joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100009224
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
xor esi, esi
and dword [rsp + 0x68], ebx
mov rcx, qword [0x100018120]
lea r14, [0x100018120]
lea r13d, [rbx + 1]
lea r15, [0x100004240]
cmp rcx, r14
je 0x10000927b
cmp byte [rcx + 0x19], 4
jb 0x10000927b
test byte [rcx + 0x1c], r13b
je 0x10000927b
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x24]
mov r8, r15
call fcn.100004b08
lea rcx, [0x100018a60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x100018154]
mov ebp, r13d
cmp edx, r13d
je 0x1000093f1
cmp qword [0x100018850], rbx
je 0x1000093c7
mov rcx, qword [0x100018860]
test rcx, rcx
je 0x1000093c7
mov eax, dword [0x100018858]
cmp eax, 0x200
jge 0x1000093c7
cmp edx, 3
jne 0x1000093c7
mov rdi, qword [rcx]
add eax, r13d
lea rcx, [0x100018a60]
mov dword [rsp + 0x68], r13d
mov dword [0x100018154], 4
mov dword [0x100018858], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebp, ebp
test rdi, rdi
je 0x1000093f1
and qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
lea r8, [0x100009174]
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x100009370
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x100009370
mov rcx, qword [0x100018120]
cmp rcx, r14
je 0x1000093f1
cmp byte [rcx + 0x19], r13b
jb 0x1000093f1
test byte [rcx + 0x1c], r13b
je 0x1000093f1
lea edx, [rbp + 0x26]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
mov r8, r15
call fcn.100004b2c
jmp 0x1000093f1
mov edx, 0x1388
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test eax, eax
je 0x1000093f1
cmp eax, 0xffffffff
jne 0x100009393
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1000093a1
mov eax, 0x139f
cmp ebx, 0x102
cmovne ebx, eax
test ebx, ebx
je 0x1000093f1
mov rcx, qword [0x100018120]
cmp rcx, r14
je 0x1000093f1
cmp byte [rcx + 0x19], r13b
jb 0x1000093f1
test byte [rcx + 0x1c], r13b
je 0x1000093f1
mov edx, 0x27
mov r9d, ebx
jmp 0x10000935f
and dword [rsp + 0x68], ebx
mov ebx, 5
mov rcx, qword [0x100018120]
cmp rcx, r14
je 0x1000093f1
test byte [rcx + 0x1c], r13b
je 0x1000093f1
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x20]
mov r8, r15
call fcn.100004b08
lea rcx, [rsp + 0x68]
call fcn.1000084c4
test ebp, ebp
je 0x10000940c
lea rcx, [0x100018a60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x10000941a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x100018120]
cmp rcx, r14
je 0x100009446
cmp byte [rcx + 0x19], 4
jb 0x100009446
test byte [rcx + 0x1c], r13b
je 0x100009446
mov rcx, qword [rcx + 0x10]
mov edx, 0x28
mov r9d, ebx
mov r8, r15
call fcn.100004b2c
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x10000bc78
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x100018110]
xor rax, rsp
mov qword [rsp + 0x30], rax
movdqu xmm6, xmmword [rcx]
mov rcx, qword [0x100018120]
lea rbp, [0x100018120]
cmp rcx, rbp
je 0x10000bcd5
cmp byte [rcx + 0x19], 4
jb 0x10000bcd5
test byte [rcx + 0x1c], 1
je 0x10000bcd5
mov rcx, qword [rcx + 0x10]
lea r8, [0x100004220]
mov edx, 0xe
call fcn.100004b08
mov rcx, qword [0x100018120]
cmp dword [0x100018878], 1
je 0x10000bd03
lea r8, [0x100018878]
lea rdx, [0x10001885c]
lea rcx, [0x100018a20]
call fcn.10000e994
mov rcx, qword [0x100018120]
mov ebx, eax
jmp 0x10000bd05
xor ebx, ebx
test ebx, ebx
jne 0x10000bdba
lea rcx, [0x100018a20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [0x100018888]
lea rcx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.10000bab4
mov ebx, eax
test eax, eax
jne 0x10000bda6
mov rdx, qword [0x100018888]
lea rcx, [0x100004150]
xor r8d, r8d
call fcn.10000f218
mov ebx, eax
test eax, eax
jne 0x10000bda6
lea ecx, [rax + 1]
mov edx, 0x4d2
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
test eax, eax
je 0x10000bd9c
mov rcx, qword [0x100018120]
cmp rcx, rbp
je 0x10000bda6
cmp byte [rcx + 0x19], 1
jb 0x10000bda6
test byte [rcx + 0x1c], 1
je 0x10000bda6
mov rcx, qword [rcx + 0x10]
lea r8, [0x100004220]
mov edx, 0xf
mov r9d, eax
call fcn.100004b2c
jmp 0x10000bda6
mov dword [0x100018150], 2
lea rcx, [0x100018a20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x100018120]
cmp rcx, rbp
je 0x10000bde3
cmp byte [rcx + 0x19], 4
jb 0x10000bde3
test byte [rcx + 0x1c], 1
je 0x10000bde3
mov rcx, qword [rcx + 0x10]
lea r8, [0x100004220]
mov edx, 0x10
mov r9d, ebx
call fcn.100004b2c
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1000152a0
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbp
ret
Function at 0x10000faa0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x20
and qword [rsp + 0x48], 0
xor edi, edi
mov rsi, rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [0x100018120]
lea r12, [0x100018120]
cmp rcx, r12
je 0x10000faef
cmp byte [rcx + 0x19], 4
jb 0x10000faef
test byte [rcx + 0x1c], 1
je 0x10000faef
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x29]
lea r8, [0x1000041c0]
call fcn.100004b08
and dword [rsi], edi
lea rcx, [rsp + 0x48]
call fcn.10000f8ac
mov ebx, eax
test eax, eax
jne 0x10000fb8d
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
mov ebx, eax
test eax, eax
je 0x10000fb35
mov rcx, qword [0x100018120]
cmp rcx, r12
je 0x10000fb8d
cmp byte [rcx + 0x19], 1
jb 0x10000fb8d
test byte [rcx + 0x1c], 1
je 0x10000fb8d
mov edx, 0x2a
mov r9d, eax
jmp 0x10000fb7d
lea rcx, [rsp + 0x40]
mov dword [rsi], 1
call fcn.10000f9a4
mov rdi, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x10000fb8d
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10000fb8d
lea ebx, [rax + 5]
mov rcx, qword [0x100018120]
cmp rcx, r12
je 0x10000fb8d
test byte [rcx + 0x1c], 1
je 0x10000fb8d
lea edx, [rax + 0x2b]
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000041c0]
call fcn.100004b2c
mov rcx, qword [rsp + 0x48]
call fcn.10000dc8c
mov rcx, rdi
call fcn.10000dc8c
mov rcx, qword [0x100018120]
cmp rcx, r12
je 0x10000fbcf
cmp byte [rcx + 0x19], 4
jb 0x10000fbcf
test byte [rcx + 0x1c], 1
je 0x10000fbcf
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000041c0]
mov edx, 0x2c
mov r9d, ebx
call fcn.100004b2c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x100013a0c
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
and qword [r11 - 0x28], 0
and qword [r11 + 0x20], 0
and qword [r11 - 0x20], 0
lea rax, [r11 - 0x20]
mov r12d, r8d
mov rdi, rcx
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x40], r8d
mov qword [r11 - 0x48], rdx
mov r8, rcx
lea rdx, [0x100013b4c]
lea rcx, [r11 + 0x20]
xor r9d, r9d
call fcn.1000141e8
mov rsi, qword [rsp + 0x88]
mov ebx, eax
test eax, eax
jne 0x100013b1f
mov rbp, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsi + 0x30], rbp
call fcn.100013e3c
mov ebx, eax
test eax, eax
jne 0x100013b1f
mov rcx, qword [0x100018130]
call fcn.1000129a8
mov rdi, qword [rsp + 0x40]
cmp dword [0x1000188e8], ebx
je 0x100013aac
mov ebx, 0x12f
jmp 0x100013b07
mov dword [rdi + 0x14], r12d
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100013ae4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
je 0x100013ae2
cmp eax, 0xea
jne 0x100013ae4
xor ebx, ebx
xor eax, eax
test ebx, ebx
sete al
mov dword [rdi + 0x10], eax
test ebx, ebx
jne 0x100013b07
lock add dword [0x1000188cc], 1
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rcx, qword [0x100018130]
call fcn.100012a34
mov rcx, rdi
call fcn.1000138e8
test ebx, ebx
je 0x100013b31
test rsi, rsi
je 0x100013b31
lea rcx, [rsp + 0x88]
call fcn.1000142cc
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret

Function at 0x100014038
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
and qword [r11 - 0x28], 0
mov rax, qword [rsp + 0x88]
and dword [rsp + 0x28], 0
and qword [r11 - 0x10], 0
and qword [r11 - 0x18], 0
mov rsi, r9
mov ebp, r8d
mov r9, rdx
mov rdi, rcx
mov r8, rcx
lea rdx, [0x100010fe0]
lea rcx, [r11 - 0x18]
mov qword [r11 - 0x38], rax
call fcn.1000141e8
mov ebx, eax
test eax, eax
jne 0x100014120
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.100013e3c
mov ebx, eax
test eax, eax
jne 0x100014120
mov rcx, qword [0x100018130]
call fcn.1000129a8
cmp dword [0x1000188e8], ebx
je 0x1000140c3
mov ebx, 0x12f
jmp 0x10001410a
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov rcx, qword [rcx + 8]
mov r8d, ebp
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000140fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
je 0x1000140fc
test eax, eax
jne 0x10001410a
lock add dword [0x1000188cc], 1
and qword [rsp + 0x40], 0
mov rcx, qword [0x100018130]
call fcn.100012a34
mov rcx, qword [rsp + 0x48]
call fcn.1000138e8
cmp qword [rsp + 0x40], 0
je 0x100014132
lea rcx, [rsp + 0x40]
call fcn.1000142cc
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x4079a0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x28
xor rcx, rcx
call fcn.00766218
mov qword [0x009570a0], rax
call fcn.00729940
call fcn.00729830
call fcn.00729a50
lea rax, [section..data]
lea rcx, [0x00436ad0]
mov qword [rax + 0x30], rcx
lea rcx, section..text
mov qword [rax], rcx
lea rcx, [0x00404840]
mov qword [rax + 8], rcx
lea rcx, [0x00404840]
mov qword [rax + 0x10], rcx
lea rcx, [0x0040799c]
mov qword [rax + 0x18], rcx
lea rcx, [0x0073dc20]
mov qword [rax + 0x68], rcx
lea rcx, [0x0073e020]
mov qword [rax + 0x70], rcx
lea rcx, [0x0073e050]
mov qword [rax + 0x78], rcx
lea rcx, [0x0073e600]
mov qword [rax + 0x80], rcx
lea rcx, [0x00989510]
mov qword [rax + 0x50], rcx
mov dword [rax + 0x20], 1
mov rcx, rax
push 0
jmp 0x73f630
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, r9
mov r14d, r8d
mov ebx, edx
mov edi, ecx
call fcn.0073f5d0
test edi, edi
je 0x73d9c5
test ebx, ebx
jne 0x73d9dc
test edi, edi
jne 0x73d9b6
call qword [0x0098a188]
call qword [0x0098a190]
call fcn.0073f5f0
mov ecx, r14d
call fcn.0073f380
jmp 0x73d9dc
mov rcx, rsi
call fcn.0073d770
call fcn.0073f4a0
call qword [0x0098a180]
test ebx, ebx
je 0x73d9a6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0073f5f0
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [rsi + 0x20]
and eax, 1
mov dword [0x0098a1e0], eax
mov rcx, qword [rsi + 0x50]
call fcn.0072c1b0
mov rcx, qword [rsi + 0x88]
call fcn.0072c1c0
mov dword [0x010ab140], 1
lea rdi, [0x010ab140]
mov qword [0x010ab148], rsi
call fcn.00766190
mov qword [0x010ab0e8], rax
call fcn.00766148
mov qword [0x010ab0f8], rax
mov rcx, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
call fcn.0073dbf0
xor edx, edx
mov rcx, rdi
call fcn.0073f3a0
test byte [rsi + 0x20], 1
jne 0x73f6f4
mov ecx, dword [0x010ab10c]
mov rdx, qword [0x010ab120]
mov r8, qword [0x010ab128]
call qword [rsi + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x73d980
mov rax, qword [0x010ab0f8]
nop dword [rax + rax]
add rax, 2
movzx ecx, word [rax - 2]
cmp ecx, 9
je 0x73f700
movzx edx, cx
cmp edx, 0x20
je 0x73f700
cmp edx, 0x22
jne 0x73f724
mov cx, word [rax]
mov edx, 0x22
jmp 0x73f72d
add rax, 0xfffffffffffffffe
mov edx, 0x20
movzx edi, cx
cmp edx, edi
je 0x73f759
nop word cs:[rax + rax]
test cx, cx
je 0x73f759
movzx edi, cx
cmp edi, 9
je 0x73f759
movzx ecx, word [rax + 2]
add rax, 2
cmp edx, ecx
jne 0x73f740
movzx ecx, cx
lea rdi, [rax + 2]
cmp ecx, 0x22
cmovne rdi, rax
jmp 0x73f774
add rdi, 2
movzx eax, word [rdi]
cmp eax, 0x20
je 0x73f770
movzx eax, ax
cmp eax, 9
je 0x73f770
mov rbx, qword [rsi + 0x30]
xor ecx, ecx
call fcn.00766218
mov rsi, rax
lea rcx, [rbp - 0x60]
call fcn.00766250
mov eax, dword [rbp - 0x24]
test al, 1
movzx eax, word [rbp - 0x20]
mov r9d, 0xa
cmovne r9d, eax
xor edx, edx
mov rcx, rsi
mov r8, rdi
call rbx
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
call 0x73d980
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x409310
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, r8
mov r12d, edx
mov ebx, ecx
cmp r12d, 1
jg 0x409351
lea eax, [r12 - 1]
nop dword [rax + rax]
shl ebx, 8
inc eax
test eax, eax
jle 0x409340
xor edi, edi
cmp r12d, 0xffffffff
jl 0x4093bc
mov esi, 0x12
mov edi, 0xffffffff
lea r15, [0x007680dd]
mov r13, rbp
nop word cs:[rax + rax]
mov eax, ebx
mov ecx, esi
shr eax, cl
and eax, 0x3f
mov qword [rbp], 0
lea rcx, [0x00768223]
movsx r8d, byte [rax + rcx]
mov rcx, r13
mov rdx, r15
call fcn.00420160
mov rcx, r14
mov rdx, r13
call fcn.00746950
mov rcx, r13
call fcn.004202c0
add esi, 0xfffffffa
inc edi
cmp edi, r12d
jle 0x409370
cmp edi, 2
jg 0x409403
inc edi
dec edi
lea rsi, [0x007680dd]
mov rbx, rbp
nop dword [rax + rax]
mov qword [rbp], 0
mov r8d, 0x3d
mov rcx, rbx
mov rdx, rsi
call fcn.00420160
mov rcx, r14
mov rdx, rbx
call fcn.00746950
mov rcx, rbx
call fcn.004202c0
inc edi
cmp edi, 3
jl 0x4093d0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x409940
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov dword [rsp + 0x20], 0
lea rcx, [0x01083420]
lea r8, [0x0076827a]
xor edx, edx
mov r9d, 1
call fcn.00765e90
test eax, eax
jne 0x40999f
mov dword [rsp + 0x20], 8
lea rcx, [0x01083420]
lea r8, [0x0076827a]
xor esi, esi
xor edx, edx
mov r9d, 1
call fcn.00765e90
test eax, eax
je 0x409a9a
mov rcx, qword [0x01083420]
lea rax, [0x01083428]
mov qword [rsp + 0x20], rax
xor esi, esi
mov edx, 0x8004
xor r8d, r8d
xor r9d, r9d
call fcn.00765e98
test eax, eax
je 0x409a9a
mov qword [rbp], 0
lea rdx, [0x00768264]
mov rcx, rbp
mov r8d, 0x9cd
call fcn.00420160
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
lea rdx, [0x00768001]
lea rcx, [rbp - 0x10]
xor r8d, r8d
call fcn.00745fa0
lea rcx, [rbp - 8]
lea rdx, [rbp - 0x10]
mov r8, rbp
call fcn.00746960
lea rcx, [rbp - 0x10]
call fcn.004202c0
mov rcx, rbp
call fcn.004202c0
mov rcx, qword [0x01083428]
mov rax, qword [rbp - 8]
test rax, rax
lea rdx, section..rodata
cmovne rdx, rax
je 0x409a4e
mov r8d, dword [rax - 4]
jmp 0x409a51
xor r8d, r8d
xor r9d, r9d
call fcn.00765ec8
test eax, eax
je 0x409a8f
mov rcx, qword [0x01083420]
mov r8, qword [0x01083428]
lea rax, [0x01083430]
mov qword [rsp + 0x20], rax
mov edx, 0x6801
mov r9d, 0x800000
call fcn.00765ea8
test eax, eax
setne sil
jmp 0x409a91
xor esi, esi
lea rcx, [rbp - 8]
call fcn.004202c0
mov eax, esi
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x409af0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov r14, rcx
mov qword [rbp - 0x28], rdx
lea rcx, [rbp - 0x28]
mov rdx, rcx
call fcn.00754280
mov qword [rbp - 0x20], 0
mov rax, qword [rbp - 0x28]
test rax, rax
lea rsi, [0x007682d8]
cmovne rsi, rax
je 0x409b3b
mov eax, dword [rax - 4]
lea eax, [rax + rax + 1]
jmp 0x409b40
mov eax, 1
mov dword [rbp - 0xc], eax
mov rcx, qword [0x01083430]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor edx, edx
mov r8d, 1
xor r9d, r9d
call fcn.00765ec0
test eax, eax
je 0x409c1d
movsxd rdi, dword [rbp - 0xc]
mov qword [rbp - 8], 0
lea rcx, [rbp - 8]
call fcn.007541b0
mov qword [rbp - 8], 0
lea rdx, section..rodata
lea rcx, [rbp - 8]
call fcn.00754220
test edi, edi
jle 0x409bd8
xor ebx, ebx
lea r15, [0x00768270]
lea r12, [rbp - 8]
nop word cs:[rax + rax]
movzx r8d, byte [rsi + rbx]
mov rcx, r12
mov rdx, r15
call fcn.00755260
inc rbx
cmp rbx, rdi
jl 0x409bc0
mov qword [rbp - 0x18], 0
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 8]
xor r8d, r8d
call fcn.007460e0
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x18]
call fcn.00746490
lea rcx, [rbp - 0x18]
call fcn.004202c0
lea rcx, [rbp - 8]
call fcn.007541c0
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.00746000
jmp 0x409c36
mov qword [r14], 0
lea rdx, section..rodata
xor r8d, r8d
mov rcx, r14
call fcn.00745fa0
lea rcx, [rbp - 0x20]
call fcn.004202c0
lea rcx, [rbp - 0x28]
call fcn.007541c0
mov rax, r14
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x409ce0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rsi, rcx
mov qword [rbp], rdx
mov rcx, rbp
mov rdx, rcx
call fcn.00746000
mov rax, qword [rbp]
test rax, rax
je 0x409d16
mov eax, dword [rax - 4]
mov ebx, eax
shr ebx, 0x1f
add ebx, eax
sar ebx, 1
jmp 0x409d18
xor ebx, ebx
mov dword [rbp - 0xc], ebx
add ebx, 2
mov rcx, rbx
call fcn.00729500
mov rdi, rax
xor edx, edx
mov rcx, rdi
mov r8, rbx
call fcn.0072a3d0
mov rcx, qword [rbp]
mov rdx, rdi
call fcn.00409500
mov rcx, qword [0x01083430]
lea rax, [rbp - 0xc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r8d, 1
xor r9d, r9d
call fcn.00765ea0
test eax, eax
je 0x409d9e
mov qword [rbp - 8], 0
lea rcx, [rbp - 8]
mov rdx, rdi
call fcn.00754490
mov rcx, rdi
call fcn.00729510
lea rdx, [rbp - 8]
mov rcx, rsi
call fcn.00754280
lea rcx, [rbp - 8]
call fcn.007541c0
jmp 0x409dbc
mov rcx, rdi
call fcn.00729510
mov qword [rsi], 0
lea rdx, [0x007682d8]
mov rcx, rsi
call fcn.00754490
mov rcx, rbp
call fcn.004202c0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x40f440
Capabilities:
Get file version info

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov r14, rcx
mov qword [rbp - 0x28], rdx
lea rcx, [rbp - 0x28]
mov rdx, rcx
call fcn.00754280
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov dword [rbp - 0xc], 0
mov qword [rbp - 0x20], 0
lea rcx, [rbp - 0x20]
call fcn.007541b0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x18], 0
lea rdx, section..rodata
lea rcx, [rbp - 0x18]
call fcn.00754220
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x40f59e
cmp dword [rcx - 4], 0
je 0x40f59e
lea rdx, [rbp - 0xc]
call fcn.007665b0
mov ebx, eax
test ebx, ebx
je 0x40f5f3
mov ecx, ebx
shl rcx, 3
call fcn.00705b20
mov rdi, rax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x40f60e
cmp dword [rcx - 4], 0
je 0x40f60e
mov edx, dword [rbp - 0xc]
mov r8d, ebx
mov r9, rdi
call fcn.007665b8
mov ebx, eax
test ebx, ebx
je 0x40f668
lea rdx, [0x00768326]
lea r8, [rbp - 0x48]
lea r9, [rbp - 0x2c]
mov rcx, rdi
call fcn.007665c0
test eax, eax
je 0x40f68f
mov rax, qword [rbp - 0x48]
movzx r8d, word [rax]
movzx r9d, word [rax + 2]
lea rdx, [0x00768358]
lea rcx, [rbp - 0x20]
call fcn.007551f0
mov rax, qword [rbp - 0x20]
test rax, rax
lea rdx, [0x007682d8]
cmovne rdx, rax
lea r8, [rbp - 0x40]
lea r9, [rbp - 0x2c]
mov rcx, rdi
call fcn.007665c0
test eax, eax
je 0x40f6b6
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 8], 0
lea rcx, [rbp - 8]
call fcn.00754490
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 8]
call fcn.007549c0
jmp 0x40f6db
mov rax, qword [0x010806d0]
mov rdi, qword [rax]
mov qword [rbp - 8], 0
lea rcx, [rbp - 8]
call fcn.007541b0
lea rdx, [rbp - 8]
mov rcx, rdi
call fcn.006d8480
mov rax, qword [rbp - 8]
test rax, rax
lea rcx, [0x007682d8]
cmovne rcx, rax
lea rdx, [rbp - 0xc]
call fcn.007665b0
mov ebx, eax
lea rcx, [rbp - 8]
call fcn.007541c0
test ebx, ebx
jne 0x40f4d4
mov qword [r14], 0
lea rdx, [0x0076831e]
mov rcx, r14
call fcn.00754490
jmp 0x40f6fd
mov rax, qword [0x010806d0]
mov rsi, qword [rax]
mov qword [rbp - 8], 0
lea rcx, [rbp - 8]
call fcn.007541b0
lea rdx, [rbp - 8]
mov rcx, rsi
call fcn.006d8480
mov rax, qword [rbp - 8]
test rax, rax
lea rcx, [0x007682d8]
cmovne rcx, rax
mov edx, dword [rbp - 0xc]
mov r8d, ebx
mov r9, rdi
call fcn.007665b8
mov ebx, eax
lea rcx, [rbp - 8]
call fcn.007541c0
test ebx, ebx
jne 0x40f511
mov qword [rbp - 8], 0
lea rdx, [0x0076831e]
lea rcx, [rbp - 8]
call fcn.00754490
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 8]
call fcn.007549c0
jmp 0x40f6db
mov qword [rbp - 8], 0
lea rdx, [0x0076831e]
lea rcx, [rbp - 8]
call fcn.00754490
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 8]
call fcn.007549c0
jmp 0x40f6db
mov qword [rbp - 8], 0
lea rdx, [0x0076831e]
lea rcx, [rbp - 8]
call fcn.00754490
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 8]
call fcn.007549c0
lea rcx, [rbp - 8]
call fcn.007541c0
test rdi, rdi
je 0x40f6f1
mov rcx, rdi
call fcn.006f8450
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.00754280
lea rcx, [rbp - 0x18]
call fcn.007541c0
lea rcx, [rbp - 0x38]
call fcn.004202c0
lea rcx, [rbp - 0x20]
call fcn.007541c0
lea rcx, [rbp - 0x28]
call fcn.007541c0
mov rax, r14
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret