joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bfc
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push 0
push 0
mov r8d, 0x411f40
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404c41
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e49
push 0
push 0
mov r8d, 0x412386
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404c8a
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e4b
push 0
push 0
mov r8d, 0x41252c
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404cd3
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e4d
push 0
push 0
mov r8d, 0x412cfa
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404d1c
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e4f
push 0
push 0
mov r8d, 0x412e88
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404d65
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e51
push 0
push 0
mov r8d, 0x413550
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404dae
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e53
push 0
push 0
mov r8d, 0x4136bf
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404df7
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e55
push 0
push 0
mov r8d, 0x414a0f
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x404e3c
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x404e57
leave
ret
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
Function at 0x404ecf
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0xc], 0
mov dword [rbp - 8], 0
jmp 0x404f63
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 4], 0
jmp 0x404f57
mov eax, dword [rbp - 4]
cmp eax, 0x191
jae 0x404f74
imul eax, eax, 0x18
movsx eax, word [rax + 0x6f5b22]
cmp eax, dword [rbp - 8]
jne 0x404f54
mov eax, dword [rbp - 4]
cmp eax, 0x191
jae 0x404f76
imul eax, eax, 0x18
movsx eax, word [rax + 0x6f5b20]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, dword [rbp - 0x10]
je 0x404f54
mov eax, dword [rbp - 0xc]
inc dword [rbp - 0xc]
cmp eax, 0x18b
jae 0x404f78
mov bx, word [rbp - 0x14]
mov word [rax*2 + 0x9d6a90], bx
mov eax, dword [rbp - 0x14]
mov dword [rbp - 0x10], eax
inc dword [rbp - 4]
cmp dword [rbp - 4], 0x191
jl 0x404efa
inc dword [rbp - 8]
cmp dword [rbp - 8], 0x32
jl 0x404eea
mov eax, dword [rbp - 0xc]
mov dword [0x009d6da8], eax
leave
ret
int 5
int 5
int 5

Function at 0x404f7a
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov r8d, 8
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov dword [rax], 0
call fcn.006defae
mov dword [rax + 4], 0xc
mov qword [0x009d6db0], rax
mov r8d, 8
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov dword [rax], 0
call fcn.006defae
mov dword [rax + 4], 0xd
mov qword [0x009d6db8], rax
push 0
push 0
mov r8d, 0x4153e4
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x405031
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x40503e
leave
ret
int 5

Function at 0x405040
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push 0
push 0
mov r8d, 0x415934
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x405085
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x405092
leave
ret
int 5

Function at 0x409865
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov byte [0x009d6ee0], 1
push rax
lea rax, [rbp - 0x10]
push rax
call fcn.00415d11
pop rcx
movsx eax, word [rbp - 0x10]
cmp eax, 0x7ef
jl 0x409891
leave
ret
push 0
push 0
mov r8d, 0x419c3a
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x4098cb
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
cmp eax, 0
setl al
leave
ret
Function at 0x409968
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push 0
push 1
call fcn.00403454
cmp eax, 0
jne 0x409bc7
push 0
push 0
mov r8d, 0x419d18
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x4099bf
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bc9
push 0
push 0
mov r8d, 0x41a127
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x409a08
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bcb
push 0
push 0
mov r8d, 0x41a1d1
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x409a51
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bcd
push 0
push 0
mov r8d, 0x41a921
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x409a9a
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bcf
push 0
push 0
mov r8d, 0x41ac07
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x409ae3
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bd1
push 0
push 0
mov r8d, 0x41b225
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x409b2c
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bd3
push 0
push 0
mov r8d, 0x41b443
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x409b75
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bd5
push 0
push 0
mov r8d, 0x41c1ea
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x409bba
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x409bd7
leave
ret
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
Function at 0x40aa77
Capabilities:
Get file size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push rax
push rax
lea rax, [rbp - 8]
push rax
movsxd rax, dword [rbp + 0x10]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
add rsp, 0x20
cmp eax, 0
jne 0x40aab1
call fcn.0042464b
cdqe
leave
ret 8
mov rax, qword [rbp - 8]
leave
ret 8

Function at 0x40aab9
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push rax
push 0
lea rax, [rbp - 4]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
movsxd rax, dword [rbp + 0x20]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
add rsp, 0x30
cmp eax, 0
jne 0x40ab02
call fcn.0042464b
leave
ret 0x18
mov eax, dword [rbp - 4]
leave
ret 0x18

Function at 0x40b0bf
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x2f0
lea rcx, [rbp - 0x78]
mov edx, 0x68
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 0x78], 0x68
mov word [rbp - 0x38], 0xa
push rax
push qword [rbp + 0x30]
push qword [rbp + 0x28]
push 0x20
call fcn.0042583b
pop rcx
cmp eax, 0xffffffff
je 0x40b13b
push 0x248
lea rax, [rbp - 0x2d8]
push rax
push 4
push 0x6f9d42
mov eax, dword [rbp + 0x30]
mov dword [rbp - 0x2e0], eax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x2e8], rax
push 1
lea rax, [rbp - 0x2e8]
push rax
call fcn.00402463
jmp 0x40b172
push 0x248
lea rax, [rbp - 0x2d8]
push rax
push 2
push 0x6eabd7
mov eax, dword [rbp + 0x30]
mov dword [rbp - 0x2e0], eax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x2e8], rax
push 1
lea rax, [rbp - 0x2e8]
push rax
call fcn.00402463
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.00401d50
cmp eax, 0
jle 0x40b1b3
push 0x248
lea rax, [rbp - 0x2d8]
push rax
push 1
push 0x6e0a74
call fcn.0040adb1
push 0x248
lea rax, [rbp - 0x2d8]
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.0040adb1
lea rax, [rbp - 0x90]
push rax
lea rax, [rbp - 0x78]
push rax
push 0
push 0
push 0
push 0
push 0
push 0
lea rax, [rbp - 0x2d8]
push rax
push 0
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
add rsp, 0x50
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x40b257
test byte [rbp + 0x10], 0xff
je 0x40b221
push rax
push rax
push 0x7530
push qword [rbp - 0x90]
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
call qword [sym.imp.user32.dll_WaitForInputIdle]
add rsp, 0x20
sub rsp, 0x18
push qword [rbp - 0x90]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
sub rsp, 0x18
push qword [rbp - 0x88]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
xor eax, eax
leave
ret 0x28
call fcn.0042464b
leave
ret 0x28
Function at 0x40dda4
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push rax
push 0
lea rax, [rbp - 4]
push rax
mov rax, qword [rbp + 0x10]
push qword [rax]
mov rax, qword [rbp + 0x10]
lea rax, [rax + 4]
push rax
movsxd rax, dword [0x009d649c]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
add rsp, 0x30
mov rax, qword [rbp + 0x10]
mov dword [rax], 0
leave
ret 8

Function at 0x40fda2
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1e0
movzx eax, byte [rbp + 0x10]
mov byte [rbp - 1], al
push rax
push qword [0x009d6034]
call fcn.0040ecbf
pop rcx
cmp eax, 0
jne 0x40ff75
push rax
push 1
push qword [rbp + 0x18]
movzx eax, byte [rbp - 1]
push rax
call fcn.00430056
pop rcx
mov qword [rbp - 0x10], rax
push rax
push qword [0x009d6034]
call fcn.0040ee3f
pop rcx
cmp eax, 0
jne 0x40ff77
push rax
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 1
jne 0x40ff79
mov qword [rbp - 0x38], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
lea rax, [rbp - 0x30]
push rax
call fcn.004303c6
pop rcx
mov rbx, qword [rbp - 0x38]
lock dec dword [rbx]
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x40ff7b
jmp 0x40fefc
dec byte [rbp - 1]
push rax
movzx eax, byte [rbp - 1]
push rax
lea rax, [rbp - 0x30]
push rax
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 1
jne 0x40ff7d
mov qword [rbp - 0x38], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
lea rax, [rbp - 0x18]
push rax
call fcn.00430536
pop rcx
mov rbx, qword [rbp - 0x38]
lock dec dword [rbx]
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x40ff7f
push rax
push qword [0x009d6034]
call fcn.0040ecbf
pop rcx
cmp eax, 0
jne 0x40ff81
push rax
push 1
push qword [rbp + 0x18]
movzx eax, byte [rbp - 1]
push rax
mov rax, qword [rbp - 0x18]
lock inc dword [rax]
cmp dword [rax + 4], 1
jne 0x40ff83
mov qword [rbp - 0x38], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
call fcn.0043097b
pop rcx
mov rbx, qword [rbp - 0x38]
lock dec dword [rbx]
push rax
push qword [0x009d6034]
call fcn.0040ee3f
pop rcx
cmp eax, 0
jne 0x40ff85
mov rax, qword [rbp - 0x18]
mov ebx, 1
call fcn.006df099
movzx eax, byte [rbp - 1]
cmp eax, 0
ja 0x40fe3b
mov rax, qword [rbp - 0x10]
mov ebx, 1
call fcn.006df099
push rax
lea rax, [rbp - 0x30]
push rax
call fcn.00430dae
pop rcx
lea rcx, [rbp - 0x1e0]
mov edx, 0x1ce
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 0x1e0], 5
push rax
push qword [0x009d607c]
push 0x1ce
lea rax, [rbp - 0x1e0]
push rax
push 7
push str.PRIMARY
call fcn.0040ee0a
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x40ff87
leave
ret 0x10
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
int 5
Function at 0x40ff89
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
mov rbp, rsp
push rax
push 0xab9820
call fcn.0040b260
pop rcx
push rax
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
call qword [sym.imp.advapi32.dll_SystemFunction036]
add rsp, 0x20
movzx eax, al
cmp eax, 1
jne 0x40ffcb
push rax
push 0xab9820
call fcn.0040ba36
pop rcx
leave
ret 0x10
int 5

Function at 0x415125
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rcx, [rbp - 0x58]
mov edx, 0x48
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
push rax
lea rax, [rbp - 0x58]
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.00450a3d
pop rcx
push rax
lea rax, [rbp - 0x58]
push rax
call fcn.00450a77
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x41518e
push rax
lea rax, [rbp - 0x58]
push rax
call fcn.00450df8
pop rcx
mov eax, dword [rbp - 4]
leave
ret 0x18
push rax
lea rax, [rbp - 0x58]
push rax
mov rax, qword [rbp + 0x10]
lea rax, [rax + 8]
push rax
mov rax, qword [rbp + 0x10]
lea rax, [rax + 0xc]
push rax
call fcn.00450e33
pop rcx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 8]
shl eax, 2
mov rbx, qword [rbp + 0x10]
mul dword [rbx + 0xc]
mov dword [rbp - 0x5c], eax
mov eax, dword [rbp - 0x5c]
cmp eax, 0x7ffffffc
jae 0x4152b7
add eax, 4
mov r8d, eax
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov ebx, dword [rbp - 0x5c]
mov dword [rax], ebx
call fcn.006defae
mov dword [rax + 4], 1
mov rbx, qword [rbp + 0x10]
mov qword [rbx], rax
push rax
lea rax, [rbp - 0x58]
push rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 1
jne 0x4152b9
mov qword [rbp - 0x60], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
call fcn.0045118d
pop rcx
mov rbx, qword [rbp - 0x60]
lock dec dword [rbx]
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x415277
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov ebx, 1
call fcn.006df099
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
push rax
lea rax, [rbp - 0x58]
push rax
call fcn.004513a4
pop rcx
mov eax, dword [rbp - 4]
leave
ret 0x18
push rax
lea rax, [rbp - 0x58]
push rax
call fcn.004513a4
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x4152b1
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov ebx, 1
call fcn.006df099
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov eax, dword [rbp - 4]
leave
ret 0x18
xor eax, eax
leave
ret 0x18
int 5
int 5
Function at 0x4152bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
push rax
movsxd rax, dword [rbp + 0x10]
push rax
movsxd rax, dword [rbp + 0x18]
push rax
push 0
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
call qword [sym.imp.KERNEL32.DLL_FindResourceA]
add rsp, 0x20
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4152f8
int 5
push rax
push rax
push qword [rbp - 8]
push 0
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_LoadResource]
add rsp, 0x20
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x41531f
int 5
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_LockResource]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
leave
ret 0x10

Function at 0x415340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
push rax
movsxd rax, dword [rbp + 0x10]
push rax
movsxd rax, dword [rbp + 0x18]
push rax
push 0
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
call qword [sym.imp.KERNEL32.DLL_FindResourceA]
add rsp, 0x20
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x41537d
int 5
push rax
push rax
push qword [rbp - 8]
push 0
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_LoadResource]
add rsp, 0x20
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x4153a4
int 5
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_LockResource]
add rsp, 0x20
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x4153c6
int 5
push rax
push rax
push qword [rbp - 8]
push 0
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
add rsp, 0x20
leave
ret 0x10

Function at 0x415daf
Capabilities:
Identify system language via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
add rsp, 0x20
movzx eax, ax
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
movzx eax, ax
and eax, 0x3ff
mov rbx, qword [rbp + 0x18]
mov dword [rbx], eax
mov eax, dword [rbp - 4]
movzx eax, ax
shr eax, 0xa
mov rbx, qword [rbp + 0x10]
mov dword [rbx], eax
leave
ret 0x10
Function at 0x415df3
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x230
push 0x104
lea rax, [rbp - 0x120]
push rax
push qword [rbp + 0x40]
push qword [rbp + 0x38]
push 0
push rbp
call fcn.00402463
mov byte [rbp - 0x1d], 0
push 0x104
lea rax, [rbp - 0x230]
push rax
push qword [rbp + 0x30]
push qword [rbp + 0x28]
push 0
push rbp
call fcn.00402463
mov byte [rbp - 0x12d], 0
push rax
push 0
lea rax, [rbp - 0x10]
push rax
push 0
push 2
push 0
push 0
push 0
lea rax, [rbp - 0x120]
push rax
mov eax, dword [rbp + 0x48]
add eax, 0x80000000
cdqe
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.advapi32.dll_RegCreateKeyExA]
add rsp, 0x50
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x415e93
mov eax, 0xffffffff
leave
ret 0x40
push qword [rbp + 0x20]
push qword [rbp + 0x18]
push qword [rbp + 0x10]
push 0
lea rax, [rbp - 0x230]
push rax
push qword [rbp - 0x10]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
add rsp, 0x30
mov dword [rbp - 4], eax
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.advapi32.dll_RegCloseKey]
add rsp, 0x20
cmp dword [rbp - 4], 0
je 0x415eed
mov eax, 0xffffffff
leave
ret 0x40
xor eax, eax
leave
ret 0x40
Function at 0x418548
Capabilities:
Delete file
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xac0
push rax
push qword [rbp + 0x28]
lea rax, [rbp - 0x10]
push rax
lea rax, [rbp - 4]
push rax
call fcn.004560f7
pop rcx
push rax
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 1
jne 0x41872c
mov qword [rbp - 0xab8], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
lea rax, [rbp - 0x30]
push rax
call fcn.004556b3
pop rcx
mov rax, qword [rbp - 0xab8]
lock dec dword [rax]
push 0
lea rax, [rbp - 0x30]
push rax
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 1
jne 0x41872e
mov qword [rbp - 0xab8], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
call fcn.004567fd
mov rax, qword [rbp - 0xab8]
lock dec dword [rax]
mov rax, qword [rbp - 0x10]
mov ebx, 1
call fcn.006df099
lea rcx, [rbp - 0xab0]
mov edx, 0xa50
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov ax, word [rbp - 4]
mov word [rbp - 0xa9a], ax
push 0x20
lea rax, [rbp - 0xa98]
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.0040aecf
push rax
lea rax, [rbp - 0xa58]
push rax
call fcn.00456b56
pop rcx
push rax
push 5
push 3
push 0x7e3
call fcn.004315e5
pop rcx
push rax
push 1
push 1
push 0x7de
mov dword [rsp + 0x20], eax
call fcn.004315e5
pop rcx
mov ebx, dword [rsp]
sub ebx, eax
mov word [rbp - 0xa44], bx
mov word [rbp - 0xa42], 0x3f0
mov byte [rbp - 0xa21], 1
mov rax, qword [0x006faf70]
mov rbx, qword [0x006faf78]
mov rsi, qword [0x006faf80]
mov rdi, qword [0x006faf88]
mov qword [rbp - 0xa02], rax
mov qword [rbp - 0x9fa], rbx
mov qword [rbp - 0x9f2], rsi
mov qword [rbp - 0x9ea], rdi
mov rax, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x28]
mov qword [rbp - 0x9e2], rax
mov qword [rbp - 0x9da], rbx
push rax
push 0xa50
lea rax, [rbp - 0xab0]
push rax
lea rax, [rbp - 0x40]
push rax
call fcn.004556b3
pop rcx
push 2
lea rax, [rbp - 0x40]
push rax
push 0xa50
lea rax, [rbp - 0xab0]
push rax
call fcn.004567fd
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], eax
push 2
lea rax, [rbp - 0x40]
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
push 0
push 0x3e3
lea rax, [rbp - 0x58]
push rax
push 1
push qword [rbp + 0x10]
push 0
call fcn.00456b87
mov qword [rbp - 0x18], rax
leave
ret 0x20
int 5
int 5