joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400025a0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10050
call fcn.1400134c0
sub rsp, rax
mov rax, qword [0x14004d020]
xor rax, rsp
mov qword [rsp + 0x10040], rax
mov rdi, rdx
mov dword [rsp + 0x30], 1
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
lea rcx, str.RookIE_1.0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
je 0x1400026b8
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x4000000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x1400026af
lea rdx, [0x140045b00]
mov rcx, rdi
call fcn.14001971c
mov rdi, rax
test rax, rax
je 0x1400026a6
lea r9, [rsp + 0x30]
mov r8d, 0x10000
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000269e
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000269e
mov r8d, eax
lea rcx, [rsp + 0x40]
mov r9, rdi
mov edx, 1
call fcn.14001c00c
lea r9, [rsp + 0x30]
mov r8d, 0x10000
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140002664
mov rcx, rdi
call fcn.14001999c
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.140012e50
lea r11, [rsp + 0x10050]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140005610
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14004d020]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400056b2
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call fcn.140015710
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400056a9
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140005693
inc rax
test ecx, ecx
jne 0x140005680
mov rcx, rbx
test edx, edx
je 0x1400056d5
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005672
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140012e50
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400056b4
Function at 0x140006790
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004d020]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov dword [rsp + 0x68], 0
lea rax, [rsp + 0x60]
mov word [rsp + 0x6c], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140006820
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x70], 1
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140012e50
add rsp, 0x80
pop rbx
ret

Function at 0x140006900
Capabilities:
Check for time delay via queryperformancecounter
Create directory
Create thread
Get common file path

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x290
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x14004d020]
xor rax, rsp
mov qword [rsp + 0x260], rax
call fcn.140006840
xor eax, eax
lea r8, [0x1400068d0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm6, xmm6
lea rcx, [rsp + 0x30]
cvtsi2sd xmm6, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x30]
movsd xmm7, qword [0x1400462f8]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm0
sub rax, rbx
cvtsi2sd xmm0, rax
divsd xmm0, xmm6
comisd xmm7, xmm0
ja 0x140006980
mov ebx, 0x2710
nop word [rax + rax]
call fcn.1400026e0
mov rcx, rax
call fcn.140001200
sub rbx, 1
jne 0x1400069b0
xor r9d, r9d
lea r8d, [rbx + 0x1c]
lea rdx, [rsp + 0x150]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call fcn.1400026e0
mov r9, rax
lea r8, [rsp + 0x150]
lea rdx, str._s_s
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.140006790
test al, al
je 0x140006a17
call fcn.1400056f0
call fcn.140004350
lea rcx, [rsp + 0x40]
call fcn.140002b10
xor ecx, ecx
call fcn.140019654
int3

Function at 0x1400084f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140008524
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140008510
ret
Function at 0x14000a7d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14000a831
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14000a7f0
mov ecx, dword [r10]
jmp 0x14000a91a
cmp ecx, 0x4e0
jb 0x14000a91a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000a850
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000a8a0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140019654
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400194e7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400194e7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400194e7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400194e7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400194e7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400194e7
cmp dword [rcx + 0xf8], 0
je 0x1400194e7
mov ecx, ebx
call fcn.140019588
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140019378
cmp dword [rbp + 0x20], 0
je 0x140019534
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001953c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140019480

Function at 0x14002630c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002632c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001dfdc
or eax, 0xffffffff
jmp 0x14002632e
xor eax, eax
add rsp, 0x28
ret
Function at 0x6d87b940
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d89c5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d87bac8
mov rax, qword [0x6d89c5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d87b98c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d87ba15
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d87b970
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d87bafd
mov rax, qword [0x6d89c5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d89c5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d87bae0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d87ba0e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d87ba70
add dword [0x6d89c5e4], 1
cmp edi, 8
jae 0x6d87ba43
test dil, 4
jne 0x6d87bab4
test edi, edi
je 0x6d87ba38
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d87bacf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d87ba38
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d87ba5c
jmp 0x6d87ba38
add rsi, qword [0x6d89c5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d87ba0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d87ba38
xor esi, esi
jmp 0x6d87b997
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d87ba38
mov rax, qword [0x6d89c5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d87c250
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d89c8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d89c8a0]
test rbx, rbx
je 0x6d87c2a4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d87c29b
test rsi, rsi
je 0x6d87c29b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d87c280
lea rcx, [0x6d89c8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d87c4e0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d87c4f0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d87c500
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d87c541
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d87c538
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d87c543
add rax, 0x28
cmp rax, r9
jne 0x6d87c524
xor eax, eax
ret

Function at 0x6d87c5e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8991f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d87c64d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d87c64d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d87c64d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d87c644
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d87c64f
add rax, 0x28
cmp rax, r9
jne 0x6d87c630
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d87c750
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8991f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d87c770
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d87c768
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d87c7cd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d87c7c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d87c7d4
add rax, 0x28
cmp rax, r9
jne 0x6d87c7b0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d87c7f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8991f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d87c85e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d87c85e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d87c85e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d87c85e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d87c855
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d87c865
add rcx, 0x28
cmp rcx, rax
jne 0x6d87c840
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d87c878
jmp 0x6d87c85e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d87c886
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d87c85e
test r9d, r9d
jg 0x6d87c870
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d87cbf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x409300
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x440
mov rbp, rsp
mov ebx, ecx
mov rsi, rdx
test bl, bl
je 0x409352
movzx ax, bl
add ax, 0x40
mov word [rbp + 0x438], ax
mov word [rbp + 0x43a], 0x3a
mov word [rbp + 0x43c], 0
mov ecx, 0x105
lea rdx, [rbp + 0x24]
call sub.kernel32.dll_GetCurrentDirectoryW
lea rcx, [rbp + 0x438]
call sub.kernel32.dll_SetCurrentDirectoryW
mov ecx, 0x105
lea rdx, [rbp + 0x22e]
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x409371
lea rcx, [rbp + 0x24]
call sub.kernel32.dll_SetCurrentDirectoryW
mov rcx, rsi
lea rdx, [rbp + 0x22e]
mov r8d, 0x105
call fcn.00413e90
lea rsp, [rbp + 0x440]
pop rbx
pop rsi
pop rbp
ret

Function at 0x4096a0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x38], 0
nop
xor rax, rax
mov dword [rbp + 0x2c], eax
call sub.kernel32.dll_GetCommandLineW
mov rcx, rax
lea rdx, [rbp + 0x38]
call fcn.004095b0
mov rcx, rax
lea rdx, [rbp + 0x38]
call fcn.004095b0
cmp qword [rbp + 0x38], 0
je 0x4096e6
mov ecx, dword [rbp + 0x2c]
add ecx, 1
mov dword [rbp + 0x2c], ecx
jmp 0x4096c8
nop
nop
lea rcx, [rbp + 0x38]
call fcn.00411eb0
mov eax, dword [rbp + 0x2c]
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x409850
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
jne 0x409862
call fcn.004092e0
add rsp, 0x28
ret
Function at 0x40f960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.0040ff00
mov esi, eax
test sil, sil
jne 0x40fb22
test ebx, ebx
je 0x40fb22
xor rdi, rdi
test r13d, r13d
jle 0x40fa47
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x40fa26
cmp ebx, 0xffffffff
je 0x40f9d3
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x40f9d3
xor rsi, rsi
jmp 0x40fb22
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x40fa26
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x40fa14
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x40fa14
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x40fb22
lea rcx, [rbp + 0x3c]
call fcn.0040f510
sub r13d, 1
test r13d, r13d
jg 0x40f9ba
nop
cmp ebx, 0xffffffff
je 0x40fa47
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jb 0x40fa42
xor rsi, rsi
jmp 0x40fb22
sub eax, r14d
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x40f97d
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40fa47
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.0040fbd0
xor rcx, rcx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x00f279a0]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x40fab1
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jae 0x40faae
sub eax, r14d
sub ebx, eax
jmp 0x40fab1
xor rbx, rbx
test sil, sil
je 0x40fae3
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x40fae0
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40fab6
mov dil, 1
nop
jmp 0x40fb00
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40fae3
mov dil, 1
test dil, dil
je 0x40fa6a
nop
test sil, sil
je 0x40fb22
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x4118c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x00f270a8], 0
je 0x41195e
cmp word [0x00f273b8], 0xd7b2
jne 0x4118f3
cmp dword [0x00f273c0], 0
jbe 0x4118f3
lea rcx, [0x00f273b0]
call qword [0x00f273d8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00def7cc]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00411994]
call fcn.004131c0
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x411980
cmp byte [0x00ded052], 0
jne 0x411980
xor rcx, rcx
lea rdx, [0x00def7cc]
lea r8, [0x00def6dc]
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x411ca0
Capabilities:
Create thread

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov ebx, edx
mov rsi, r8
mov rdi, r9
cmp qword [0x00ded058], 0
je 0x411cd1
mov rcx, rsi
mov rdx, rdi
call qword [0x00ded058]
mov r13, rax
jmp 0x411ce7
mov ecx, 0x10
call fcn.00408ef0
mov r13, rax
mov qword [r13], rsi
mov qword [r13 + 8], rdi
mov byte [0x00f270a9], 1
mov rcx, qword [rsp + 0x38]
mov edx, ebx
lea r8, [0x00411c30]
mov r9, r13
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov rbx, rax
test rbx, rbx
jne 0x411d2c
mov rcx, r13
call fcn.00408f20
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x4164f0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x00f2bc90]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x00f2bcb8], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x00f2bc88], al
cmp byte [0x00f2bc88], 0
je 0x41658f
lea rcx, [0x00416594]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x004165ae]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00f2bc70], rax
lea rcx, [0x00416594]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x004165cc]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00f2bc78], rax
lea rcx, [0x00416594]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x004165ea]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00f2bc80], rax
add rsp, 0x28
ret