joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001fc0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x14000204c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140001fff
mov eax, 1
jmp 0x14000206e
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000204a
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x38]
jmp 0x14000206e
jmp 0x140002069
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
je 0x140002069
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000206e
mov eax, 1
add rsp, 0x48
ret

Function at 0x140002b20
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x140002b2e
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x140002b60
mov r8, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call fcn.140001fc0
jmp 0x140002be3
movzx eax, byte [0x140040cb0]
test eax, eax
jne 0x140002ba5
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140002b9e
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140040ca8], rax
mov byte [0x140040cb0], 1
cmp qword [0x140040ca8], 0
je 0x140002bd0
xor r9d, r9d
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [0x140040ca8]
jmp 0x140002be3
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x38
ret

Function at 0x140002bf0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x140002bfe
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x28
ret

Function at 0x140002eb0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x140002ec3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x140002f00
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x140002f18
cmp qword [rsp + 0x60], 0
je 0x140002f30
mov dword [rsp + 0x30], 1
jmp 0x140002f38
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140002f4e
mov eax, 0xd
jmp 0x140002f8e
xor eax, eax
test eax, eax
jne 0x140002f1e
mov rcx, qword [rsp + 0x60]
call fcn.140017a04
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret

Function at 0x140002fa0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x140002fb3
cmp qword [rsp + 0x70], 0
je 0x140002fcb
mov dword [rsp + 0x38], 1
jmp 0x140002fd3
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140002fe9
mov eax, 0xd
jmp 0x140003068
xor eax, eax
test eax, eax
jne 0x140002fb9
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140017a04
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x30], 1
jne 0x140003001
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret
Function at 0x140003070
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140002a30
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x58]
call fcn.140002de0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1400030f5
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x58]
call fcn.140002a70
mov eax, dword [rsp + 0x48]
jmp 0x1400031b3
mov dword [rsp + 0x44], pe_nt_image_headers64
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003182
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.140003070
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140003175
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x58]
call fcn.140002a70
mov eax, dword [rsp + 0x4c]
jmp 0x1400031b3
mov dword [rsp + 0x44], pe_nt_image_headers64
jmp 0x1400030fd
lea rcx, [rsp + 0x58]
call fcn.140002c20
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.140002b20
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call fcn.140002a70
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140010eb0
add rsp, 0x298
ret
Function at 0x140011c04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140011c4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140011c4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140011c4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140011c4e
cmp dword [rcx + 0x84], 0xe
jbe 0x140011c4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140011c50
xor al, al
add rsp, 0x28
ret

Function at 0x14001bb1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001b90c
Function at 0x14001fd18
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001fd9f
mov rsi, rbx
cmp word [rax], bp
je 0x14001fd5e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001fd48
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001fd44
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001cbc0
mov rdi, rax
test rax, rax
je 0x14001fd8c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140012e80
mov rbp, rdi
xor ecx, ecx
call fcn.14001cb84
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x406a50
Capabilities:
Set file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov esi, edx
mov rdi, rcx
call fcn.0040a2e4
mov ebx, eax
cmp eax, 1
je 0x406a85
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x406a85
mov al, 1
jmp 0x406ad8
test ebx, ebx
je 0x406ad6
lea rcx, [rsp + 0x28]
call fcn.004030d4
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a960
test al, al
je 0x406acc
mov edx, esi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406ad8
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x406af8
Capabilities:
Delete directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a2e4
mov ebx, eax
cmp eax, 1
je 0x406b28
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406b28
mov al, 1
jmp 0x406b79
test ebx, ebx
je 0x406b77
lea rcx, [rsp + 0x28]
call fcn.004030d4
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a960
test al, al
je 0x406b6d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406b79
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x406ba0
Capabilities:
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
call fcn.0040a2e4
mov esi, eax
mov rcx, rbp
call fcn.0040a2e4
mov edi, eax
mov ebx, 1
cmp esi, ebx
je 0x406bef
cmp eax, ebx
je 0x406bef
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x406bef
mov al, bl
jmp 0x406c7d
test esi, esi
jne 0x406bfb
test edi, edi
je 0x406c7b
lea rcx, [rsp + 0x48]
call fcn.004030d4
nop
lea rcx, [rsp + 0x38]
call fcn.004030d4
nop
cmp esi, ebx
je 0x406c19
cmp edi, ebx
jne 0x406c1b
xor bl, bl
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rcx, r12
call fcn.0040a9a0
test al, al
je 0x406c66
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406c7d
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x406e20
Capabilities:
Create directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a2e4
mov ebx, eax
cmp eax, 1
je 0x406e5f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x406e52
mov al, 1
jmp 0x406eb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406eb0
test ebx, ebx
je 0x406eb0
lea rcx, [rsp + 0x28]
call fcn.004030d4
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a960
test al, al
je 0x406ea6
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406eb2
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x406ee4
Capabilities:
Delete file

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.00407edc
cmp eax, 0xffffffff
je 0x406f1a
test al, 0x10
jne 0x406f1a
test al, 1
je 0x406f1a
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call fcn.00406a50
test al, al
je 0x406f8b
mov rcx, rbx
call fcn.0040a2e4
mov edi, eax
cmp eax, 1
je 0x406f3a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406f3a
mov al, 1
jmp 0x406f8b
test edi, edi
je 0x406f89
lea rcx, [rsp + 0x28]
call fcn.004030d4
nop
cmp edi, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.0040a960
test al, al
je 0x406f7f
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406f8b
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x406fb4
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x407094
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.00403214
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
Function at 0x4070ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rbp, r9
mov rsi, r8
mov r12b, dl
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
shl ebx, 2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edi, ebx
shl edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
xor r13d, edi
xor edi, edi
lea r15d, [rdi + 1]
mov ebx, edi
mov rdx, r14
mov rcx, rsi
call fcn.00403214
cmp r12b, dil
je 0x4071c4
mov r9d, r13d
mov r8, rdi
mov r10d, 8
mov edx, r9d
shr r9d, 4
and edx, 0xf
cmp edx, 0xa
lea ecx, [rdx + 0x30]
lea eax, [rdx + 0x37]
cmovb ax, cx
mov word [rsp + r8*2 + 0x20], ax
add r8, r15
sub r10, r15
jne 0x407151
cmp rbp, rdi
mov word [rsp + r8*2 + 0x20], di
je 0x4071a7
mov eax, dword [rsi + 8]
cmp dword [rsi + 0xc], eax
jne 0x407191
mov rcx, rsi
call fcn.00402eb0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov word [rcx + rdx*2], 0x2e
add edx, r15d
mov word [rcx + rdx*2], di
mov dword [rsi + 8], edx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.00403374
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 2
cmove eax, r15d
add r13d, eax
cmp rbp, rdi
mov r12b, r15b
je 0x4071db
lea rdx, [0x0044cad8]
mov rcx, rsi
call fcn.00403374
mov rcx, qword [rsi]
call fcn.0040893c
cmp al, dil
je 0x4071f5
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x407229
cmp rbp, rdi
je 0x40720a
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbp
call fcn.004093d8
jmp 0x407212
mov rcx, qword [rsi]
call fcn.00406e20
cmp al, dil
jne 0x407251
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x407229
cmp eax, 0xb7
jne 0x407235
add ebx, r15d
cmp ebx, 0x64
jb 0x407135
mov rax, qword [rsi]
mov dword [rsi + 8], edi
mov word [rax], di
xor al, al
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov al, r15b
jmp 0x407240
Function at 0x407edc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a2e4
mov ebx, eax
cmp eax, 1
je 0x407f09
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407f5a
test ebx, ebx
je 0x407f55
lea rcx, [rsp + 0x28]
call fcn.004030d4
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a960
test al, al
je 0x407f4b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x407f5a
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, 0xffffffff
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x4089c4
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rcx
movsxd rbx, dword [rcx + 8]
mov rdi, rbx
test ebx, ebx
je 0x408a14
shl rdi, 3
add ebx, 0xffffffff
sub rdi, 8
mov rax, qword [r12]
mov rsi, qword [rdi + rax]
test rsi, rsi
je 0x408a10
mov rcx, qword [rsi]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x4089ec
mov dword [r12 + 8], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test eax, eax
je 0x408b08
mov rcx, rdi
xor ebx, ebx
mov qword [rsp + 0x80], rbx
test eax, eax
je 0x408a55
add rcx, rcx
call fcn.004020b4
mov rbx, rax
mov qword [rsp + 0x80], rax
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x408afe
cmp eax, edi
ja 0x408afe
lea rcx, [rsp + 0x28]
call fcn.004030d4
nop
xor r13d, r13d
xor edi, edi
test esi, esi
je 0x408adf
mov rbp, rbx
cmp word [rbp], 0
jne 0x408ad5
lea rdx, [rbx + r13*2]
lea rcx, [rsp + 0x28]
call fcn.00403214
lea r13d, [rdi + 1]
mov ecx, 0x10
call fcn.004020b4
mov qword [rsp + 0x88], rax
test rax, rax
je 0x408ac8
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.0040318c
jmp 0x408aca
xor eax, eax
mov rdx, rax
mov rcx, r12
call fcn.0040b8bc
inc edi
add rbp, 2
cmp edi, esi
jb 0x408a89
cmp r13d, esi
sete dil
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
nop
mov rcx, rbx
call sub.msvcrt.dll_free
mov al, dil
jmp 0x408b08
mov rcx, rbx
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x408bac
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 8], 0
mov rbx, rdx
je 0x408bcb
cmp byte [rcx + 9], 0
je 0x408bcb
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x408bff
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x408bee
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408bee
xor al, al
jmp 0x408c01
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x408c84
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x408cc0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x0046709c]
cmp r8d, eax
cmova r8d, eax
jmp fcn.00408c84

Function at 0x408d80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x0046709c]
mov rcx, qword [rcx]
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x408e28
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.00408c08
xor ebx, ebx
cmp al, bl
je 0x408e50
cmp qword [rsp + 0x50], rdi
je 0x408e54
xor al, al
jmp 0x408e62
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x40a110
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.00403214
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret

Function at 0x40ad24
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x0044ca58]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40ad8a
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call rax
test eax, eax
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rax, qword [rsp + 0x48]
setne bpl
mov qword [rdi], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40addc
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
imul rcx, rax
test bpl, bpl
mov qword [rbx], rcx
jne 0x40adda
mov eax, dword [rsp + 0x38]
imul rax, rcx
mov qword [rsi], rax
mov eax, dword [rsp + 0x3c]
imul rax, qword [rbx]
mov qword [rdi], rax
mov al, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b4ac
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov r11, rsp
sub rsp, 0x40
mov rax, qword [r8]
mov dword [r8 + 8], 0
mov rsi, rcx
mov word [rax], 0
mov rcx, qword [rcx]
lea rax, [r11 + 0x30]
mov rbx, r8
mov qword [r11 - 0x18], rax
lea r9, [r11 - 0x10]
xor r8d, r8d
mov qword [r11 - 0x20], 0
mov rdi, rdx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x70], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b50b
cmp eax, 0xea
jne 0x40b581
mov edx, dword [rsp + 0x70]
cmp edx, dword [rbx + 0xc]
mov dword [rsp + 0x78], edx
jbe 0x40b520
mov rcx, rbx
call fcn.00402e28
mov rax, qword [rbx]
lea rcx, [rsp + 0x78]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rbx]
cmp ecx, dword [rsp + 0x78]
cmova ecx, dword [rsp + 0x78]
mov dword [rsp + 0x70], ecx
shr rcx, 1
mov word [rdx + rcx*2], 0
xor ecx, ecx
cmp word [rdx], cx
je 0x40b57e
add rdx, 2
inc ecx
cmp word [rdx], 0
jne 0x40b572
mov dword [rbx + 8], ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x40b600
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40b62b
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
add rsp, 0x68
ret

Function at 0x41839c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r13d, edx
xor edx, edx
mov rbp, r8
mov r14, rcx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x20]
mov rsi, r9
call sub.msvcrt.dll_memset
xor ebx, ebx
test rbp, rbp
je 0x418469
mov rdi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
test rdi, rdi
je 0x4183f8
test bl, bl
jne 0x4183f8
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test eax, eax
jne 0x41846b
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
mov r11, qword [r12]
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call qword [r11 + 0x20]
mov r11, qword [r12]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [r11 + 0x28]
mov r11, qword [r12]
mov rcx, r12
call qword [r11 + 0x30]
cmp eax, 0x40
ja 0x41847a
xor ecx, ecx
test eax, eax
je 0x418454
lea r8d, [rax - 1]
lea rdx, [rsp + 0x20]
shr r8d, 2
inc r8d
xor ecx, dword [rdx]
add rdx, 4
dec r8
jne 0x418449
test rsi, rsi
je 0x41845d
cmp ecx, dword [rsi]
jne 0x41847a
inc rbx
cmp rbx, rbp
jb 0x4183e2
xor eax, eax
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x41846b