joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405748
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp qword [0x00459230], 0
je 0x4057b1
mov ecx, dword [0x00459238]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [0x00459230]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x405797
mov rcx, qword [0x00459230]
mov edx, 0x8ae
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x00459230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x00459240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x00459230], 0
add rsp, 0x28
ret
Function at 0x406794
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call fcn.00401250
xor r9d, r9d
test al, al
je 0x406804
cmp qword [0x004591b0], r9
jne 0x4067fc
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x004591b0]
lea r8, [0x0040871c]
mov qword [0x004591c0], rax
lea rax, [0x004591b8]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.0041abc0
mov rcx, qword [0x004591c0]
mov qword [0x004591b0], rax
jmp 0x40685b
mov ecx, dword [0x004591b8]
jmp 0x406881
cmp qword [0x00459230], 0
jne 0x40687b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [0x00459230]
lea r8, [0x004057c4]
mov qword [0x00459240], rax
lea rax, [0x00459238]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.0041abc0
mov rcx, qword [0x00459240]
mov qword [0x00459230], rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x406891
lea rcx, str.Error_starting_SplashThread_n
call fcn.0040b26c
jmp 0x406891
mov ecx, dword [0x00459238]
mov r8d, 2
lea edx, [r8 + 4]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
add rsp, 0x38
ret
Function at 0x406cf4
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rbx, rcx
mov ecx, 0x40
mov rsi, rdx
call fcn.00416460
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rbx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0x30], 0
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rsi
mov qword [rdi + 8], rax
mov dword [rdi + 0x14], 0
call fcn.00407738
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rdi]
mov ebx, 0xffffffff
mov edx, ebx
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r11, [rsp + 0x30]
lea r8, [0x00406c64]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406988]
mov r9, rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x34]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406a54]
mov r9, rdi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406b44]
mov r9, rdi
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x3c]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00406bd4]
mov r9, rdi
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi]
mov dword [rdi + 0x30], 5
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 0x38]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rdi + 0x10]
lea rcx, str._HttpDownloader__Download_Tasks_Complete___success_d__n
call fcn.0040b26c
lea rcx, str._HttpDownloader__Saving_any_detected_proxy_settings_n
call fcn.0040b26c
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.00405c50
xor ebx, ebx
mov rcx, qword [rsp + rbx*8 + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 1
cmp rbx, 5
jl 0x406e9f
cmp dword [rdi + 0x10], 0
je 0x406ebe
xor eax, eax
jmp 0x406ed7
lea rcx, str._HttpDownloader__Downloads_failed._Closing_buffer._n
call fcn.0040b26c
mov rcx, rsi
call fcn.00407888
mov eax, 0xffffffff
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x406f04
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
mov eax, 0x2758
call fcn.00438730
sub rsp, rax
mov rsi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SetDllDirectoryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x13c0]
mov rdx, rsi
mov rbx, rax
mov byte [rsp + 0x13c0], 0
call fcn.00416730
lea r14, [0x0044b24c]
lea rcx, [rsp + 0x13c0]
mov rdx, r14
call fcn.0040b1c0
lea rdx, [rsp + 0x13c0]
lea rcx, str._JNILaunch__Bin_folder_is__s_n
call fcn.0040b26c
mov edi, 0x7d0
mov rcx, rdi
call fcn.00416460
mov ecx, edi
mov rdx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [rsp + 0x13c0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test rbx, rbx
je 0x406fb8
lea rcx, [rsp + 0x13c0]
call rbx
lea r13, str.jvm.dll
lea r9, str.server
lea rcx, [rsp + 0x30]
mov r8, r14
mov rdx, rsi
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x20], r13
call fcn.0040b228
lea rcx, [rsp + 0x30]
call fcn.0040ad28
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Trying_to_load__s__exists_d__n
mov r8d, eax
call fcn.0040b26c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407142
lea r9, str.client
lea rcx, [rsp + 0x30]
mov r8, r14
mov rdx, rsi
mov byte [rsp + 0x30], al
mov qword [rsp + 0x20], r13
call fcn.0040b228
lea rcx, [rsp + 0x30]
call fcn.0040ad28
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Failed._Now_trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040b26c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407142
mov byte [rsp + 0x30], al
lea rax, str.client
lea r8, [0x0044b230]
lea rcx, [rsp + 0x30]
mov r9, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.0040b228
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.0040b1c0
lea rcx, [rsp + 0x30]
call fcn.0040ad28
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Failed._Now_trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040b26c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407142
mov byte [rsp + 0x30], al
lea rax, str.server
lea r8, [0x0044b230]
lea rcx, [rsp + 0x30]
mov r9, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.0040b228
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.0040b1c0
lea rcx, [rsp + 0x30]
call fcn.0040ad28
lea rdx, [rsp + 0x30]
lea rcx, str._JNILaunch__Failed._Now_trying_to_load_library__s__exists_d__n
mov r8d, eax
call fcn.0040b26c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
jne 0x407142
lea rcx, str._JNILauncher__Failed_to_load_DLL._Will_fall_back_to_spawning._n
call fcn.0040b26c
jmp 0x407153
lea rdx, [rsp + 0x30]
lea rcx, str._JNILauncher__Loaded_Windows_DLL____s_n
call fcn.0040b26c
test rbx, rbx
je 0x40715c
xor ecx, ecx
call rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, rdi
add rsp, 0x2758
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4075a8
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rbp, r8
mov rdi, rdx
call fcn.00409958
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rbp], 0
lea r8d, [rdx + 0x20]
mov rbx, rax
mov qword [rbp + 8], 0
call fcn.00418100
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x18]
call fcn.00418100
lea rcx, str._Proxy__Opening_HTTP_Session_n
call fcn.0040b26c
xor r9d, r9d
lea rcx, str.JWrapper_Proxy_Detector_1.0
lea edx, [r9 + 1]
xor r8d, r8d
mov dword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
mov rsi, rax
je 0x407726
test rdi, rdi
mov dword [rsp + 0x48], 1
je 0x40764f
lea rcx, str._Proxy__Using_auto_config_URL:__S_n
mov rdx, rdi
mov dword [rsp + 0x48], 3
call fcn.0040b26c
mov qword [rsp + 0x50], rdi
lea rcx, str._Proxy__Attempting_to_detect_proxy_for_URL__S_n
mov rdx, rbx
mov dword [rsp + 0x4c], 3
mov dword [rsp + 0x64], 1
call fcn.0040b26c
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x4076e9
lea rcx, str._Proxy__Configuration_found_n
call fcn.0040b26c
cmp dword [rsp + 0x30], 1
jne 0x4076a9
lea rcx, str._Proxy__Direct_connection_used_n
call fcn.0040b26c
jmp 0x4076fd
mov rdx, qword [rsp + 0x38]
lea rcx, str._Proxy___S_n
call fcn.0040b26c
mov rdx, qword [rsp + 0x40]
lea rcx, str._Proxy___S_n
call fcn.0040b26c
mov rcx, qword [rsp + 0x38]
call fcn.004099b8
mov rcx, qword [rsp + 0x40]
mov qword [rbp], rax
call fcn.004099b8
mov qword [rbp + 8], rax
jmp 0x4076fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._Proxy__Configuration_NOT_found___d__n
mov edx, eax
call fcn.0040b26c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x40770d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40771d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call fcn.00416420
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4081f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
mov eax, 0xc430
call fcn.00438730
sub rsp, rax
mov rbx, rcx
lea rcx, str._Spawner__Constructing_command_line..._n
call fcn.0040b26c
call fcn.0041b960
lea rcx, [rax + 0x30]
call fcn.00417cd0
xor esi, esi
mov byte [rsp + 0xe0], 0
cmp qword [rbx], rsi
je 0x40827a
mov rdi, rbx
lea rdx, [0x0044b22c]
lea rcx, [rsp + 0xe0]
call fcn.00416730
mov rdx, qword [rdi]
lea rcx, [rsp + 0xe0]
call fcn.00416730
lea rdx, [0x00450608]
lea rcx, [rsp + 0xe0]
call fcn.00416730
add rsi, 1
lea rdi, [rbx + rsi*8]
cmp qword [rdi], 0
jne 0x408234
lea rdx, [rsp + 0xe0]
lea rcx, str._Spawner__Creating_command_line__s_n
call fcn.0040b26c
call fcn.0041b960
lea rcx, [rax + 0x30]
call fcn.00417cd0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.00418100
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.00418100
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408337
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___d_._n
mov edx, eax
call fcn.0040b26c
call fcn.0041b960
lea rcx, [rax + 0x30]
call fcn.00417cd0
mov rax, 0xffffffffffffffff
jmp 0x40838c
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xc458]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xc458]
lea rcx, str._Spawner__runSpawnerAndWait_returned__d_n
call fcn.0040b26c
mov rax, qword [rsp + 0xc458]
add rsp, 0xc430
pop rdi
pop rsi
pop rbx
ret
Function at 0x408398
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0xc430
call fcn.00438730
sub rsp, rax
mov rbx, rcx
lea rcx, str._Spawner__Constructing_command..._n
mov byte [rsp + 0xe0], 0
call fcn.0040b26c
call fcn.0041b960
lea rcx, [rax + 0x30]
call fcn.00417cd0
xor esi, esi
cmp qword [rbx], rsi
je 0x40841e
mov rdi, rbx
lea rdx, [0x0044b22c]
lea rcx, [rsp + 0xe0]
call fcn.00416730
mov rdx, qword [rdi]
lea rcx, [rsp + 0xe0]
call fcn.00416730
lea rdx, [0x00450608]
lea rcx, [rsp + 0xe0]
call fcn.00416730
add rsi, 1
lea rdi, [rbx + rsi*8]
cmp qword [rdi], 0
jne 0x4083d8
lea rdx, [rsp + 0xe0]
lea rcx, str._Spawner__Executing_command__s_n
call fcn.0040b26c
call fcn.0041b960
lea rcx, [rax + 0x30]
call fcn.00417cd0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.00418100
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.00418100
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4084d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___d_._n
mov edx, eax
call fcn.0040b26c
call fcn.0041b960
lea rcx, [rax + 0x30]
call fcn.00417cd0
mov eax, 0xffffffff
jmp 0x40850b
lea rcx, str._Spawner__Create_process_seems_to_have_worked_n
call fcn.0040b26c
call fcn.0041b960
lea rcx, [rax + 0x30]
call fcn.00417cd0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xc430
pop rdi
pop rsi
pop rbx
ret

Function at 0x408628
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp qword [0x004591b0], 0
je 0x408691
mov ecx, dword [0x004591b8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov rcx, qword [0x004591b0]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408677
mov rcx, qword [0x004591b0]
mov edx, 0x8ae
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x004591b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x004591c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x004591b0], 0
add rsp, 0x28
ret
Function at 0x409634
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
mov rsi, rdx
mov rbx, rcx
mov edx, 0x19000
mov ecx, 4
call fcn.00407800
lea rcx, str._Streamer__Downloading_from__s_into__s_n
mov r8, rsi
mov rdx, rbx
mov rdi, rax
call fcn.0040b26c
mov r13d, 0x18
lea r12d, [r13 - 0x17]
mov rdx, r13
mov rcx, r12
call fcn.0041b880
mov rdx, r13
mov rcx, r12
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov rbp, rax
call fcn.0041b880
lea rdx, [0x0044b6c0]
mov rcx, rsi
mov qword [rax + 8], rdi
mov r13, rax
call fcn.00417ef0
lea r8, [0x00409464]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov qword [r13], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x00409510]
mov r9, r13
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov rdi, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, 0xffffffff
mov rcx, rdi
mov edx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [rbp + 0x10], 0
jne 0x409727
cmp dword [r13 + 0x10], 0
je 0x40972a
xor r12d, r12d
mov eax, r12d
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x40973c
Capabilities:
Create thread

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov rbx, rcx
mov edx, 0x32000
mov ecx, 3
call fcn.00407800
mov edx, 0x18
lea ecx, [rdx - 0x17]
mov rdi, rax
call fcn.0041b880
lea r8, [0x00409594]
xor edx, edx
xor ecx, ecx
mov r9, rax
mov qword [rsp + 0x28], 0
mov qword [rax + 8], rdi
mov qword [rax], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, rdi
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x40979c
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x18
mov rdi, rdx
call fcn.00416460
mov esi, 0x19000
mov r14d, 1
mov edx, esi
mov ecx, r14d
mov r13, rax
call fcn.00407800
lea ecx, [r14 + 1]
mov edx, esi
mov r12, rax
call fcn.00407800
lea edx, [r14 + 0x17]
mov rcx, r14
mov rbp, rax
call fcn.0041b880
lea edx, [r14 + 0x1f]
mov rcx, r14
mov qword [rax], rbx
mov qword [rax + 8], r12
mov rsi, rax
call fcn.0041b880
lea r8, [0x00409464]
mov r9, rsi
mov qword [rax + 0x10], rdi
xor edi, edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov rbx, rax
mov qword [rax], r12
mov qword [rax + 8], rbp
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x004094a0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [r13], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x004094d8]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [r13 + 0x10], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rax
mov qword [r13 + 8], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
call fcn.00407888
mov rcx, rbp
call fcn.00407888
cmp dword [rsi + 0x10], edi
jne 0x4098a1
cmp dword [rbx + 0x18], edi
je 0x4098a4
mov r14d, edi
mov eax, r14d
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4098b8
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rdi, rcx
mov ecx, 0x18
mov rsi, rdx
call fcn.00416460
mov edx, 0x19000
mov ecx, 5
mov r12, rax
call fcn.00407800
mov edx, 0x20
lea ecx, [rdx - 0x1f]
mov rbx, rax
call fcn.0041b880
lea r8, [0x004094a0]
xor edx, edx
mov qword [rax + 8], rbx
xor ebx, ebx
mov r9, rax
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov rbp, rax
mov qword [rax], rdi
mov qword [rax + 0x10], rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x004094d8]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [r12 + 0x10], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r12 + 8], rax
mov rax, r12
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40ad78
Capabilities:
Encode data using xor
Get session user name
Hash data using fnv
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
lea rcx, str.ALLUSERSPROFILE
call fcn.0041a650
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r12, rax
mov dword [rsp + 0x130], 0x64
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x20]
call fcn.00416670
xor esi, esi
xor edi, edi
test eax, eax
mov ebx, 0x811c9dc5
movsxd rbp, eax
jle 0x40adfb
movzx ecx, byte [rsp + rdi + 0x20]
mov edx, esi
xor ebx, ecx
movsx r8d, cl
lea rcx, str.__d___d__d_n
imul ebx, ebx, 0x1000193
mov r9d, ebx
call fcn.0040b26c
add rdi, 1
add esi, 1
cmp rdi, rbp
jl 0x40adcd
test ebx, ebx
jns 0x40ae01
neg ebx
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x64]
call fcn.00418100
lea rdx, [0x0044c6e4]
lea rcx, [rsp + 0x90]
mov r8d, ebx
call fcn.00417330
lea rcx, [rsp + 0x20]
xor ebx, ebx
call fcn.00416670
test rax, rax
je 0x40ae5b
cmp byte [rsp + rbx + 0x20], 0x80
jb 0x40ae48
mov byte [rsp + rbx + 0x20], 0x5f
lea rcx, [rsp + 0x20]
add rbx, 1
call fcn.00416670
cmp rbx, rax
jb 0x40ae3c
mov ecx, 0x1388
call fcn.00416460
mov rdx, r12
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.00416730
lea rdx, str.JWUser_
mov rcx, rbx
call fcn.0040b1c0
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.00416730
lea rdx, [0x0044b924]
mov rcx, rbx
call fcn.00416730
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.00416730
mov rcx, rbx
call fcn.0040b17c
mov rax, rbx
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40aecc
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rcx, str.APPDATA
mov dword [rsp + 0x20], 0x94
call fcn.0041a650
test rax, rax
mov rdi, rax
je 0x40afa7
mov rcx, rax
call fcn.00416670
cmp rax, 2
jbe 0x40afa7
cmp byte [rdi], 0x5c
jne 0x40afa7
cmp byte [rdi + 1], 0x5c
jne 0x40afa7
lea rcx, str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040b26c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40afb3
cmp dword [rsp + 0x24], 5
jbe 0x40af5d
lea rcx, str.LOCALAPPDATA
call fcn.0041a650
lea rcx, str._Extractor__Local_AppData_directory_resolved_to__s_n
mov rdx, rax
mov rdi, rax
call fcn.0040b26c
jmp 0x40afb3
lea rcx, str.USERPROFILE
call fcn.0041a650
mov ecx, 0x1388
mov rbx, rax
call fcn.00416460
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.00416730
lea rdx, str.Local_Settings
mov rcx, rdi
call fcn.0040b1c0
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040b1c0
jmp 0x40afb3
lea rcx, str._Extractor__Local_AppData_directory_detected_n
call fcn.0040b26c
lea rcx, str.Validating_directory..._n
call fcn.0040b26c
lea rcx, str.Shared_dir_detected_is__s_n
mov rdx, rdi
call fcn.0040b26c
lea rcx, str.Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040b26c
mov edx, 6
mov rcx, rdi
call fcn.0041c640
test eax, eax
jne 0x40b069
lea rcx, str.Checking_if_string_is_cAscii__s_n
mov rdx, rdi
call fcn.0040b26c
mov rcx, rdi
xor ebx, ebx
call fcn.00416670
test rax, rax
je 0x40b023
cmp byte [rbx + rdi], 0x80
jae 0x40b069
mov rcx, rdi
add rbx, 1
call fcn.00416670
cmp rbx, rax
jb 0x40b00c
lea rcx, str.Checking_if__s_contains_a___n
mov rdx, rdi
call fcn.0040b26c
mov rcx, rdi
xor ebx, ebx
call fcn.00416670
test rax, rax
je 0x40b058
cmp byte [rbx + rdi], 0x21
je 0x40b069
mov rcx, rdi
add rbx, 1
call fcn.00416670
cmp rbx, rax
jb 0x40b041
lea rcx, str.Shared_directory_appears_valid._n
call fcn.0040b26c
jmp 0x40b0ee
lea rcx, str.The_directory__s_appears_invalid._n
mov rdx, rdi
call fcn.0040b26c
lea rcx, str.Trying_the_short_path_instead._n
mov rdx, rdi
call fcn.0040b26c
mov ecx, 0x1388
call fcn.00416460
mov r8d, 0x400
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40b0de
lea rcx, str.Got_short_path_of__s_n
mov rdx, rbx
call fcn.0040b26c
lea rcx, str.Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040b26c
mov edx, 6
mov rcx, rdi
call fcn.0041c640
test eax, eax
jne 0x40b0de
mov rax, rbx
jmp 0x40b0f1
mov rcx, rbx
call fcn.00416420
call fcn.0040ad78
mov rdi, rax
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40d570
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40d597
lea rdx, str.._srchashes_sha2_sha256.c
lea rcx, str.md___NULL
mov r8d, 0xd0
call fcn.0040fd60
xor eax, eax
mov dword [rbx + 0x280], 0x6a09e667
mov dword [rbx + 0x284], 0xbb67ae85
mov dword [rbx + 0x288], 0x3c6ef372
mov dword [rbx + 0x28c], 0xa54ff53a
mov dword [rbx + 0x290], 0x510e527f
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x9b05688c
mov dword [rbx + 0x298], 0x1f83d9ab
mov dword [rbx + 0x29c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret

Function at 0x40db30
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40db55
lea r8d, [rcx + 0x2a]
lea rdx, str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
lea rcx, str.md___NULL
call fcn.0040fd60
xor eax, eax
mov dword [rbx + 0x280], 0xc1059ed8
mov dword [rbx + 0x284], 0x367cd507
mov dword [rbx + 0x288], 0x3070dd17
mov dword [rbx + 0x28c], 0xf70e5939
mov dword [rbx + 0x290], 0xffc00b31
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x68581511
mov dword [rbx + 0x298], 0x64f98fa7
mov dword [rbx + 0x29c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret