb42
mov sil, 1
jmp 0x58bb45
xor sil, sil
mov ebp, 0x100
test bl, 2
je 0x58bb8a
and ebx, 0xfffffffd
mov dword [rsp + 0xc0], ebx
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0xa0]
cmp rcx, rax
je 0x58bb8a
test rcx, rcx
je 0x58bb8a
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
cmp rdx, rbp
jbe 0x58bb84
call fcn.006a4944
jmp 0x58bb8a
call fcn.006a3610
nop
test bl, 1
je 0x58bbbc
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x58bbbc
test rcx, rcx
je 0x58bbbc
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
cmp rdx, rbp
jbe 0x58bbb7
call fcn.006a4944
jmp 0x58bbbc
call fcn.006a3610
test sil, sil
je 0x58bc18
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.00401f00
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
and ebx, 0x10
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x58bc10
test rcx, rcx
je 0x58bc10
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rbp
jbe 0x58bc0b
call fcn.006a4944
jmp 0x58bc10
call fcn.006a3610
test ebx, ebx
je 0x58bc18
mov al, 1
jmp 0x58bc1a
xor al, al
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x58bc34
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.00401f00
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x68]
xor ebx, ebx
mov edi, eax
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x58bc90
cmp rcx, rbx
je 0x58bc90
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x58bc8b
call fcn.006a4944
jmp 0x58bc90
call fcn.006a3610
mov rbx, qword [rsp + 0x80]
cmp edi, 0xffffffff
setne al
add rsp, 0x70
pop rdi
ret
Function at 0x58bd4c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [0x0085ad54]
lea r9, [0x00865610]
cmp ecx, 0x270
jl 0x58be36
cmp ecx, 0x271
jne 0x58bd98
mov dword [0x00865610], 0x1105
lea rcx, [0x00865614]
mov edx, 0x26f
mov eax, dword [rcx - 4]
imul eax, eax, 0x10dcd
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x58bd83
mov r8, r9
lea r10, [0x00861110]
lea rdx, [0x0086599c]
mov ecx, dword [r8 + 4]
xor ecx, dword [r8]
btr ecx, 0x1f
xor ecx, dword [r8]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r10 + rax*4]
xor eax, ecx
xor eax, dword [r8 + 0x634]
mov dword [r8], eax
add r8, 4
cmp r8, rdx
jl 0x58bda9
mov ecx, dword [rdx + 4]
xor ecx, dword [rdx]
btr ecx, 0x1f
xor ecx, dword [rdx]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r10 + rax*4]
xor eax, ecx
xor eax, dword [rdx - 0x38c]
mov dword [rdx], eax
lea rax, [0x00865fcc]
add rdx, 4
cmp rdx, rax
jl 0x58bdd7
mov eax, dword [0x00865fcc]
mov ecx, dword [0x00865610]
xor ecx, eax
btr ecx, 0x1f
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r10 + rax*4]
xor eax, ecx
xor eax, dword [0x00865c40]
xor ecx, ecx
mov dword [0x00865fcc], eax
movsxd rax, ecx
inc ecx
mov r8d, dword [r9 + rax*4]
mov dword [0x0085ad54], ecx
mov eax, r8d
shr eax, 0xb
xor r8d, eax
mov ecx, r8d
and ecx, 0xff3a58ad
shl ecx, 7
xor r8d, ecx
mov ecx, r8d
and ecx, 0xffffdf8c
shl ecx, 0xf
xor r8d, ecx
mov ecx, r8d
shr ecx, 0x12
xor r8d, ecx
rdtsc
shl rdx, 0x20
or rax, rdx
xor eax, r8d
ret

Function at 0x58de60
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
and dword [rbp + 0x18], 0
mov r8, qword [rdx + 0x40]
mov qword [rbp + 0x10], rbx
mov rbx, rcx
mov rcx, qword [rdx + 0x48]
mov qword [rbp + 0x20], rsi
sub r8, rcx
mov qword [rbp + 0x28], rdi
mov rdi, rdx
sar r8, 1
add r8, 0x7d0
lea rax, [r8 + r8]
lea r9, [rax + 0xf]
cmp r9, rax
ja 0x58dead
movabs r9, 0xffffffffffffff0
and r9, 0xfffffffffffffff0
mov rax, r9
call fcn.006e5e00
sub rsp, r9
lea rsi, [rsp + 0x20]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
test eax, eax
je 0x58dedf
lea r8, [rbp + 0x18]
mov rdx, rsi
call fcn.004023b4
jmp 0x58dee7
mov rdx, rdi
call fcn.004021f8
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
mov rax, rbx
mov rbx, qword [rbp + 0x10]
mov rsp, rbp
pop rbp
ret
Function at 0x594a94
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, r8
and qword [rsp + 0x20], 0
lea r9, [rax + 8]
mov r8d, dword [r8]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x594b1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.0058defc
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.006a49e8
lea r11, [0x00798b08]
mov qword [rsp + 0x38], r11
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.004029b4
lea r11, [0x00798b08]
mov qword [rsp + 0x38], r11
lea rdx, [0x00850da0]
lea rcx, [rsp + 0x38]
call fcn.006ab82c
nop
mov eax, dword [rsp + 0xc0]
mov qword [rbx], rax
add rsp, 0xb0
pop rbx
ret

Function at 0x594b34
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
and qword [rsp + 0x20], 0
lea r9, [rax + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x594bb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.0058defc
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.006a49e8
lea r11, [0x00798b08]
mov qword [rsp + 0x38], r11
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.004029b4
lea r11, [0x00798b08]
mov qword [rsp + 0x38], r11
lea rdx, [0x00850da0]
lea rcx, [rsp + 0x38]
call fcn.006ab82c
nop
mov eax, dword [rsp + 0xc0]
add rsp, 0xb0
pop rbx
ret

Function at 0x594c54
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov sil, r8b
mov rbp, rdx
mov rdi, rcx
lea rcx, [rax - 0x60]
call fcn.00401f00
mov rbx, rax
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.00401f00
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x594cde
test rcx, rcx
je 0x594cde
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x594cd8
call fcn.006a4944
jmp 0x594cde
call fcn.006a3610
nop
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
cmp rcx, rax
je 0x594d19
test rcx, rcx
je 0x594d19
mov rax, qword [rsp + 0x78]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x594d14
call fcn.006a4944
jmp 0x594d19
call fcn.006a3610
test ebx, ebx
jne 0x594d8b
test sil, sil
jne 0x594d78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x78]
call fcn.0058defc
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.006a49e8
lea r11, [0x00798b08]
mov qword [rsp + 0x28], r11
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.004029b4
lea r11, [0x00798b08]
mov qword [rsp + 0x28], r11
lea rdx, [0x00850da0]
lea rcx, [rsp + 0x28]
call fcn.006ab82c
nop
mov rdx, rbp
mov rcx, rdi
call fcn.00594da4
mov rcx, rdi
call fcn.00594f58
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret