joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149f0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.004149e0
mov ebx, eax
test ebx, ebx
je 0x414a39
cmp dword [0x0045c3c8], 0xffffffff
jne 0x414a13
mov ecx, 0xe2
call fcn.0040ba30
mov ecx, ebx
call fcn.004149c0
test rax, rax
jne 0x414a2b
mov ecx, 0xe2
call fcn.0040ba30
jmp 0x414a39
mov ecx, dword [0x0045c3c8]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x414a40
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0046b268], 0
je 0x414a7b
mov ecx, dword [0x0045c3c8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x414a8e
call fcn.004149f0
mov ecx, dword [0x0045c3c8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x414a8e
mov rax, qword [0x0046b2a0]
jmp 0x414a8e
mov rax, qword gs:[0x58]
mov ecx, dword [0x0045c3c8]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret
Function at 0x429270
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00429030
mov ebx, eax
mov rax, qword [0x00464178]
cmp byte [rax], 0
je 0x42939f
mov rcx, qword [0x00463f50]
call fcn.00406900
call fcn.00405a40
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00429230]
mov r8d, 1
movsxd r9, esi
call fcn.00410430
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x0042942c]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x4293e2
mov rcx, qword [0x0046b270]
call fcn.00410990
mov rcx, rax
mov rax, qword [0x00463ef0]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW
xor ecx, ecx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00429230]
call fcn.00410600
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x42b3d0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov qword [rbp + 0x98], r9
nop
mov byte [rbp + 0x67], 0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
call fcn.0040c3e0
lea rcx, [rbp + 0x58]
call fcn.0040c6a0
mov rcx, qword [rbp + 0x58]
call fcn.0040d710
mov rcx, rax
lea rdx, [rbp + 0x50]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x42b4e0
mov ecx, dword [rbp + 0x54]
call fcn.00405700
mov qword [rbp + 0x68], rax
nop
mov rcx, qword [rbp + 0x58]
call fcn.0040d710
mov rcx, rax
mov edx, dword [rbp + 0x50]
mov r8d, dword [rbp + 0x54]
mov r9, qword [rbp + 0x68]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42b4d6
mov rcx, qword [rbp + 0x68]
lea rdx, [0x0042b538]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x44]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42b4d6
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x40], eax
mov rax, qword [rbp + 0x88]
mov ecx, dword [rbp + 0x40]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x48]
movzx ecx, word [rcx + 0x10]
mov dword [rax], ecx
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x14]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x98]
mov ecx, dword [rbp + 0x3c]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov byte [rbp + 0x67], 1
nop
mov rcx, qword [rbp + 0x68]
call fcn.00405730
nop
lea rcx, [rbp + 0x58]
call fcn.0040bcf0
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x42c850
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040c580
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.004146e0
mov esi, eax
cmp esi, 0x104
jbe 0x42c8ab
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00405700
mov rdi, rax
jmp 0x42c8af
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.004146e0
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x42c905
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x42c8e6
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x42c917
mov rcx, rdi
call fcn.00405730
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x4328d0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
mov edx, 0x58
xor r8, r8
call fcn.004069b0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x433020
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov byte [rbx], 0
mov esi, 0x3e8
mov byte [rbp + 0x2f], 0
mov edi, 8
shl byte [rbp + 0x2f], 1
lea rcx, [rbp + 0x38]
call sub.kernel32.dll_QueryPerformanceCounter
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_QueryPerformanceCounter
mov rax, qword [rbp + 0x30]
sub qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
and rax, 1
jns 0x433073
sub rax, 1
or rax, 0xfffffffffffffffe
add rax, 1
test rax, rax
jne 0x433082
mov qword [rbp + 0x38], 0
jmp 0x43308a
mov qword [rbp + 0x38], 1
movzx rax, byte [rbp + 0x38]
add byte [rbp + 0x2f], al
sub edi, 1
test edi, edi
jne 0x43303f
nop
movzx rax, byte [rbp + 0x2f]
xor byte [rbx], al
sub esi, 1
test esi, esi
jne 0x433036
nop
mov esi, 8
lea rcx, [rbp + 0x38]
call sub.kernel32.dll_QueryPerformanceCounter
mov ecx, 1
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_QueryPerformanceCounter
mov rax, qword [rbp + 0x30]
sub rax, qword [rbp + 0x38]
mov qword [rbp + 0x38], rax
movzx rax, byte [rbp + 0x38]
mov byte [rbp + 0x2f], al
movzx rax, byte [rbp + 0x2f]
xor byte [rbx], al
sub esi, 1
test esi, esi
jne 0x4330ae
nop
mov qword [rbp + 0x38], 0
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x2f]
mov r8d, 1
call fcn.00405ac0
mov qword [rbp + 0x30], 0
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x435630
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
xor ecx, ecx
movzx r8, r8b
sub r8d, 1
mov eax, ecx
cmp eax, r8d
ja 0x4356b9
sub r8d, ecx
add r8d, 1
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov r9d, ecx
lea r10, [0x004610d8]
mov r11d, ecx
movzx r11, byte [rdx + r11]
lea rbx, [0x004614d8]
mov esi, ecx
add esi, 1
mov esi, esi
movzx rsi, byte [rdx + rsi]
mov r10d, dword [r10 + r11*4]
xor r10d, dword [rbx + rsi*4]
lea r11, [0x004618d8]
mov ebx, ecx
add ebx, 2
mov ebx, ebx
movzx rbx, byte [rdx + rbx]
xor r10d, dword [r11 + rbx*4]
lea r11, [0x00461cd8]
add ecx, 3
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
xor r10d, dword [r11 + rcx*4]
mov dword [rdx + r9], r10d
add eax, 1
sub r8d, 1
test r8d, r8d
jne 0x43564a
nop
pop rbx
pop rsi
ret
Function at 0x435c10
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
test rax, rax
je 0x435c1c
mov rax, qword [rax - 8]
mov r9, qword [rdx]
mov r8, r9
test r8, r8
je 0x435c2b
mov r8, qword [r8 - 8]
movsxd r10, eax
cmp r8, r10
jge 0x435c3f
mov rax, r9
test rax, rax
je 0x435c3f
mov rax, qword [rax - 8]
xor r8, r8
mov r9d, eax
sub r9d, 1
mov eax, r8d
cmp eax, r9d
jg 0x435c79
sub r9d, r8d
add r9d, 1
movsxd r8, eax
mov r10, qword [rcx]
lea r10, [r10 + r8]
mov r11, qword [rdx]
movzx r8, byte [r11 + r8]
xor byte [r10], r8b
add eax, 1
sub r9d, 1
test r9d, r9d
jne 0x435c58
nop
ret

Function at 0x435c80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov rbx, rcx
mov rsi, r8
mov rdi, r9
xor r13, r13
mov rax, qword [rbp + 0x88]
mov rcx, qword [rax]
mov rdx, qword [rdx]
mov r8d, pe_nt_image_headers64
mov r9, qword [rsi]
call fcn.00435ac0
mov rcx, qword [rsi]
lea rdx, [rbp + 0x20]
mov r8d, 0x10
call fcn.00405ac0
jmp 0x435d15
mov rax, qword [rbp + 0x88]
mov rcx, qword [rax]
lea rdx, [rbp + 0x20]
lea r8, [rbp + 0x20]
call fcn.00435260
xor eax, eax
lea rcx, [rbp + 0x20]
movzx rdx, al
mov r8d, r13d
add r8d, edx
movsxd rdx, r8d
mov r8, qword [rdi]
mov r9, qword [rbx]
movzx r9, byte [r9 + rdx]
xor r9b, byte [rcx]
mov byte [r8 + rdx], r9b
add al, 1
add rcx, 1
cmp al, 0x10
jne 0x435ce5
nop
add r13d, 0x10
mov eax, r13d
add eax, 0x10
cmp eax, dword [rbp + 0x80]
jle 0x435cc8
cmp r13d, dword [rbp + 0x80]
je 0x435d96
mov rax, qword [rbp + 0x88]
mov rcx, qword [rax]
lea rdx, [rbp + 0x20]
lea r8, [rbp + 0x20]
call fcn.00435260
xor ecx, ecx
movzx r8, byte [rbp + 0x80]
sub r8b, r13b
sub r8b, 1
mov eax, ecx
cmp al, r8b
ja 0x435d95
sub r8b, cl
add r8b, 1
lea rcx, [rbp + 0x20]
movzx rdx, al
mov r9d, r13d
add r9d, edx
movsxd rdx, r9d
mov r9, qword [rdi]
mov r10, qword [rbx]
movzx r10, byte [r10 + rdx]
xor r10b, byte [rcx]
mov byte [r9 + rdx], r10b
add al, 1
add rcx, 1
sub r8b, 1
test r8b, r8b
jne 0x435d66
nop
mov rax, qword [rbp + 0x88]
mov rcx, qword [rax]
call fcn.00435a10
lea rcx, [rbp + 0x20]
mov edx, 0x10
xor r8, r8
call fcn.004069b0
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x437190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
mov rdx, r8
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x4371f9
mov rcx, rsi
mov rdx, rax
call sub.kernel32.dll_LoadResource
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x4371f9
mov rcx, rax
call sub.kernel32.dll_LockResource
mov rdi, rax
mov rcx, rsi
mov rdx, qword [rbx + 0x10]
call sub.kernel32.dll_SizeofResource
mov rcx, rbx
mov rdx, rdi
movsxd r8, eax
call fcn.00437180
mov byte [rbx + 8], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x437d20
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x80], rcx
lea rcx, [rbp + 0x80]
call fcn.0040bf00
nop
xor eax, eax
mov byte [rbp + 0x4f], al
mov rcx, qword [rbp + 0x80]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x437e18
mov rcx, rbx
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x437da5
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x437e18
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x0042ee20]
call fcn.00410600
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x0042ee20]
mov r8d, 1
mov r9, qword [rbp + 0x58]
call fcn.00410430
mov dword [rbp + 0x54], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x437e0a
mov rcx, rbx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x58]
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov al, 1
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x80]
call fcn.0040bd90
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x4389b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x4389d9
mov rcx, qword [0x00463f50]
lea rdx, [0x00438a08]
call fcn.004080c0
mov rcx, rax
call fcn.00408220
call fcn.00405a40
mov ecx, 1
xor edx, edx
mov r8d, ebx
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4389b9
add rsp, 0x20
pop rbx
ret
Function at 0x439b10
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x68]
mov rax, qword [0x00463fc0]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439d18]
call fcn.0040d230
mov rcx, qword [rbp + 0x68]
call fcn.0042fe80
test al, al
je 0x439cb3
mov rcx, 0xffffffff80000001
lea rdx, [0x00439d3e]
lea r8, [rbp + 0x78]
call sub.advapi32.dll_RegOpenKeyW
mov rax, qword [0x00463fc0]
mov rax, qword [rax + 0x80]
test rax, rax
je 0x439ba8
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00463fc0]
mov rdx, qword [rdx + 0x80]
mov r8d, eax
call fcn.00432b30
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x50]
call fcn.00432a70
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x60]
call fcn.0040d150
mov rcx, qword [rbp + 0x48]
call fcn.0040d180
mov rsi, rax
lea rcx, [rbp + 0x40]
mov rax, qword [0x00463fc0]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439d18]
call fcn.0040d230
mov rax, qword [rbp + 0x40]
xor ebx, ebx
test rax, rax
je 0x439c17
mov ebx, dword [rax - 4]
shr ebx, 1
lea rcx, [rbp + 0x38]
mov rax, qword [0x00463fc0]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439d18]
call fcn.0040d230
mov rcx, qword [rbp + 0x38]
call fcn.0040d180
mov rcx, qword [rbp + 0x78]
mov rdx, rsi
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add ebx, ebx
mov dword [rsp + 0x28], ebx
call sub.advapi32.dll_RegSetValueExW
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_RegCloseKey
lea rcx, [rbp + 0x30]
mov rax, qword [0x00463fc0]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439d18]
call fcn.0040d230
mov rcx, qword [rbp + 0x30]
call fcn.0040d180
xor ecx, ecx
lea rdx, [0x00439d9a]
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x30]
mov edx, 4
call fcn.0040be70
lea rcx, [rbp + 0x60]
call fcn.0040bd40
lea rcx, [rbp + 0x68]
call fcn.0040bd90
lea rsp, [rbp + 0x80]
pop rbx
pop rsi
pop rbp
ret
Function at 0x439db0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
mov rax, qword [0x00463fc0]
lea rcx, [rax + 0x98]
mov rdx, qword [0x0042ee20]
call fcn.00410600
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x439e43
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x0043a0b4]
mov rax, qword [0x00463fc0]
mov r9, qword [rax + 0x118]
lea rax, [0x0043a0e8]
mov qword [rsp + 0x20], rax
call fcn.0040d530
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.0040d820
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00439060
lea rcx, [rbp + 0x48]
mov rax, qword [0x00463fc0]
mov rdx, qword [rax + 0x118]
lea r8, [0x0043a0e8]
call fcn.0040d230
mov rcx, qword [rbp + 0x48]
call fcn.0040d180
mov rcx, rax
mov edx, 0x80000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x439ecd
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43a055
lea rcx, [0x0043a11c]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
jmp 0x43a055
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x439eeb
lea rcx, [0x0043a164]
mov dl, 1
call fcn.00439060
mov rcx, rbx
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x439f2d
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x439f20
lea rcx, [0x0043a1a0]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x43a055
mov rax, qword [0x00463fc0]
lea rcx, [rax + 0x98]
mov rdx, qword [0x0042ee20]
mov r8d, 1
mov r9, qword [rbp + 0x60]
call fcn.00410430
mov dword [rbp + 0x6c], 0
jmp 0x43a022
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x439fa3
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43a022
lea rcx, [0x0043a1f0]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
jmp 0x43a022
mov rcx, rbx
mov rax, qword [0x00463fc0]
mov rdx, qword [rax + 0x98]
mov r8d, dword [rbp + 0x60]
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x439ff5
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43a022
lea rcx, [0x0043a25c]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
jmp 0x43a022
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
je 0x43a022
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43a022
lea rcx, [0x0043a2b8]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
jne 0x439f5d
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43a054
lea rcx, [0x0043a324]
mov dl, 1
call fcn.00439060
nop
lea rcx, [rbp + 0x48]
call fcn.0040bd90
lea rcx, [rbp + 0x50]
call fcn.0040bcf0
lea rcx, [rbp + 0x58]
call fcn.0040bd90
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x43a970
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x90], rcx
lea rcx, [rbp + 0x90]
call fcn.0040bf00
nop
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43a9fc
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x0043ac40]
mov rax, qword [0x00463fc0]
mov r9, qword [rax + 0x118]
lea rax, [0x0043ac88]
mov qword [rsp + 0x20], rax
call fcn.0040d530
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.0040d820
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00439060
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x90]
lea r8, [0x0043ac88]
call fcn.0040d230
mov rcx, qword [rbp + 0x48]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x43aa7f
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43abc4
lea rcx, [0x0043acbc]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
jmp 0x43abc4
mov dword [rbp + 0x6c], 0
jmp 0x43ab7d
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x43aad4
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43ab7d
lea rcx, [0x0043ad18]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
jmp 0x43ab7d
mov rax, qword [0x00463fc0]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x43aaeb
mov rax, qword [rax - 8]
mov rcx, rbx
mov rdx, qword [0x00463fc0]
mov rdx, qword [rdx + 0x98]
mov r8d, eax
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x43ab3c
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43ab7d
lea rcx, [0x0043ad84]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
jmp 0x43ab7d
mov rax, qword [0x00463fc0]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x43ab53
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
je 0x43ab7d
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43ab7d
lea rcx, [0x0043addc]
mov dl, 1
call fcn.00439060
xor ecx, ecx
call fcn.004392a0
mov rax, qword [0x00463fc0]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x43ab94
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
jne 0x43aa8b
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00463fc0]
cmp byte [rax + 0x134], 0
je 0x43abc3
lea rcx, [0x0043ae48]
mov dl, 1
call fcn.00439060
nop
lea rcx, [rbp + 0x48]
call fcn.0040bd90
lea rcx, [rbp + 0x50]
call fcn.0040bcf0
lea rcx, [rbp + 0x58]
call fcn.0040bd90
lea rcx, [rbp + 0x90]
call fcn.0040bd90
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x440000
Capabilities:
Get geographical location

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
mov rbp, rsp
mov rbx, rcx
mov esi, edx
call fcn.0042b330
cmp eax, 2
jne 0x440040
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x20]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x20]
call fcn.0040fc10
jmp 0x44006e
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x220]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x220]
mov r8d, pe_nt_image_headers64
call fcn.0040d7b0
mov rax, rbx
lea rsp, [rbp + 0x420]
pop rbx
pop rsi
pop rbp
ret

Function at 0x440080
Capabilities:
Get keyboard layout

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
nop
mov rcx, qword [rbp + 0x80]
lea rdx, [0x0044024c]
call fcn.0040c440
mov qword [rbp + 0x58], 0
xor ecx, ecx
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
jbe 0x440182
mov ecx, dword [rbp + 0x54]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov ecx, ecx
call fcn.00405700
mov qword [rbp + 0x58], rax
nop
mov ecx, dword [rbp + 0x54]
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov rcx, qword [rbp + 0x80]
call fcn.0040bd90
xor eax, eax
mov ebx, dword [rbp + 0x54]
sub ebx, 1
mov dword [rbp + 0x50], eax
cmp dword [rbp + 0x50], ebx
ja 0x44016c
sub ebx, eax
add ebx, 1
mov rax, qword [rbp + 0x58]
mov ecx, dword [rbp + 0x50]
movzx eax, word [rax + rcx*8]
mov dword [rbp + 0x4c], eax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x4c]
call fcn.00440000
lea rcx, [rbp + 0x30]
lea rdx, [0x00440270]
call fcn.0040d9b0
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040d850
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.0040d1a0
add dword [rbp + 0x50], 1
sub ebx, 1
test ebx, ebx
jne 0x44011a
nop
nop
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x54]
add edx, edx
add edx, edx
add edx, edx
mov edx, edx
call fcn.00405730
mov dword [rbp + 0x44], 0
mov rax, qword [rbp + 0x80]
mov rax, qword [rax]
test rax, rax
je 0x4401a1
mov eax, dword [rax - 4]
shr eax, 1
mov dword [rbp + 0x44], eax
mov rcx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax]
mov r8d, 1
mov r9d, dword [rbp + 0x44]
sub r9d, 4
call fcn.0040d650
nop
lea rcx, [rbp + 0x28]
call fcn.0040bd90
lea rcx, [rbp + 0x30]
call fcn.0040bcf0
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret