joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400132e4
Capabilities:
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbp
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov r14, rcx
mov ecx, 8
mov ebp, r8d
mov rsi, rdx
mov r9, qword [rax]
lea rax, str.CTieredVolume::SetDesiredStorageClass
mov qword [rcx + r9], rax
lea rcx, [r11 - 0x30]
call fcn.14000865c
and qword [rsp + 0x98], 0
lea r8, [rsp + 0x98]
mov rdx, rsi
mov rcx, r14
call fcn.140012428
mov dword [rsp + 0x50], eax
mov edi, eax
test eax, eax
jns 0x140013383
mov rcx, qword [0x140048138]
lea rax, [0x140048138]
cmp rcx, rax
je 0x14001341d
test byte [rcx + 0x1c], 1
je 0x14001341d
cmp byte [rcx + 0x19], 2
jb 0x14001341d
mov edx, 0x10b
mov dword [rsp + 0x30], edi
jmp 0x1400133f5
mov rcx, qword [rsp + 0x98]
lea r8, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x20], 0x43
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x40], ebp
lea r9d, [rax + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ebp, eax
test eax, eax
jns 0x14001341d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.14000395c
mov edi, eax
mov dword [rsp + 0x50], eax
mov rcx, qword [0x140048138]
lea rax, [0x140048138]
cmp rcx, rax
je 0x14001341d
test byte [rcx + 0x1c], 1
je 0x14001341d
cmp byte [rcx + 0x19], 2
jb 0x14001341d
mov edx, 0x10c
mov dword [rsp + 0x30], ebp
mov r9, qword [rsi + 8]
lea rax, [r14 + 0x2a0]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f470]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi]
mov qword [rsp + 0x20], rax
call fcn.14000aa1c
cmp qword [rsp + 0x98], 0
je 0x140013436
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rsp + 0x48]
call fcn.1400084bc
lea r11, [rsp + 0x70]
mov eax, edi
mov rbp, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x140014d54
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov rbp, rcx
mov ecx, 8
mov r14, r8
mov r15, rdx
mov r9, qword [rax]
lea rax, str.CTieredVolume::QueryDesiredStorageClass
mov qword [rcx + r9], rax
lea rcx, [rsp + 0x48]
call fcn.14000865c
and qword [rsp + 0xa8], 0
lea r8, [rsp + 0xa8]
mov rdx, r15
mov rcx, rbp
call fcn.140012428
mov dword [rsp + 0x50], eax
mov esi, eax
test eax, eax
jns 0x140014df5
mov rcx, qword [0x140048138]
lea rax, [0x140048138]
cmp rcx, rax
je 0x140014e9d
test byte [rcx + 0x1c], 1
je 0x140014e9d
cmp byte [rcx + 0x19], 2
jb 0x140014e9d
mov edx, 0x134
mov dword [rsp + 0x30], esi
jmp 0x140014e75
mov rcx, qword [rsp + 0xa8]
lea r8, [rsp + 0x40]
mov r9d, 8
mov dword [rsp + 0x20], 0x43
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test eax, eax
js 0x140014e2a
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
jmp 0x140014e9d
cmp edi, 0xc000050c
jne 0x140014e38
and dword [r14], 0
jmp 0x140014e9d
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.14000395c
mov esi, eax
mov dword [rsp + 0x50], eax
mov rcx, qword [0x140048138]
lea rax, [0x140048138]
cmp rcx, rax
je 0x140014e9d
test byte [rcx + 0x1c], 1
je 0x140014e9d
cmp byte [rcx + 0x19], 2
jb 0x140014e9d
mov edx, 0x135
mov dword [rsp + 0x30], edi
mov r9, qword [r15 + 8]
lea rax, [rbp + 0x2a0]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f470]
mov qword [rsp + 0x28], rax
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
call fcn.14000aa1c
cmp qword [rsp + 0xa8], 0
je 0x140014eb6
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rsp + 0x48]
call fcn.1400084bc
lea r11, [rsp + 0x70]
mov eax, esi
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140018078
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rdi, rcx
mov ecx, 8
mov esi, r9d
mov rbp, r8
mov rbx, rdx
mov r10, qword [rax]
lea rax, str.TieringJetDatabase::Initialize
mov qword [rcx + r10], rax
lea rcx, [r11 - 0x18]
call fcn.14000865c
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x68], rax
mov qword [rdi], rbx
mov dword [rdi + 0x60], esi
mov qword [rdi + 0x70], rbp
cmp esi, 1
jne 0x1400180de
lea rax, str.TieringEngineHeat
jmp 0x1400180fc
cmp esi, 2
jne 0x1400180ec
lea rax, str.TieringPinnedFiles
jmp 0x1400180fc
cmp esi, 3
jne 0x140018195
lea rax, str.TieringPinnedCacheFiles
mov qword [rdi + 0x58], rax
xor esi, esi
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x140018113
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
jmp 0x140018188
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov rbx, rax
test rax, rax
jne 0x140018184
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx r8d, ax
or r8d, 0x80070000
test eax, eax
cmovle r8d, eax
mov dword [rsp + 0x38], r8d
mov rcx, qword [0x140048138]
lea rax, [0x140048138]
cmp rcx, rax
je 0x140018184
test byte [rcx + 0x1c], 1
je 0x140018184
cmp byte [rcx + 0x19], 2
jb 0x140018184
mov r9, qword [rdi + 0x70]
lea edx, [rbx + 0x3d]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14003f778]
call fcn.140003d20
mov qword [rdi + 0x50], rbx
mov word [rdi + 0x4c], si
mov byte [rdi + 0x9c], 1
jmp 0x1400181e0
mov ebx, 0x8009300f
mov dword [rsp + 0x38], ebx
mov rcx, qword [0x140048138]
lea rax, [0x140048138]
cmp rcx, rax
je 0x1400181de
test byte [rcx + 0x1c], 1
je 0x1400181de
cmp byte [rcx + 0x19], 2
jb 0x1400181de
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f778]
mov edx, 0x3c
mov dword [rsp + 0x28], ebx
mov r9d, esi
mov qword [rsp + 0x20], rbp
call fcn.14001598c
mov esi, ebx
lea rcx, [rsp + 0x30]
call fcn.1400084bc
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14003b60c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140048cc8], rbx
je 0x14003b673
cmp rax, rbx
jne 0x14003b666
mov ebx, 1
mov esi, ebx
jmp 0x14003b678
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b64b
mov ebx, 1
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b690
mov edi, 0x1f
mov ecx, edi
call fcn.1400db000
jmp 0x14003b6fc
mov eax, dword [0x140048cd0]
test eax, eax
jne 0x14003b6f1
mov dword [0x140048cd0], ebx
lea r15, [0x14003e288]
lea rdi, [0x14003e270]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b6e3
test eax, eax
jne 0x14003b6e7
cmp qword [rdi], r14
je 0x14003b6d8
mov rax, qword [rdi]
mov rcx, qword [0x14003e230]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b6ba
test eax, eax
je 0x14003b6f7
mov eax, 0xff
jmp 0x14003b852
mov dword [0x140048284], ebx
mov edi, 0x1f
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b723
lea rdx, [0x14003e268]
lea rcx, [0x14003e238]
call sub.msvcrt.dll__initterm
mov dword [0x140048cd0], 2
test esi, esi
jne 0x14003b731
mov rax, r14
xchg qword [0x140048cc8], rax
cmp qword [0x140048ce8], r14
je 0x14003b764
lea rcx, [0x140048ce8]
call fcn.14003bbf0
test eax, eax
je 0x14003b764
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140048ce8]
mov r9, qword [0x14003e230]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b77d
mov eax, 0xff
jmp 0x14003b852
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14003b803
test ax, ax
je 0x14003b798
test edx, edx
jne 0x14003b803
sub ax, bx
cmp ax, di
ja 0x14003b7ae
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14003b798
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fc0
mov dword [0x140048280], eax
cmp dword [0x1400482a0], r14d
jne 0x14003b7ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140048284], r14d
jne 0x14003b801
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140048280]
jmp 0x14003b852
cmp ax, 0x22
jne 0x14003b817
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b786
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14003bc70
add rsp, 0x28
jmp 0x14003b60c
Function at 0x14003bb00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003bb4c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003bb44
cmp dword [rcx + 0x3c], edx
jl 0x14003bb44
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14003bb44
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14003bb4c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x4024a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x00418078], 0
je 0x40255b
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.00405f30
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x00415080]
call fcn.00405f30
mov rcx, rsi
mov rdx, qword [0x00415080]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.00405f30
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x402570
xor rcx, rcx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA_1
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x405380
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x00418078], 0
je 0x40541e
cmp word [0x00418388], 0xd7b2
jne 0x4053b3
cmp dword [0x00418390], 0
jbe 0x4053b3
lea rcx, [0x00418380]
call qword [0x004183a8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, str.Runtime_error_____at_0000000000000000
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00405454]
call fcn.00406570
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x405440
cmp byte [0x00415032], 0
jne 0x405440
xor rcx, rcx
lea rdx, str.Runtime_error_____at_0000000000000000
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA_1
add rsp, 0x40
pop rbx
ret

Function at 0x408150
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x0041ce30]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x0041ce58], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x0041ce28], al
cmp byte [0x0041ce28], 0
je 0x4081ef
lea rcx, [0x004081f4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040820e]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0041ce10], rax
lea rcx, [0x004081f4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040822c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0041ce18], rax
lea rcx, [0x004081f4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040824a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0041ce20], rax
add rsp, 0x28
ret

Function at 0x408580
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x4085a0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x4085c4
cmp eax, 1
jae 0x4085c9
cmp ecx, 5
jbe 0x4085d5
mov dword [0x00418974], 0x7f
jmp 0x4085df
mov dword [0x00418974], 0x409
add rsp, 0x28
ret

Function at 0x408810
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00408800
mov ebx, eax
test ebx, ebx
je 0x40885b
cmp dword [0x004165a0], 0xffffffff
jne 0x408834
mov ecx, 0xe2
call fcn.00405630
mov ecx, ebx
call fcn.004087e0
test rax, rax
jne 0x40884d
mov ecx, 0xe2
call fcn.00405630
jmp 0x40885b
mov ecx, dword [0x004165a0]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x408870
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0041ce5c], 0
je 0x4088ab
mov ecx, dword [0x004165a0]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4088be
call fcn.00408810
mov ecx, dword [0x004165a0]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4088be
mov rax, qword [0x0041ce90]
jmp 0x4088be
mov rax, qword gs:[0x58]
mov ecx, dword [0x004165a0]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x40be20
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov rcx, qword [rbp + 0x40]
call fcn.00405980
nop
lea rcx, [0x0041d0b0]
mov rdx, qword [rbp + 0x40]
call fcn.00405d90
mov qword [0x0041d0b8], 0
lea rcx, [0x0040bd50]
lea rdx, [0x0041d0b0]
movsxd rdx, edx
call sub.user32.dll_EnumWindows
cmp qword [0x0041d0b8], 0
setne al
mov byte [rbp + 0x2f], al
nop
lea rcx, [rbp + 0x40]
call fcn.004057f0
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x40c480
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x250
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
nop
lea rcx, [rbp + 0x46]
mov edx, 0x104
call sub.kernel32.dll_GetWindowsDirectoryW
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x46]
call fcn.0040c2e0
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0040c3a0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
lea r8, [0x0040c534]
call fcn.00406c50
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.004058d0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x250]
pop rbp
ret
Function at 0x40c7d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x80], r8
mov qword [rbp + 0x88], r9
mov rcx, qword [rbp + 0x80]
call fcn.00405980
mov rcx, qword [rbp + 0x88]
call fcn.00405980
mov rcx, qword [rbp + 0x90]
call fcn.00405980
nop
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x90]
call fcn.00405d90
mov rcx, qword [rbp + 0x80]
call fcn.004068b0
mov rcx, qword [rbp + 0x38]
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40c8ec
mov rcx, qword [rbp + 0x88]
call fcn.004068b0
mov rcx, qword [rbp + 0x48]
mov rdx, rax
xor r8, r8
lea r9, [rbp + 0x44]
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c8e3
mov rcx, qword [rbp + 0x30]
mov edx, dword [rbp + 0x40]
call fcn.00406a80
mov rcx, qword [rbp + 0x88]
call fcn.004068b0
mov rbx, rax
mov rax, qword [rbp + 0x30]
mov rcx, qword [rax]
call fcn.004068b0
mov rcx, qword [rbp + 0x48]
mov rdx, rbx
xor r8, r8
lea r9, [rbp + 0x44]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
mov rcx, qword [rbp + 0x30]
mov edx, dword [rbp + 0x40]
sub edx, 1
call fcn.00406a80
mov rcx, qword [rbp + 0x48]
call sub.advapi32.dll_RegCloseKey
nop
lea rcx, [rbp + 0x80]
mov edx, 3
call fcn.004058d0
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret

Function at 0x40cc20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, r8
xor rsi, rsi
xor rax, rax
mov r8, rcx
mov r9, rdx
mov rcx, rax
mov rdx, r8
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov rdi, rax
mov rcx, rbx
call fcn.004068b0
mov rcx, rax
mov edx, 0x40000000
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
test ebx, ebx
jbe 0x40cccd
xor rcx, rcx
mov edx, edi
call sub.kernel32.dll_LoadResource
mov rcx, rax
call sub.kernel32.dll_LockResource
mov r13, rax
xor rcx, rcx
mov edx, edi
call sub.kernel32.dll_SizeofResource
mov ecx, ebx
mov rdx, r13
mov r8d, eax
lea r9, [rbp + 0x4c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x40cccd
mov sil, 1
mov ecx, ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x40cef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
xor rcx, rcx
mov r8d, r9d
sub r8d, 1
cmp ecx, r8d
jg 0x40cf3d
add r8d, 1
mov r9d, eax
shr r9d, 8
and r9d, 0xffffff
lea r10, [0x00416c68]
movsxd r11, ecx
movzx r11, byte [rdx + r11]
xor eax, r11d
and eax, 0xff
movsxd rax, eax
xor r9d, dword [r10 + rax*4]
mov eax, r9d
add ecx, 1
cmp ecx, r8d
jne 0x40cf05
nop
ret
Function at 0x40cf40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.00405980
nop
or eax, 0xffffffff
mov dword [rbp + 0x4c], eax
movsxd rcx, dword [0x00416c64]
call fcn.00403700
mov rbx, rax
mov rcx, qword [rbp + 0x80]
call fcn.004068b0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x40d019
mov rcx, rsi
mov rdx, rbx
mov r8d, dword [0x00416c64]
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov ecx, dword [rbp + 0x4c]
mov rdx, rbx
mov r8d, 0x100000
mov r9d, dword [rbp + 0x5c]
call fcn.0040cef0
mov dword [rbp + 0x4c], eax
mov eax, dword [rbp + 0x5c]
movsxd rcx, dword [0x00416c64]
cmp rax, rcx
je 0x40cfb9
mov rcx, rsi
call sub.kernel32.dll_CloseHandle_1
mov rcx, rbx
call fcn.00403730
mov eax, dword [rbp + 0x4c]
not eax
mov dword [rbp + 0x4c], eax
nop
lea rcx, [rbp + 0x80]
call fcn.004057f0
mov eax, dword [rbp + 0x4c]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rbp
ret
Function at 0x40d3a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov dword [rbp + 0x34], edx
mov dword [rbp + 0x30], r8d
mov qword [rbp + 0x38], 0
nop
mov rcx, qword [rbp + 0x28]
call fcn.004057f0
mov eax, dword [rbp + 0x34]
test eax, eax
je 0x40d42f
mov ecx, 0x10
mov eax, dword [rbp + 0x34]
xor edx, edx
div ecx
mov rax, rdx
movsxd rcx, eax
shr rcx, 0x20
xor eax, ecx
lea rdx, [rbp + 0x38]
lea r8, str.0123456789ABCDEF
sub eax, ecx
movsxd rax, eax
movzx rax, word [r8 + rax*2]
mov rcx, rdx
mov edx, eax
call fcn.00406900
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x28]
mov r8, qword [rax]
call fcn.00406c50
mov ecx, 0x10
mov eax, dword [rbp + 0x34]
xor edx, edx
div ecx
mov dword [rbp + 0x34], eax
mov eax, dword [rbp + 0x34]
test eax, eax
jne 0x40d3cc
nop
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40d46b
jmp 0x40d453
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0040d550]
mov rax, qword [rbp + 0x28]
mov r8, qword [rax]
call fcn.00406c50
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.00405f20
mov ecx, dword [rbp + 0x30]
cmp eax, ecx
jl 0x40d43c
jmp 0x40d501
xor rax, rax
mov rcx, qword [rbp + 0x28]
cmp qword [rcx], 0
je 0x40d482
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov eax, dword [rax - 4]
mov rcx, qword [rbp + 0x28]
mov rcx, qword [rcx]
movsxd rax, eax
cmp word [rcx + rax*2 - 2], 0x2d
jne 0x40d4ed
xor rax, rax
mov rcx, qword [rbp + 0x28]
cmp qword [rcx], 0
je 0x40d4ab
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov eax, dword [rax - 4]
mov rcx, qword [rbp + 0x28]
mov edx, eax
mov r8d, 1
call fcn.00406ec0
lea rcx, [0x0040d560]
mov rdx, qword [rbp + 0x28]
mov r8d, 1
call fcn.00406f40
jmp 0x40d4ed
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0040d550]
mov rax, qword [rbp + 0x28]
mov r8, qword [rax]
call fcn.00406c50
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.00405f20
mov ecx, dword [rbp + 0x30]
cmp eax, ecx
jl 0x40d4d6
nop
lea rcx, [rbp + 0x38]
call fcn.004057f0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x40d570
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xe0
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
nop
mov rcx, qword [rbp + 0x30]
call fcn.00405840
mov dword [rbp + 0x54], 0x10
lea rcx, [rbp + 0xdc]
xor rdx, rdx
xor r8, r8
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000020
call sub.advapi32.dll_CryptAcquireContextA
test eax, eax
je 0x40d6ce
mov ecx, dword [rbp + 0xdc]
mov edx, 0x8003
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x40d6c0
xor rbx, rbx
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x40d60d
mov rax, qword [rbp + 0x38]
mov ebx, dword [rax - 4]
mov rcx, qword [rbp + 0x38]
call fcn.00406570
mov ecx, dword [rbp + 0xd8]
mov rdx, rax
mov r8d, ebx
xor r9, r9
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x40d6b5
mov ecx, dword [rbp + 0xd8]
mov edx, 2
lea r8, [rbp + 0x58]
lea r9, [rbp + 0x54]
mov dword [rsp + 0x20], 0
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x40d6b5
xor rbx, rbx
mov esi, dword [rbp + 0x54]
sub esi, 1
cmp ebx, esi
jg 0x40d6b4
add esi, 1
lea rcx, [rbp + 0x48]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax]
call fcn.00406a00
lea rcx, [rbp + 0x40]
movsxd rax, ebx
movzx rdx, byte [rax + rbp + 0x58]
mov r8d, 2
call fcn.0040d3a0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.00406b60
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
xor r8, r8
call fcn.00406670
add ebx, 1
cmp ebx, esi
jne 0x40d667
nop
mov ecx, dword [rbp + 0xd8]
call sub.advapi32.dll_CryptDestroyHash
mov ecx, dword [rbp + 0xdc]
xor rdx, rdx
call sub.advapi32.dll_CryptReleaseContext
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.004058d0
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0xe0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x40dba0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbp, rsp
mov rbx, rdx
xor rsi, rsi
call fcn.00406700
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rdi, rax
mov eax, edi
cmp rax, 0xffffffffffffffff
je 0x40dc79
mov ecx, edi
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer
mov ecx, edi
lea rdx, [rbp + 0x4c]
mov r8d, 0x40
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
cmp word [rbp + 0x4c], 0x5a4d
jne 0x40dc72
mov ecx, edi
mov edx, dword [rbp + 0x88]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer
mov ecx, edi
mov rdx, rbx
mov r8d, 0x108
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
cmp dword [rbx], 0x4550
jne 0x40dc72
mov sil, 1
mov ecx, edi
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
lea rsp, [rbp + 0x98]
pop rbx
pop rsi
pop rdi
pop rbp
ret