joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r13
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
lea r13, [0x140000000]
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor dil, dil
mov dword [rbp + 0x50], 0x130
mov rcx, rax
lea rdx, [rbp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x1400010ad
mov cl, byte [rbp + 0x7c]
cmp cl, 0x46
jl 0x140001077
mov al, cl
mov dl, 0x46
xor r8d, r8d
cmp al, dl
jg 0x140001077
test al, al
je 0x14000109d
mov al, byte [rbp + r8 + 0x7d]
inc r8
mov dl, byte [r8 + r13 + 0x2040]
cmp al, dl
jge 0x14000105d
cmp cl, 0x73
jl 0x1400010a0
mov al, 0x73
xor edx, edx
cmp cl, al
jg 0x1400010a0
test cl, cl
je 0x14000109d
mov cl, byte [rbp + rdx + 0x7d]
inc rdx
mov al, byte [rdx + r13 + 0x2068]
cmp cl, al
jge 0x140001082
jmp 0x1400010a0
mov dil, 1
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000104c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
je 0x1400010cf
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001025
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x140001188
mov cl, byte [rsp + 0x4c]
cmp cl, 0x46
jl 0x14000117a
mov al, cl
mov r8b, 0x46
xor edx, edx
cmp al, r8b
jg 0x140001125
test al, al
je 0x14000114b
mov al, byte [rsp + rdx + 0x4d]
inc rdx
mov r8b, byte [rdx + r13 + 0x2078]
cmp al, r8b
jge 0x14000110b
cmp cl, 0x46
jl 0x14000117a
mov dl, 0x46
xor eax, eax
cmp cl, dl
jg 0x14000117a
test cl, cl
je 0x14000114b
mov cl, byte [rsp + rax + 0x4d]
inc rax
mov dl, byte [rax + r13 + 0x20a0]
cmp cl, dl
jge 0x140001130
jmp 0x14000117a
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000117a
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400010f8
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r13, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x4019a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rdi, r9
mov rbx, rdx
mov rsi, rcx
call fcn.00401610
lea r11, [rdi + 2]
sub rdi, rbx
mov edx, 4
nop
movzx eax, byte [rdi + rbx]
add rbx, 4
add r11, 4
xor byte [rbx - 4], al
movzx eax, byte [r11 - 5]
xor byte [rbx - 3], al
movzx eax, byte [r11 - 4]
xor byte [rbx - 2], al
movzx eax, byte [r11 - 3]
xor byte [rbx - 1], al
dec rdx
jne 0x4019d0
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
test rcx, rcx
je 0x401a1e
mov rax, qword [rsi]
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov qword [rcx + 8], rax
mov rsi, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x417fd0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x00480250]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x00480348]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x418051
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00480348]
jmp 0x41806d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x00480348], r11
mov qword [0x004802e8], rax
mov rax, qword [0x0047e2e8]
mov qword [0x004801c0], r11
mov qword [0x004802d0], rdi
mov dword [0x004801b0], 0xc0000409
mov dword [0x004801b4], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x0047e2e0]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00464bc8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x0047e2e8]
jne 0x462039
rol rcx, 0x10
test cx, 0xffff
jne 0x462035
ret
ror rcx, 0x10
jmp 0x417fd0

Function at 0x418830
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub rsp, 0x48
cmp r8d, 1
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov rdi, rdx
mov rbx, rcx
jge 0x418877
lea rax, str.Key_Length_should_be_at_least_1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.0044cfd0
lea rdx, [0x0047c300]
lea rcx, [rsp + 0x28]
call fcn.0044b300
int3
xor eax, eax
inc rcx
nop
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x100
jl 0x418880
mov byte [rbx + 0x201], 0
mov byte [rbx + 0x202], 0
lea r10, [rbx + 1]
mov r11d, 0x100
nop
nop
nop
movzx eax, byte [rbx + 0x201]
mov qword [rbx + 0x208], r10
inc r10
movzx ecx, byte [rax + rdi]
add cl, byte [r10 - 1]
add byte [rbx + 0x202], cl
movzx eax, byte [rbx + 0x202]
lea rax, [rax + rbx + 1]
mov qword [rbx + 0x210], rax
movzx eax, byte [r10 - 1]
mov byte [rbx + 0x218], al
mov rax, qword [rbx + 0x210]
movzx ecx, byte [rax]
mov byte [r10 - 1], cl
movzx eax, byte [rbx + 0x218]
mov rcx, qword [rbx + 0x210]
mov byte [rcx], al
movzx eax, byte [rbx + 0x201]
inc eax
cdq
idiv r8d
dec r11
mov byte [rbx + 0x201], dl
jne 0x4188b0
lea rcx, [rbx + 0x101]
lea rdx, [rbx + 1]
mov r8d, 0x100
call fcn.00448f40
mov rdi, qword [rsp + 0x68]
mov byte [rbx + 0x201], 0
mov byte [rbx + 0x202], 0
mov byte [rbx], 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x418ae0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x24], eax
mov rax, rcx
ret
Function at 0x41a8d0
Capabilities:
Delete service

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rdx
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 2]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rdi, rax
jne 0x41a908
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x41a95c
mov r8d, 0xf01ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x41a935
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x41a95c
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x41a94a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
je 0x41a9b8
sub ebx, 5
je 0x41a9a9
sub ebx, 0x41f
je 0x41a99a
cmp ebx, 0xc
je 0x41a98b
mov eax, 0x119
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov eax, 0x117
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov eax, 0x11a
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov eax, 0x115
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x41d2a0
Capabilities:
Get file size

Disassembly:
mov r11, rsp
sub rsp, 0x188
mov rax, qword [0x0047e2e8]
mov qword [rsp + 0x170], rax
mov rax, qword [0x00465248]
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbp, rcx
lea rcx, [rsp + 0x40]
mov qword [r11 + 0x20], rsi
mov qword [rcx], rax
mov rax, qword [str.z5p6i7ea8p9n0]
mov edx, 0x16
mov qword [rcx + 8], rax
mov eax, dword [0x00465258]
mov qword [r11 - 8], rdi
mov dword [rcx + 0x10], eax
movzx eax, word [0x0046525c]
mov word [rcx + 0x14], ax
lea rcx, [rsp + 0x40]
call fcn.0040edd0
lea rdx, [rsp + 0x60]
mov r8d, 0x104
mov esi, dword [rax]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x60]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, dword [rbp + 0xac]
mov rbx, qword [rsp + 0x198]
sub edi, esi
mov rsi, qword [rsp + 0x1a8]
sub edi, 0x10
mov dword [rbp + 0xa8], edi
mov rdi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x170]
call fcn.00462020
add rsp, 0x188
ret
Function at 0x4283e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov r11, rsp
sub rsp, 0x208
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov qword [r11 - 0x10], r13
mov rax, qword [0x0047e2e8]
mov qword [rsp + 0x1e0], rax
lea r12d, [rdx + rcx]
mov r8d, 0x104
lea rdx, [r11 - 0x138]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r13 + 3]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
sub ebx, r12d
sub ebx, 0x10
lea rcx, [rsp + 0x50]
call fcn.00460400
nop
mov r8d, ebx
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.00460460
movsxd rbx, ebx
lea rdx, [rbx + rdi + 0x10]
mov r8d, r12d
lea rcx, [rsp + 0x50]
call fcn.00460460
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.00460530
lea r11, [rsp + 0xc0]
mov rax, qword [rbx + rdi]
mov qword [r11], rax
mov rax, qword [rbx + rdi + 8]
mov qword [r11 + 8], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xc0]
lea rax, [rsp + 0xb0]
mov rcx, qword [r11]
cmp rcx, qword [rax]
jne 0x42854c
mov rcx, qword [r11 + 8]
cmp rcx, qword [rax + 8]
je 0x428554
sbb eax, eax
sbb eax, 0xffffffff
mov r13d, eax
test r13d, r13d
jne 0x42855f
lea eax, [r13 + 1]
jmp 0x428561
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
call fcn.00462020
mov rbx, qword [rsp + 0x210]
mov rbp, qword [rsp + 0x218]
mov rsi, qword [rsp + 0x220]
mov rdi, qword [rsp + 0x228]
mov r12, qword [rsp + 0x200]
mov r13, qword [rsp + 0x1f8]
add rsp, 0x208
ret
Function at 0x42b1b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rax, qword [rcx + 0x1c8]
mov qword [r11 - 8], r12
mov r12, rcx
test byte [rax + 0x10], 1
je 0x42b2dd
mov qword [r11 - 0x10], r13
xor r13d, r13d
cmp dword [rcx + 0xa4], r13d
jbe 0x42b2d8
mov qword [r11 - 0x18], r14
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
nop
nop
nop
mov rax, qword [r12 + 0xb0]
mov edx, dword [r12 + 0xc0]
lea rcx, [r12 + 0xb0]
call qword [rax + 8]
mov esi, dword [r12 + 0x2f8]
mov edi, dword [r12 + 0x2f0]
mov ebp, r13d
and esi, 0xfffd
add rbp, qword [r12 + 0xb8]
or esi, 2
movzx ebx, byte [rbp]
call fcn.00432b20
xor bl, dil
shr edi, 8
movzx ecx, bl
mov ebx, dword [r12 + 0x2f8]
mov eax, dword [rax + rcx*4]
xor eax, edi
movzx edi, al
mov dword [r12 + 0x2f0], eax
add edi, dword [r12 + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [r12 + 0x2f4], edi
shr edi, 0x18
call fcn.00432b20
xor dil, bl
shr ebx, 8
inc r13d
movzx ecx, dil
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [r12 + 0x2f8], eax
mov eax, esi
xor eax, 1
imul eax, esi
sar eax, 8
xor byte [rbp], al
cmp r13d, dword [r12 + 0xa4]
jb 0x42b200
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x42b360
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x1c8]
mov qword [rsp + 0x50], rsi
mov rsi, rcx
test byte [rax + 0x10], 1
je 0x42b462
test edx, edx
je 0x42b462
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x40], rbx
xor ebp, ebp
mov r13d, edx
mov qword [rsp + 0x58], rdi
mov rax, qword [rsi + 0xb0]
mov edx, dword [rsi + 0xc0]
lea rcx, [rsi + 0xb0]
call qword [rax + 8]
mov ecx, dword [rsi + 0x2f8]
mov r11, qword [rsi + 0xb8]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
sar eax, 8
xor byte [r11 + rbp], al
movzx ebx, byte [r11 + rbp]
mov edi, dword [rsi + 0x2f0]
call fcn.00432b20
xor bl, dil
shr edi, 8
movzx ecx, bl
mov ebx, dword [rsi + 0x2f8]
mov eax, dword [rax + rcx*4]
xor eax, edi
movzx edi, al
mov dword [rsi + 0x2f0], eax
add edi, dword [rsi + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [rsi + 0x2f4], edi
shr edi, 0x18
call fcn.00432b20
xor dil, bl
shr ebx, 8
inc rbp
movzx ecx, dil
mov eax, dword [rax + rcx*4]
xor eax, ebx
dec r13
mov dword [rsi + 0x2f8], eax
jne 0x42b3a3
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x42b470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
sub rsp, 0xf8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov rax, qword [0x0047e2e8]
mov qword [rsp + 0xd0], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 0
cmp byte [rcx + 0x88], 0
jne 0x42b5c9
lea rax, [0x00465968]
mov qword [rsp + 0x30], rax
mov eax, dword [r8 + 8]
mov dword [rsp + 0x38], eax
movzx eax, word [r8 + 0xc]
mov word [rsp + 0x3c], ax
movzx eax, word [r8 + 0xe]
mov word [rsp + 0x3e], ax
movzx eax, word [r8 + 0x10]
mov word [rsp + 0x40], ax
movzx eax, word [r8 + 0x12]
mov word [rsp + 0x42], ax
movzx eax, word [r8 + 0x14]
mov word [rsp + 0x44], ax
movzx eax, word [r8 + 0x16]
mov word [rsp + 0x46], ax
mov eax, dword [r8 + 0x18]
mov dword [rsp + 0x48], eax
mov eax, dword [r8 + 0x1c]
mov dword [rsp + 0x4c], eax
mov eax, dword [r8 + 0x20]
mov dword [rsp + 0x50], eax
movzx eax, word [r8 + 0x24]
mov word [rsp + 0x54], ax
movzx eax, word [r8 + 0x26]
mov word [rsp + 0x56], ax
mov eax, dword [r8 + 0x28]
mov dword [rsp + 0x58], eax
movzx eax, word [r8 + 0x2c]
mov word [rsp + 0x5c], ax
movzx eax, word [r8 + 0x2e]
mov word [rsp + 0x5e], ax
mov eax, dword [r8 + 0x30]
mov dword [rsp + 0x60], eax
lea rdx, [r8 + 0x38]
lea rcx, [rsp + 0x68]
call fcn.00428f80
nop
lea rdx, [rdi + 0x58]
lea rcx, [rsp + 0x88]
call fcn.00428f80
nop
lea rdx, [rdi + 0x78]
lea rcx, [rsp + 0xa8]
call fcn.00428f80
nop
cmp byte [rsi + 0x88], 0
jne 0x42b5ac
movzx r8d, byte [rsi + 0x89]
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.0042f490
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.0042a980
nop
lea rcx, [rsp + 0x30]
call fcn.00429190
mov rax, rbx
jmp 0x42b5d4
mov rcx, r8
call fcn.0042a980
mov rax, rbx
mov rcx, qword [rsp + 0xd0]
call fcn.00462020
mov rbx, qword [rsp + 0x118]
mov rsi, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xf8
ret

Function at 0x42b8d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
cmp dword [rcx + 0x2e0], ebp
mov rsi, rcx
mov dword [rcx + 0x2f0], 0x12345678
mov dword [rcx + 0x2f4], 0x23456789
mov dword [rcx + 0x2f8], 0x34567890
jbe 0x42b9b9
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdi
nop
mov rax, qword [rsi + 0x2d0]
mov edx, dword [rsi + 0x2e0]
lea rcx, [rsi + 0x2d0]
call qword [rax + 8]
mov rax, qword [rsi + 0x2d8]
mov edi, dword [rsi + 0x2f0]
movzx ebx, byte [rbp + rax]
call fcn.00432b20
xor bl, dil
shr edi, 8
movzx ecx, bl
mov ebx, dword [rsi + 0x2f8]
mov eax, dword [rax + rcx*4]
xor eax, edi
movzx edi, al
mov dword [rsi + 0x2f0], eax
add edi, dword [rsi + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [rsi + 0x2f4], edi
shr edi, 0x18
call fcn.00432b20
xor dil, bl
shr ebx, 8
inc ebp
movzx ecx, dil
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [rsi + 0x2f8], eax
cmp ebp, dword [rsi + 0x2e0]
jb 0x42b920
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x42b9d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
mov rbp, rcx
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rsp + 0x28]
call fcn.00428e70
nop
mov edx, dword [rsp + 0x38]
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x28]
call qword [rax + 8]
lea rcx, [rbp + 0xd0]
xor r9d, r9d
lea r8d, [r9 + 0xc]
mov rdx, qword [rsp + 0x30]
call fcn.004329d0
xor r12d, r12d
nop
nop
nop
mov edx, dword [rsp + 0x38]
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x28]
call qword [rax + 8]
mov r11d, dword [rbp + 0x2f8]
and r11d, 0xfffd
or r11d, 2
mov esi, r11d
xor esi, 1
imul esi, r11d
sar esi, 8
mov rax, qword [rsp + 0x30]
xor sil, byte [r12 + rax]
mov ebx, dword [rbp + 0x2f0]
call fcn.00432b20
movzx edx, sil
xor dl, bl
movzx ecx, dl
shr ebx, 8
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [rbp + 0x2f0], eax
movzx edi, al
add edi, dword [rbp + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [rbp + 0x2f4], edi
shr edi, 0x18
mov ebx, dword [rbp + 0x2f8]
call fcn.00432b20
xor dil, bl
movzx ecx, dil
shr ebx, 8
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [rbp + 0x2f8], eax
inc r12
cmp r12, 0xc
jl 0x42ba40
mov rcx, qword [rbp + 0x1c8]
movzx eax, byte [rcx + 0x10]
shr al, 3
test al, 1
je 0x42bafd
cmp byte [rcx + 0x15], sil
sete bl
jmp 0x42bb04
cmp byte [rcx + 0x1b], sil
sete bl
lea rcx, [rsp + 0x28]
call fcn.00428c30
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x42f610
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x42f7e0
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x110
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.0042c060
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.0042f6d0
nop
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x138]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x42f95f
mov edx, dword [rsp + 0x40]
test edx, edx
jle 0x42f890
mov r9, qword [rsp + 0x38]
movsxd rax, edx
movzx r8d, byte [rax + r9 - 1]
mov al, 0x5c
lea rcx, [0x00465650]
cmp al, r8b
je 0x42f886
inc rcx
movzx eax, byte [rcx]
test al, al
je 0x42f890
jmp 0x42f875
dec edx
mov dword [rsp + 0x40], edx
test edx, edx
jg 0x42f863
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
movsxd rbx, dword [rsp + 0x40]
lea edx, [rbx + 1]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
cmp ebx, ebx
jge 0x42f8ce
mov rdx, qword [rsp + 0x38]
add rdx, rbx
lea rcx, [rdx + 1]
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.00448f40
mov rax, rbx
add rax, qword [rsp + 0x38]
mov byte [rax], 0x5c
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x138]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x42f95f
lea rax, [0x00463658]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], eax
test rcx, rcx
je 0x42f945
call fcn.00448f10
lea rax, [0x00463630]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
call fcn.004362a0
xor eax, eax
jmp 0x42f9b8
mov ebx, dword [rsp + 0x128]
imul ebx, dword [rsp + 0x130]
imul ebx, dword [rsp + 0x138]
lea rax, [0x00463658]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], eax
test rcx, rcx
je 0x42f9a0
call fcn.00448f10
lea rax, [0x00463630]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
call fcn.004362a0
mov eax, ebx
add rsp, 0x110
pop rbx
ret

Function at 0x42fa10
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov rbp, rcx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
mov esi, eax
jne 0x42fa40
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdi
call fcn.0044aa30
mov ecx, esi
mov bl, 1
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x42fa6a
xor bl, bl
jmp 0x42fa75
mov rdx, rdi
mov rcx, rbp
call fcn.0040fc80
mov rcx, rdi
call fcn.00448f00
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret