joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003212c
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push r14
sub rsp, 0x50
mov r14, r8
mov dword [rsp + 0x28], 1
lea rax, str.SMARTREBOOT
xor esi, esi
test rdx, rdx
mov qword [r11 - 0x38], rax
lea r9, str.DEFAULTINSTALL
cmovne r9, rdx
lea r8, [r11 - 0x28]
lea rdx, [r11 + 8]
xor ecx, ecx
call fcn.140030764
test eax, eax
je 0x1400322b6
lea edx, [rsi + 1]
lea rcx, [rsp + 0x30]
call fcn.1400306ac
mov rdi, rax
test rax, rax
je 0x1400322b6
mov rdx, rax
lea rcx, [0x1400481e0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400322ae
mov rdx, rdi
lea rcx, [0x1400481e4]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400322ae
mov rdx, rdi
lea rcx, [0x1400481e8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
mov rcx, qword [0x140050310]
test eax, eax
jne 0x140032245
cmp rcx, 0xffffffffffffffff
jne 0x1400321fd
lea edx, [rsi + 2]
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x140032227
cmp dword [0x1400516e0], 2
jl 0x140032227
and dword [rsp + 0x68], esi
lea r9, [rsp + 0x68]
and qword [rsp + 0x20], rsi
lea rdx, str.__An_INF_will_be_installing_a_driver.__May_require_a_reboot._r_n
mov r8d, 0x3e
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0xd2af8
test r14, r14
je 0x1400322ae
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.1400306ac
mov qword [r14], rax
jmp 0x1400322ae
cmp rcx, 0xffffffffffffffff
jne 0x140032260
lea edx, [rcx + 3]
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14003228a
cmp dword [0x1400516e0], 2
jl 0x14003228a
and dword [rsp + 0x68], esi
lea r9, [rsp + 0x68]
and qword [rsp + 0x20], rsi
lea rdx, str.__An_INF_requested_a_reboot_via_the_SmartReboot_section._r_n
mov r8d, 0x3a
call qword [sym.imp.KERNEL32.dll_WriteFile]
or dword [0x140050558], 8
lea r8, str.INF_set_SmartRebootA
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
mov ecx, 2
call fcn.140016868
mov esi, 0xd2af9
mov rcx, rdi
call fcn.14003c2b8
mov rdi, qword [rsp + 0x78]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x140032f14
Capabilities:
Delete directory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [r11 - 0x38], rdx
mov r14d, 1
cmp rdx, 0xffffffffffffffff
je 0x140033080
test r8, r8
mov dword [r11 - 0x40], r14d
lea rax, str.DELDIRS
lea r9, str.DEFAULTINSTALL
mov qword [r11 - 0x48], rax
cmovne r9, r8
lea rdx, [r11 - 0x38]
lea r8, [r11 - 0x30]
xor ecx, ecx
call fcn.140030764
test eax, eax
je 0x140033080
mov ecx, 0x26d7
xor r14d, r14d
call fcn.140015b74
lea rcx, [rsp + 0x38]
call fcn.140030614
mov rdi, rax
test rax, rax
je 0x140033080
mov rcx, rax
jmp 0x14003305f
mov r8, rbx
lea rdx, str._Parsing_DelDirs_section:_S._r_n
mov ecx, 4
call fcn.140016868
lea rcx, str.setupapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140032fda
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call fcn.14001b05c
test eax, eax
je 0x14003305d
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
mov esi, 1
call fcn.14001aed0
mov ecx, eax
mov ebp, eax
call fcn.1400159e8
cmp ebp, esi
jb 0x14003305d
mov ecx, esi
call fcn.140015aec
lea rcx, [rsp + 0x38]
inc esi
call fcn.140030614
mov rbx, rax
test rax, rax
je 0x140033045
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rbx
call fcn.14001739c
mov r8, rbx
lea rdx, str._Attempted_to_delete:__S._r_n
mov ecx, 4
call fcn.140016868
mov rcx, rbx
call fcn.14003c2b8
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x38]
call qword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
je 0x14003305d
cmp esi, ebp
jbe 0x140032ffd
xor ecx, ecx
lea rdx, [0x140043808]
call qword [sym.imp.msvcrt.dll_wcstok]
mov rbx, rax
test rax, rax
jne 0x140032f9a
mov rcx, rdi
call fcn.14003c2b8
lea r11, [rsp + 0x50]
mov eax, r14d
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140038234
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
lea rax, [rbp - 0x10]
and dword [r8], ebx
mov rsi, r8
and qword [rbp - 0x10], rbx
mov r14, rdx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140038316
mov rdi, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
and dword [rbp + 0x30], ebx
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov rcx, rdi
and qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov dword [rbp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400382e8
mov ecx, dword [rbp + 0x30]
call fcn.14003c310
mov rbx, rax
test rax, rax
je 0x1400382e8
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x38]
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test rbx, rbx
je 0x140038316
cmp dword [rbp + 0x38], 1
jne 0x140038316
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__strlwr]
mov rcx, rax
mov rdx, r14
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
je 0x140038316
mov dword [rsi], 1
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140038325
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140038332
mov rcx, rbx
call fcn.14003c2b8
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140038360
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x140038514
test rdx, rdx
je 0x140038514
mov edi, 7
lea rdx, str.http:__
mov r8d, edi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x14003850d
lea r8d, [rdi + 1]
mov rcx, rbx
lea rdx, str.https:__
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x14003850d
mov r8d, edi
lea rdx, str.file:__
mov rcx, rbx
xor esi, esi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x1400383e0
add rbx, 0xe
and qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000080
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140038436
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
lea ecx, [rbp + 0x58]
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
xor ebx, ebx
jmp 0x1400384f3
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140038468
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1400384d9
mov rdx, rdi
mov ecx, 0x42
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x140038448
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140038448
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140038448
mov r8, r14
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, eax
test eax, eax
js 0x1400384d9
mov rcx, qword [r14]
mov rdx, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [0x14003f118]
mov edi, eax
mov rcx, rbp
mov rbx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400384f3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
test rsi, rsi
cmove rcx, rbx
test edi, edi
jns 0x140038519
test rcx, rcx
je 0x140038519
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140038519
mov edi, 0x80004001
jmp 0x140038519
mov edi, 0x80004003
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140039000
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ebx, ax
mov rax, qword [0x140051730]
test rax, rax
jne 0x140039052
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140039046
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140051730], rax
jmp 0x14003904d
mov rax, qword [0x140051730]
test rax, rax
je 0x14003905b
call qword [0x14003f118]
movzx ebx, ax
movzx eax, bx
add rsp, 0x20
pop rbx
ret

Function at 0x14003a3c4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov rbx, rcx
cmp dword [0x140051750], edi
mov qword [rcx], rdi
mov dword [rcx + 8], edi
mov word [rcx + 0xc], di
jne 0x14003a45b
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [0x140051750], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14003a45b
cmp dword [rsp + 0x24], 5
jb 0x14003a43b
cmp dword [rsp + 0x28], 1
jae 0x14003a442
cmp dword [rsp + 0x24], 6
jb 0x14003a45b
mov ecx, dword [0x14005033c]
mov eax, 0x7f
cmp dword [rsp + 0x30], 2
cmove ecx, eax
mov dword [0x14005033c], ecx
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x14003aee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
call fcn.14003a954
test rdi, rdi
jne 0x14003af20
mov rax, qword [0x140050cb8]
mov rdi, qword [rax + 0x10]
test rdi, rdi
jne 0x14003af20
mov ecx, 0x80070057
jmp 0x14003afab
mov eax, ebx
mov ebp, 1
shr eax, 4
mov rcx, rdi
add ax, bp
movzx edx, ax
lea r8d, [rbp + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14003af53
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14003af6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14003afab
jmp 0x14003af7e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
test rax, rax
jne 0x14003af85
mov ecx, 0x8000ffff
jmp 0x14003afab
and ebx, 0xf
je 0x14003af99
movzx eax, word [rdx]
lea rdx, [rdx + rax*2]
lea rdx, [rdx + 2]
sub ebx, ebp
jne 0x14003af8a
movzx r8d, word [rdx]
mov rcx, rsi
add rdx, 2
call fcn.14003a4fc
mov ecx, eax
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003b3ec
Capabilities:
Get file version info

Disassembly:
sub rsp, 0x28
and qword [rsp + 0x38], 0
lea r9, [0x140051dc0]
and dword [rsp + 0x30], 0
lea rcx, str.mfcore.dll
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14003b492
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x140042140]
lea rcx, [0x140051dc0]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14003b492
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + 0xa]
mov word [0x140050348], ax
movzx r8d, word [rcx + 8]
mov word [0x14005034a], r8w
movzx edx, word [rcx + 0xe]
mov word [0x14005034c], dx
movzx eax, word [rcx + 0xc]
mov ecx, 0xc
mov word [0x140050340], cx
mov word [0x14005034e], ax
mov word [0x140050342], r8w
mov word [0x140050344], dx
mov word [0x140050346], ax
mov byte [0x14005175c], 1
lea rax, [0x140050340]
add rsp, 0x28
ret

Function at 0x14003ca3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003ca88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003ca80
cmp dword [rcx + 0x3c], edx
jl 0x14003ca80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14003ca80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14003ca88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x408ed8
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbp, rcx
movsxd rbx, dword [rcx + 8]
mov rdi, rbx
test ebx, ebx
je 0x408f28
shl rdi, 3
add ebx, 0xffffffff
sub rdi, 8
mov rax, qword [rbp]
mov rsi, qword [rdi + rax]
test rsi, rsi
je 0x408f24
mov rcx, qword [rsi]
call fcn.0040237c
mov rcx, rsi
call fcn.0040237c
test ebx, ebx
jne 0x408f00
mov dword [rbp + 8], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test eax, eax
je 0x40902d
mov rcx, rdi
xor ebx, ebx
mov qword [rsp + 0x80], rbx
test eax, eax
je 0x408f67
add rcx, rcx
call fcn.00402350
mov rbx, rax
mov qword [rsp + 0x80], rax
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x409023
cmp eax, edi
ja 0x409023
lea rcx, [rsp + 0x28]
call fcn.00403558
nop
xor r13d, r13d
xor edi, edi
test esi, esi
je 0x409004
mov r12, rbx
cmp word [r12], 0
jne 0x408ffa
lea rdx, [rbx + r13*2]
lea rcx, [rsp + 0x28]
call fcn.0040373c
lea r13d, [rdi + 1]
mov rcx, rbp
call fcn.004421a4
mov ecx, 0x10
call fcn.00402350
mov qword [rsp + 0x88], rax
test rax, rax
je 0x408fe6
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.004036b4
mov r11, rax
jmp 0x408fe9
xor r11d, r11d
mov ecx, dword [rbp + 8]
lea eax, [rcx + 1]
mov dword [rbp + 8], eax
mov rax, qword [rbp]
mov qword [rax + rcx*8], r11
inc edi
add r12, 2
cmp edi, esi
jb 0x408f9b
cmp r13d, esi
sete dil
mov rcx, qword [rsp + 0x28]
call fcn.0040237c
nop
mov rcx, rbx
call fcn.0040237c
mov al, dil
jmp 0x40902d
mov rcx, rbx
call fcn.0040237c
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4090fc
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 9], 0
mov rbx, rdx
je 0x40911b
cmp byte [rcx + 0xa], 0
je 0x40911b
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x409157
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x409146
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x409146
xor al, al
jmp 0x409159
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x40927c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x4092b8
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x400000
cmp r8d, eax
cmova r8d, eax
jmp fcn.0040927c
Function at 0x40937c
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov eax, 0x400000
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x409490
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.004091bc
xor ebx, ebx
cmp al, bl
je 0x4094b8
cmp qword [rsp + 0x50], rdi
je 0x4094bc
xor al, al
jmp 0x4094ca
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x40aaf8
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.0040373c
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret

Function at 0x40b740
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x0045d9a0]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40b7a6
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call rax
test eax, eax
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rax, qword [rsp + 0x48]
setne bpl
mov qword [rdi], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40b7f8
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
imul rcx, rax
test bpl, bpl
mov qword [rbx], rcx
jne 0x40b7f6
mov eax, dword [rsp + 0x38]
imul rax, rcx
mov qword [rsi], rax
mov eax, dword [rsp + 0x3c]
imul rax, qword [rbx]
mov qword [rdi], rax
mov al, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x45b500
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov rbx, rcx
mov r8, rdx
mov qword [rsp + 0x28], rax
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
je 0x45b53b
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret

Function at 0x45b560
Capabilities:
Create thread
Resume thread

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rsi
mov rsi, r9
mov r9, r8
mov rbx, rcx
mov r8, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
mov rbx, qword [rsp + 0x58]
mov rdi, rax
je 0x45b5c5
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x45b5e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
mov eax, ecx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x48
ret

Function at 0x45b860
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45b88c
cmp dword [rsp + 0x24], 6
jne 0x45b88c
cmp dword [rsp + 0x28], 0
je 0x45b8b5
lea rcx, [0x0045d9a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x45b8b5
mov ecx, 0xc00
call rax
add rsp, 0x148
ret

Function at 0x45bbf0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x00400000], 0x5a4d
je 0x45bc11
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
movsxd rax, dword [0x0040003c]
lea rcx, [0x00400000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x45bc32
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x45bc70
cmp ecx, 0x20b
je 0x45bc4e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
cmp dword [rax + 0x84], 0xe
ja 0x45bc5f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
cmp dword [rax + 0x74], 0xe
ja 0x45bc7e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45bc8d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call fcn.0045c990
add byte [rax - 0x39], cl
add eax, 0x240e5
Function at 0x45c990
Capabilities:
Encode data using xor

Disassembly:
mov r10, r11
xor rax, rax
xorps xmm7, xmm13
xorps xmm4, xmm0
mov r13, qword [rsp + rax]
and rsi, r11
mov r15, 0x2b28904a
cmp rdi, r11
and r12, 0x45
mov r10, 0x2b2d2cdd
pop rbx
mov r11, rbx
push r11
xor r15, r10
or rax, 0x1e
sub r13, r15
and rsi, r12
mov rax, 0x7851f97e
shl r12, 0xa
shl rbx, 6
mov r14, 0x78542bd6
pop rsi
mov r12, rsi
push r12
xor rax, r14
mov r11, 0x22
xor r15, r11
add rax, r13
mov rsi, 0x55
shr r15, 0x2a
mov rdi, qword [rax]
and rbx, 0xcb
xor rsi, r14
mov rbx, 0x50afb81d
add r15, 0xe6
pop r12
mov r10, r12
push r10
mov r11, 0x50a71b1d
or r14, rax
xor rbx, r11
nop
and r14, 0xc1
add rbx, r13
rol r15, 0x28
dec rsi
mov rsi, 0x59bb08d6
pop r14
mov rax, r14
push rax
mov r13, 0x59ba3683
or r11, r14
xor r12, r15
xor rsi, r13
shr r11, 7
pop r10
mov r14, r10
push r14
mov r15, 0x8a
mov r13, rax
mov r14, 0x8e
sub r11, rax
xor r15, r14
push r13
pop r11
push rbx
shl rax, 0xc
cmp r14, r12
push rsi
inc r14
add r10, 0x28
push rdi
pop r11
mov r13, r11
push r13
sub rsp, 0x20
add r10, 0x69
xor r13, r10
mov rcx, rbx
push r10
pop r14
mov rdx, rsi
shl r14, 9
mov r14, 0xcd
mov r8, r15
cmp r15, r10
dec r12
lea r9, [rsp]
and r15, 0xde
call rdi
nop
add rsp, 0x20
ror r14, 8
pop r10
xor r11, 0x9a
pop r13
and rax, 0xfe
xor r15, 0x25
pop rsi
lea r11, [r11 + 0xf1]
subps xmm15, xmm5
xor rdi, rdi
sub rbx, 0x61
lea r14, [rsi + rdi]
or r12, rbx
mov r15b, byte [r14]
add r12, 0x23
sub r12, 0xc9
xor r15b, 0xa5
mov r12, rax
sub r12, 0x3f
add r15b, 0xaa
sub rax, 0x7a
mov byte [r14], r15b
push r11
pop rax
xor rax, 0xb8
inc rdi
nop
cmp rdi, r13
nop
jne 0x45cb06
addps xmm10, xmm1
mov r12, 0x47
lea r11, [r11 + 0xa6]
rol r11, 0x36
mov rbx, 0x67
shr r11, 0x2d
sub rax, r14
xor r12, rbx
push r14
pop r11
and r15, 0x2f
push rsi
nop
cmp r14, rdi
sub rsp, 0x20
test r15, rdi
mov rcx, rsi
or rdi, r15
mov rdx, r13
sub rbx, 0x53
dec rbx
mov r8, r12
and r14, 0xfc
nop
lea r9, [rsp]
and r15, 0xaa
test rax, rbx
call r10
or rbx, r13
add rsp, 0x20
add r12, 0xab
ret
Function at 0x140007718
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14005e860], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x140007778
movdqa xmm0, xmmword [0x14003f910]
movdqa xmm1, xmmword [0x14003f900]
movdqa xmmword [0x140053600], xmm0
movdqa xmm0, xmmword [0x14003f8e0]
movdqa xmmword [0x140053610], xmm1
movdqa xmm1, xmmword [0x14003f8f0]
movdqa xmmword [0x140053620], xmm0
movdqa xmmword [0x140053630], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140029f30
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x14003f8c0]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x140007794
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret