joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, r8d
mov edx, edx
lea rdx, [rcx + rdx]
cmp rcx, rdx
jae 0x45f5a4
movzx r8, byte [rcx]
xor eax, r8d
imul eax, eax, 0x1000193
add rcx, 1
cmp rcx, rdx
jb 0x45f58e
nop
ret

Function at 0x476770
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov byte [rbp + 0x88], dl
cmp byte [rbp + 0x88], 0
je 0x4767ae
mov rcx, qword [rbp + 0x80]
movzx rdx, byte [rbp + 0x88]
call fcn.0040e2d0
mov qword [rbp + 0x80], rax
nop
mov rcx, qword [0x0046e6b0]
mov dl, 1
call fcn.004a3500
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 8], rax
mov rcx, qword [0x00475258]
mov dl, 1
call fcn.004a82a0
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x10], rax
mov rcx, qword [0x00475258]
mov dl, 1
call fcn.004a82a0
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x18], rax
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_GetSystemInfo
mov rax, qword [rbp + 0x80]
mov ecx, dword [rbp + 0x34]
mov dword [rax + 0x20], ecx
cmp byte [rbp + 0x88], 0
je 0x47686b
mov rcx, qword [rbp + 0x80]
call fcn.0040e310
mov qword [rbp + 0x80], rax
jmp 0x47686b
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x4fb760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov qword [rbp + 0x60], r8
movzx rax, byte [rbp + 0x70]
mov byte [rbp + 0x70], al
mov rcx, rsi
mov rdx, qword [rbp + 0x60]
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x20], 0
jne 0x4fb79f
mov rcx, rbp
call fcn.004fb680
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_LoadResource
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x28], 0
jne 0x4fb7be
mov rcx, rbp
call fcn.004fb680
mov rcx, qword [rbx + 0x28]
call sub.kernel32.dll_LockResource
mov rdi, rax
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_SizeofResource
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call fcn.004fb040
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x50dde0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
movzx rax, byte [rcx + 0x19]
or al, dl
test al, al
je 0x50de30
cmp byte [rcx + 0x1d], 0
jne 0x50de30
cmp byte [rcx + 0x40], 0
jne 0x50de30
mov byte [rcx + 0x1b], 0
mov byte [rcx + 0x19], 0
mov rcx, qword [rcx + 0x10]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x50de4d
mov rcx, qword [0x004ca998]
mov dl, 1
mov r8, qword [0x00584dd0]
call fcn.0043aa00
mov rcx, rax
call fcn.0040fd90
jmp 0x50de4d
mov rcx, qword [0x004ca998]
mov dl, 1
mov r8, qword [0x00584dd0]
call fcn.0043aa00
mov rcx, rax
call fcn.0040fd90
add rsp, 0x28
ret
Function at 0x50ea40
Capabilities:
Suspend thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
movzx rax, byte [rax + 0x1b]
mov byte [rbp + 0x3f], al
nop
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x1b], 1
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_SuspendThread
mov rcx, qword [rbp + 0x50]
test eax, eax
setge dl
call fcn.0050dc60
jmp 0x50ea9b
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x50eac0
Capabilities:
Resume thread

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rbx + 0x10]
call sub.kernel32.dll_ResumeThread
mov esi, eax
mov rcx, rbx
test esi, esi
setge dl
call fcn.0050dc60
cmp esi, 1
jne 0x50eaea
mov byte [rbx + 0x1b], 0
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x5377c0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
mov edx, 0x58
xor r8, r8
call fcn.0040b460
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret

Function at 0x538080
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov byte [rbx], 0
mov esi, 0x3e8
mov byte [rbp + 0x2f], 0
mov edi, 8
shl byte [rbp + 0x2f], 1
lea rcx, [rbp + 0x38]
call sub.kernel32.dll_QueryPerformanceCounter
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_QueryPerformanceCounter
mov rax, qword [rbp + 0x30]
sub qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
and rax, 1
jns 0x5380d3
sub rax, 1
or rax, 0xfffffffffffffffe
add rax, 1
test rax, rax
jne 0x5380e2
mov qword [rbp + 0x38], 0
jmp 0x5380ea
mov qword [rbp + 0x38], 1
movzx rax, byte [rbp + 0x38]
add byte [rbp + 0x2f], al
sub edi, 1
test edi, edi
jne 0x53809f
nop
movzx rax, byte [rbp + 0x2f]
xor byte [rbx], al
sub esi, 1
test esi, esi
jne 0x538096
nop
mov esi, 8
lea rcx, [rbp + 0x38]
call sub.kernel32.dll_QueryPerformanceCounter
mov ecx, 1
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_QueryPerformanceCounter
mov rax, qword [rbp + 0x30]
sub rax, qword [rbp + 0x38]
mov qword [rbp + 0x38], rax
movzx rax, byte [rbp + 0x38]
mov byte [rbp + 0x2f], al
movzx rax, byte [rbp + 0x2f]
xor byte [rbx], al
sub esi, 1
test esi, esi
jne 0x53810e
nop
mov qword [rbp + 0x38], 0
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x2f]
mov r8d, 1
call fcn.004095f0
mov qword [rbp + 0x30], 0
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x539240
Capabilities:
Encode data using base64

Disassembly:
push r13
push rdi
push rsi
push rbx
mov r10, rcx
mov r11, rdx
xor ecx, ecx
xor r9, r9
mov ebx, 1
mov esi, 3
mov eax, r8d
cdq
idiv esi
mov rsi, rax
mov eax, ebx
cmp eax, esi
jg 0x539346
sub esi, ebx
add esi, 1
movsxd rax, ecx
movsxd rdx, r9d
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rdi, byte [r10 + rax]
shr edi, 2
mov edi, edi
movzx rbx, byte [rbx + rdi]
mov byte [r11 + rdx], bl
mov edx, ecx
add edx, 1
movsxd rdx, edx
mov ebx, r9d
add ebx, 1
movsxd rbx, ebx
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 3
movzx rax, al
shl eax, 4
movzx r13, byte [r10 + rdx]
shr r13d, 4
add eax, r13d
mov eax, eax
movzx rax, byte [rdi + rax]
mov byte [r11 + rbx], al
mov eax, ecx
add eax, 2
movsxd rax, eax
mov ebx, r9d
add ebx, 2
movsxd rbx, ebx
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rdx, byte [r10 + rdx]
and dl, 0xf
movzx rdx, dl
add edx, edx
add edx, edx
movzx r13, byte [r10 + rax]
shr r13d, 6
add edx, r13d
mov edx, edx
movzx rdx, byte [rdi + rdx]
mov byte [r11 + rbx], dl
mov edx, r9d
add edx, 3
movsxd rdx, edx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 0x3f
movzx rax, al
movzx rax, byte [rbx + rax]
mov byte [r11 + rdx], al
add r9d, 4
add ecx, 3
sub esi, 1
test esi, esi
jne 0x539272
nop
mov ebx, 3
mov eax, r8d
cdq
idiv ebx
mov rax, rdx
sub eax, 1
test eax, eax
je 0x539369
sub eax, 1
test eax, eax
jne 0x539463
jmp 0x5393d2
movsxd rcx, ecx
movsxd rax, r9d
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rbx, byte [r10 + rcx]
shr ebx, 2
mov ebx, ebx
movzx rdx, byte [rdx + rbx]
mov byte [r11 + rax], dl
mov eax, r9d
add eax, 1
movsxd rax, eax
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rcx, byte [r10 + rcx]
and cl, 3
movzx rcx, cl
shl ecx, 4
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 2
movsxd rax, eax
mov byte [r11 + rax], 0x3d
add r9d, 3
movsxd r9, r9d
mov byte [r11 + r9], 0x3d
jmp 0x539463
movsxd rax, ecx
movsxd rdx, r9d
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rsi, byte [r10 + rax]
shr esi, 2
mov esi, esi
movzx rbx, byte [rbx + rsi]
mov byte [r11 + rdx], bl
add ecx, 1
movsxd rcx, ecx
mov edx, r9d
add edx, 1
movsxd rdx, edx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 3
movzx rax, al
shl eax, 4
movzx rsi, byte [r10 + rcx]
shr esi, 4
add eax, esi
mov eax, eax
movzx rax, byte [rbx + rax]
mov byte [r11 + rdx], al
mov eax, r9d
add eax, 2
movsxd rax, eax
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rcx, byte [r10 + rcx]
and cl, 0xf
movzx rcx, cl
add ecx, ecx
add ecx, ecx
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
mov byte [r11 + rax], cl
add r9d, 3
movsxd r9, r9d
mov byte [r11 + r9], 0x3d
mov eax, r8d
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x5395c0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x10
mov rbp, rsp
mov r10, rcx
mov r11, rdx
xor edx, edx
xor r9, r9
xor eax, eax
mov ebx, 1
test r8d, r8d
jns 0x5395e5
add r8d, 3
sar r8d, 2
mov ecx, ebx
cmp ecx, r8d
jg 0x539725
sub r8d, ebx
add r8d, 1
mov ebx, 4
lea rcx, [rbp + 0xc]
movsxd rax, edx
movzx rax, byte [r10 + rax]
movzx rsi, al
cmp esi, 0x3d
jg 0x539632
cmp esi, 0x3d
je 0x539663
sub esi, 0x2b
test esi, esi
je 0x539659
sub esi, 4
test esi, esi
je 0x53965e
sub esi, 1
cmp esi, 0xa
jae 0x539666
jmp 0x539652
sub esi, 0x41
cmp esi, 0x1a
jb 0x539644
sub esi, 0x20
cmp esi, 0x1a
jae 0x539666
jmp 0x53964b
sub al, 0x41
mov byte [rcx], al
jmp 0x539666
add al, 0xb9
mov byte [rcx], al
jmp 0x539666
add al, 4
mov byte [rcx], al
jmp 0x539666
mov byte [rcx], 0x3e
jmp 0x539666
mov byte [rcx], 0x3f
jmp 0x539666
mov byte [rcx], 0xff
add edx, 1
add rcx, 1
sub ebx, 1
test ebx, ebx
jne 0x539604
nop
movsxd rax, r9d
movzx rcx, byte [rbp + 0xc]
add ecx, ecx
add ecx, ecx
movzx rbx, byte [rbp + 0xd]
shr ebx, 4
or cl, bl
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 1
movzx rcx, byte [rbp + 0xe]
cmp cl, 0xff
je 0x5396cf
cmp byte [rbp + 0xf], 0xff
jne 0x5396cf
mov eax, r9d
add eax, 1
movsxd rax, eax
movzx rbx, byte [rbp + 0xd]
shl ebx, 4
movzx rcx, cl
shr ecx, 2
or bl, cl
mov byte [r11 + rax], bl
mov eax, r9d
add eax, 2
add r9d, 1
jmp 0x539714
cmp cl, 0xff
je 0x539714
mov eax, r9d
add eax, 1
movsxd rax, eax
movzx rbx, byte [rbp + 0xd]
shl ebx, 4
movzx rcx, cl
shr ecx, 2
or bl, cl
mov byte [r11 + rax], bl
mov eax, r9d
add eax, 2
movsxd rax, eax
movzx rcx, byte [rbp + 0xe]
shl ecx, 6
or cl, byte [rbp + 0xf]
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 3
add r9d, 2
add r9d, 1
sub r8d, 1
test r8d, r8d
jne 0x5395fb
nop
lea rsp, [rbp + 0x10]
pop rbx
pop rsi
pop rbp
ret

Function at 0x53cee0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9, r9
mov r10d, r8d
sub r10d, 1
mov eax, r9d
cmp eax, r10d
ja 0x53cf14
sub r10d, r9d
add r10d, 1
mov r8d, eax
lea r9, [rcx + r8]
movzx r8, byte [rdx + r8]
xor byte [r9], r8b
add eax, 1
sub r10d, 1
test r10d, r10d
jne 0x53cef9
nop
ret

Function at 0x53f290
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
xor r8, r8
movzx r9, dl
sub r9d, 1
mov eax, r8d
cmp eax, r9d
ja 0x53f31b
sub r9d, r8d
add r9d, 1
mov edx, eax
add edx, edx
add edx, edx
mov r8d, edx
lea r10, [0x00581ffc]
mov r11d, edx
movzx r11, byte [rcx + r11]
lea rbx, [0x005823fc]
mov esi, edx
add esi, 1
mov esi, esi
movzx rsi, byte [rcx + rsi]
mov r10d, dword [r10 + r11*4]
xor r10d, dword [rbx + rsi*4]
lea r11, [0x005827fc]
mov ebx, edx
add ebx, 2
mov ebx, ebx
movzx rbx, byte [rcx + rbx]
xor r10d, dword [r11 + rbx*4]
lea r11, [0x00582bfc]
add edx, 3
mov edx, edx
movzx rdx, byte [rcx + rdx]
xor r10d, dword [r11 + rdx*4]
mov dword [rcx + r8], r10d
add eax, 1
sub r9d, 1
test r9d, r9d
jne 0x53f2ac
nop
pop rbx
pop rsi
ret
Function at 0x53ff10
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
test rax, rax
je 0x53ff1c
mov rax, qword [rax - 8]
mov r9, qword [rdx]
mov r8, r9
test r8, r8
je 0x53ff2b
mov r8, qword [r8 - 8]
movsxd r10, eax
cmp r8, r10
jge 0x53ff3f
mov rax, r9
test rax, rax
je 0x53ff3f
mov rax, qword [rax - 8]
xor r8, r8
mov r9d, eax
sub r9d, 1
mov eax, r8d
cmp eax, r9d
jg 0x53ff79
sub r9d, r8d
add r9d, 1
movsxd r8, eax
mov r10, qword [rcx]
lea r10, [r10 + r8]
mov r11, qword [rdx]
movzx r8, byte [r11 + r8]
xor byte [r10], r8b
add eax, 1
sub r9d, 1
test r9d, r9d
jne 0x53ff58
nop
ret

Function at 0x541bf0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x80], rcx
lea rcx, [rbp + 0x80]
call fcn.00410cd0
nop
xor eax, eax
mov byte [rbp + 0x4f], al
mov rcx, qword [rbp + 0x80]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x541ce8
mov rcx, rbx
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x541c75
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x541ce8
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x00447e70]
call fcn.00415bc0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x00447e70]
mov r8d, 1
mov r9, qword [rbp + 0x58]
call fcn.004159f0
mov dword [rbp + 0x54], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x541cda
mov rcx, rbx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x58]
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov al, 1
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x80]
call fcn.00410b60
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x542400
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x542429
mov rcx, qword [0x00584ab8]
lea rdx, [0x00542458]
call fcn.0040cb70
mov rcx, rax
call fcn.0040ccd0
call fcn.00409570
mov ecx, 1
xor edx, edx
mov r8d, ebx
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x542409
add rsp, 0x20
pop rbx
ret
Function at 0x543340
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x68]
mov rax, qword [0x00584b48]
mov rdx, qword [rax + 0x118]
lea r8, [0x00543548]
call fcn.00412200
mov rcx, qword [rbp + 0x68]
call fcn.00448b20
test al, al
je 0x5434e3
mov rcx, 0xffffffff80000001
lea rdx, [0x0054356e]
lea r8, [rbp + 0x78]
call sub.advapi32.dll_RegOpenKeyW
mov rax, qword [0x00584b48]
mov rax, qword [rax + 0x80]
test rax, rax
je 0x5433d8
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00584b48]
mov rdx, qword [rdx + 0x80]
mov r8d, eax
call fcn.00537a20
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x50]
call fcn.00537960
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x60]
call fcn.00412120
mov rcx, qword [rbp + 0x48]
call fcn.00412150
mov rsi, rax
lea rcx, [rbp + 0x40]
mov rax, qword [0x00584b48]
mov rdx, qword [rax + 0x118]
lea r8, [0x00543548]
call fcn.00412200
mov rax, qword [rbp + 0x40]
xor ebx, ebx
test rax, rax
je 0x543447
mov ebx, dword [rax - 4]
shr ebx, 1
lea rcx, [rbp + 0x38]
mov rax, qword [0x00584b48]
mov rdx, qword [rax + 0x118]
lea r8, [0x00543548]
call fcn.00412200
mov rcx, qword [rbp + 0x38]
call fcn.00412150
mov rcx, qword [rbp + 0x78]
mov rdx, rsi
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add ebx, ebx
mov dword [rsp + 0x28], ebx
call sub.advapi32.dll_RegSetValueExW
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_RegCloseKey
lea rcx, [rbp + 0x30]
mov rax, qword [0x00584b48]
mov rdx, qword [rax + 0x118]
lea r8, [0x00543548]
call fcn.00412200
mov rcx, qword [rbp + 0x30]
call fcn.00412150
xor ecx, ecx
lea rdx, [0x005435ca]
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x30]
mov edx, 4
call fcn.00410c40
lea rcx, [rbp + 0x60]
call fcn.00410b10
lea rcx, [rbp + 0x68]
call fcn.00410b60
lea rsp, [rbp + 0x80]
pop rbx
pop rsi
pop rbp
ret
Function at 0x5435e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
mov rax, qword [0x00584b48]
lea rcx, [rax + 0x98]
mov rdx, qword [0x00447e70]
call fcn.00415bc0
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x543673
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x005438e4]
mov rax, qword [0x00584b48]
mov r9, qword [rax + 0x118]
lea rax, [0x00543918]
mov qword [rsp + 0x20], rax
call fcn.00412500
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00412810
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00542890
lea rcx, [rbp + 0x48]
mov rax, qword [0x00584b48]
mov rdx, qword [rax + 0x118]
lea r8, [0x00543918]
call fcn.00412200
mov rcx, qword [rbp + 0x48]
call fcn.00412150
mov rcx, rax
mov edx, 0x80000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x5436fd
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x543885
lea rcx, [0x0054394c]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
jmp 0x543885
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x54371b
lea rcx, [0x00543994]
mov dl, 1
call fcn.00542890
mov rcx, rbx
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x54375d
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x543750
lea rcx, [0x005439d0]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x543885
mov rax, qword [0x00584b48]
lea rcx, [rax + 0x98]
mov rdx, qword [0x00447e70]
mov r8d, 1
mov r9, qword [rbp + 0x60]
call fcn.004159f0
mov dword [rbp + 0x6c], 0
jmp 0x543852
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x5437d3
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x543852
lea rcx, [0x00543a20]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
jmp 0x543852
mov rcx, rbx
mov rax, qword [0x00584b48]
mov rdx, qword [rax + 0x98]
mov r8d, dword [rbp + 0x60]
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x543825
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x543852
lea rcx, [0x00543a8c]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
jmp 0x543852
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
je 0x543852
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x543852
lea rcx, [0x00543ae8]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
jne 0x54378d
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x543884
lea rcx, [0x00543b54]
mov dl, 1
call fcn.00542890
nop
lea rcx, [rbp + 0x48]
call fcn.00410b60
lea rcx, [rbp + 0x50]
call fcn.00410ac0
lea rcx, [rbp + 0x58]
call fcn.00410b60
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x5441a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x90], rcx
lea rcx, [rbp + 0x90]
call fcn.00410cd0
nop
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x54422c
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x00544470]
mov rax, qword [0x00584b48]
mov r9, qword [rax + 0x118]
lea rax, [0x005444b8]
mov qword [rsp + 0x20], rax
call fcn.00412500
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00412810
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00542890
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x90]
lea r8, [0x005444b8]
call fcn.00412200
mov rcx, qword [rbp + 0x48]
call fcn.00412150
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x5442af
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5443f4
lea rcx, [0x005444ec]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
jmp 0x5443f4
mov dword [rbp + 0x6c], 0
jmp 0x5443ad
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x544304
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5443ad
lea rcx, [0x00544548]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
jmp 0x5443ad
mov rax, qword [0x00584b48]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x54431b
mov rax, qword [rax - 8]
mov rcx, rbx
mov rdx, qword [0x00584b48]
mov rdx, qword [rdx + 0x98]
mov r8d, eax
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x54436c
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5443ad
lea rcx, [0x005445b4]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
jmp 0x5443ad
mov rax, qword [0x00584b48]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x544383
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
je 0x5443ad
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5443ad
lea rcx, [0x0054460c]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rax, qword [0x00584b48]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x5443c4
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
jne 0x5442bb
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5443f3
lea rcx, [0x00544678]
Function at 0x549850
Capabilities:
Get geographical location

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
mov rbp, rsp
mov rbx, rcx
mov esi, edx
call fcn.0043c660
cmp eax, 2
jne 0x549890
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x20]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x20]
call fcn.00414f70
jmp 0x5498be
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x220]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x220]
mov r8d, pe_nt_image_headers64
call fcn.004127a0
mov rax, rbx
lea rsp, [rbp + 0x420]
pop rbx
pop rsi
pop rbp
ret

Function at 0x5498d0
Capabilities:
Get keyboard layout

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
nop
mov rcx, qword [rbp + 0x80]
lea rdx, [0x00549a9c]
call fcn.00411230
mov qword [rbp + 0x58], 0
xor ecx, ecx
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
jbe 0x5499d2
mov ecx, dword [rbp + 0x54]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov ecx, ecx
call fcn.00409230
mov qword [rbp + 0x58], rax
nop
mov ecx, dword [rbp + 0x54]
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov rcx, qword [rbp + 0x80]
call fcn.00410b60
xor eax, eax
mov ebx, dword [rbp + 0x54]
sub ebx, 1
mov dword [rbp + 0x50], eax
cmp dword [rbp + 0x50], ebx
ja 0x5499bc
sub ebx, eax
add ebx, 1
mov rax, qword [rbp + 0x58]
mov ecx, dword [rbp + 0x50]
movzx eax, word [rax + rcx*8]
mov dword [rbp + 0x4c], eax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x4c]
call fcn.00549850
lea rcx, [rbp + 0x30]
lea rdx, [0x00549ac0]
call fcn.00412a30
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.00412840
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.00412170
add dword [rbp + 0x50], 1
sub ebx, 1
test ebx, ebx
jne 0x54996a
nop
nop
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x54]
add edx, edx
add edx, edx
add edx, edx
mov edx, edx
call fcn.00409260
mov dword [rbp + 0x44], 0
mov rax, qword [rbp + 0x80]
mov rax, qword [rax]
test rax, rax
je 0x5499f1
mov eax, dword [rax - 4]
shr eax, 1
mov dword [rbp + 0x44], eax
mov rcx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax]
mov r8d, 1
mov r9d, dword [rbp + 0x44]
sub r9d, 4
call fcn.00412620
nop
lea rcx, [rbp + 0x28]
call fcn.00410b60
lea rcx, [rbp + 0x30]
call fcn.00410ac0
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret