joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400027d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x1400027e9
mov qword [r8], 0
lea rdx, [0x1400387b8]
call fcn.1400025e0
mov rbx, rax
test rax, rax
jne 0x140002808
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
xor edx, edx
mov r8d, 2
mov qword [rsp + 0x38], rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400028ca
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400028ca
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400028ca
mov rax, qword [0x1400438e0]
mov rbp, rsi
test rax, rax
je 0x140002867
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400028ca
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1400028b7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400438e0]
test rax, rax
je 0x1400028ac
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400028d3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400028c5
mov qword [rdi], rbp
mov rax, rsi
jmp 0x1400028d5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140012500
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1400438e0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x14001261a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001255a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140013530
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001256e
mov edx, 8
mov rcx, rbx
call fcn.140013530
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x1400125ba
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140012590
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x1400125c9
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x1400387bc]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400438d8]
mov rcx, r15
cmovne rdi, rax
call fcn.1400025e0
mov rbx, rax
test rax, rax
je 0x140012615
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001a530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r13
push r14
sub rsp, 0xb8
mov r13, rcx
movsxd rax, r9d
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xe8], ecx
mov r14, rdx
test r9d, r9d
jle 0x14001a792
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rbp
movzx ebp, byte [r13 + 0x24]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov edi, 0x100
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
movzx r11d, byte [r13 + 0x20]
movss xmm8, dword [0x14003ce80]
nop word [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001a5fa
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, di
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, di
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x14001a619
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
xor edi, edi
mov byte [rbx], r11b
mov byte [rbx + 1], bpl
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x14001a730
mov r15, qword [rsp + 0xf0]
mov rax, r12
shl rax, 4
add r15, 6
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001a660
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x14001a663
mov edx, dword [rax + rsi]
mov eax, dword [r13 + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [r13 + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140015860
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.140018190
movzx ecx, word [r13 + 0x1c]
inc r12
movzx r11d, word [r13 + 0x20]
movzx eax, cx
sub ax, word [rsp + 0x50]
dec cx
movzx ebp, word [r13 + 0x24]
dec ax
add ax, r11w
inc edi
add ax, word [rsp + 0x54]
add rsi, 4
mov word [r15 - 2], ax
movzx eax, bp
sub ax, word [rsp + 0x58]
add ax, cx
mov ecx, dword [rsp + 0xe8]
add ax, word [rsp + 0x5c]
inc ecx
mov word [r15], ax
add r15, 0x10
mov dword [rsp + 0xe8], ecx
cmp edi, dword [rbx - 0x10]
jl 0x14001a650
jmp 0x14001a737
mov ecx, dword [rsp + 0xe8]
add rbx, 0x28
mov edi, 0x100
sub qword [rsp + 0x60], 1
jne 0x14001a5b0
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, ecx
add rsp, 0xb8
pop r14
pop r13
ret
Function at 0x14001e490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001e649
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001e526
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001de00
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001d410
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001e517
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1400131b0
mov dword [rbx + 0x80], 0
jmp 0x14001e635
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001c2f0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400365e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140036632
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140036632
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140036632
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140036632
cmp dword [rcx + 0x84], 0xe
jbe 0x140036632
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140036634
xor al, al
add rsp, 0x28
ret
Function at 0x401370
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x28
xor rcx, rcx
call sub.KERNEL32_GetModuleHandleA
mov qword [0x004550a0], rax
call fcn.00439740
call fcn.00435300
call fcn.00439750
lea rax, [section..data]
lea rcx, [0x00401f00]
mov qword [rax + 0x30], rcx
lea rcx, section..text
mov qword [rax], rcx
lea rcx, [0x0040130c]
mov qword [rax + 8], rcx
lea rcx, [0x0040130c]
mov qword [rax + 0x10], rcx
lea rcx, [0x0040136c]
mov qword [rax + 0x18], rcx
lea rcx, [0x0044a7e0]
mov qword [rax + 0x68], rcx
lea rcx, [0x0044abe0]
mov qword [rax + 0x70], rcx
lea rcx, [0x0044ac10]
mov qword [rax + 0x78], rcx
lea rcx, [0x0044b1c0]
mov qword [rax + 0x80], rcx
lea rcx, [0x004626b0]
mov qword [rax + 0x50], rcx
mov rcx, rax
push 0
jmp 0x44bce0
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, r9
mov r14d, r8d
mov ebx, edx
mov edi, ecx
call fcn.0044bc80
test edi, edi
je 0x44a375
test ebx, ebx
jne 0x44a38c
test edi, edi
jne 0x44a366
call qword [0x004632b8]
call qword [0x004632c0]
call fcn.0044bca0
mov ecx, r14d
call fcn.0044ba30
jmp 0x44a38c
mov rcx, rsi
call fcn.0044a120
call fcn.0044bb50
call qword [0x004632b0]
test ebx, ebx
je 0x44a356
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0044bca0
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [rsi + 0x20]
and eax, 1
mov dword [0x00463310], eax
mov rcx, qword [rsi + 0x50]
call fcn.0043bae0
mov rcx, qword [rsi + 0x88]
call fcn.0043baf0
mov dword [0x00476c20], 1
lea rdi, [0x00476c20]
mov qword [0x00476c28], rsi
call sub.KERNEL32_GetEnvironmentStrings
mov qword [0x00476bc0], rax
call sub.KERNEL32_GetCommandLineA
mov qword [0x00476bd0], rax
mov rcx, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
call fcn.0044a5a0
xor edx, edx
mov rcx, rdi
call fcn.0044ba50
test byte [rsi + 0x20], 1
jne 0x44bda4
mov ecx, dword [0x00476bec]
mov rdx, qword [0x00476bf0]
mov r8, qword [0x00476bf8]
call qword [rsi + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x44a330
mov rax, qword [0x00476bd0]
nop dword [rax + rax]
inc rax
mov cl, byte [rax - 1]
cmp cl, 9
je 0x44bdb0
cmp cl, 0x20
je 0x44bdb0
cmp cl, 0x22
jne 0x44bdce
mov cl, byte [rax]
mov edx, 0x22
jmp 0x44bdd6
dec rax
mov edx, 0x20
movsx edi, cl
cmp edx, edi
je 0x44bdf4
nop dword [rax]
test cl, cl
je 0x44bdf4
cmp cl, 9
je 0x44bdf4
movsx ecx, byte [rax + 1]
inc rax
cmp edx, ecx
jne 0x44bde0
lea rdi, [rax + 1]
cmp cl, 0x22
cmovne rdi, rax
jmp 0x44be13
inc rdi
movzx eax, byte [rdi]
cmp al, 0x20
je 0x44be10
cmp al, 9
je 0x44be10
mov rbx, qword [rsi + 0x30]
xor ecx, ecx
call sub.KERNEL32_GetModuleHandleA
mov rsi, rax
lea rcx, [rbp - 0x60]
call sub.KERNEL32_GetStartupInfoA
mov eax, dword [rbp - 0x24]
test al, 1
movzx eax, word [rbp - 0x20]
mov r9d, 0xa
cmovne r9d, eax
xor edx, edx
mov rcx, rsi
mov r8, rdi
call rbx
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
call 0x44a330
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x401840
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov rsi, rdx
mov rax, rcx
lea rdx, [0x004511d0]
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r8, rax
call fcn.00403020
lea rdx, [0x004511fe]
mov r8d, 0x14
mov rcx, rdi
call fcn.00405530
mov rdi, rax
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], 0
mov word [rbp + 0x38], 0
mov rcx, qword [rdi + 0x20]
cmp rcx, 7
ja 0x4018c9
mov r8, qword [rdi + 0x18]
mov rbx, rdi
add rbx, 8
inc r8
je 0x4018e0
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.0043a110
mov rcx, qword [rdi + 0x20]
jmp 0x4018e0
mov rbx, rdi
add rbx, 8
mov rax, qword [rdi + 8]
mov qword [rbp + 0x38], rax
mov qword [rdi + 8], 0
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rcx
mov qword [rdi + 0x20], 7
mov qword [rdi + 0x18], 0
mov word [rbx], 0
lea rcx, [rbp - 0x20]
lea rdx, [rbp + 0x30]
mov r8, rsi
call fcn.00402f00
lea rdx, [0x00451228]
lea rcx, [rbp - 0x20]
mov r8d, 1
call fcn.00405530
mov rdi, rax
mov qword [rbp + 0x28], 7
lea rsi, [rbp + 0x10]
mov qword [rbp + 0x20], 0
mov word [rbp + 0x10], 0
mov rcx, qword [rdi + 0x20]
cmp rcx, 7
ja 0x40196f
mov r8, qword [rdi + 0x18]
mov rbx, rdi
add rbx, 8
inc r8
je 0x401986
mov rcx, rsi
mov rdx, rbx
call fcn.0043a110
mov rcx, qword [rdi + 0x20]
jmp 0x401986
mov rbx, rdi
add rbx, 8
mov rax, qword [rdi + 8]
mov qword [rbp + 0x10], rax
mov qword [rdi + 8], 0
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rcx
mov qword [rdi + 0x20], 7
mov qword [rdi + 0x18], 0
mov word [rbx], 0
mov rax, qword [rbp]
cmp rax, 8
jb 0x4019cb
mov rcx, qword [rbp - 0x18]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x4019c6
mov rcx, qword [rcx - 8]
call fcn.004073e0
mov qword [rbp], 7
mov qword [rbp - 8], 0
mov word [rbp - 0x18], 0
mov rax, qword [rbp + 0x50]
cmp rax, 8
jb 0x401a05
mov rcx, qword [rbp + 0x38]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x401a00
mov rcx, qword [rcx - 8]
call fcn.004073e0
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], 0
mov word [rbp + 0x38], 0
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x401a3f
mov rcx, qword [rbp - 0x40]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x401a3a
mov rcx, qword [rcx - 8]
call fcn.004073e0
cmp qword [rbp + 0x28], 7
cmova rsi, qword [rbp + 0x10]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x0045122c]
lea r8, [0x00451236]
xor ecx, ecx
mov r9, rsi
call sub.SHELL32.DLL_ShellExecuteW
cmp eax, 0x20
jg 0x401ab4
lea rcx, [0x00464948]
lea rdx, [0x00451096]
call fcn.00402c40
mov rsi, rax
mov rax, qword [rsi]
mov rcx, qword [rax - 0x18]
add rcx, rsi
mov edx, 0xa
call fcn.00405050
movzx edx, al
mov rcx, rsi
call fcn.00404ee0
mov rcx, rsi
call fcn.00404150
mov rax, qword [rbp + 0x28]
cmp rax, 8
jb 0x401ad8
mov rcx, qword [rbp + 0x10]
lea rax, [rax + rax + 2]
cmp rax, 0x1000
jb 0x401ad3
mov rcx, qword [rcx - 8]
call fcn.004073e0
nop
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x401e00
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp + 0x30], 0
mov dword [rbp - 0x30], 0x68
movaps xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 0
lea rdx, [rcx + 8]
cmp qword [rcx + 0x20], 7
cmova rdx, qword [rcx + 8]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32_CreateProcessW
test eax, eax
jne 0x401ee2
lea rcx, [0x00464948]
lea rdx, [0x004510b2]
call fcn.00402c40
mov rsi, rax
mov rax, qword [rsi]
mov rcx, qword [rax - 0x18]
add rcx, rsi
mov edx, 0xa
call fcn.00405050
movzx edx, al
mov rcx, rsi
call fcn.00404ee0
mov rcx, rsi
call fcn.00404150
nop
add rsp, 0xd8
pop rsi
pop rbp
ret
xor ecx, ecx
call sub.KERNEL32_ExitProcess
ud2

Function at 0x434bc0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
test rsi, rsi
je 0x434d02
test rbx, rbx
je 0x434d02
test r15, r15
je 0x434d02
lea rcx, [0x00453180]
call sub.KERNEL32_GetModuleHandleA
mov rdi, rax
test rdi, rdi
je 0x434d02
mov r13, qword [rbp + 0x78]
mov r12, qword [rbp + 0x70]
lea rdx, [0x00453189]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [rsi], rax
lea rdx, [0x004531a2]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [rbx], rax
lea rdx, [0x004531bd]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r15], rax
lea rdx, [0x004531dc]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r14], rax
lea rdx, [0x004531f7]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r12], rax
lea rdx, [0x00453225]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r13], rax
mov rax, qword [rsi]
mov qword [0x00465350], rax
cmp qword [r14], 0
je 0x434cde
cmp qword [r12], 0
jne 0x434cac
lea rax, [0x00434b70]
mov qword [r12], rax
mov rcx, qword [r13]
test rcx, rcx
je 0x434cf1
cmp qword [rsi], 0
je 0x434d02
cmp qword [rbx], 0
je 0x434d02
cmp qword [r15], 0
je 0x434d02
cmp qword [r14], 0
je 0x434d02
cmp qword [r12], 0
je 0x434d02
xor eax, eax
test rcx, rcx
setne al
jmp 0x434d04
lea rax, [0x00434b80]
mov qword [r14], rax
cmp qword [r12], 0
jne 0x434cac
jmp 0x434ca1
lea rcx, [0x00434b70]
mov qword [r13], rcx
cmp qword [rsi], 0
jne 0x434cbb
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x436aa0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
cmp dword [0x004657a0], 0
jg 0x436b0c
mov eax, dword [0x004657a0]
test eax, eax
jg 0x436b0c
mov esi, 0xffffffff
nop word cs:[rax + rax]
test eax, eax
jne 0x436ae0
xor eax, eax
lock cmpxchg dword [0x004657a0], esi
je 0x436af5
xor ecx, ecx
xor edx, edx
call sub.KERNEL32_SleepEx
mov eax, dword [0x004657a0]
test eax, eax
jle 0x436ad0
jmp 0x436b0c
lea rcx, [0x004657a8]
call fcn.00450920
mov eax, 1
xchg dword [0x004657a0], eax
lea rcx, [0x004657a8]
call fcn.004507f0
cmp qword [0x004653a0], 0
jne 0x436b9a
lea rcx, [rbp - 0x28]
call sub.KERNEL32_GetSystemInfo
mov eax, dword [rbp]
lea ecx, [rax - 1]
test rcx, rax
jne 0x436bae
mov edx, 0xffffffff
mov ecx, dword [rbp - 0x24]
add edx, ecx
test rdx, rcx
jne 0x436bae
mov qword [0x004653b0], rax
mov qword [0x004653a8], rcx
movaps xmm0, xmmword [0x00453350]
movups xmmword [0x004653b8], xmm0
mov dword [0x004653c8], 7
mov dword [0x00465740], 7
lea rcx, [0x00465748]
mov edx, 0x80000fa0
call sub.KERNEL32_InitializeCriticalSectionAndSpinCount
call sub.KERNEL32_GetTickCount
and eax, 0xfffffff0
xor eax, 0x55555558
mov qword [0x004653a0], rax
lea rcx, [0x004657a8]
call fcn.00450950
nop
add rsp, 0x58
pop rsi
pop rbp
ret
call fcn.0044a020
ud2

Function at 0x43a750
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, edx
call sub.KERNEL32_GetFileAttributesA
mov ecx, eax
cmp ecx, 0xffffffff
je 0x43a78d
xor eax, eax
test sil, 2
je 0x43a786
and ecx, 1
je 0x43a786
call fcn.00449800
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x28
pop rsi
pop rbp
ret
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.0043d0a0
jmp 0x43a750
Function at 0x43ab80
Capabilities:
Check if file exists

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov ebx, edx
mov r14, rcx
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x40], r8
call fcn.0043c540
test bh, 0xc0
jne 0x43abb6
mov rax, qword [0x004626c0]
mov ecx, 0xc000
and ecx, dword [rax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
shr eax, 8
mov edi, 3
cmp eax, 6
ja 0x43abe1
shl rax, 0x28
sar rax, 0x28
lea rcx, [0x004533b0]
mov edi, dword [rcx + rax*4]
test bh, 1
je 0x43ac06
lea rax, [rbp + 0x48]
mov qword [rbp - 0x18], rax
mov al, byte [0x0045de90]
and al, byte [rbp + 0x40]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x43ac16
mov rcx, r14
call sub.KERNEL32_GetFileAttributesA
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x43ac2f
cmp al, 2
je 0x43ac36
cmp al, 1
jne 0x43ad16
mov edx, 0x40000000
jmp 0x43ac3b
mov edx, 0x80000000
jmp 0x43ac3b
mov edx, 0xc0000000
mov eax, ebx
and eax, 0x70
add eax, 0xfffffff0
shr eax, 4
cmp eax, 3
mov esi, 3
cmovb esi, eax
xor r8d, r8d
cmp edx, 0x80000000
sete r8b
test bl, 4
cmove r8d, esi
mov dword [rbp - 0x18], 0x18
mov qword [rbp - 0x10], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [rbp - 8], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x30], 0
lea r9, [rbp - 0x18]
mov rcx, r14
call sub.KERNEL32_CreateFileA
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x43acf6
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov ecx, esi
call fcn.0043aac0
mov edx, edi
or edx, 0x2000
test eax, eax
cmove edx, edi
and edx, 0xfffff8ff
mov ecx, esi
call fcn.0043c730
mov edi, eax
cmp edi, 0xffffffff
jne 0x43ad22
mov ecx, 4
call fcn.0043cfe0
mov rcx, rsi
call sub.KERNEL32_CloseHandle
mov edi, 0xffffffff
jmp 0x43ad22
call sub.KERNEL32_GetLastError
movzx eax, ax
test bh, 1
mov edx, 0x50
mov ecx, 2
cmovne ecx, edx
cmp eax, 0x6e
cmovne ecx, eax
jmp 0x43ad1b
mov ecx, 1
call fcn.0043cfe0
mov edi, eax
call fcn.0043c5a0
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x43b5e0
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x00461ea0], ecx
jbe 0x43b61c
movsxd rax, ecx
lea rcx, [0x00465ff0]
movsxd rcx, dword [rcx + rax*4]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call sub.KERNEL32_ReadFile
cmp eax, 1
jne 0x43b62d
mov eax, dword [rbp - 4]
jmp 0x43b626
mov ecx, 6
call fcn.0043cfe0
nop
add rsp, 0x30
pop rbp
ret
call sub.KERNEL32_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x43b626
jmp 0x43b621

Function at 0x43b670
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x00461ea0], ecx
jbe 0x43b6ac
movsxd rax, ecx
lea rcx, [0x00465ff0]
movsxd rcx, dword [rcx + rax*4]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call sub.KERNEL32_WriteFile
cmp eax, 1
jne 0x43b6b8
mov eax, dword [rbp - 4]
jmp 0x43b6bd
mov ecx, 6
call fcn.0043cfe0
jmp 0x43b6bd
call fcn.0043d0a0
nop
add rsp, 0x30
pop rbp
ret