joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b610
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x68
mov rbx, rcx
lea rcx, str._Utils__Converted_SID_for_USERS_n
mov rbp, r8
mov r13, rdx
mov qword [rsp + 0x48], 0
call fcn.0040becc
xor r9d, r9d
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
je 0x40b69d
lea rcx, str.GetNamedSecurityInfo_Error__u_n
mov edx, eax
call fcn.0040becc
mov rcx, qword [rbp]
test rcx, rcx
je 0x40b696
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x40b806
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclA]
test eax, eax
je 0x40b6dd
lea rcx, str.GetExplicitEntriesFromAcl_failed__u_n
mov edx, eax
call fcn.0040becc
mov rcx, qword [rbp]
test rcx, rcx
je 0x40b6d6
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
jmp 0x40b68b
mov edx, dword [rsp + 0xb8]
lea rcx, str._Utils__Got__u_ACEs_for_folder_n
call fcn.0040becc
mov edx, dword [rsp + 0xb8]
lea edi, [rdx - 1]
test edi, edi
movsxd rax, edi
js 0x40b7cb
lea rsi, [rax + rax*2]
shl rsi, 4
mov rax, qword [rsp + 0x40]
mov edx, edi
cmp dword [rsi + rax + 0x1c], 0
jne 0x40b7ab
lea rcx, str._Utils__Trustee__u_is_SID_n
call fcn.0040becc
mov r11, qword [rsp + 0x40]
mov rdx, qword [rbp]
mov rcx, qword [rsi + r11 + 0x28]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40b7b7
mov rax, qword [rsp + 0x40]
lea rcx, str._Utils__Trustee__u_is_Users._Permissions_is__u._Trimming..._n
mov edx, edi
mov r8d, dword [rsi + rax]
call fcn.0040becc
mov edx, dword [rsp + 0xb8]
mov r12d, edi
lea eax, [rdx - 1]
cmp edi, eax
jae 0x40b79f
mov rcx, rsi
mov rax, qword [rsp + 0x40]
lea rbx, [rcx + 0x30]
mov r8d, 0x30
lea rdx, [rbx + rax]
add rcx, rax
call fcn.00417c60
mov edx, dword [rsp + 0xb8]
add r12d, 1
lea eax, [rdx - 1]
mov rcx, rbx
cmp r12d, eax
jb 0x40b76e
add edx, 0xffffffff
mov dword [rsp + 0xb8], edx
jmp 0x40b7be
lea rcx, str._Utils__Unknown_trustee_at__u_n
call fcn.0040becc
mov edx, dword [rsp + 0xb8]
sub rsi, 0x30
sub edi, 1
jns 0x40b70d
lea rcx, str._Utils__Trimmed_ACE_size_is__u_n
call fcn.0040becc
mov rcx, qword [rbp]
test rcx, rcx
je 0x40b7e6
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x40b7f6
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0xb8]
mov dword [r13], eax
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b814
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
test rcx, rcx
mov rdi, r8
mov r12, rcx
mov qword [rsp + 0x40], 0
jne 0x40b842
lea eax, [rcx + 0x57]
jmp 0x40b9cb
lea rcx, str.PROGRAMDATA
call fcn.0041b630
lea rdx, [rsp + 0x48]
lea rcx, str.S_1_5_32_545
xor esi, esi
mov qword [rsp + 0x48], 0
mov rbx, rax
mov dword [rsp + 0xc0], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidA
test eax, eax
je 0x40b899
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.0040b610
mov esi, dword [rsp + 0xc0]
mov rbx, rax
jmp 0x40b8a7
lea rcx, str._Utils__Unable_to_convert_SID_n
call fcn.0040becc
xor ebx, ebx
test rbx, rbx
jne 0x40b8b4
lea eax, [rbx + 0x65]
jmp 0x40b9cb
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x30]
call fcn.004190e0
lea r14d, [rsi + 1]
mov dword [rsp + 0x50], 0x1200a9
lea rcx, [r14 + r14*2]
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], 3
shl rcx, 4
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x78], rdi
call fcn.00417100
test esi, esi
mov rdi, rax
je 0x40b926
mov rbp, rax
sub rbx, rax
mov r13d, esi
lea rdx, [rbx + rbp]
mov rcx, rbp
mov r8d, 0x30
call fcn.00417c60
add rbp, 0x30
sub r13, 1
jne 0x40b90a
mov eax, esi
lea rdx, [rsp + 0x50]
mov r8d, 0x30
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, rdi
call fcn.00417c60
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov ecx, r14d
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
mov ebx, eax
je 0x40b966
lea rcx, str.SetEntriesInAcl_Error__u_n
jmp 0x40b9a5
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
mov r8d, 0x80000004
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
test eax, eax
mov ebx, eax
je 0x40b9ac
lea rcx, str.SetNamedSecurityInfo_Error__u_n
mov edx, eax
call fcn.0040becc
test rdi, rdi
je 0x40b9b9
mov rcx, rdi
call fcn.004170c0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40b9c9
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b9e0
Capabilities:
Encode data using xor
Get session user name
Hash data using fnv
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
lea rcx, str.ALLUSERSPROFILE
call fcn.0041b630
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r12, rax
mov dword [rsp + 0x130], 0x64
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x20]
call fcn.00417310
xor esi, esi
xor edi, edi
test eax, eax
mov ebx, 0x811c9dc5
movsxd rbp, eax
jle 0x40ba63
movzx ecx, byte [rsp + rdi + 0x20]
mov edx, esi
xor ebx, ecx
movsx r8d, cl
lea rcx, str.__d___d__d_n
imul ebx, ebx, 0x1000193
mov r9d, ebx
call fcn.0040becc
add rdi, 1
add esi, 1
cmp rdi, rbp
jl 0x40ba35
test ebx, ebx
jns 0x40ba69
neg ebx
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x64]
call fcn.004190e0
lea rdx, [0x0044d914]
lea rcx, [rsp + 0x90]
mov r8d, ebx
call fcn.004182a0
lea rcx, [rsp + 0x20]
xor ebx, ebx
call fcn.00417310
test rax, rax
je 0x40bac3
cmp byte [rsp + rbx + 0x20], 0x80
jb 0x40bab0
mov byte [rsp + rbx + 0x20], 0x5f
lea rcx, [rsp + 0x20]
add rbx, 1
call fcn.00417310
cmp rbx, rax
jb 0x40baa4
mov ecx, 0x1388
call fcn.00417100
mov rdx, r12
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.004173d0
lea rdx, str.JWUser_
mov rcx, rbx
call fcn.0040be2c
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.004173d0
lea rdx, [0x0044cb28]
mov rcx, rbx
call fcn.004173d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.004173d0
mov rcx, rbx
call fcn.0040bde4
mov rax, rbx
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40bb34
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rcx, str.APPDATA
mov dword [rsp + 0x20], 0x94
call fcn.0041b630
test rax, rax
mov rdi, rax
je 0x40bc0f
mov rcx, rax
call fcn.00417310
cmp rax, 2
jbe 0x40bc0f
cmp byte [rdi], 0x5c
jne 0x40bc0f
cmp byte [rdi + 1], 0x5c
jne 0x40bc0f
lea rcx, str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040becc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40bc1b
cmp dword [rsp + 0x24], 5
jbe 0x40bbc5
lea rcx, str.LOCALAPPDATA
call fcn.0041b630
lea rcx, str._Extractor__Local_AppData_directory_resolved_to__s_n
mov rdx, rax
mov rdi, rax
call fcn.0040becc
jmp 0x40bc1b
lea rcx, str.USERPROFILE
call fcn.0041b630
mov ecx, 0x1388
mov rbx, rax
call fcn.00417100
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004173d0
lea rdx, str.Local_Settings
mov rcx, rdi
call fcn.0040be2c
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040be2c
jmp 0x40bc1b
lea rcx, str._Extractor__Local_AppData_directory_detected_n
call fcn.0040becc
lea rcx, str.Validating_directory..._n
call fcn.0040becc
lea rcx, str.Shared_dir_detected_is__s_n
mov rdx, rdi
call fcn.0040becc
lea rcx, str._Utils__Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040becc
mov edx, 6
mov rcx, rdi
call fcn.0041d700
test eax, eax
jne 0x40bcd1
lea rcx, str.Checking_if_string_is_cAscii__s_n
mov rdx, rdi
call fcn.0040becc
mov rcx, rdi
xor ebx, ebx
call fcn.00417310
test rax, rax
je 0x40bc8b
cmp byte [rbx + rdi], 0x80
jae 0x40bcd1
mov rcx, rdi
add rbx, 1
call fcn.00417310
cmp rbx, rax
jb 0x40bc74
lea rcx, str.Checking_if__s_contains_a___n
mov rdx, rdi
call fcn.0040becc
mov rcx, rdi
xor ebx, ebx
call fcn.00417310
test rax, rax
je 0x40bcc0
cmp byte [rbx + rdi], 0x21
je 0x40bcd1
mov rcx, rdi
add rbx, 1
call fcn.00417310
cmp rbx, rax
jb 0x40bca9
lea rcx, str.Shared_directory_appears_valid._n
call fcn.0040becc
jmp 0x40bd56
lea rcx, str.The_directory__s_appears_invalid._n
mov rdx, rdi
call fcn.0040becc
lea rcx, str.Trying_the_short_path_instead._n
mov rdx, rdi
call fcn.0040becc
mov ecx, 0x1388
call fcn.00417100
mov r8d, 0x400
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40bd46
lea rcx, str.Got_short_path_of__s_n
mov rdx, rbx
call fcn.0040becc
lea rcx, str._Utils__Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040becc
mov edx, 6
mov rcx, rdi
call fcn.0041d700
test eax, eax
jne 0x40bd46
mov rax, rbx
jmp 0x40bd59
mov rcx, rbx
call fcn.004170c0
call fcn.0040b9e0
mov rdi, rax
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40e210
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e237
lea rdx, str.._srchashes_sha2_sha256.c
lea rcx, str.md___NULL
mov r8d, 0xd0
call fcn.00410a00
xor eax, eax
mov dword [rbx + 0x280], 0x6a09e667
mov dword [rbx + 0x284], 0xbb67ae85
mov dword [rbx + 0x288], 0x3c6ef372
mov dword [rbx + 0x28c], 0xa54ff53a
mov dword [rbx + 0x290], 0x510e527f
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x9b05688c
mov dword [rbx + 0x298], 0x1f83d9ab
mov dword [rbx + 0x29c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret

Function at 0x40e7d0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e7f5
lea r8d, [rcx + 0x2a]
lea rdx, str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
lea rcx, str.md___NULL
call fcn.00410a00
xor eax, eax
mov dword [rbx + 0x280], 0xc1059ed8
mov dword [rbx + 0x284], 0x367cd507
mov dword [rbx + 0x288], 0x3070dd17
mov dword [rbx + 0x28c], 0xf70e5939
mov dword [rbx + 0x290], 0xffc00b31
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x68581511
mov dword [rbx + 0x298], 0x64f98fa7
mov dword [rbx + 0x29c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
Function at 0x411e80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0xc8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
test eax, eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
js 0x411ffe
cdq
and edx, 7
add eax, edx
and eax, 7
cmp eax, edx
jne 0x411ffe
cmp r8, 8
mov qword [rsp + 0x38], rbp
jb 0x411f21
xor ebp, ebp
nop
nop
mov eax, dword [rbx + 0xc8]
test eax, eax
je 0x411f21
cdq
add rsi, 1
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
cmp dword [rbx + 0xc8], 0x440
jne 0x411f17
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00411ae0
mov dword [rbx + 0xc8], ebp
sub rdi, 8
cmp rdi, 8
jae 0x411ed0
cmp rdi, 0x440
jb 0x411f6e
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rdi
mov rbp, rdx
shr rbp, 0xa
mov rax, rbp
imul rax, rax, 0xfffffffffffffbc0
add rdi, rax
nop
nop
mov r8d, 0x11
mov rdx, rsi
mov rcx, rbx
call fcn.00411ae0
add rsi, 0x88
sub rbp, 1
jne 0x411f50
cmp rdi, 8
mov rbp, qword [rsp + 0x38]
jb 0x411fba
mov r8, rdi
shr r8, 3
mov rax, r8
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
nop
nop
mov eax, dword [rbx + 0xc8]
add rsi, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
sub r8, 1
jne 0x411f90
test rdi, rdi
je 0x411fe8
mov eax, dword [rbx + 0xc8]
mov ecx, 8
cdq
sub cl, dil
and edx, 7
add eax, edx
movzx edx, byte [rsi]
sar eax, 3
shr dl, cl
movsxd r8, eax
xor byte [r8 + rbx], dl
add dword [rbx + 0xc8], edi
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x28
ret

Function at 0x418270
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x418299
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418299
mov ecx, eax
call fcn.00417610
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x418d40
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418d69
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418d69
mov ecx, eax
call fcn.00417610
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x41d700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x41d746
call fcn.004175e0
mov dword [rax], 0
call fcn.004175b0
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.0041f9d0
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x41d70d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41d777
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417610
call fcn.004175b0
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x41d7ab
test al, 1
je 0x41d7ab
test bl, 2
je 0x41d7ab
call fcn.004175e0
mov dword [rax], 5
call fcn.004175b0
mov dword [rax], 0xd
call fcn.004175b0
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x41d7c0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41d7eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d7eb
mov ecx, eax
call fcn.00417610
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x41d800
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41d829
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d829
mov ecx, eax
call fcn.00417610
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x429cb7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004586e8]
jne 0x41df9a
rol rcx, 0x10
test cx, 0xffff
jne 0x41df96
repz ret
ror rcx, 0x10
jmp 0x429c10
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0045c740]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0045c838]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x429c95
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0045c740]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x429cb7
mov rax, qword [rsp + 0x88]
mov qword [0x0045c838], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0045c7d8], rax
mov rax, qword [0x0045c838]
mov qword [0x0045c6b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0045c7c0], rax
mov dword [0x0045c6a0], 0xc0000409
mov dword [0x0045c6a4], 1
mov rax, qword [0x004586e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004586f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0045c738], eax
mov ecx, 1
call fcn.0042a490
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0044ab40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0045c738], 0
jne 0x429d3e
mov ecx, 1
call fcn.0042a490
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x429d60
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0041fb60
xor ebx, ebx
cmp qword [0x0045cc10], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x429e91
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x429dc3
xor eax, eax
jmp 0x429f71
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x429dbc
mov rcx, rax
call fcn.0041faf0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0045cc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041faf0
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0045cc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041faf0
lea rcx, [rsp + 0x30]
mov qword [0x0045cc20], rax
call fcn.00418540
test eax, eax
je 0x429e47
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f930
cmp dword [rsp + 0x30], 2
jne 0x429e91
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041faf0
test rax, rax
mov qword [0x0045cc30], rax
je 0x429e91
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041faf0
mov qword [0x0045cc28], rax
mov rcx, qword [0x0045cc28]
cmp rcx, rsi
je 0x429f23
cmp qword [0x0045cc30], rsi
je 0x429f23
call fcn.0041fbc0
call rax
test rax, rax
mov rbp, rax
je 0x429eee
mov rcx, qword [0x0045cc30]
call fcn.0041fbc0
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x429eee
test byte [rsp + 0x48], 1
jne 0x429f23
lea rcx, [rsp + 0x34]
call fcn.00418590
test eax, eax
je 0x429f10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f930
cmp dword [rsp + 0x34], 4
jb 0x429f1d
bts edi, 0x15
jmp 0x429f57
bts edi, 0x12
jmp 0x429f57
mov rcx, qword [0x0045cc18]
cmp rcx, rsi
je 0x429f57
call fcn.0041fbc0
call rax
test rax, rax
mov rbx, rax
je 0x429f57
mov rcx, qword [0x0045cc20]
cmp rcx, rsi
je 0x429f57
call fcn.0041fbc0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0045cc10]
call fcn.0041fbc0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x4400f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x00446160]
mov rbx, rdx
mov r11, rcx
not r8d
cmp rdx, 8
jbe 0x4401f6
mov qword [rsp + 0x10], rdi
test cl, 7
je 0x440144
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
test r11b, 7
jne 0x440120
mov rdi, rbx
and ebx, 7
and rdi, 0xfffffffffffffff8
add rdi, r11
cmp r11, rdi
jae 0x4401f1
nop word [rax + rax]
xor r8d, dword [r11]
mov r10d, dword [r11 + 4]
add r11, 8
mov r9d, r8d
mov eax, r8d
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
cmp r11, rdi
jb 0x440160
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x440222
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub rbx, 1
jne 0x440200
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x440230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
lea r14, [0x00448160]
mov rbx, rdx
mov r11, rcx
not r8
cmp rdx, 4
jbe 0x440317
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
test cl, 3
je 0x440285
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
test r11b, 3
jne 0x440260
xor esi, esi
mov rcx, rbx
and rcx, 0xfffffffffffffffc
and ebx, 3
lea rdi, [rcx + 3]
shr rdi, 2
lea rax, [rcx + r11]
cmp r11, rax
cmova rdi, rsi
test rdi, rdi
je 0x44030d
nop dword [rax]
mov r10d, dword [r11]
inc rsi
mov eax, r8d
add r11, 4
xor r10, rax
mov rax, r10
shr rax, 0x10
movzx edx, al
mov rax, r10
shr rax, 8
movzx ecx, al
mov rax, r10
shr rax, 0x18
mov r9, qword [r14 + rdx*8 + 0x800]
xor r9, qword [r14 + rcx*8 + 0x1000]
xor r9, qword [r14 + rax*8]
movzx eax, r10b
xor r9, qword [r14 + rax*8 + 0x1800]
mov rax, r8
shr rax, 0x20
mov r8, r9
xor r8, rax
cmp rsi, rdi
jb 0x4402b0
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
test rbx, rbx
je 0x440343
nop dword [rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
sub rbx, 1
jne 0x440320
mov rbx, qword [rsp + 0x20]
not r8
mov rax, r8
pop r14
ret