joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b490
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14009b408], rbx
je 0x14004b4f7
cmp rax, rbx
jne 0x14004b4ea
mov ebx, 1
mov esi, ebx
jmp 0x14004b4fc
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14004b4cf
mov ebx, 1
mov eax, dword [0x14009b410]
cmp eax, ebx
jne 0x14004b514
mov edi, AtlInternalQueryInterface
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14004b580
mov eax, dword [0x14009b410]
test eax, eax
jne 0x14004b575
mov dword [0x14009b410], ebx
lea r15, [0x140051d70]
lea rdi, [0x140051d58]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14004b567
test eax, eax
jne 0x14004b56b
cmp qword [rdi], r14
je 0x14004b55c
mov rax, qword [rdi]
mov rcx, qword [0x140051cd0]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14004b53e
test eax, eax
je 0x14004b57b
mov eax, 0xff
jmp 0x14004b6d6
mov dword [0x14009a724], ebx
mov edi, AtlInternalQueryInterface
mov eax, dword [0x14009b410]
cmp eax, ebx
jne 0x14004b5a7
lea rdx, [0x140051d50]
lea rcx, [0x140051cd8]
call sub.msvcrt.dll__initterm
mov dword [0x14009b410], 2
test esi, esi
jne 0x14004b5b5
mov rax, r14
xchg qword [0x14009b408], rax
cmp qword [0x14009b428], r14
je 0x14004b5e8
lea rcx, [0x14009b428]
call fcn.14004bcc0
test eax, eax
je 0x14004b5e8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14009b428]
mov r9, qword [0x140051cd0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14004b601
mov eax, 0xff
jmp 0x14004b6d6
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14004b687
test ax, ax
je 0x14004b61c
test edx, edx
jne 0x14004b687
sub ax, bx
cmp ax, di
ja 0x14004b632
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14004b61c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400064cc
mov dword [0x14009a720], eax
cmp dword [0x14009a740], r14d
jne 0x14004b670
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14009a724], r14d
jne 0x14004b685
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14009a720]
jmp 0x14004b6d6
cmp ax, 0x22
jne 0x14004b69b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14004b60a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14012e000
add rsp, 0x28
jmp 0x14004b490
Function at 0x14004bbbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004bc08
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14004bc00
cmp dword [rcx + 0x3c], edx
jl 0x14004bc00
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14004bc00
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14004bc08
mov rax, rdx
add rsp, 0x18
ret
Function at 0x4068b1
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
sub rsp, 0x60
mov dword [rsp + 0x34], ecx
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
sbb byte [rax - 0x77], cl
and al, 0x58

Function at 0x406a11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x3c], ecx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
cmp eax, dword [rcx + 0x18]
jae 0x406b11
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
call fcn.004069a1
cmp eax, dword [rsp + 0x40]
jne 0x406b02
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x24]
movzx ecx, word [rdx + rcx*2]
mov ecx, dword [r8 + rcx*4]
add rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x406b1a
jmp 0x406b04
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
jmp 0x406aa2
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
add rsp, 0x78
ret
Function at 0x408840
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x00447098], 0
je 0x4088de
cmp word [0x004473a8], 0xd7b2
jne 0x408873
cmp dword [0x004473b0], 0
jbe 0x408873
lea rcx, [0x004473a0]
call qword [0x004473c8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00440564]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00408914]
call fcn.00409730
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x408900
cmp byte [0x0043f03a], 0
jne 0x408900
xor rcx, rcx
lea rdx, [0x00440564]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40b390
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x0044be60]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x0044be88], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x0044be58], al
cmp byte [0x0044be58], 0
je 0x40b42f
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b44e]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be40], rax
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b46c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be48], rax
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b48a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be50], rax
add rsp, 0x28
ret
Function at 0x40b710
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.00408cb0
movzx rax, word [rbp + 0x4e]
cmp word [0x00440a60], ax
ja 0x40b7f8
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x00440e60]
mov word [rbp + 0x4e], ax
ja 0x40b7f8
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x40b7f7
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x00440a60]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x40b7b1
mov ecx, eax
sub ecx, 1
jmp 0x40b7f2
lea rdx, [0x00440a60]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x40b7d3
mov r8d, eax
add r8d, 1
jmp 0x40b7f2
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x00440a68]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.0040b5a0
jmp 0x40b7f7
cmp ecx, r8d
jae 0x40b780
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x40b8da
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40b8da
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00409cc0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.00409cc0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00409cc0
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x0040b934]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x0040b944]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.0040a0b0
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.00408d90
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret
Function at 0x40bb50
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x0044be60]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x0044be88], ax
jne 0x40bbbb
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0044be8a]
mov r8d, 0x55
call fcn.00409cc0
lea rcx, [0x0044be60]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40bcc6
lea rcx, [0x0044be60]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.00408cb0
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40bc80
cmp byte [0x0044be58], 0
je 0x40bc14
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.0040b9e0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.00409270
jmp 0x40bc80
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.0040b710
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.00409270
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x40bc80
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x40bc5f
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0040bd14]
call fcn.00409ea0
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.0040b710
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.00409ea0
lea rcx, [0x0044be60]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x0044be88], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.00409c10
lea rcx, [0x0044be8a]
mov edx, 0xaa
mov r8, rax
call fcn.0040b4c0
lea rcx, [0x0044be60]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.00408d90
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x40c6f0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.00408e40
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00409cc0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.00409f90
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040c510
test al, al
jne 0x40c7be
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00409cc0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.00409f90
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040c510
test al, al
jne 0x40c7be
mov rcx, qword [rbp + 0x20]
call fcn.00408cb0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00408d90
lea rcx, [rbp + 0x70]
call fcn.00408cb0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x40c830
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.00408e40
mov rcx, qword [rbp + 0x90]
call fcn.00408e40
nop
mov rcx, qword [rbp + 0x28]
call fcn.00408cb0
cmp qword [rbp + 0x90], 0
je 0x40c9f6
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.004092f0
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x40c8e1
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x40c91b
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x40c914
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.0040a1a0
jmp 0x40c91b
sub eax, 1
test eax, eax
jne 0x40c8e6
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.0040c400
cmp qword [rbp + 0x68], 0
je 0x40c959
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.0040c5b0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.00409270
jmp 0x40c9f5
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040bb50
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.0040c5b0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.00409270
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40c9ce
cmp byte [0x0044be58], 0
jne 0x40c9ce
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.0040bb50
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.0040c5b0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.00409270
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40c9f5
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.0040c6f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.00409270
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.00408d90
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.00408d90
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x40d300
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x40d320
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x40d344
cmp eax, 1
jae 0x40d349
cmp ecx, 5
jbe 0x40d355
mov dword [0x004479a0], 0x7f
jmp 0x40d35f
mov dword [0x004479a0], 0x409
add rsp, 0x28
ret
Function at 0x40d610
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.0040d600
mov ebx, eax
test ebx, ebx
je 0x40d65b
cmp dword [0x00441264], 0xffffffff
jne 0x40d634
mov ecx, 0xe2
call fcn.00408af0
mov ecx, ebx
call fcn.0040d5e0
test rax, rax
jne 0x40d64d
mov ecx, 0xe2
call fcn.00408af0
jmp 0x40d65b
mov ecx, dword [0x00441264]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x40d6b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
lea rax, [0x1a0]
test rax, rax
je 0x40d6f0
cmp dword [0x00441264], 0xffffffff
je 0x40d6f0
mov ecx, dword [0x00441264]
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x40d6f0
mov rcx, rax
call sub.kernel32.dll_LocalFree
mov ecx, dword [0x00441264]
xor rdx, rdx
call sub.kernel32.dll_TlsSetValue
add rsp, 0x28
ret

Function at 0x40d730
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0044bf34], 0
je 0x40d76b
mov ecx, dword [0x00441264]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40d77f
call fcn.0040d610
mov ecx, dword [0x00441264]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x40d77f
mov rax, qword [0x0044bf70]
jmp 0x40d77f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x00441264]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x41ea60
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41ea87
movzx rax, word [rbp + 0x2c]
jmp 0x41ea89
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x420360
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00420100
mov ebx, eax
mov rax, qword [0x00446240]
cmp byte [rax], 0
je 0x420498
mov rcx, qword [0x00446068]
call fcn.00405720
call fcn.00405250
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00420320]
mov r8d, 1
movsxd r9, esi
call fcn.0040ae30
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x00420538]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x4204de
mov rcx, qword [0x0044bf38]
call fcn.0040b160
mov rcx, rax
mov rax, qword [0x00446018]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00420320]
call fcn.0040b010
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x422cb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.00409410
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.0040d2e0
mov esi, eax
cmp esi, 0x104
jbe 0x422d0d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00404f40
mov rdi, rax
jmp 0x422d11
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.0040d2e0
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x422d64
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x422d48
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x422d76
mov rcx, rdi
call fcn.00404f70
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x427870
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rbx
mov r9d, edx
test r9d, r9d
jle 0x42797b
mov eax, ecx
test eax, 1
je 0x4278b8
lea rax, [0x00443338]
mov edx, r8d
shr edx, 0x10
movzx r10, byte [rcx]
xor edx, r10d
and edx, 0xff
mov edx, edx
shl r8d, 8
mov eax, dword [rax + rdx*4]
xor eax, r8d
mov r8d, eax
add rcx, 1
sub r9d, 1
xor r10, r10
mov r11d, 2
mov eax, r9d
cdq
idiv r11d
mov r11, rax
sub r11d, 1
mov eax, r10d
cmp eax, r11d
jg 0x427938
add r11d, 1
movsxd rdx, eax
movzx edx, word [rcx + rdx*2]
lea r10, [0x00443338]
mov ebx, r8d
shr ebx, 0x10
xor ebx, edx
and ebx, 0xff
mov ebx, ebx
shl r8d, 8
mov r10d, dword [r10 + rbx*4]
xor r10d, r8d
mov r8d, r10d
lea r10, [0x00443338]
mov ebx, r8d
shr ebx, 0x10
shr edx, 8
xor ebx, edx
and ebx, 0xff
mov ebx, ebx
shl r8d, 8
mov edx, dword [r10 + rbx*4]
xor edx, r8d
mov r8d, edx
add eax, 1
cmp eax, r11d
jne 0x4278dc
nop
mov eax, r9d
test eax, 1
je 0x427974
lea rax, [0x00443338]
mov edx, r8d
shr edx, 0x10
and r9d, 0xfffffffe
movsxd r9, r9d
movzx rcx, byte [rcx + r9]
xor edx, ecx
and edx, 0xff
mov edx, edx
shl r8d, 8
mov eax, dword [rax + rdx*4]
xor eax, r8d
mov r8d, eax
and r8d, 0xffffff
mov eax, r8d
pop rbx
ret

Function at 0x427ca0
Capabilities:
Hash data with md5

Disassembly:
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov qword [rcx + 0x18], 0
ret
Function at 0x42ba40
Capabilities:
Encode data using xor

Disassembly:
push rbx
test r8d, r8d
jle 0x42baaa
xor rax, rax
movsxd r9, eax
mov r9d, dword [rdx + r9*4]
movsxd r10, eax
mov r10d, dword [rcx + r10*4]
add r10d, r10d
mov r11d, r9d
and r11d, 1
add r10d, r11d
mov r11d, r10d
sub r11d, r9d
movsxd rbx, eax
shr r11d, 1
xor r11d, 0x40000000
sub r11d, 0x40000000
mov dword [rcx + rbx*4], r11d
mov r11d, r10d
add r11d, r9d
movsxd r9, eax
shr r11d, 1
xor r11d, 0x40000000
sub r11d, 0x40000000
mov dword [rdx + r9*4], r11d
add eax, 1
cmp eax, r8d
jl 0x42ba49
pop rbx
ret

Function at 0x42bb10
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rax, rcx
cmp dword [rsp + 0x30], 0
jne 0x42bb20
xor r10, r10
jmp 0x42bb34
mov r10d, 1
mov ecx, 0x1f
sub ecx, dword [rsp + 0x30]
shl r10d, cl
xor rcx, rcx
mov r11d, r8d
sub r11d, 1
mov r8d, ecx
cmp r8d, r11d
jg 0x42bb94
add r11d, 1
mov ebx, dword [rax]
movzx rcx, byte [rsp + 0x30]
shr ebx, cl
xor ebx, r10d
sub ebx, r10d
mov ecx, ebx
imul ecx, r9d
add ecx, 0x80
shr ecx, 8
xor ecx, 0x800000
sub ecx, 0x800000
mov ebx, ecx
movzx rcx, byte [rsp + 0x30]
shl ebx, cl
sub ebx, dword [rdx]
mov dword [rdx], ebx
add rdx, 4
add rax, 4
add r8d, 1
cmp r8d, r11d
jne 0x42bb4a
nop
pop rbx
ret
Function at 0x140018afc
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov esi, r8d
mov rbx, rdx
xor edi, edi
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
cmp rcx, r12
je 0x140018b5a
test byte [rcx + 0x1c], 4
je 0x140018b5a
cmp byte [rcx + 0x19], 5
jb 0x140018b5a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xea
call fcn.14000ffa8
lea rcx, [0x140009e88]
lea rax, [0x140009ea0]
cmp esi, edi
cmovne rax, rcx
lea r8, [0x140009d80]
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1400118ac
cmp eax, edi
mov ebx, eax
jge 0x140018bda
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140018bc2
test byte [rcx + 0x1c], 4
je 0x140018bc2
cmp byte [rcx + 0x19], 2
jb 0x140018bc2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xeb
mov r9d, eax
call fcn.1400100e0
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
mov eax, ebx
jmp 0x140018c29
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, edi
jne 0x140018c27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140018c27
test byte [rcx + 0x1c], 4
je 0x140018c27
cmp byte [rcx + 0x19], 2
jb 0x140018c27
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x30]
lea r8, [0x140009868]
mov edx, 0xec
mov dword [rsp + 0x20], eax
call fcn.140011a18
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008c5b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop r12
pop rdi
pop rsi
ret