joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419110
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00419100
mov ebx, eax
test ebx, ebx
je 0x41915b
cmp dword [0x0073ccb8], 0xffffffff
jne 0x419134
mov ecx, 0xe2
call fcn.0040fab0
mov ecx, ebx
call fcn.004190e0
test rax, rax
jne 0x41914d
mov ecx, 0xe2
call fcn.0040fab0
jmp 0x41915b
mov ecx, dword [0x0073ccb8]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x4191b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
lea rax, [0x274]
test rax, rax
je 0x4191ef
cmp dword [0x0073ccb8], 0xffffffff
je 0x4191ef
mov ecx, dword [0x0073ccb8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x4191ef
mov rcx, rax
call sub.kernel32.dll_LocalFree
mov ecx, dword [0x0073ccb8]
xor edx, edx
call sub.kernel32.dll_TlsSetValue
add rsp, 0x28
ret

Function at 0x419230
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0078c270], 0
je 0x41926b
mov ecx, dword [0x0073ccb8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41927e
call fcn.00419110
mov ecx, dword [0x0073ccb8]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41927e
mov rax, qword [0x0078c2b0]
jmp 0x41927e
mov rax, qword gs:[0x58]
mov ecx, dword [0x0073ccb8]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x4333d0
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
nop
mov ecx, 0x104
lea rdx, [rbp + 0x254]
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x4334e4
lea rbx, [rbp + 0x254]
mov word [rbx + 4], 0
mov rcx, rbx
lea rdx, [rbp + 0x48]
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x4334ca
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x48]
mov r8d, 0x106
call fcn.004111b0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov r8d, 1
call fcn.004119d0
test eax, eax
jle 0x4334ca
xor esi, esi
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x43347f
mov esi, dword [rax - 4]
xor edi, edi
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x43348d
mov edi, dword [rax - 4]
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.00411150
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, esi
add r8d, 1
mov r9d, edi
sub r9d, esi
call fcn.00411710
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.004114f0
jmp 0x4334e3
add rbx, 2
cmp word [rbx], 0
jne 0x4334c6
add rbx, 4
test rbx, rbx
je 0x4334e3
cmp word [rbx], 0
jne 0x433422
nop
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.0040fe80
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x468]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x433680
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
sub rsp, 0x2a0
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x2c0], r8
mov dword [rbp + 0x2c8], r9d
nop
mov byte [rbp + 0x28f], 0
mov rcx, qword [rbp + 0x2c0]
call fcn.0040fda0
mov dword [rbp + 0x288], 0
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x288]
call sub.kernel32.dll_GetFileSize
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
jne 0x433797
cmp dword [rbp + 0x288], 0
jne 0x433797
mov ecx, 6
xor edx, edx
call fcn.004404c0
test al, al
je 0x433797
mov rcx, qword [rbp + 0x2b8]
lea rdx, [rbp + 0x78]
mov r8d, 0x104
mov r9d, 2
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x433797
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.004111b0
mov rcx, rbp
lea rdx, [rbp + 0x60]
mov r8, qword [rbp + 0x58]
call fcn.004333d0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x60]
call fcn.004103d0
mov byte [rbp + 0x28f], 1
jmp 0x433901
cmp dword [rbp + 0x284], 0
jne 0x4337ad
cmp dword [rbp + 0x288], 0
je 0x43389a
mov rcx, qword [rbp + 0x2b8]
xor edx, edx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x290], rax
cmp qword [rbp + 0x290], 0x3ee
je 0x43389a
nop
mov rcx, qword [rbp + 0x290]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 1
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x298], rax
cmp qword [rbp + 0x298], 0
je 0x43388d
nop
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, qword [rbp + 0x298]
lea r8, [rbp + 0x78]
mov r9d, 0x104
call fcn.00422df0
test eax, eax
jbe 0x433880
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x78]
mov r8d, 0x106
call fcn.004111b0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x48]
call fcn.004333d0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x50]
call fcn.004103d0
mov byte [rbp + 0x28f], 1
nop
mov rcx, qword [rbp + 0x298]
call sub.kernel32.dll_UnmapViewOfFile
nop
mov rcx, qword [rbp + 0x290]
call sub.kernel32.dll_CloseHandle_1
cmp byte [rbp + 0x28f], 0
jne 0x433900
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x2b8]
call fcn.00433530
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x40]
call fcn.004103d0
mov rax, qword [rbp + 0x2c0]
cmp qword [rax], 0
je 0x433900
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0x2c0]
mov r8, qword [rax]
call fcn.004333d0
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x38]
call fcn.004103d0
mov byte [rbp + 0x28f], 1
nop
lea rcx, [rbp + 0x38]
mov edx, 6
call fcn.0040fe80
movzx rax, byte [rbp + 0x28f]
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x433990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x67], 0
mov ecx, 6
xor edx, edx
call fcn.004404c0
test al, al
je 0x433aa5
mov rcx, qword [rbp + 0x80]
xor edx, edx
call fcn.00436020
test al, al
je 0x433aa5
mov rcx, qword [rbp + 0x80]
call fcn.00435c10
test al, 0x20
je 0x433aa5
mov rcx, qword [rbp + 0x80]
call fcn.004110b0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], 0xffffffff
je 0x433aa5
mov eax, dword [rbp + 0x5c]
test eax, 0x400
je 0x433aa5
mov eax, dword [rbp + 0x5c]
test eax, 0x10
je 0x433a32
mov dword [rbp + 0x60], 0x2000000
jmp 0x433a39
mov dword [rbp + 0x60], 0
mov rcx, qword [rbp + 0x80]
call fcn.004110b0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov eax, dword [rbp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x433aa5
nop
mov rcx, rbp
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x88]
mov r9d, dword [rbp + 0x60]
call fcn.00433680
mov byte [rbp + 0x67], al
nop
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle_1
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x435c10
Capabilities:
Get disk information

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x70]
mov rdx, qword [0x00435b90]
mov r8d, 1
mov r9d, 0x104
call fcn.00413260
lea rcx, [rbp + 0x68]
mov rdx, qword [0x00435bd0]
mov r8d, 1
mov r9d, 0x104
call fcn.00413260
movzx rax, byte [0x00435e90]
mov byte [rbp + 0x4f], al
mov rcx, qword [rbp + 0x40]
mov dl, 1
call fcn.00436100
test al, al
jne 0x435cb5
mov rcx, qword [rbp + 0x40]
mov dl, 1
call fcn.00436020
test al, al
je 0x435dc4
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x40]
call fcn.00436a90
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x58]
call fcn.00440ca0
mov rcx, qword [rbp + 0x88]
call fcn.004110b0
mov rbx, rax
mov rcx, rbx
mov rdx, qword [rbp + 0x70]
mov r8d, 0x104
lea r9, [rbp + 0x84]
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x104
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x435dbf
mov eax, dword [rbp + 0x80]
test eax, 1
je 0x435d42
movzx rax, byte [rbp + 0x4f]
or al, 1
mov byte [rbp + 0x4f], al
mov eax, dword [rbp + 0x80]
test eax, 2
je 0x435d5b
movzx rax, byte [rbp + 0x4f]
or al, 2
mov byte [rbp + 0x4f], al
mov eax, dword [rbp + 0x80]
test eax, 0x80
je 0x435d74
movzx rax, byte [rbp + 0x4f]
or al, 0x20
mov byte [rbp + 0x4f], al
mov rcx, rbx
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
test eax, eax
je 0x435d98
sub eax, 1
test eax, eax
je 0x435da5
sub eax, 1
test eax, eax
je 0x435db2
sub eax, 1
test eax, eax
jne 0x435def
movzx rax, byte [rbp + 0x4f]
or al, 0x10
mov byte [rbp + 0x4f], al
jmp 0x435def
movzx rax, byte [rbp + 0x4f]
or al, 4
mov byte [rbp + 0x4f], al
jmp 0x435def
movzx rax, byte [rbp + 0x4f]
or al, 8
mov byte [rbp + 0x4f], al
jmp 0x435def
call fcn.00441f10
lea rcx, [rbp + 0x50]
mov rdx, qword [0x007853b8]
call fcn.004177c0
mov rcx, qword [0x0042a570]
mov dl, 1
mov r8, qword [rbp + 0x50]
call fcn.0043e9a0
mov rcx, rax
call fcn.0040eed0
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.0040fe80
lea rcx, [rbp + 0x68]
mov rdx, qword [0x00435bd0]
call fcn.00413430
lea rcx, [rbp + 0x70]
mov rdx, qword [0x00435b90]
call fcn.00413430
lea rcx, [rbp + 0x88]
call fcn.0040fda0
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x436020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rcx, rbx
call fcn.004110b0
mov rdi, rax
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4360cd
mov ecx, eax
test ecx, 0x400
je 0x4360c2
test sil, sil
jne 0x436063
mov al, 1
jmp 0x4360f6
test eax, 0x10
je 0x436072
xor eax, eax
jmp 0x4360f6
mov rcx, rdi
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x4360b5
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x4360f6
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x20
sete al
jmp 0x4360f6
test eax, 0x10
sete al
jmp 0x4360f6
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x4360f0
cmp eax, 3
je 0x4360f0
cmp eax, 0x7b
je 0x4360f0
mov rcx, rbp
mov rdx, rbx
call fcn.00435fd0
test al, al
jne 0x4360f4
xor eax, eax
jmp 0x4360f6
mov al, 1
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x436100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, edx
xor esi, esi
call fcn.004110b0
mov r13, rax
mov rcx, r13
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x4361ee
mov eax, edi
test eax, 0x400
jne 0x436142
test edi, 0x10
setne sil
jmp 0x436221
test bl, bl
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x436219
cmp eax, 3
je 0x436219
cmp eax, 0xa1
je 0x436219
cmp eax, 0x7b
je 0x436219
cmp eax, 0x35
je 0x436219
cmp eax, 0x15
je 0x436219
cmp eax, 0x43
jne 0x43621e
xor esi, esi
jmp 0x436221
mov sil, 1

Function at 0x436470
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2b], dl
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [rbp + 0x20]
call fcn.004110b0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x2c], eax
mov eax, dword [rbp + 0x2c]
test eax, 0x400
setne al
movzx rcx, byte [rbp + 0x2b]
test cl, al
je 0x436524
or eax, 0xffffffff
mov dword [rbp + 0x2c], eax
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.00433990
test al, al
je 0x436524
mov rcx, qword [rbp + 0x48]
call fcn.00436d20
test al, al
je 0x436510
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.004369a0
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00440ca0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.004114f0
mov rcx, qword [rbp + 0x48]
call fcn.004110b0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x2c], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040fe80
lea rcx, [rbp + 0x48]
call fcn.0040fda0
mov eax, dword [rbp + 0x2c]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x436580
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov dword [rbp + 0x34], edx
mov byte [rbp + 0x3b], r8b
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
xor eax, eax
mov dword [rbp + 0x3c], eax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x28]
call fcn.00410450
movzx rax, byte [rbp + 0x3b]
test al, al
je 0x43663e
mov rcx, qword [rbp + 0x28]
call fcn.004110b0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
test eax, 0x400
je 0x43663e
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x50]
call fcn.00433990
test al, al
je 0x43663e
mov rcx, qword [rbp + 0x50]
call fcn.00436d20
test al, al
je 0x436631
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
call fcn.004369a0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.00440ca0
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x50]
call fcn.004114f0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.00410450
mov rcx, qword [rbp + 0x58]
call fcn.004110b0
mov rcx, rax
mov edx, dword [rbp + 0x34]
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x43665e
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x3c], eax
nop
lea rcx, [rbp + 0x40]
mov edx, 4
call fcn.0040fe80
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x436800
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rbx
call fcn.004110b0
mov r13, rax
mov rcx, r13
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne sil
test sil, sil
jne 0x43686f
call sub.kernel32.dll_GetLastError_2
mov edi, eax
mov rcx, r13
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x436868
mov ecx, eax
test ecx, 0x400
je 0x436868
test eax, 0x10
je 0x436868
mov rcx, rbx
call fcn.004110b0
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
setne sil
jmp 0x43686f
mov ecx, edi
call sub.kernel32.dll_SetLastError
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x436db0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.004110b0
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x43cd10
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x43cd37
movzx rax, word [rbp + 0x2c]
jmp 0x43cd39
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x43e7b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.0043e560
mov ebx, eax
mov rax, qword [0x007851c0]
cmp byte [rax], 0
je 0x43e8e6
mov rcx, qword [0x00784a58]
call fcn.0040bd20
call fcn.004093d0
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043e770]
mov r8d, 1
movsxd r9, esi
call fcn.00413260
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x0043e97c]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x43e92b
mov rcx, qword [0x0078c278]
call fcn.00413a40
mov rcx, rax
mov rax, qword [0x00784930]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor ecx, ecx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043e770]
call fcn.00413430
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x4404e0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
nop
mov dword [rbp + 0x54], 0xffffffff
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x70]
call fcn.00410450
lea rcx, [rbp + 0x48]
call fcn.00410690
mov rcx, qword [rbp + 0x48]
call fcn.004110b0
mov rcx, rax
lea rdx, [rbp + 0x40]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x440591
mov ecx, dword [rbp + 0x44]
call fcn.004090b0
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.004110b0
mov rcx, rax
mov edx, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x440587
mov rcx, qword [rbp + 0x58]
lea rdx, [0x004405e8]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x34]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x440587
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x54], eax
nop
mov rcx, qword [rbp + 0x58]
call fcn.004090e0
nop
lea rcx, [rbp + 0x48]
call fcn.0040fda0
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x4405f0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov qword [rbp + 0x98], r9
nop
mov byte [rbp + 0x67], 0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
call fcn.00410450
lea rcx, [rbp + 0x58]
call fcn.00410690
mov rcx, qword [rbp + 0x58]
call fcn.004110b0
mov rcx, rax
lea rdx, [rbp + 0x50]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x440700
mov ecx, dword [rbp + 0x54]
call fcn.004090b0
mov qword [rbp + 0x68], rax
nop
mov rcx, qword [rbp + 0x58]
call fcn.004110b0
mov rcx, rax
mov edx, dword [rbp + 0x50]
mov r8d, dword [rbp + 0x54]
mov r9, qword [rbp + 0x68]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4406f6
mov rcx, qword [rbp + 0x68]
lea rdx, [0x00440758]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x44]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4406f6
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x40], eax
mov rax, qword [rbp + 0x88]
mov ecx, dword [rbp + 0x40]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x48]
movzx ecx, word [rcx + 0x10]
mov dword [rax], ecx
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x14]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x98]
mov ecx, dword [rbp + 0x3c]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov byte [rbp + 0x67], 1
nop
mov rcx, qword [rbp + 0x68]
call fcn.004090e0
nop
lea rcx, [rbp + 0x58]
call fcn.0040fda0
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x441b60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.00410570
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00417890
mov esi, eax
cmp esi, 0x104
jbe 0x441bbc
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.004090b0
mov rdi, rax
jmp 0x441bc0
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00417890
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x441c17
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x441bf8
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x441c29
mov rcx, rdi
call fcn.004090e0
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x4c5d60
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb5
mov r8, rcx
xor edx, edx
mov ecx, edx
and ecx, 0x3f
mov r9, r8
shr r9, cl
and r9b, 0xff
xor al, r9b
add edx, 1
cmp edx, 8
jne 0x4c5d67
nop
ret

Function at 0x50ccf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov qword [rbp + 0x60], r8
mov rcx, rsi
mov rdx, qword [rbp + 0x60]
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x20], 0
jne 0x50cd27
mov rcx, rbp
call fcn.0050cc10
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_LoadResource
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x28], 0
jne 0x50cd46
mov rcx, rbp
call fcn.0050cc10
mov rcx, qword [rbx + 0x28]
call sub.kernel32.dll_LockResource
mov rdi, rax
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_SizeofResource
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call fcn.0050c2d0
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x51f010
Capabilities:
Resume thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x20]
movzx rax, byte [rax + 0x19]
movzx rcx, byte [rbp + 0x2f]
or al, cl
test al, al
je 0x51f0a2
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x1d], 0
jne 0x51f0a2
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x40], 0
jne 0x51f0a2
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x1b], 0
mov byte [rax + 0x19], 0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x51f0cc
lea rcx, [rbp + 0x38]
mov rdx, qword [0x00785098]
call fcn.004177c0
mov rcx, qword [0x004dff20]
mov dl, 1
mov r8, qword [rbp + 0x38]
call fcn.0043e9a0
mov rcx, rax
call fcn.0040eed0
jmp 0x51f0cc
lea rcx, [rbp + 0x30]
mov rdx, qword [0x00785098]
call fcn.004177c0
mov rcx, qword [0x004dff20]
mov dl, 1
mov r8, qword [rbp + 0x30]
call fcn.0043e9a0
mov rcx, rax
call fcn.0040eed0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040fe80
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x51fc40
Capabilities:
Suspend thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
movzx rax, byte [rax + 0x1b]
mov byte [rbp + 0x3f], al
nop
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x1b], 1
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_SuspendThread
mov rcx, qword [rbp + 0x50]
test eax, eax
setge dl
call fcn.0051ee50
jmp 0x51fc9b
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x51fcc0
Capabilities:
Resume thread

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rbx + 0x10]
call sub.kernel32.dll_ResumeThread
mov esi, eax
mov rcx, rbx
test esi, esi
setge dl
call fcn.0051ee50
cmp esi, 1
jne 0x51fcea
mov byte [rbx + 0x1b], 0
add rsp, 0x28
pop rbx
pop rsi
ret