joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000beb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000befa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000befa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000befa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000befa
cmp dword [rcx + 0x84], 0xe
jbe 0x14000befa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000befc
xor al, al
add rsp, 0x28
ret

Function at 0x14000eb54
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000ebc3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ebc3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ebc3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ebc3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ebc3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ebc3
cmp dword [rcx + 0xf8], 0
je 0x14000ebc3
mov ecx, ebx
call fcn.14000ec74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000ea50
nop
cmp dword [rbp + 0x20], 0
je 0x14000ec11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ec1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000eb54

Function at 0x14000ed58
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000ebc3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ebc3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ebc3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ebc3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ebc3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ebc3
cmp dword [rcx + 0xf8], 0
je 0x14000ebc3
mov ecx, ebx
call fcn.14000ec74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000ea50
nop
cmp dword [rbp + 0x20], 0
je 0x14000ec11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ec1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000eb54
Function at 0x140018340
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400183c7
mov rsi, rbx
cmp word [rax], bp
je 0x140018386
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018370
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001836c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140015b70
mov rdi, rax
test rax, rax
je 0x1400183b4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001f620
mov rbp, rdi
xor ecx, ecx
call fcn.140014b94
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a990
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001a9a6
mov al, 1
jmp 0x14001aa06
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001a9b7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001aa04
mov ecx, dword [rcx + 0x18]
nop
call fcn.140018ae4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001aa04
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001aa04
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001aa04
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001aa06
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001ee20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001ee48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001ee48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011096
Capabilities:
Get process image filename

Disassembly:
jmp 0x140011aea
jmp qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]

Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140012f00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Get process image filename

Disassembly:
jmp 0x140011890
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001c008]
xor rax, rbp
mov qword [rbp + 0x448], rax
lea rcx, [0x1400220ab]
call fcn.140011375
mov qword [rbp + 8], 0
mov dword [rbp + 0x254], 0x104
xor eax, eax
cmp eax, 1
je 0x140011975
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x278], rax
je 0x140011965
mov rax, qword [rbp + 0x278]
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x294]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x294]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2b8], rax
mov r8d, dword [rbp + 0x254]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2b8]
call fcn.140011096
lea rdx, [rbp + 0x30]
lea rcx, [0x140019d08]
call fcn.14001102d
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400118df
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140019cd0]
call fcn.14001130c
mov eax, edi
mov rcx, qword [rbp + 0x448]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret

Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014250
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014270
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014283
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400142ad
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400142c1
xor al, al
jmp 0x1400142f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400142d3
xor al, al
jmp 0x1400142f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142ef
xor al, al
jmp 0x1400142f1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400069f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea rdx, [rsp + 0x38]
mov r8d, 4
mov rdi, rcx
mov dword [rsp + 0x38], 0xfffe00ff
call fcn.140006730
lea rdx, [rsp + 0x38]
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x38], 0x10000
call fcn.140006730
mov r11d, dword [rbx + 0xc]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x38], r11d
call fcn.140006730
mov r11d, dword [rbx + 8]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x38], r11d
call fcn.140006730
mov eax, dword [rbx + 0x10]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.140006730
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140006730
Function at 0x14000ddf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov ecx, 8
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000de2a
mov rcx, qword [rsp + 0x38]
call fcn.14000dfe0
mov qword [rsp + 0x48], rax
jmp 0x14000de33
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x60]
lea r8, [0x14000ddd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x20]
mov qword [rax], r11
add rsp, 0x58
ret

Function at 0x1400122b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x28
ret

Function at 0x140012390
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1400123de
lea rdx, str.unable_to_set_tls_value
lea rcx, [rsp + 0x28]
call fcn.140001480
lea rdx, [0x14001f248]
lea rcx, [rsp + 0x28]
call sub.MSVCR90.dll__CxxThrowException
add rsp, 0x68
ret

Function at 0x140012790
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
xor r9d, r9d
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov r11, rax
mov rax, qword [rsp + 0x70]
mov qword [rax], r11
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov r11d, eax
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], r11d
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
jne 0x1400127f6
lea rdx, str.unable_to_create_tls_index
lea rcx, [rsp + 0x20]
call fcn.140001480
lea rdx, [0x14001f248]
lea rcx, [rsp + 0x20]
call sub.MSVCR90.dll__CxxThrowException
mov rcx, qword [rsp + 0x70]
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140014b1b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140021080]
jne 0x1400144fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400144f6
repz ret
ror rcx, 0x10
jmp 0x140014a74
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140021540]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140021638]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140014af9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140021540]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140014b1b
mov rax, qword [rsp + 0x88]
mov qword [0x140021638], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400215d8], rax
mov rax, qword [0x140021638]
mov qword [0x1400214b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400215c0], rax
mov dword [0x1400214a0], 0xc0000409
mov dword [0x1400214a4], 1
mov rax, qword [0x140021080]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140021088]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140021538], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140019ed8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140021538], 0
jne 0x140014ba2
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x4171a0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00417190
mov ebx, eax
test ebx, ebx
je 0x4171eb
cmp dword [0x008b19bc], 0xffffffff
jne 0x4171c4
mov ecx, 0xe2
call fcn.0040f0c0
mov ecx, ebx
call fcn.00417170
test rax, rax
jne 0x4171dd
mov ecx, 0xe2
call fcn.0040f0c0
jmp 0x4171eb
mov ecx, dword [0x008b19bc]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x417200
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00913d64], 0
je 0x41723b
mov ecx, dword [0x008b19bc]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41724f
call fcn.004171a0
mov ecx, dword [0x008b19bc]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41724f
mov rax, qword [0x00913d98]
jmp 0x41724f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x008b19bc]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x41f760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x41f7bb
movsxd rax, dword [rcx + 0x3c]
xor ebp, ebp
mov esi, dword [rax + rcx + 0x88]
add rsi, rcx
mov edi, dword [rsi + 0x20]
add rdi, rcx
cmp dword [rsi + 0x18], ebp
jbe 0x41f7bb
mov ecx, dword [rdi]
mov rdx, r14
add rcx, rbx
call fcn.0041f850
test al, al
jne 0x41f7d8
inc ebp
add rdi, 4
cmp ebp, dword [rsi + 0x18]
jb 0x41f79f
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x1c]
add rax, rbx
add rcx, rbx
movzx edx, word [rax + rbp*2]
mov eax, dword [rcx + rdx*4]
add rax, rbx
jmp 0x41f7bd

Function at 0x41f7f0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rdi, rdx
mov esi, ecx
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
mov rax, qword [rbx + 0x60]
test rax, rax
je 0x41f815
test rdi, rdi
je 0x41f829
mov qword [rdi], rax
test esi, esi
je 0x41f83a
mov rcx, qword [rbx + 0x60]
call fcn.0041f8a4
cmp esi, eax
jne 0x41f815
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x41f8dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea rdx, [rsp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x48], rbp
call fcn.0041f7f0
mov ecx, dword [0x0090e5a8]
xor edx, edx
mov rsi, rax
call fcn.0041f7f0
mov rbx, qword [0x0090e5c0]
mov rdi, rax
cmp dword [rbx], ebp
je 0x41f95c
mov r8, qword [rsp + 0x48]
mov edx, ebp
cmp word [r8], bp
je 0x41f92f
inc edx
cmp word [r8 + rdx*2], bp
jne 0x41f926
cmp dl, byte [rbx]
je 0x41f941
cmp dl, byte [rbx + 1]
je 0x41f941
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
mov rcx, r8
call fcn.0041f880
cmp eax, dword [rbx + 4]
je 0x41f95c
cmp eax, dword [rbx + 8]
je 0x41f95c
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
mov edx, dword [0x0090e590]
xor ecx, ecx
mov dword [rsp + 0x40], ebp
call qword [sym.imp.kernel32.dll_LocalAlloc]
mov ecx, dword [0x0090e5ac]
mov r9d, ebp
test ecx, ecx
je 0x41f9a1
mov rcx, qword [0x0090e5c8]
movsxd r8, r9d
mov edx, dword [rcx + r8]
mov dword [r8 + rax], edx
mov ecx, dword [0x0090e5b0]
add r9d, ecx
mov ecx, dword [0x0090e5ac]
cmp r9d, ecx
jb 0x41f97b
mov rdx, rax
mov rcx, rdi
call fcn.0041f760
mov rdi, rax
test rax, rax
je 0x41fa53
mov rbx, qword [0x0090e5b8]
lea r9, [rsp + 0x40]
mov edx, dword [0x0090e5a4]
mov rcx, rbx
mov r8d, dword [0x0090e5ac]
call rdi
mov r9, qword [0x0090e594]
mov r8d, 8
mov eax, dword [0x0090e5a4]
mov r9d, r9d
add r9, rsi
mov r10d, dword [r9 + 4]
cmp eax, r8d
jbe 0x41fa19
movsxd rdx, r8d
mov ecx, dword [rdx + r9]
add ecx, r10d
mov dword [rdx + rbx], ecx
mov eax, dword [0x0090e5b0]
add r8d, eax
mov eax, dword [0x0090e5a4]
cmp r8d, eax
jb 0x41f9f8
mov eax, dword [0x0090e59c]
lea r9, [rsp + 0x40]
mov dword [rbx + 8], eax
mov rcx, rbx
mov edx, dword [0x0090e5a4]
mov r8d, dword [rsp + 0x40]
call rdi
mov eax, dword [0x0090e5b4]
mov r8d, dword [rbx + 0xc]
mov ecx, dword [0x0090e5b4]
add r8, rax
add r8, rbx
add rcx, rbx
call r8
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x4323f0
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
nop
mov ecx, 0x104
lea rdx, [rbp + 0x254]
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x43250c
lea rbx, [rbp + 0x254]
mov word [rbx + 4], 0
mov rcx, rbx
lea rdx, [rbp + 0x48]
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x4324f2
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x48]
mov r8d, 0x106
call fcn.00411190
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov r8d, 1
call fcn.004119b0
test eax, eax
jle 0x4324f2
xor rsi, rsi
cmp qword [rbp + 0x40], 0
je 0x4324a2
mov rax, qword [rbp + 0x40]
mov esi, dword [rax - 4]
xor rdi, rdi
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x4324b5
mov rax, qword [rbp + 0x28]
mov edi, dword [rax - 4]
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.00411130
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, esi
add r8d, 1
mov r9d, edi
sub r9d, esi
call fcn.00411700
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.004114f0
jmp 0x43250b
add rbx, 2
cmp word [rbx], 0
jne 0x4324ee
add rbx, 4
test rbx, rbx
je 0x43250b
cmp word [rbx], 0
jne 0x432442
nop
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.0040f4a0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x468]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x435490
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [rbp + 0x20]
call fcn.00411090
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x28]
test eax, 0x400
je 0x435543
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x435543
or eax, 0xffffffff
mov dword [rbp + 0x28], eax
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.004329e0
test al, al
je 0x435543
mov rcx, qword [rbp + 0x48]
call fcn.00435be0
test al, al
je 0x43552f
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00435850
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00440300
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.004114f0
mov rcx, qword [rbp + 0x48]
call fcn.00411090
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040f4a0
lea rcx, [rbp + 0x48]
call fcn.0040f3c0
mov eax, dword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x43cc20
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x43cc47
movzx rax, word [rbp + 0x2c]
jmp 0x43cc49
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x43df10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.0043dcb0
mov ebx, eax
mov rax, qword [0x0090e118]
cmp byte [rax], 0
je 0x43e048
mov rcx, qword [0x0090d950]
call fcn.0040b5d0
call fcn.00408bd0
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043ded0]
mov r8d, 1
movsxd r9, esi
call fcn.00412f40
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x0043e0e8]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x43e08e
mov rcx, qword [0x00913d68]
call fcn.004133e0
mov rcx, rax
mov rax, qword [0x0090d7e0]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043ded0]
call fcn.00413120
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x43fcc0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
nop
mov dword [rbp + 0x54], 0xffffffff
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x70]
call fcn.0040fa70
lea rcx, [rbp + 0x48]
call fcn.0040fd20
mov rcx, qword [rbp + 0x48]
call fcn.00411090
mov rcx, rax
lea rdx, [rbp + 0x40]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x43fd71
mov ecx, dword [rbp + 0x44]
call fcn.00408890
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.00411090
mov rcx, rax
mov edx, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43fd67
mov rcx, qword [rbp + 0x58]
lea rdx, [0x0043fde4]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x34]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43fd67
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x54], eax
nop
mov rcx, qword [rbp + 0x58]
call fcn.004088c0
nop
lea rcx, [rbp + 0x48]
call fcn.0040f3c0
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x440df0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040fc00
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00415980
mov esi, eax
cmp esi, 0x104
jbe 0x440e4d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00408890
mov rdi, rax
jmp 0x440e51
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00415980
mov rax, rdi
mov rcx, rax
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x440ea7
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x440e8b
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x440eb9
mov rcx, rdi
call fcn.004088c0
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret