joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48edb0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov dword [rbp + 0x3c], 0
mov dword [rbp + 0x38], 0
lea rax, [0x00746dd8]
mov qword [rbp + 0x30], rax
mov rcx, rbp
call fcn.0048ec00
jmp 0x48f191

Function at 0x48f1c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x70], rcx
mov rax, qword [rbp + 0x70]
lea rax, [rax + rbp + 0x60]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rbp + 0x70]
lea rcx, [rcx + rbp + 0x60]
mov rdx, rbp
neg rdx
mov rcx, qword [rcx + rdx]
mov ecx, dword [rcx + 0x48]
shr ecx, 1
movsxd rcx, ecx
mov rax, qword [rax + 0x68]
add rax, rcx
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x70]
lea rax, [rax + rbp + 0x60]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rax + 0x68]
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x70]
lea rax, [rax + rbp + 0x60]
mov r8, rbp
neg r8
mov rax, qword [rax + r8]
mov r8d, dword [rax + 0x48]
shr r8d, 1
movsxd r8, r8d
call fcn.00406200
add qword [rbp + 0x30], 0x10
xor rax, rax
mov rcx, qword [rbp + 0x70]
lea rcx, [rcx + rbp + 0x60]
mov rdx, rbp
neg rdx
mov rcx, qword [rcx + rdx]
mov ebx, dword [rcx + 0x78]
add ebx, ebx
add ebx, ebx
sub ebx, 5
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], ebx
jg 0x48f328
add ebx, 1
lea rax, [0x00741714]
mov rcx, qword [rbp + 0x30]
mov ecx, dword [rcx]
shr ecx, 8
and ecx, 0xff
movsxd rcx, ecx
mov ecx, dword [rax + rcx*4]
mov edx, 8
call fcn.00489db0
mov esi, eax
lea rax, [0x00741714]
mov rcx, qword [rbp + 0x30]
mov ecx, dword [rcx]
shr ecx, 0x10
and ecx, 0xff
movsxd rcx, ecx
mov ecx, dword [rax + rcx*4]
mov edx, 0x10
call fcn.00489db0
mov edi, eax
lea rax, [0x00741714]
mov rcx, qword [rbp + 0x30]
mov ecx, dword [rcx]
shr ecx, 0x18
movsxd rcx, ecx
mov ecx, dword [rax + rcx*4]
mov edx, 0x18
call fcn.00489db0
mov rcx, qword [rbp + 0x30]
lea rdx, [0x00741714]
mov r8, qword [rbp + 0x30]
mov r8d, dword [r8]
and r8d, 0xff
movsxd r8, r8d
mov edx, dword [rdx + r8*4]
xor edx, esi
xor edx, edi
xor edx, eax
mov dword [rcx], edx
add qword [rbp + 0x30], 4
add dword [rbp + 0x3c], 1
cmp dword [rbp + 0x3c], ebx
jne 0x48f27b
nop
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x491720
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov dword [rbp + 0x38], r9d
mov eax, dword [rbp + 0x38]
and eax, 0xff
imul eax, eax, 0x1010101
mov dword [rbp + 0x38], eax
mov dword [rbp + 0xc], 0
mov rax, qword [rbp + 0x28]
mov ecx, dword [rbp + 0xc]
mov rdx, qword [rbp + 0x30]
mov r8d, dword [rbp + 0xc]
mov edx, dword [rdx + r8*4]
xor edx, dword [rbp + 0x38]
mov dword [rax + rcx*4], edx
add dword [rbp + 0xc], 1
cmp dword [rbp + 0xc], 0x40
jne 0x491751
nop
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x4d2680
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x250
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x48], 0
nop
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x4d281f
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x4d26b5
mov esi, dword [rax - 4]
jmp 0x4d26b8
xor rsi, rsi
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x4d26cc
mov rax, qword [rbp + 0x38]
movzx rax, word [rax - 0xa]
jmp 0x4d26d0
mov ax, 2
cmp ax, 1
jne 0x4d278a
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x4d26ee
mov rax, qword [rbp + 0x38]
movzx rax, word [rax - 0xc]
jmp 0x4d26f9
mov rax, qword [0x00a8df30]
movzx rax, word [rax]
movzx ecx, ax
xor rdx, rdx
mov r8, qword [rbp + 0x38]
mov r9d, esi
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00414a90
mov esi, eax
cmp esi, 0x100
jle 0x4d2737
mov ecx, esi
add ecx, ecx
movsxd rcx, ecx
call fcn.00405da0
mov rbx, rax
jmp 0x4d273b
lea rbx, [rbp + 0x50]
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x4d274f
mov rax, qword [rbp + 0x38]
movzx rax, word [rax - 0xc]
jmp 0x4d275a
mov rax, qword [0x00a8df30]
movzx rax, word [rax]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x4d2768
mov ecx, dword [rcx - 4]
jmp 0x4d276b
xor rcx, rcx
movzx eax, ax
xor rdx, rdx
mov r8, qword [rbp + 0x38]
mov r9d, ecx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], esi
mov ecx, eax
call fcn.00414a90
jmp 0x4d27c9
cmp esi, 0x100
jle 0x4d27a3
mov ecx, esi
add ecx, ecx
movsxd rcx, ecx
call fcn.00405da0
mov rbx, rax
jmp 0x4d27a7
lea rbx, [rbp + 0x50]
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
call fcn.0042b020
mov rcx, qword [rbp + 0x48]
mov rdx, rbx
mov r8d, esi
add r8d, r8d
movsxd r8, r8d
call fcn.00406200
xor rax, rax
mov dword [rbp + 0x44], eax
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x4d280b
add ecx, 1
mov edx, dword [rbp + 0x44]
shl edx, 5
mov r8d, dword [rbp + 0x44]
shr r8d, 0x1b
or edx, r8d
mov dword [rbp + 0x44], edx
movsxd rdx, eax
movzx edx, word [rbx + rdx*2]
mov r8d, dword [rbp + 0x44]
xor r8d, edx
mov dword [rbp + 0x44], r8d
add eax, 1
cmp eax, ecx
jne 0x4d27de
nop
lea rax, [rbp + 0x50]
cmp rbx, rax
je 0x4d2825
mov rcx, rbx
call fcn.00405dd0
jmp 0x4d2825
xor rax, rax
mov dword [rbp + 0x44], eax
nop
lea rcx, [rbp + 0x48]
call fcn.0040e080
mov eax, dword [rbp + 0x44]
lea rsp, [rbp + 0x250]
pop rbx
pop rsi
pop rbp
ret
Function at 0x4f51e0
Capabilities:
Get memory capacity

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x80], rcx
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_GlobalMemoryStatus
mov rax, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rbp + 0x80]
cmp qword [rax + 8], 0
jne 0x4f5226
mov rax, qword [rbp + 0x80]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x68], rax
jmp 0x4f5266
mov rax, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x80]
mov rax, qword [rax + 0x18]
cmp rax, qword [rcx + 8]
jge 0x4f524f
mov rax, qword [rbp + 0x80]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x28], rax
jmp 0x4f525e
mov rax, qword [rbp + 0x80]
mov rax, qword [rax + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x507e20
Capabilities:
Clear file content

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov rcx, qword [rbp + 0x40]
call fcn.0046e830
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
call fcn.0046e850
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x50]
call sub.kernel32.dll_SetEndOfFile_1
mov ecx, eax
call fcn.00439c50
mov rax, qword [rbp + 0x28]
cmp rax, qword [rbp + 0x48]
jle 0x507e77
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
call fcn.0046e850
jmp 0x507e84
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
call fcn.0046e850
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x50c320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov dword [rbp + 0x40], ecx
mov qword [rbp + 0x48], rdx
mov dword [rbp + 0x50], r8d
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x2c], eax
xor rax, rax
mov ecx, dword [rbp + 0x50]
sub ecx, 1
jae 0x50c349
call fcn.0040abd0
mov dword [rbp + 0x28], eax
cmp dword [rbp + 0x28], ecx
jg 0x50c395
add ecx, 1
mov eax, dword [rbp + 0x2c]
shr eax, 8
and eax, 0xffffff
lea rdx, [0x00756060]
mov r8, qword [rbp + 0x48]
movsxd r9, dword [rbp + 0x28]
movzx r8, byte [r8 + r9]
mov r9d, dword [rbp + 0x2c]
xor r9d, r8d
and r9d, 0xff
mov r9d, r9d
xor eax, dword [rdx + r9*4]
mov dword [rbp + 0x2c], eax
add dword [rbp + 0x28], 1
cmp dword [rbp + 0x28], ecx
jne 0x50c354
nop
mov eax, dword [rbp + 0x2c]
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x549910
Capabilities:
Clear file content

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0xa0]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0xa8]
mov rdx, rbp
neg rdx
mov rdx, qword [rax + rdx]
xor r8, r8
call fcn.005494f0
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0xa0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rax + 0x18]
call sub.kernel32.dll_SetEndOfFile_1
test eax, eax
setne al
mov byte [rbp + 0x2f], al
cmp byte [rbp + 0x2f], 0
jne 0x549997
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [rbp + 0x40]
lea rcx, [rcx + rbp + 0x8c]
mov rdx, rbp
neg rdx
mov dword [rcx + rdx], eax
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x549b80
Capabilities:
Get file size

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0xa0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rax + 0x18]
lea rdx, [rbp + 0x28]
call sub.kernel32.dll_GetFileSize_1
mov rcx, qword [rbp + 0x40]
lea rcx, [rcx + rbp + 0x88]
mov rdx, rbp
neg rdx
mov dword [rcx + rdx], eax
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x88]
mov rcx, rbp
neg rcx
cmp dword [rax + rcx], 0xffffffff
setne al
mov byte [rbp + 0x2f], al
cmp byte [rbp + 0x2f], 0
jne 0x549c02
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [rbp + 0x40]
lea rcx, [rcx + rbp + 0x84]
mov rdx, rbp
neg rdx
mov dword [rcx + rdx], eax
jmp 0x549c1a
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x8c]
mov rcx, rbp
neg rcx
mov edx, dword [rbp + 0x28]
mov dword [rax + rcx], edx
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x54a760
Capabilities:
Get file size

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
lea rax, [rax + rbp + 0x40]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rax + 0x18]
lea rdx, [rbp + 0x20]
call sub.kernel32.dll_GetFileSize_1
mov dword [rbp + 0x28], eax
cmp dword [rbp + 0x28], 0xffffffff
sete al
mov byte [rbp + 0x27], al
movzx rax, byte [rbp + 0x27]
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x54ad40
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0x40]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0x58]
mov rdx, rbp
neg rdx
mov rdx, qword [rax + rdx]
call fcn.00549480
mov byte [rbp + 0x3f], al
cmp byte [rbp + 0x3f], 0
je 0x54add7
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0x40]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rax + 0x18]
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0x48]
mov rdx, rbp
neg rdx
mov rdx, qword [rax + rdx]
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0x50]
mov r8, rbp
neg r8
mov r8d, dword [rax + r8]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile_1
test eax, eax
setne al
mov byte [rbp + 0x3f], al
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x54ae70
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0xe0]
mov rcx, rbp
neg rcx
mov rcx, qword [rax + rcx]
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0xf8]
mov rdx, rbp
neg rdx
mov rdx, qword [rax + rdx]
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0x100]
mov r8, rbp
neg r8
mov r8d, dword [rax + r8]
call fcn.005494f0
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0xe0]
mov rcx, rbp
neg rcx
mov rax, qword [rax + rcx]
mov rcx, qword [rax + 0x18]
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0xe8]
mov rdx, rbp
neg rdx
mov rdx, qword [rax + rdx]
mov rax, qword [rbp + 0x50]
lea rax, [rax + rbp + 0xf0]
mov r8, rbp
neg r8
mov r8d, dword [rax + r8]
lea rax, [rbp + 0xcc]
sub rax, rbp
mov r9, qword [rbp + 0x50]
add r9, rax
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
test eax, eax
setne al
mov byte [rbp + 0x3f], al
cmp byte [rbp + 0x3f], 0
jne 0x54af50
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [rbp + 0x50]
lea rcx, [rcx + rbp + 0xc8]
mov rdx, rbp
neg rdx
mov dword [rcx + rdx], eax
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x5a99e0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x30]
call fcn.005abd10
mov rcx, qword [rsp + 0x30]
mov dl, 1
call fcn.005ab780
mov rcx, qword [rsp + 0x30]
call fcn.005ab8b0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0xa8]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
add rsp, 0x28
ret

Function at 0x5a9af0
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
nop
mov rcx, qword [rbp + 0x88]
call fcn.0040e080
lea rcx, [rbp + 0x58]
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax + 0xa8]
lea r8, [0x005a9cac]
call fcn.004102f0
nop
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x88]
call fcn.005a9ce0
mov byte [rbp + 0x57], al
jmp 0x5a9b89
cmp byte [rbp + 0x57], 0
je 0x5a9be9
mov rcx, qword [rbp + 0x80]
call fcn.005a99e0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x58]
call fcn.0040e770
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax + 0xa8]
call fcn.0040e770
mov rcx, qword [rbp + 0x48]
call fcn.0040feb0
mov rbx, rax
mov rcx, qword [rbp + 0x40]
call fcn.0040feb0
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_MoveFileW
test eax, eax
setne al
mov byte [rbp + 0x3f], al
jmp 0x5a9c1a
mov rax, qword [rbp + 0x88]
cmp qword [rax], 0
jne 0x5a9c09
mov rcx, qword [rbp + 0x88]
lea rdx, [0x005a9cc4]
call fcn.0040e6f0
mov rcx, qword [rbp + 0x58]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.0040e160
lea rcx, [rbp + 0x58]
call fcn.0040e080
mov rax, qword [rbp + 0x88]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x5ea720
Capabilities:
Get file system object information

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x300
mov rbp, rsp
mov qword [rbp + 0x320], rcx
mov rcx, qword [rbp + 0x320]
call fcn.0040e210
nop
xor rax, rax
cmp qword [rbp + 0x320], 0
je 0x5ea758
mov rax, qword [rbp + 0x320]
mov eax, dword [rax - 4]
mov rcx, qword [rbp + 0x320]
movsxd rax, eax
cmp word [rcx + rax*2 - 2], 0x5c
jne 0x5ea778
mov ebx, 0x101
mov esi, 0x10
jmp 0x5ea784
mov ebx, 0x111
mov esi, 0x80
lea rcx, [rbp + 0x48]
mov edx, 0x2b8
xor r8, r8
call fcn.00408d50
mov rcx, qword [rbp + 0x320]
call fcn.0040feb0
mov rcx, rax
mov edx, esi
lea r8, [rbp + 0x48]
mov r9d, 0x2b8
mov dword [rsp + 0x20], ebx
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
jne 0x5ea7c8
xor rax, rax
mov qword [rbp + 0x38], rax
jmp 0x5ea7d0
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x38], rax
nop
lea rcx, [rbp + 0x320]
call fcn.0040e080
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x300]
pop rbx
pop rsi
pop rbp
ret
Function at 0x5ecba0
Capabilities:
Get disk information

Disassembly:
push rbp
push rbx
sub rsp, 0x858
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
nop
mov rcx, qword [rbp + 0x30]
lea rdx, [0x005ece84]
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
call qword [rax + 0x70]
lea rcx, [rbp + 0x7e]
mov edx, 0x7d2
xor r8, r8
call fcn.00408d50
mov ecx, 0x3e8
lea rdx, [rbp + 0x7e]
call sub.kernel32.dll_GetLogicalDriveStringsW
xor rbx, rbx
movsxd rax, ebx
cmp word [rbp + rax*2 + 0x7e], 0
jne 0x5ece03
mov rcx, qword [rbp + 0x70]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 4
jg 0x5ecc6c
cmp eax, 4
je 0x5ecd01
sub eax, 2
test eax, eax
je 0x5ecc87
sub eax, 1
test eax, eax
jne 0x5ecdb2
jmp 0x5eccc4
sub eax, 5
test eax, eax
je 0x5ecd3e
sub eax, 1
test eax, eax
jne 0x5ecdb2
jmp 0x5ecd78
lea rcx, [rbp + 0x68]
mov edx, 3
lea r8, [0x005ecea0]
mov r9, qword [rbp + 0x70]
lea rax, [0x005eceb8]
mov qword [rsp + 0x20], rax
call fcn.00410420
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
call qword [rax + 0x70]
jmp 0x5ecdea
lea rcx, [rbp + 0x60]
mov edx, 3
lea r8, [0x005ecea0]
mov r9, qword [rbp + 0x70]
lea rax, [0x005ecee0]
mov qword [rsp + 0x20], rax
call fcn.00410420
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
call qword [rax + 0x70]
jmp 0x5ecdea
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x005ecea0]
mov r9, qword [rbp + 0x70]
lea rax, [0x005ecf08]
mov qword [rsp + 0x20], rax
call fcn.00410420
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
call qword [rax + 0x70]
jmp 0x5ecdea
lea rcx, [rbp + 0x50]
mov edx, 3
lea r8, [0x005ecea0]
mov r9, qword [rbp + 0x70]
lea rax, [0x005ecf28]
mov qword [rsp + 0x20], rax
call fcn.00410420
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
call qword [rax + 0x70]
jmp 0x5ecdea
lea rcx, [rbp + 0x48]
mov edx, 3
lea r8, [0x005ecea0]
mov r9, qword [rbp + 0x70]
lea rax, [0x005ecf48]
mov qword [rsp + 0x20], rax
call fcn.00410420
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
call qword [rax + 0x70]
jmp 0x5ecdea
lea rcx, [rbp + 0x40]
mov edx, 3
lea r8, [0x005ecea0]
mov r9, qword [rbp + 0x70]
lea rax, [0x005ecf6c]
mov qword [rsp + 0x20], rax
call fcn.00410420
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
call qword [rax + 0x70]
lea rcx, [rbp + 0x70]
call fcn.0040e080
movsxd rax, ebx
cmp word [rbp + rax*2 + 0x80], 0
je 0x5ece31
jmp 0x5ece22
lea rcx, [rbp + 0x38]
movsxd rax, ebx
movzx rdx, word [rbp + rax*2 + 0x7e]
call fcn.0040ff00
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x38]
call fcn.00410220
add ebx, 1
cmp ebx, 0x3e9
jne 0x5ecc2a
nop
nop
lea rcx, [rbp + 0x38]
mov edx, 8
call fcn.0040e160
lea rsp, [rbp + 0x858]
pop rbx
pop rbp
ret
Function at 0x5ecf90
Capabilities:
Get memory capacity

Disassembly:
push rbp
sub rsp, 0xc0
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
nop
mov rcx, qword [rbp + 0x28]
lea rdx, [0x005ed1c4]
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
call qword [rax + 0x70]
lea rcx, [rbp + 0x80]
mov edx, 0x40
xor r8, r8
call fcn.00408d50
mov dword [rbp + 0x80], 0x40
lea rcx, [rbp + 0x80]
call sub.kernel32.dll_GlobalMemoryStatusEx
cmp qword [rbp + 0x88], 0
jbe 0x5ed099
lea rcx, [rbp + 0x78]
lea rdx, [0x005ed1dc]
call fcn.0040e770
mov rax, qword [rbp + 0x88]
cvtsi2sd xmm0, rax
test rax, rax
jge 0x5ed053
addsd xmm0, qword [0x005ed180]
divsd xmm0, qword [0x005ed188]
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x78]
movapd xmm2, xmm0
mov r9, qword [0x00a8df50]
call fcn.00432c60
lea rcx, [rbp + 0x58]
lea rdx, [0x005ed200]
mov r8, qword [rbp + 0x70]
call fcn.004102f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
call qword [rax + 0x70]
cmp qword [rbp + 0x90], 0
jbe 0x5ed112
lea rcx, [rbp + 0x68]
lea rdx, [0x005ed1dc]
call fcn.0040e770
mov rax, qword [rbp + 0x90]
cvtsi2sd xmm0, rax
test rax, rax
jge 0x5ed0cc
addsd xmm0, qword [0x005ed180]
divsd xmm0, qword [0x005ed188]
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
movapd xmm2, xmm0
mov r9, qword [0x00a8df50]
call fcn.00432c60
lea rcx, [rbp + 0x50]
lea rdx, [0x005ed224]
mov r8, qword [rbp + 0x60]
call fcn.004102f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
call qword [rax + 0x70]
cmp dword [rbp + 0x84], 0
jbe 0x5ed165
mov eax, dword [rbp + 0x84]
mov dword [rbp + 0x30], eax
mov byte [rbp + 0x38], 0
lea rcx, [rbp + 0x40]
lea rdx, [0x005ed270]
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.0042e480
lea rcx, [rbp + 0x48]
lea rdx, [0x005ed248]
mov r8, qword [rbp + 0x40]
call fcn.004102f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
call qword [rax + 0x70]
nop
lea rcx, [rbp + 0x40]
mov edx, 8
call fcn.0040e160
lea rsp, [rbp + 0xc0]
pop rbp
ret
Function at 0x5eec90
Capabilities:
Check os version

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x830
mov rbp, rsp
mov rbx, rcx
xor rsi, rsi
lea rcx, [rbp + 0x2e]
mov edx, 0x802
xor r8, r8
call fcn.00408d50
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eedb8]
call sub.kernel32.dll_lstrcpyW
lea rcx, [rbp + 0x20]
call fcn.005ee9e0
cmp al, 1
jne 0x5eed0a
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eedbe]
call sub.kernel32.dll_lstrcatW
lea rcx, [rbp + 0x2e]
mov rdx, qword [rbp + 0x20]
call sub.kernel32.dll_lstrcatW
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eedd2]
call sub.kernel32.dll_lstrcatW
mov ecx, dword [rbp + 0x20]
call sub.kernel32.dll_LocalFree_1
jmp 0x5eed1a
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eedd6]
call sub.kernel32.dll_lstrcatW
call sub.kernel32.dll_GetVersion_1
cmp al, 5
jne 0x5eed36
call sub.kernel32.dll_GetVersion_1
movzx eax, ax
shr eax, 8
test al, al
sete al
jmp 0x5eed39
xor rax, rax
test al, al
je 0x5eed4f
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eedf0]
call sub.kernel32.dll_lstrcatW
jmp 0x5eed6f
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eee0e]
call sub.kernel32.dll_lstrcatW
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eedf0]
call sub.kernel32.dll_lstrcatW
call sub.kernel32.dll_GetVersion_1
cmp al, 6
jb 0x5eed89
lea rcx, [rbp + 0x2e]
lea rdx, [0x005eee2c]
call sub.kernel32.dll_lstrcatW
lea rcx, [rbp + 0x2e]
mov edx, 1
mov r8, rbx
xor r9, r9
call sub.advapi32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne al
test al, al
je 0x5eedaa
mov sil, 1
mov eax, esi
lea rsp, [rbp + 0x830]
pop rbx
pop rsi
pop rbp
ret

Function at 0x5efcf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r13d, r9d
mov rcx, rbx
mov edx, 0x160
xor r8, r8
call fcn.00408d50
test rsi, rsi
je 0x5efdb9
mov qword [rbx + 0x158], rsi
mov eax, r13d
movzx r13, word [rsi + 8]
cmp ax, r13w
jbe 0x5efd66
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8, rdi
movzx r9d, ax
call fcn.005efc50
movzx rax, word [rsi + 0xa]
lea rcx, [rbp + 0x20]
lea rdx, [rbx + 0xd4]
movzx r8, ax
call fcn.00406200
jmp 0x5efd79
mov rcx, rdi
lea rdx, [rbx + 0xd4]
movzx r8, ax
call fcn.00406200
xor rax, rax
mov ecx, r13d
sub cx, 1
cmp ax, cx
ja 0x5efda1
add cx, 1
movzx rdx, ax
xor byte [rbx + rdx + 0xd4], 0x36
add ax, 1
cmp ax, cx
jne 0x5efd8c
nop
mov rcx, rbx
call qword [rsi + 0xc]
mov rcx, rbx
lea rdx, [rbx + 0xd4]
movzx r8d, r13w
call qword [rsi + 0x1c]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x5efe00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
cmp qword [rbx + 0x158], 0
je 0x5efeaf
mov rax, qword [rbx + 0x158]
movzx rdi, word [rax + 8]
mov rcx, rbx
mov rdx, rsi
mov r13, qword [rbx + 0x158]
call qword [r13 + 0x14]
xor rax, rax
movzx ecx, di
sub ecx, 1
cmp eax, ecx
jg 0x5efe5c
add ecx, 1
movsxd rdx, eax
xor byte [rbx + rdx + 0xd4], 0x6a
add eax, 1
cmp eax, ecx
jne 0x5efe4a
nop
mov rcx, rbx
mov r13, qword [rbx + 0x158]
call qword [r13 + 0xc]
mov rcx, rbx
lea rdx, [rbx + 0xd4]
movzx r8d, di
mov rdi, qword [rbx + 0x158]
call qword [rdi + 0x1c]
mov rcx, rbx
mov rdx, rsi
mov rax, qword [rbx + 0x158]
movzx r8d, word [rax + 0xa]
mov rdi, qword [rbx + 0x158]
call qword [rdi + 0x1c]
mov rcx, rbx
mov rdx, rsi
mov rbx, qword [rbx + 0x158]
call qword [rbx + 0x14]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret