joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003040
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003113
cmp byte [rcx + 0x71], 0
je 0x140003113
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000310f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400030d4
sub eax, 1
je 0x1400030d8
cmp eax, 2
jne 0x14000310f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004340
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003106
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000310f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400030bc
xor al, al
jmp 0x1400030bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004340
add rsp, 0x60
pop rbx
ret

Function at 0x140004cc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004d0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004d0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004d0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004d0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140004d0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004d0c
xor al, al
add rsp, 0x28
ret
Function at 0x180001a00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, rcx
mov r12d, edx
lea rcx, str.kernel32.dll
xor edx, edx
call qword [sym.imp.ole32.dll_CoLoadLibrary]
lea rdx, str.VirtualAlloc
mov rcx, rax
call fcn.1800036e8
lea rcx, [0x180060178]
mov rsi, rax
call fcn.1800052bc
lea rcx, str.8192
mov edi, eax
call fcn.1800052bc
lea rcx, str.4096
mov ebx, eax
call fcn.1800052bc
mov edx, r12d
or ebx, eax
mov r9d, edi
xor ecx, ecx
mov r8d, ebx
call rsi
xor r8d, r8d
mov r11, rax
test rax, rax
je 0x180001acc
test r12d, r12d
je 0x180001ac9
mov r9, rax
sub rbp, rax
mov eax, 0xae4c415d
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
inc r8d
imul edx, edx, 0x2f
sub eax, edx
movsxd rcx, eax
lea rax, str.O_9s_tL_sH_I_fj9V__bT_d_3uB8_d5m1dMIO4VLzUmj
mov al, byte [rcx + rax]
xor al, byte [r9 + rbp]
mov byte [r9], al
inc r9
cmp r8d, r12d
jb 0x180001a8d
mov rax, r11
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1800036e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
movsxd r12, dword [0x180065a14]
movsxd rsi, dword [0x180065a08]
movsxd rbp, dword [0x180065a10]
movsxd r13, dword [0x180065a0c]
movsxd rbx, dword [0x180065a04]
movsxd r11, dword [0x180065a18]
mov rdx, r12
mov r10d, esi
mov r9, rsi
mov rax, rbp
lea r8, [r11 + r11]
mov r14, r12
imul rdx, r13
imul r10d, r13d
shl rax, 2
add rdx, rsi
sub r9, r8
sub r9, rbx
add r9, r9
imul rdx, rbx
imul rdx, r11
sub rdx, rbp
imul rdx, r11
dec rdx
imul rdx, rsi
sub rdx, rax
add rdx, r12
add rdx, rbx
shl rdx, 7
movsxd rax, dword [rdx + rcx + 0x3c]
mov eax, dword [rax + rcx + 0x88]
mov qword [rsp + 0x80], rax
mov eax, esi
imul eax, ebp
movsxd rcx, eax
mov eax, ebx
add rcx, rbp
imul eax, ebp
movsxd rdx, eax
lea rax, [rcx + r12*2]
mov rcx, qword [rsp + 0x70]
add rdx, rax
mov rax, qword [rsp + 0x80]
add rdx, rsi
imul rdx, rdx, 0x78
sub rax, rdx
add rax, rcx
mov qword [rsp + 0x80], rax
mov eax, r10d
imul eax, r11d
imul eax, ebp
imul eax, r12d
imul eax, r12d
movsxd rdx, eax
mov eax, esi
imul eax, r12d
cdqe
add rdx, rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x20]
sub rdx, r8
add rcx, rax
sub rdx, r13
add rdx, rsi
imul esi, r11d
imul esi, ebx
lea rdx, [rcx + rdx*8]
mov qword [rsp + 0x88], rdx
imul esi, r12d
imul esi, r12d
imul r12d, r12d
movsxd rax, esi
sub r9, rax
mov eax, r13d
imul eax, ebp
movsxd rcx, eax
movsxd rax, r12d
sub r9, rcx
sub r9, rax
imul r10d, r13d
movsxd rax, r10d
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x70]
sub r9, rax
mov ebp, dword [rsi + 0x1c]
mov r12d, dword [rsi + 0x24]
sub r9, r13
add r9, r14
xor ebx, ebx
add r12, rdi
add r9, r9
lea rax, [rdi + r9*8]
add rbp, rax
cmp dword [rsi + 0x18], ebx
jbe 0x180003896
mov r13, qword [rsp + 0x78]
mov ecx, dword [rdx + rbx*4]
mov rdx, r13
add rcx, rdi
call fcn.180005840
test eax, eax
je 0x1800038a9
mov rdx, qword [rsp + 0x88]
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x180003875
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ecx, word [r12 + rbx*2]
mov eax, dword [rbp + rcx*4]
add rax, rdi
jmp 0x180003898
Function at 0x180005d23
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800640a0]
jne 0x1800049fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1800049f6
repz ret
ror rcx, 0x10
jmp 0x180005c7c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180065b60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180065c58]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180005d01
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180065b60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180005d23
mov rax, qword [rsp + 0x88]
mov qword [0x180065c58], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180065bf8], rax
mov rax, qword [0x180065c58]
mov qword [0x180065ad0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180065be0], rax
mov dword [0x180065ac0], 0xc0000409
mov dword [0x180065ac4], 1
mov rax, qword [0x1800640a0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800640a8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180065b58], eax
mov ecx, 1
call fcn.180008d5c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180022758]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180065b58], 0
jne 0x180005daa
mov ecx, 1
call fcn.180008d5c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180012f34
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1800640a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180007e30
xor ebx, ebx
cmp qword [0x180066b50], rbx
mov rdi, rax
jne 0x180013047
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18001311e
lea rdx, [0x180024750]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001311e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180066b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180066b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180066b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180066b70], rax
test rax, rax
je 0x18001303e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180066b68], rax
jmp 0x18001304e
mov rax, qword [0x180066b68]
jmp 0x180013055
mov rax, qword [0x180066b68]
mov r11, qword [0x180066b70]
cmp rax, rdi
je 0x1800130bc
cmp r11, rdi
je 0x1800130bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180066b70]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1800130bc
test rax, rax
je 0x1800130bc
call rsi
test rax, rax
je 0x1800130b6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800130b6
test byte [rsp + 0x40], 1
jne 0x1800130bc
bts ebp, 0x15
jmp 0x1800130fc
mov rcx, qword [0x180066b58]
cmp rcx, rdi
je 0x1800130fc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800130fc
call rax
mov rbx, rax
test rax, rax
je 0x1800130fc
mov rcx, qword [0x180066b60]
cmp rcx, rdi
je 0x1800130fc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800130fc
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180066b50]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001311e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180013120
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800049e0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x402124
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4021b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402186
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x402186
mov rax, qword [rbx]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x0040f008]
je 0x40217c
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
dec ecx
test ecx, ecx
jg 0x40217c
mov rcx, qword [rbx]
sub rcx, 0xc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 0xffffffff
jmp 0x402214
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x0040f008]
je 0x4021b1
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x4021b1
mov rcx, qword [rbx]
sub rcx, 0xc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x402214
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
test al, 0x10
je 0x4021eb
cmp rcx, qword [0x0040f008]
je 0x4021e4
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x4021e4
mov rcx, qword [rbx]
sub rcx, 0xc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 2
jmp 0x402214
cmp rcx, qword [0x0040f008]
je 0x40220f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x40220f
mov rcx, qword [rbx]
sub rcx, 0xc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x4022f0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x1048
call fcn.0040b1c0
sub rsp, rax
mov rax, qword [0x0040f278]
mov qword [rsp + 0x1030], rax
mov rbx, rcx
mov esi, r8d
mov rdi, rdx
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x7fc
mov ebp, r9d
mov dword [rsp + 0x30], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x834]
xor edx, edx
mov r8d, 0x7fc
mov dword [rsp + 0x830], 0
call sub.msvcrt.dll_memset
lea rdx, [0x0040c638]
lea rcx, [rsp + 0x830]
mov r8d, esi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [0x0040f498]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4023a9
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__wtoi
mov esi, eax
mov eax, dword [rsp + 0x1090]
cmp eax, 0xffffffff
je 0x4023c4
cmp ebp, 0xffffffff
je 0x4023c4
cmp esi, eax
cmovg esi, eax
cmp esi, ebp
cmovl esi, ebp
mov eax, esi
mov rcx, qword [rsp + 0x1030]
call fcn.0040b190
add rsp, 0x1048
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x402428
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x48
mov rax, qword [0x0040f278]
mov qword [rsp + 0x30], rax
mov rax, qword [0x0040f498]
mov r9, rdx
mov r8, rdx
mov rdx, rcx
mov qword [rsp + 0x28], rax
lea rcx, str.Program
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, qword [rsp + 0x30]
call fcn.0040b190
add rsp, 0x48
ret
Function at 0x403abc
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x868
mov rax, qword [0x0040f278]
mov qword [rsp + 0x850], rax
mov edi, 0x493e0
mov rcx, rdi
call sub.msvcrt.dll_malloc
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rbx, rax
mov word [rax], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov word [rsp + 0x40], 0xfeff
call sub.msvcrt.dll_wcscat
lea rdx, str._____Please_dont_forget______Write_in_e_mail_subject:_Strings_for:
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, qword [0x005b13b0]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
lea rdx, str._LNG:xxxx
mov rcx, rbx
call sub.msvcrt.dll_wcscat
lea rdi, [0x0040c748]
mov rcx, rbx
mov rdx, rdi
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, qword [0x005b1478]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscat
lea rdx, [0x005b1bb0]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x54]
xor edx, edx
mov r8d, 0x7fc
mov dword [rsp + 0x50], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, str.translate_
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_wcscat
lea rdx, [0x0040f070]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_wcscat
lea rdx, str..txt
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x403c62
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x44]
mov rdx, rbx
lea r8d, [rax + rax]
mov rcx, rdi
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x850]
call fcn.0040b190
add rsp, 0x868
pop rdi
pop rbx
ret
Function at 0x404c2c
Capabilities:
Create process on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x98
mov rdi, rcx
mov ebx, 0x70
lea rcx, [rsp + 0x20]
mov r8, rbx
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, str.explorer.exe
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x50], 1
call fcn.004017ec
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rdx, qword [rdi]
add rdx, 0xfffffffffffffff4
mov ebx, eax
cmp rdx, qword [0x0040f008]
je 0x404cc6
mov ecx, 0xffffffff
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jg 0x404cc6
mov rcx, qword [rdi]
sub rcx, 0xc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, ebx
add rsp, 0x98
pop rdi
pop rbx
ret

Function at 0x4054c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp dword [0x005b3c90], 1
jne 0x4054d9
mov dword [0x005b3c90], 0
jmp 0x405515
mov r9, qword [0x005b3c88]
lea rax, [rsp + 0x40]
lea r8, [0x00405298]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [0x005b3c90], 1
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x405764
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
xor r9d, r9d
mov rdi, rcx
mov rcx, qword [rcx]
mov rbp, rdx
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x40585d
mov rax, qword [rbp]
mov dword [rsp + 0x70], 0
mov ecx, dword [rax - 8]
lea ecx, [rcx + rcx + 1]
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov r8, qword [rbp]
mov qword [rsp + 0x38], 0
mov rbx, rax
mov eax, dword [r8 - 8]
xor edx, edx
add eax, eax
mov qword [rsp + 0x30], 0
lea r9d, [rdx - 1]
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r11, qword [rbp]
lea r9, [rsp + 0x70]
mov r8d, dword [r11 - 8]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rdi]
add r11, 0xfffffffffffffff4
cmp r11, qword [0x0040f008]
je 0x405856
mov ecx, 0xffffffff
lock xadd dword [r11], ecx
dec ecx
test ecx, ecx
jg 0x405856
mov rcx, qword [rdi]
sub rcx, 0xc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 1
jmp 0x40588a
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x0040f008]
je 0x405888
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x405888
mov rcx, qword [rdi]
sub rcx, 0xc
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40962c
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor edx, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x210]
lea r8d, [rdx + 2]
call sub.msvcrt.dll_fseek
mov rcx, qword [rbx + 0x210]
call sub.msvcrt.dll_ftell
mov r9, qword [rbx + 0x218]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rbx + 0x220]
mov dword [rbx + 0x220], eax
call sub.msvcrt.dll_fwrite
add dword [rbx + 0x224], 4
cmp dword [rbx + 0x220], 0
je 0x409880
mov rcx, qword [rbx + 0x210]
call sub.msvcrt.dll_rewind
mov rcx, rbx
mov dword [rbx + 0x220], 0
call fcn.00408ee4
mov eax, 0x1000
lea rdi, [rbx + 0x5270]
lea ebp, [rax - 0x3c]
mov ecx, 0x100
mov dl, 0x20
rep stosw word [rdi], ax
mov rcx, rax
lea rdi, [rbx + 0x5470]
rep stosw word [rdi], ax
lea rcx, [rbx + 0x22c]
mov r8, rbp
xor r14w, r14w
call sub.msvcrt.dll_memset
xor di, di
mov rcx, qword [rbx + 0x210]
call sub.msvcrt.dll_getc
cmp ax, 0xffff
je 0x409714
movsx rcx, di
inc di
cmp di, 0x3c
mov byte [rcx + rbx + 0x11f0], al
jl 0x4096ee
movsx eax, di
mov si, 0xfc3
mov dword [rbx + 0x220], eax
movzx edx, si
mov rcx, rbx
call fcn.00408bd0
dec si
cmp si, 0xf88
jge 0x409721
movzx edx, bp
mov rcx, rbx
call fcn.00408bd0
cmp word [rbx + 0x126a], di
jle 0x409751
mov word [rbx + 0x126a], di
movzx edx, word [rbx + 0x126a]
mov rcx, rbx
cmp dx, 2
jg 0x40977d
movsx rax, bp
mov word [rbx + 0x126a], 1
movzx edx, byte [rax + rbx + 0x22c]
call fcn.004090b8
jmp 0x409799
add dx, 0xfd
call fcn.004090b8
movzx edx, word [rbx + 0x1268]
mov rcx, rbx
dec dx
call fcn.004091c4
movzx esi, word [rbx + 0x126a]
xor r12w, r12w
test si, si
jle 0x40980c
mov rcx, qword [rbx + 0x210]
call sub.msvcrt.dll_getc
cmp ax, 0xffff
mov r13d, eax
je 0x40980c
movzx edx, r14w
mov rcx, rbx
call fcn.00408da0
cmp r14w, 0x3b
movsx r11, r14w
mov byte [r11 + rbx + 0x22c], r13b
jge 0x4097e5
mov byte [r11 + rbx + 0x122c], r13b
inc bp
inc r14w
mov rcx, rbx
and bp, 0xfff
and r14w, 0xfff
movzx edx, bp
call fcn.00408bd0
inc r12w
cmp r12w, si
jl 0x4097a9
movsx eax, r12w
add dword [rbx + 0x220], eax
mov eax, dword [rbx + 0x228]
cmp dword [rbx + 0x220], eax
jbe 0x40982f
add eax, 0x400
mov dword [rbx + 0x228], eax
cmp r12w, si
jge 0x40986f
sub si, r12w
movzx esi, si
movzx edx, r14w
mov rcx, rbx
call fcn.00408da0
inc r14w
inc bp
and r14w, 0xfff
and bp, 0xfff
dec di
je 0x40986a
movzx edx, bp
mov rcx, rbx
call fcn.00408bd0
dec rsi
jne 0x40983c
test di, di
jg 0x409741
mov rcx, rbx
call fcn.004092c0
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x409894
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rax, qword [0x005b7550]
mov rbx, rcx
lea rsi, [rcx + 0x220]
test rax, rax
je 0x4098c8
mov eax, dword [rax]
mov dword [rsi], eax
add dword [0x005b7558], 4
jmp 0x4098e0
mov r9, qword [rcx + 0x210]
mov edx, 4
mov rcx, rsi
lea r8d, [rdx - 3]
call sub.msvcrt.dll_fread
cmp dword [rsi], 0
je 0x409a25
mov rcx, rbx
call fcn.0040938c
mov rcx, rbx
call fcn.00408ee4
mov edi, 0xfc4
lea rcx, [rbx + 0x22c]
mov r8, rdi
mov dl, 0x20
call sub.msvcrt.dll_memset
xor r12d, r12d
cmp dword [rsi], r12d
jbe 0x409a25
mov rcx, rbx
call fcn.004093c4
cmp ax, 0x100
movzx ebp, ax
jge 0x409981
mov rcx, qword [0x005b7568]
test rcx, rcx
je 0x409956
movsxd rdx, dword [0x005b7570]
lea eax, [rdx + 1]
cmp eax, dword [0x005b7560]
jge 0x409965
mov byte [rdx + rcx], bpl
inc dword [0x005b7570]
jmp 0x409965
mov rdx, qword [rbx + 0x218]
movsx ecx, bp
call sub.msvcrt.dll_putc
movsx rax, di
inc di
and di, 0xfff
inc r12d
mov byte [rax + rbx + 0x22c], bpl
jmp 0x409a1c
mov rcx, rbx
call fcn.00409504
movzx ecx, di
sub bp, 0xfd
sub cx, ax
xor r14w, r14w
dec cx
and cx, 0xfff
test bp, bp
jle 0x409a1c
movzx eax, bp
movsx r15d, cx
add r12d, eax
mov rdx, qword [0x005b7568]
mov ax, r14w
add eax, r15d
and eax, 0xfff
test rdx, rdx
movzx r13d, byte [rax + rbx + 0x22c]
je 0x4099ee
movsxd rcx, dword [0x005b7570]
lea eax, [rcx + 1]
cmp eax, dword [0x005b7560]
jge 0x4099fe
mov byte [rcx + rdx], r13b
inc dword [0x005b7570]
jmp 0x4099fe
mov rdx, qword [rbx + 0x218]
movsx ecx, r13w
call sub.msvcrt.dll_putc
movsx rax, di
inc di
inc r14w
and di, 0xfff
cmp r14w, bp
mov byte [rax + rbx + 0x22c], r13b
jl 0x4099af
cmp r12d, dword [rsi]
jb 0x40991b
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret