joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409df8
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x18
mov rdi, rdx
call fcn.00417210
mov esi, 0x19000
mov r14d, 1
mov edx, esi
mov ecx, r14d
mov r13, rax
call fcn.00407dec
lea ecx, [r14 + 1]
mov edx, esi
mov r12, rax
call fcn.00407dec
lea edx, [r14 + 0x17]
mov rcx, r14
mov rbp, rax
call fcn.0041c970
lea edx, [r14 + 0x1f]
mov rcx, r14
mov qword [rax], rbx
mov qword [rax + 8], r12
mov rsi, rax
call fcn.0041c970
lea r8, [0x00409ac0]
mov r9, rsi
mov qword [rax + 0x10], rdi
xor edi, edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov rbx, rax
mov qword [rax], r12
mov qword [rax + 8], rbp
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00409afc]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [r13], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00409b34]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [r13 + 0x10], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rax
mov qword [r13 + 8], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
call fcn.00407e74
mov rcx, rbp
call fcn.00407e74
cmp dword [rsi + 0x10], edi
jne 0x409efd
cmp dword [rbx + 0x18], edi
je 0x409f00
mov r14d, edi
mov eax, r14d
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x409f14
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rdi, rcx
mov ecx, 0x18
mov rsi, rdx
call fcn.00417210
mov edx, 0x19000
mov ecx, 5
mov r12, rax
call fcn.00407dec
mov edx, 0x20
lea ecx, [rdx - 0x1f]
mov rbx, rax
call fcn.0041c970
lea r8, [0x00409afc]
xor edx, edx
mov qword [rax + 8], rbx
xor ebx, ebx
mov r9, rax
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov rbp, rax
mov qword [rax], rdi
mov qword [rax + 0x10], rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00409b34]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [r12 + 0x10], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r12 + 8], rax
mov rax, r12
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b744
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x68
mov rbx, rcx
lea rcx, str._Utils__Converted_SID_for_USERS_n
mov rbp, r8
mov r13, rdx
mov qword [rsp + 0x48], 0
call fcn.0040bfd4
xor r9d, r9d
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
je 0x40b7d1
lea rcx, str.GetNamedSecurityInfo_Error__u_n
mov edx, eax
call fcn.0040bfd4
mov rcx, qword [rbp]
test rcx, rcx
je 0x40b7ca
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x40b93a
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclA]
test eax, eax
je 0x40b811
lea rcx, str.GetExplicitEntriesFromAcl_failed__u_n
mov edx, eax
call fcn.0040bfd4
mov rcx, qword [rbp]
test rcx, rcx
je 0x40b80a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
jmp 0x40b7bf
mov edx, dword [rsp + 0xb8]
lea rcx, str._Utils__Got__u_ACEs_for_folder_n
call fcn.0040bfd4
mov edx, dword [rsp + 0xb8]
lea edi, [rdx - 1]
test edi, edi
movsxd rax, edi
js 0x40b8ff
lea rsi, [rax + rax*2]
shl rsi, 4
mov rax, qword [rsp + 0x40]
mov edx, edi
cmp dword [rsi + rax + 0x1c], 0
jne 0x40b8df
lea rcx, str._Utils__Trustee__u_is_SID_n
call fcn.0040bfd4
mov r11, qword [rsp + 0x40]
mov rdx, qword [rbp]
mov rcx, qword [rsi + r11 + 0x28]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40b8eb
mov rax, qword [rsp + 0x40]
lea rcx, str._Utils__Trustee__u_is_Users._Permissions_is__u._Trimming..._n
mov edx, edi
mov r8d, dword [rsi + rax]
call fcn.0040bfd4
mov edx, dword [rsp + 0xb8]
mov r12d, edi
lea eax, [rdx - 1]
cmp edi, eax
jae 0x40b8d3
mov rcx, rsi
mov rax, qword [rsp + 0x40]
lea rbx, [rcx + 0x30]
mov r8d, 0x30
lea rdx, [rbx + rax]
add rcx, rax
call fcn.00417d70
mov edx, dword [rsp + 0xb8]
add r12d, 1
lea eax, [rdx - 1]
mov rcx, rbx
cmp r12d, eax
jb 0x40b8a2
add edx, 0xffffffff
mov dword [rsp + 0xb8], edx
jmp 0x40b8f2
lea rcx, str._Utils__Unknown_trustee_at__u_n
call fcn.0040bfd4
mov edx, dword [rsp + 0xb8]
sub rsi, 0x30
sub edi, 1
jns 0x40b841
lea rcx, str._Utils__Trimmed_ACE_size_is__u_n
call fcn.0040bfd4
mov rcx, qword [rbp]
test rcx, rcx
je 0x40b91a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x40b92a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0xb8]
mov dword [r13], eax
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b948
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
test rcx, rcx
mov rdi, r8
mov r12, rcx
mov qword [rsp + 0x40], 0
jne 0x40b976
lea eax, [rcx + 0x57]
jmp 0x40baff
lea rcx, str.PROGRAMDATA
call fcn.0041b740
lea rdx, [rsp + 0x48]
lea rcx, str.S_1_5_32_545
xor esi, esi
mov qword [rsp + 0x48], 0
mov rbx, rax
mov dword [rsp + 0xc0], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidA
test eax, eax
je 0x40b9cd
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.0040b744
mov esi, dword [rsp + 0xc0]
mov rbx, rax
jmp 0x40b9db
lea rcx, str._Utils__Unable_to_convert_SID_n
call fcn.0040bfd4
xor ebx, ebx
test rbx, rbx
jne 0x40b9e8
lea eax, [rbx + 0x65]
jmp 0x40baff
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x30]
call fcn.004191f0
lea r14d, [rsi + 1]
mov dword [rsp + 0x50], 0x1200a9
lea rcx, [r14 + r14*2]
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], 3
shl rcx, 4
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x78], rdi
call fcn.00417210
test esi, esi
mov rdi, rax
je 0x40ba5a
mov rbp, rax
sub rbx, rax
mov r13d, esi
lea rdx, [rbx + rbp]
mov rcx, rbp
mov r8d, 0x30
call fcn.00417d70
add rbp, 0x30
sub r13, 1
jne 0x40ba3e
mov eax, esi
lea rdx, [rsp + 0x50]
mov r8d, 0x30
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, rdi
call fcn.00417d70
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov ecx, r14d
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
mov ebx, eax
je 0x40ba9a
lea rcx, str.SetEntriesInAcl_Error__u_n
jmp 0x40bad9
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
mov r8d, 0x80000004
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
test eax, eax
mov ebx, eax
je 0x40bae0
lea rcx, str.SetNamedSecurityInfo_Error__u_n
mov edx, eax
call fcn.0040bfd4
test rdi, rdi
je 0x40baed
mov rcx, rdi
call fcn.004171d0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40bafd
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40bb14
Capabilities:
Encode data using xor
Get session user name
Hash data using fnv
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
lea rcx, str.ALLUSERSPROFILE
call fcn.0041b740
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r12, rax
mov dword [rsp + 0x130], 0x64
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x20]
call fcn.00417420
xor esi, esi
xor edi, edi
test eax, eax
mov ebx, 0x811c9dc5
movsxd rbp, eax
jle 0x40bb97
movzx ecx, byte [rsp + rdi + 0x20]
mov edx, esi
xor ebx, ecx
movsx r8d, cl
lea rcx, str.__d___d__d_n
imul ebx, ebx, 0x1000193
mov r9d, ebx
call fcn.0040bfd4
add rdi, 1
add esi, 1
cmp rdi, rbp
jl 0x40bb69
test ebx, ebx
jns 0x40bb9d
neg ebx
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x64]
call fcn.004191f0
lea rdx, [0x0044d954]
lea rcx, [rsp + 0x90]
mov r8d, ebx
call fcn.004183b0
lea rcx, [rsp + 0x20]
xor ebx, ebx
call fcn.00417420
test rax, rax
je 0x40bbf7
cmp byte [rsp + rbx + 0x20], 0x80
jb 0x40bbe4
mov byte [rsp + rbx + 0x20], 0x5f
lea rcx, [rsp + 0x20]
add rbx, 1
call fcn.00417420
cmp rbx, rax
jb 0x40bbd8
mov ecx, 0x1388
call fcn.00417210
mov rdx, r12
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.004174e0
lea rdx, str.JWUser_
mov rcx, rbx
call fcn.0040bf34
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.004174e0
lea rdx, [0x0044cb48]
mov rcx, rbx
call fcn.004174e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.004174e0
mov rcx, rbx
call fcn.0040beec
mov rax, rbx
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40bc68
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rcx, str.APPDATA
mov dword [rsp + 0x20], 0x94
call fcn.0041b740
test rax, rax
mov rdi, rax
je 0x40bd43
mov rcx, rax
call fcn.00417420
cmp rax, 2
jbe 0x40bd43
cmp byte [rdi], 0x5c
jne 0x40bd43
cmp byte [rdi + 1], 0x5c
jne 0x40bd43
lea rcx, str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040bfd4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40bd4f
cmp dword [rsp + 0x24], 5
jbe 0x40bcf9
lea rcx, str.LOCALAPPDATA
call fcn.0041b740
lea rcx, str._Extractor__Local_AppData_directory_resolved_to__s_n
mov rdx, rax
mov rdi, rax
call fcn.0040bfd4
jmp 0x40bd4f
lea rcx, str.USERPROFILE
call fcn.0041b740
mov ecx, 0x1388
mov rbx, rax
call fcn.00417210
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004174e0
lea rdx, str.Local_Settings
mov rcx, rdi
call fcn.0040bf34
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040bf34
jmp 0x40bd4f
lea rcx, str._Extractor__Local_AppData_directory_detected_n
call fcn.0040bfd4
lea rcx, str.Validating_directory..._n
call fcn.0040bfd4
lea rcx, str.Shared_dir_detected_is__s_n
mov rdx, rdi
call fcn.0040bfd4
mov rcx, rdi
call fcn.0040b710
test eax, eax
je 0x40bdee
lea rcx, str.Checking_if_string_is_cAscii__s_n
mov rdx, rdi
call fcn.0040bfd4
mov rcx, rdi
xor ebx, ebx
call fcn.00417420
test rax, rax
je 0x40bdab
cmp byte [rbx + rdi], 0x80
jae 0x40bdee
mov rcx, rdi
add rbx, 1
call fcn.00417420
cmp rbx, rax
jb 0x40bd94
lea rcx, str.Checking_if__s_contains_a___n
mov rdx, rdi
call fcn.0040bfd4
mov rcx, rdi
xor ebx, ebx
call fcn.00417420
test rax, rax
je 0x40bde0
cmp byte [rbx + rdi], 0x21
je 0x40bdee
mov rcx, rdi
add rbx, 1
call fcn.00417420
cmp rbx, rax
jb 0x40bdc9
lea rcx, str.Shared_directory_appears_valid._n
call fcn.0040bfd4
jmp 0x40be5f
lea rcx, str.The_directory__s_appears_invalid._n
mov rdx, rdi
call fcn.0040bfd4
lea rcx, str.Trying_the_short_path_instead._n
mov rdx, rdi
call fcn.0040bfd4
mov ecx, 0x1388
call fcn.00417210
mov r8d, 0x400
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40be4f
lea rcx, str.Got_short_path_of__s_n
mov rdx, rbx
call fcn.0040bfd4
mov rcx, rdi
call fcn.0040b710
test eax, eax
je 0x40be4f
mov rax, rbx
jmp 0x40be62
mov rcx, rbx
call fcn.004171d0
call fcn.0040bb14
mov rdi, rax
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40e320
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e347
lea rdx, str.._srchashes_sha2_sha256.c
lea rcx, str.md___NULL
mov r8d, 0xd0
call fcn.00410b10
xor eax, eax
mov dword [rbx + 0x280], 0x6a09e667
mov dword [rbx + 0x284], 0xbb67ae85
mov dword [rbx + 0x288], 0x3c6ef372
mov dword [rbx + 0x28c], 0xa54ff53a
mov dword [rbx + 0x290], 0x510e527f
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x9b05688c
mov dword [rbx + 0x298], 0x1f83d9ab
mov dword [rbx + 0x29c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret

Function at 0x40e8e0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e905
lea r8d, [rcx + 0x2a]
lea rdx, str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
lea rcx, str.md___NULL
call fcn.00410b10
xor eax, eax
mov dword [rbx + 0x280], 0xc1059ed8
mov dword [rbx + 0x284], 0x367cd507
mov dword [rbx + 0x288], 0x3070dd17
mov dword [rbx + 0x28c], 0xf70e5939
mov dword [rbx + 0x290], 0xffc00b31
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x68581511
mov dword [rbx + 0x298], 0x64f98fa7
mov dword [rbx + 0x29c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
Function at 0x411f90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0xc8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
test eax, eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
js 0x41210e
cdq
and edx, 7
add eax, edx
and eax, 7
cmp eax, edx
jne 0x41210e
cmp r8, 8
mov qword [rsp + 0x38], rbp
jb 0x412031
xor ebp, ebp
nop
nop
mov eax, dword [rbx + 0xc8]
test eax, eax
je 0x412031
cdq
add rsi, 1
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
cmp dword [rbx + 0xc8], 0x440
jne 0x412027
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00411bf0
mov dword [rbx + 0xc8], ebp
sub rdi, 8
cmp rdi, 8
jae 0x411fe0
cmp rdi, 0x440
jb 0x41207e
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rdi
mov rbp, rdx
shr rbp, 0xa
mov rax, rbp
imul rax, rax, 0xfffffffffffffbc0
add rdi, rax
nop
nop
mov r8d, 0x11
mov rdx, rsi
mov rcx, rbx
call fcn.00411bf0
add rsi, 0x88
sub rbp, 1
jne 0x412060
cmp rdi, 8
mov rbp, qword [rsp + 0x38]
jb 0x4120ca
mov r8, rdi
shr r8, 3
mov rax, r8
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
nop
nop
mov eax, dword [rbx + 0xc8]
add rsi, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
sub r8, 1
jne 0x4120a0
test rdi, rdi
je 0x4120f8
mov eax, dword [rbx + 0xc8]
mov ecx, 8
cdq
sub cl, dil
and edx, 7
add eax, edx
movzx edx, byte [rsi]
sar eax, 3
shr dl, cl
movsxd r8, eax
xor byte [r8 + rbx], dl
add dword [rbx + 0xc8], edi
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x28
ret

Function at 0x418380
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4183a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4183a9
mov ecx, eax
call fcn.00417720
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x418e50
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418e79
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418e79
mov ecx, eax
call fcn.00417720
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x41d810
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x41d856
call fcn.004176f0
mov dword [rax], 0
call fcn.004176c0
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.0041f950
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x41d81d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41d887
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417720
call fcn.004176c0
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x41d8bb
test al, 1
je 0x41d8bb
test bl, 2
je 0x41d8bb
call fcn.004176f0
mov dword [rax], 5
call fcn.004176c0
mov dword [rax], 0xd
call fcn.004176c0
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x41d8d0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41d8fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d8fb
mov ecx, eax
call fcn.00417720
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x41d910
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41d939
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d939
mov ecx, eax
call fcn.00417720
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x429dc7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004596e8]
jne 0x41e0aa
rol rcx, 0x10
test cx, 0xffff
jne 0x41e0a6
repz ret
ror rcx, 0x10
jmp 0x429d20
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0045d740]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0045d838]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x429da5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0045d740]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x429dc7
mov rax, qword [rsp + 0x88]
mov qword [0x0045d838], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0045d7d8], rax
mov rax, qword [0x0045d838]
mov qword [0x0045d6b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0045d7c0], rax
mov dword [0x0045d6a0], 0xc0000409
mov dword [0x0045d6a4], 1
mov rax, qword [0x004596e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004596f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0045d738], eax
mov ecx, 1
call fcn.0042a5a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0044ab40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0045d738], 0
jne 0x429e4e
mov ecx, 1
call fcn.0042a5a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x429e70
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0041fae0
xor ebx, ebx
cmp qword [0x0045dc10], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x429fa1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x429ed3
xor eax, eax
jmp 0x42a081
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x429ecc
mov rcx, rax
call fcn.0041fa70
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0045dc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa70
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0045dc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa70
lea rcx, [rsp + 0x30]
mov qword [0x0045dc20], rax
call fcn.00418650
test eax, eax
je 0x429f57
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f8b0
cmp dword [rsp + 0x30], 2
jne 0x429fa1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa70
test rax, rax
mov qword [0x0045dc30], rax
je 0x429fa1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa70
mov qword [0x0045dc28], rax
mov rcx, qword [0x0045dc28]
cmp rcx, rsi
je 0x42a033
cmp qword [0x0045dc30], rsi
je 0x42a033
call fcn.0041fb40
call rax
test rax, rax
mov rbp, rax
je 0x429ffe
mov rcx, qword [0x0045dc30]
call fcn.0041fb40
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x429ffe
test byte [rsp + 0x48], 1
jne 0x42a033
lea rcx, [rsp + 0x34]
call fcn.004186a0
test eax, eax
je 0x42a020
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f8b0
cmp dword [rsp + 0x34], 4
jb 0x42a02d
bts edi, 0x15
jmp 0x42a067
bts edi, 0x12
jmp 0x42a067
mov rcx, qword [0x0045dc18]
cmp rcx, rsi
je 0x42a067
call fcn.0041fb40
call rax
test rax, rax
mov rbx, rax
je 0x42a067
mov rcx, qword [0x0045dc20]
cmp rcx, rsi
je 0x42a067
call fcn.0041fb40
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0045dc10]
call fcn.0041fb40
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x440200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x00446160]
mov rbx, rdx
mov r11, rcx
not r8d
cmp rdx, 8
jbe 0x440306
mov qword [rsp + 0x10], rdi
test cl, 7
je 0x440254
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
test r11b, 7
jne 0x440230
mov rdi, rbx
and ebx, 7
and rdi, 0xfffffffffffffff8
add rdi, r11
cmp r11, rdi
jae 0x440301
nop word [rax + rax]
xor r8d, dword [r11]
mov r10d, dword [r11 + 4]
add r11, 8
mov r9d, r8d
mov eax, r8d
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
cmp r11, rdi
jb 0x440270
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x440332
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub rbx, 1
jne 0x440310
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x440340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
lea r14, [0x00448160]
mov rbx, rdx
mov r11, rcx
not r8
cmp rdx, 4
jbe 0x440427
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
test cl, 3
je 0x440395
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
test r11b, 3
jne 0x440370
xor esi, esi
mov rcx, rbx
and rcx, 0xfffffffffffffffc
and ebx, 3
lea rdi, [rcx + 3]
shr rdi, 2
lea rax, [rcx + r11]
cmp r11, rax
cmova rdi, rsi
test rdi, rdi
je 0x44041d
nop dword [rax]
mov r10d, dword [r11]
inc rsi
mov eax, r8d
add r11, 4
xor r10, rax
mov rax, r10
shr rax, 0x10
movzx edx, al
mov rax, r10
shr rax, 8
movzx ecx, al
mov rax, r10
shr rax, 0x18
mov r9, qword [r14 + rdx*8 + 0x800]
xor r9, qword [r14 + rcx*8 + 0x1000]
xor r9, qword [r14 + rax*8]
movzx eax, r10b
xor r9, qword [r14 + rax*8 + 0x1800]
mov rax, r8
shr rax, 0x20
mov r8, r9
xor r8, rax
cmp rsi, rdi
jb 0x4403c0
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
test rbx, rbx
je 0x440453
nop dword [rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
sub rbx, 1
jne 0x440430
mov rbx, qword [rsp + 0x20]
not r8
mov rax, r8
pop r14
ret