joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030d0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x48], rdi
mov qword [rcx + 0x1100], rsi
xor ecx, ecx
call fcn.004055d0
lea rdx, [0x0041c142]
mov qword [rbx + 0x1100], rsi
test rdx, rdx
je 0x40312e
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x40312e
mov rcx, rdx
call sub.KERNEL32.dll_LoadLibraryA
mov qword [rbx + 0x1100], rax
mov rcx, qword [rbx + 0x1100]
mov qword [rbx + 0x1108], rsi
mov qword [rbx + 0x1110], rsi
mov qword [rbx + 0x1118], rsi
mov qword [rbx + 0x1120], rsi
mov qword [rbx + 0x1128], rsi
mov qword [rbx + 0x1130], rsi
call fcn.004055d0
lea rdx, str.gwendsecurity.dll
test rdx, rdx
mov qword [rbx + 0x1100], rsi
mov rsi, qword [rsp + 0x40]
je 0x4031a1
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x4031a1
mov rcx, rdx
call fcn.004054d0
mov qword [rbx + 0x1100], rax
mov rcx, qword [rbx + 0x1100]
lea rdx, str.ESInit
call sub.KERNEL32.dll_GetProcAddress
mov rcx, qword [rbx + 0x1100]
lea rdx, str.ESCreate
mov qword [rbx + 0x1108], rax
call sub.KERNEL32.dll_GetProcAddress
mov rcx, qword [rbx + 0x1100]
lea rdx, str.ESDestroy
mov qword [rbx + 0x1110], rax
call sub.KERNEL32.dll_GetProcAddress
mov rcx, qword [rbx + 0x1100]
lea rdx, str.ESRun
mov qword [rbx + 0x1118], rax
call sub.KERNEL32.dll_GetProcAddress
mov rcx, qword [rbx + 0x1100]
lea rdx, str.ESStop
mov qword [rbx + 0x1120], rax
call sub.KERNEL32.dll_GetProcAddress
mov rcx, qword [rbx + 0x1100]
lea rdx, str.ESGetResult
mov qword [rbx + 0x1128], rax
call sub.KERNEL32.dll_GetProcAddress
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x1130], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x403e40
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x00424820]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x00424918]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x403ec1
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00424918]
jmp 0x403edd
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x00424918], r11
mov qword [0x004248b8], rax
mov rax, qword [0x00424338]
mov qword [0x00424790], r11
mov qword [0x004248a0], rdi
mov dword [0x00424780], 0xc0000409
mov dword [0x00424784], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x00424330]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0041c318]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x00424338]
jne 0x419e79
rol rcx, 0x10
test cx, 0xffff
jne 0x419e75
ret
ror rcx, 0x10
jmp 0x403e40

Function at 0x404460
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0xcc8
mov rax, qword [0x00424338]
mov qword [rsp + 0xca0], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
movsxd rdi, edx
xor edx, edx
mov rbx, r8
mov rsi, rcx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0xa0], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x4a1]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x4a0], 0
call sub.msvcrt.dll_memset
lea rdx, str.___s__
lea rcx, [rsp + 0x20]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_sprintf]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r9, [rsp + 0xa0]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_sprintf]
mov rbx, qword [rsp + 0xce8]
mov byte [rdi + rsi], 0
inc edi
xor ecx, ecx
movsxd r8, edi
add r8, rsi
movzx edx, byte [rsp + rcx + 0x4a0]
test dl, dl
je 0x404561
inc rcx
mov byte [r8], dl
inc edi
inc r8
cmp rcx, 0x800
jl 0x404541
movsxd rcx, edi
mov eax, edi
mov rdi, qword [rsp + 0xcb8]
mov byte [rcx + rsi + 1], 0
mov byte [rcx + rsi + 2], 0
mov rsi, qword [rsp + 0xcc0]
mov rcx, qword [rsp + 0xca0]
call fcn.00419e60
add rsp, 0xcc8
ret
Function at 0x405020
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x00424338]
mov qword [rsp + 0x420], rax
mov rbx, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x20]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
xor edx, edx
mov r8, qword [r8]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
mov rcx, qword [rsp + 0x420]
call fcn.00419e60
add rsp, 0x430
pop rbx
ret

Function at 0x4056c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x00424338]
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov rsi, rdx
xor edx, edx
mov ebx, ecx
lea ecx, [rdx + 0xa]
mov qword [r11 - 0x18], rdi
mov rbp, r8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x405766
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x40575d
nop
cmp dword [rsp + 0x40], ebx
jne 0x40574b
mov r9d, dword [rsp + 0x28]
mov rdx, rbp
mov rcx, rsi
mov r8d, r9d
call fcn.00405690
test al, al
jne 0x40574b
mov r8, rbp
mov rdx, rsi
mov ecx, r9d
call fcn.004056c0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x405720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
test rax, rax
mov rbp, qword [rsp + 0x170]
mov rbx, rax
je 0x4057ab
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
call fcn.00419e60
add rsp, 0x178
ret
Function at 0x407300
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
test rcx, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], r12
mov r12, rdx
mov rsi, rcx
je 0x407327
mov rcx, qword [rcx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ecx, byte [r12]
mov qword [rsp + 0x30], rbx
mov ebx, 0x1505
test ecx, ecx
mov eax, ebx
mov rdx, r12
je 0x40734f
nop
imul eax, eax, 0x21
inc rdx
add eax, ecx
movzx ecx, byte [rdx]
test ecx, ecx
jne 0x407340
xor r8d, r8d
lea rcx, [rsi + 8]
mov qword [rsp + 0x48], rdi
xor edx, edx
nop
mov edi, dword [rcx]
test edi, edi
je 0x40737e
cmp eax, edi
je 0x40741c
inc rdx
inc r8d
add rcx, 0x28
cmp rdx, 0x14
jl 0x407360
cmp r8d, 0x14
jge 0x40743b
movsxd rax, r8d
mov qword [rsp + 0x38], rbp
lea rdx, [0x0041cb08]
lea rdi, [rax + rax*4]
xor eax, eax
mov r8, r12
lea rbp, [rsi + rdi*8 + 0xc]
mov rcx, rbp
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call qword [sym.imp.msvcrt.dll_sprintf]
lea r12, [rsi + rdi*8 + 8]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
mov dword [r12], 0
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x407404
movzx eax, byte [rbp]
test eax, eax
je 0x407400
nop
nop
imul ebx, ebx, 0x21
inc rbp
add ebx, eax
movzx eax, byte [rbp]
test eax, eax
jne 0x4073f0
mov dword [r12], ebx
test rsi, rsi
mov rbp, qword [rsp + 0x38]
je 0x407417
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, r12
jmp 0x40744b
test rsi, rsi
movsxd rax, r8d
lea rcx, [rax + rax*4]
lea rdi, [rsi + rcx*8 + 8]
je 0x407436
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rdi
jmp 0x40744b
test rsi, rsi
je 0x407449
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x408930
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004275c0]
mov qword [rsp + 0x40], rbx
mov rbx, rcx
test rax, rax
jne 0x4089bc
mov qword [rsp + 0x48], rdi
lea rdi, [0x004275d0]
test rdi, rdi
je 0x40896b
mov rcx, qword [0x004275d0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x004275c0]
test rax, rax
jne 0x4089a5
mov ecx, 0x1750
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x408990
mov rcx, rax
call fcn.004086c0
jmp 0x408992
xor eax, eax
lea rcx, [0x00407d00]
mov qword [0x004275c0], rax
call fcn.004070d0
test rdi, rdi
mov rdi, qword [rsp + 0x48]
je 0x4089bc
mov rcx, qword [0x004275d0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x004275c0]
mov rdx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
jmp fcn.00407300

Function at 0x40a8f0
Capabilities:
Get mac address on windows

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov dword [rcx], 0
mov rbp, rcx
mov qword [rsp + 0x78], rdi
mov ecx, 0x2c0
mov qword [rsp + 0x50], r12
xor r12b, r12b
mov esi, edx
call qword [sym.imp.msvcrt.dll_malloc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x2c0
mov rcx, rax
mov rdi, rax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40a95d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
je 0x40aac1
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x60], rbx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x40aaab
test rdi, rdi
mov rbx, rdi
je 0x40aab9
cmp dword [rbx + 0x194], 6
jne 0x40aa9f
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_ntoa]
test rax, rax
mov r11, rax
je 0x40aa9f
lea r9, [rbx + 0x1b8]
test r9, r9
je 0x40aa9f
nop
nop
nop
lea r8, [r9 + 8]
mov rax, r11
sub r8, r11
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x40a9e3
inc rax
test ecx, ecx
jne 0x40a9d0
test edx, edx
je 0x40a9f4
mov r9, qword [r9]
test r9, r9
jne 0x40a9c0
jmp 0x40aa9f
movzx edx, byte [rbx + 0x19c]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x19b]
movzx r11d, byte [rbx + 0x19a]
movzx r9d, byte [rbx + 0x199]
movzx r8d, byte [rbx + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r10d
lea rdx, [0x0041ccd8]
lea rcx, [rbp + 4]
mov r12b, 1
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_sprintf]
movzx r11d, byte [rbx + 0x198]
mov byte [rbp + 0x84], r11b
movzx eax, byte [rbx + 0x199]
mov byte [rbp + 0x85], al
movzx eax, byte [rbx + 0x19a]
mov byte [rbp + 0x86], al
movzx eax, byte [rbx + 0x19b]
mov byte [rbp + 0x87], al
movzx eax, byte [rbx + 0x19c]
mov byte [rbp + 0x88], al
movzx eax, byte [rbx + 0x19d]
mov dword [rbp], 1
mov byte [rbp + 0x89], al
mov rbx, qword [rbx]
test rbx, rbx
jne 0x40a983
test rdi, rdi
je 0x40aab9
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x60]
mov al, r12b
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x58
ret
Function at 0x40b300
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x118
mov rax, qword [0x00424338]
mov qword [rsp + 0x100], rax
cmp byte [0x00428980], 0
jne 0x40b539
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
lea rcx, [rsp + 0x64]
xor ebx, ebx
xor edx, edx
mov r8d, 0x98
mov dword [rsp + 0x60], ebx
mov qword [r11 + 0x20], rdi
call sub.msvcrt.dll_memset
lea r8d, [rbx + 0x2c]
lea rcx, [rsp + 0x2c]
xor edx, edx
mov dword [rsp + 0x28], ebx
call sub.msvcrt.dll_memset
xor ecx, ecx
mov dword [0x004289a4], ebx
call fcn.004055d0
lea rdx, [0x0041cf98]
test rdx, rdx
mov rsi, rbx
je 0x40b39b
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x40b39b
mov rcx, rdx
call sub.KERNEL32.dll_LoadLibraryA
mov rsi, rax
lea rdx, [0x0041cfa8]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
mov rcx, rsi
mov rdi, rax
call fcn.004055d0
test rdi, rdi
mov rsi, qword [rsp + 0x130]
je 0x40b3cb
lea rcx, [rsp + 0x28]
call rdi
jmp 0x40b3d6
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40b4fc
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x68]
movzx eax, word [rsp + 0x6c]
cmp edx, 5
mov dword [0x00428994], edx
mov dword [0x00428998], ecx
mov dword [0x004289a0], eax
jne 0x40b4b3
test ecx, ecx
jne 0x40b42c
mov dword [0x00428990], 1
jmp 0x40b529
cmp ecx, 1
jne 0x40b440
mov dword [0x00428990], 2
jmp 0x40b529
cmp ecx, 2
jne 0x40b529
cmp byte [rsp + 0xfa], 1
jne 0x40b46a
cmp word [rsp + 0x28], 9
jne 0x40b46a
mov dword [0x00428990], 3
jmp 0x40b529
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40b4a7
cmp word [rsp + 0xf8], 0x8000
je 0x40b4a7
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40b529
mov dword [0x00428990], 5
jmp 0x40b529
mov dword [0x00428990], 4
jmp 0x40b529
cmp edx, 6
jne 0x40b529
test ecx, ecx
jne 0x40b4d1
cmp byte [rsp + 0xfa], 1
setne bl
add ebx, edx
mov dword [0x00428990], ebx
jmp 0x40b529
cmp ecx, 1
jne 0x40b4eb
cmp byte [rsp + 0xfa], cl
sete bl
add ebx, 8
mov dword [0x00428990], ebx
jmp 0x40b529
cmp ecx, 2
jne 0x40b529
mov dword [0x00428990], 0xa
jmp 0x40b529
xor ecx, ecx
call fcn.00406ef0
lea rdx, str._error_
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.004108b0
lea rdx, str._comm__detect_OS_type_failed:__s
mov rcx, rax
mov r8, rdi
call fcn.004109b0
mov rbx, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x138]
mov byte [0x00428980], 1
mov rcx, qword [rsp + 0x100]
call fcn.00419e60
add rsp, 0x118
ret
Function at 0x40c130
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
lea rax, [0x0041d078]
mov rbx, rcx
mov byte [rcx + 0x18], 0
mov qword [rcx], rax
mov rcx, qword [rcx + 0x10]
xor esi, esi
mov qword [rsp + 0x58], rdi
test rcx, rcx
mov edi, edx
je 0x40c1bf
lea edx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40c1bf
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov byte [rbx + 0x18], sil
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x20], 0x103
jne 0x40c1bf
mov rcx, qword [rbx + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 0x19], sil
mov dword [rbx + 8], esi
je 0x40c1bf
lea edx, [rsi + 1]
mov rcx, rbx
call fcn.0040c130
mov qword [rbx + 0x10], rsi
mov dword [rbx + 8], esi
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x40c1d8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xa0], rsi
mov rsi, qword [rsp + 0x50]
test dil, 1
mov rdi, qword [rsp + 0x58]
je 0x40c1f7
mov rcx, rbx
call fcn.00419af0
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x40c910
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov rcx, qword [rcx]
mov rax, r8
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rdi, rdx
lea rdx, [r11 - 0x18]
mov qword [r11 - 0x20], rdx
lea rdx, [r11 - 0x14]
lea r9, [r11 - 0x10]
mov qword [r11 - 0x28], rdx
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, eax
jne 0x40c96b
mov ecx, dword [rsp + 0x34]
mov dword [rdi], ecx
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.RegQueryValueEx_failed:_d.
mov ecx, 4
mov r8d, eax
call fcn.0040e440
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x40c9a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2878
call fcn.00419e90
sub rsp, rax
mov rax, qword [0x00424338]
mov qword [rsp + 0x2840], rax
mov qword [rsp + 0x2870], rbx
mov qword [rsp + 0x2868], rbp
mov rbx, rcx
mov qword [rsp + 0x2860], rsi
mov rbp, rdx
mov rsi, r8
lea rcx, [rsp + 0x41]
mov r8d, 0x27ff
xor edx, edx
mov qword [rsp + 0x2858], rdi
mov dword [rsp + 0x30], 0x2800
mov byte [rsp + 0x40], 0
mov rdi, r9
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
lea r11, [rsp + 0x30]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rdi, qword [rsp + 0x2858]
test eax, eax
mov ebx, eax
jne 0x40ca75
mov rax, qword [rsi]
mov edx, dword [rsp + 0x30]
test rax, rax
je 0x40ca4e
cmp rax, rdx
jbe 0x40ca51
mov qword [rsi], rdx
mov r8, qword [rsi]
test r8, r8
je 0x40ca73
lea rdx, [rsp + 0x40]
dec r8
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strncpy]
mov r11, qword [rsi]
mov byte [r11 + rbp - 1], 0
mov eax, ebx
mov rsi, qword [rsp + 0x2860]
mov rbp, qword [rsp + 0x2868]
mov rbx, qword [rsp + 0x2870]
mov rcx, qword [rsp + 0x2840]
call fcn.00419e60
add rsp, 0x2878
ret

Function at 0x40cb00
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x40cb40
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rsp + 0x28], ecx
mov rcx, qword [r10]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
pop rdi
ret
Function at 0x40ce00
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x00424338]
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x40ced2
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], al
call sub.msvcrt.dll_memset
mov r8, qword [rbx + 8]
test r8, r8
lea rdx, [0x0041d19c]
lea rcx, [rsp + 0x50]
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x40cebb
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x40cebb
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
mov byte [rsp + 0x20], al
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
lea rcx, [rsp + 0x28]
call fcn.0040ce00
lea rcx, [rsp + 0x28]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rcx, qword [rbx + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x160]
call fcn.00419e60
add rsp, 0x170
pop rbx
ret

Function at 0x40cfc0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x10], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
je 0x40cfee
lea rcx, str.Wow64Redirection::disabler_____
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x40d010
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
je 0x40d03e
lea rcx, str.Wow64Redirection::restore_____
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [rbx + 0x18]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret