joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c640
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42c8c6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42c8ba
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00583272], 0
jne 0x42c69a
xor edx, edx
xor ebx, ebx
jmp 0x42c6e0
xor edx, edx
jmp 0x42c6c5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041ba00
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c69e
add rax, 0x1268
call fcn.0042c5c0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42c854
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42c6db
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.004113c0
test rax, rax
jne 0x42c72c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c6db
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42c76c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c6db
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42c8ad
lea r10, [0x00555658]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42c7ef
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42c825
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c6db
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42c8a5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42c6db
cmp rbx, 0x200
ja 0x42c894
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00422240
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042c5c0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.0045d0a0
mov rax, r8
call fcn.0045d020
mov rax, r8
mov ecx, 0x40
call fcn.0045d040
mov edx, 0x200
nop
call fcn.0045d080
nop
mov qword [rsp + 8], rax
call fcn.00461860
mov rax, qword [rsp + 8]
jmp fcn.0042c640
Function at 0x441400
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x441567
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441412
cmp edx, ecx
jne 0x441555
nop word [rax + rax]
test rsi, rsi
jne 0x441555
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441474
nop
call fcn.0045e880
xorps xmm15, xmm15
mov r14, qword [0x00583488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00441320
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x441550
mov rdx, qword [0x00530488]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x441545
mov rcx, qword [0x00530480]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00530ef0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00530ef0], rax
nop
mov edx, 1
lea rsi, [0x00530ef8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x441533
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004a5341]
mov ebx, 0x28
nop
call fcn.00432940
mov rax, rsi
mov rcx, rdx
call fcn.0045d020
call fcn.00430fe0
lea rax, [0x004a46f1]
mov ebx, 0x23
call fcn.00432940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ada0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00441400
Function at 0x44c040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44c1b7
movzx edx, byte [rax]
test edx, edx
jne 0x44c074
nop dword [rax]
test r8b, r8b
jne 0x44c074
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44c087
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44c177
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44c165
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44c157
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44c0dd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44c120
mov eax, 1
cmp rax, rbx
ja 0x44c10b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0045d0e0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44c14f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44c113
mov rcx, r11
mov eax, r12d
jmp 0x44c0e2
mov rcx, rbx
call fcn.0045d020
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045d020
mov eax, r8d
mov rcx, rbx
call fcn.0045d0e0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44c1ad
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44c170
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44c08d
mov eax, edx
mov rcx, rbx
call fcn.0045d020
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045d020
nop
int3
Function at 0x453580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45362f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00453680]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045ac60
xorps xmm15, xmm15
mov r14, qword [0x00583488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045ada0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00453580
Function at 0x45cb80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403183
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408be0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ada0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403160
cmp byte [0x0058326b], 0
je 0x45cb95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x459de0
jmp 0x403160

Function at 0x45cba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00583520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0058326b], 0
je 0x45cbd5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005837e0]
aesenc xmm0, xmmword [0x005837f0]
aesenc xmm0, xmmword [0x00583800]
movq rax, xmm0
ret
jmp 0x408e00

Function at 0x45cbe0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00583520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0058326b], 0
je 0x45cc16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005837e0]
aesenc xmm0, xmmword [0x005837f0]
aesenc xmm0, xmmword [0x00583800]
movq rax, xmm0
ret
jmp 0x408e60

Function at 0x45e8e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45e914
mov rcx, 0x28
jmp 0x45e91f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00583488], rcx
pop rbp
ret
Function at 0x473fc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47408a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x00583488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47406f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0048bae0]
xor ebx, ebx
mov rcx, rdx
call fcn.00445480
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004745a0
inc rbx
cmp rcx, rbx
jae 0x47405e
mov edi, 1
lea rsi, [0x0048bae0]
call fcn.00445560
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004bf1c8]
lea rsi, [0x004beb68]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ada0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00473fc0
Function at 0x431100
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
test rsi, rsi
je 0x431242
test rbx, rbx
je 0x431242
test r15, r15
je 0x431242
lea rcx, [0x0044e990]
call sub.KERNEL32_GetModuleHandleA
mov rdi, rax
test rdi, rdi
je 0x431242
mov r13, qword [rbp + 0x78]
mov r12, qword [rbp + 0x70]
lea rdx, [0x0044e999]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [rsi], rax
lea rdx, [0x0044e9b2]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [rbx], rax
lea rdx, [0x0044e9cd]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r15], rax
lea rdx, [0x0044e9ec]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r14], rax
lea rdx, [0x0044ea07]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r12], rax
lea rdx, [0x0044ea35]
mov rcx, rdi
call sub.KERNEL32_GetProcAddress
mov qword [r13], rax
mov rax, qword [rsi]
mov qword [0x0045f8e0], rax
cmp qword [r14], 0
je 0x43121e
cmp qword [r12], 0
jne 0x4311ec
lea rax, [0x004310b0]
mov qword [r12], rax
mov rcx, qword [r13]
test rcx, rcx
je 0x431231
cmp qword [rsi], 0
je 0x431242
cmp qword [rbx], 0
je 0x431242
cmp qword [r15], 0
je 0x431242
cmp qword [r14], 0
je 0x431242
cmp qword [r12], 0
je 0x431242
xor eax, eax
test rcx, rcx
setne al
jmp 0x431244
lea rax, [0x004310c0]
mov qword [r14], rax
cmp qword [r12], 0
jne 0x4311ec
jmp 0x4311e1
lea rcx, [0x004310b0]
mov qword [r13], rcx
cmp qword [rsi], 0
jne 0x4311fb
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x433810
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rsi, rcx
cmp qword [0x0045fcd8], 0
je 0x433840
cmp rsi, 0xffffffffffffff7f
jbe 0x4338bc
jmp 0x433a82
lea rcx, [rbp - 0x28]
call sub.KERNEL32_GetSystemInfo
mov eax, dword [rbp]
lea ecx, [rax - 1]
test rcx, rax
jne 0x433a9b
mov edx, 0xffffffff
mov ecx, dword [rbp - 0x24]
add edx, ecx
test rdx, rcx
jne 0x433a9b
mov qword [0x0045fce8], rax
mov qword [0x0045fce0], rcx
movaps xmm0, xmmword [0x0044eb70]
movups xmmword [0x0045fcf0], xmm0
mov dword [0x0045fd00], 5
mov dword [0x0045fca0], 5
call sub.KERNEL32_GetTickCount
and eax, 0xfffffff0
xor eax, 0x55555558
mov qword [0x0045fcd8], rax
cmp rsi, 0xffffffffffffff7f
ja 0x433a82
mov rcx, qword [0x0045f958]
test rcx, rcx
je 0x433a82
lea rdx, [rsi + 0x50]
mov rax, qword [0x0045f940]
cmp rax, rdx
jbe 0x433a5a
mov rbx, qword [0x0045fce8]
mov rdx, 0xffffffffffffffb0
sub rdx, rsi
add rdx, rax
lea rax, [rbx + rdx - 1]
xor edx, edx
div rbx
mov r15, rax
dec r15
imul r15, rbx
lea rbx, [0x0045fca8]
nop
mov rax, qword [rbx]
cmp rax, rcx
ja 0x433921
add rax, qword [rbx + 8]
cmp rax, rcx
ja 0x43392c
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x433910
xor ebx, ebx
mov eax, dword [rbx + 0x18]
and eax, 9
cmp eax, 1
jne 0x433a5a
mov rcx, qword [rbx + 8]
mov rax, rcx
sub rax, r15
jb 0x433a5a
mov rdi, qword [rbx]
add rcx, rdi
lea rdx, [0x0045fca8]
nop dword [rax + rax]
cmp rdi, rdx
ja 0x43396e
cmp rcx, rdx
ja 0x433a5a
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x433960
test r15, r15
je 0x433a5a
add rdi, rax
lea r14, [rbp - 0x28]
mov rsi, r15
mov r8d, 0x30
mov rcx, rdi
mov rdx, r14
call sub.KERNEL32_VirtualQuery
cmp qword [rbp - 0x10], rsi
ja 0x433a5a
test rax, rax
je 0x433a5a
cmp qword [rbp - 0x28], rdi
jne 0x433a5a
cmp qword [rbp - 0x20], rdi
jne 0x433a5a
cmp dword [rbp - 8], 0x1000
jne 0x433a5a
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call sub.KERNEL32_VirtualFree
test eax, eax
je 0x433a5a
mov rax, qword [rbp - 0x10]
add rdi, rax
sub rsi, rax
jne 0x43398a
sub qword [rbx + 8], r15
sub qword [0x0045fc88], r15
mov rax, qword [0x0045f958]
mov rdi, qword [0x0045f940]
sub rdi, r15
lea rdx, [rax + 0x10]
mov ebx, edx
and ebx, 0xf
neg edx
and edx, 0xf
test rbx, rbx
cmove rdx, rbx
lea rbx, [rax + rdx]
mov rcx, rdi
sub rcx, rdx
mov qword [0x0045f958], rbx
mov qword [0x0045f940], rcx
or rcx, 1
mov qword [rax + rdx + 8], rcx
mov qword [rax + rdi + 8], 0x50
mov rax, qword [0x0045fcf8]
mov qword [0x0045f960], rax
jmp 0x433a5d
xor r15d, r15d
call fcn.00433ab0
add rax, r15
jne 0x433a84
mov rax, qword [0x0045f940]
cmp rax, qword [0x0045f960]
jbe 0x433a82
mov qword [0x0045f960], 0xffffffffffffffff
xor eax, eax
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.004456d0
ud2
Function at 0x436c70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, edx
call sub.KERNEL32_GetFileAttributesA
mov ecx, eax
cmp ecx, 0xffffffff
je 0x436cad
xor eax, eax
test sil, 2
je 0x436ca6
and ecx, 1
je 0x436ca6
call fcn.004450d0
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x28
pop rsi
pop rbp
ret
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.00439140
jmp 0x436c70

Function at 0x437040
Capabilities:
Check if file exists

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov ebx, edx
mov r14, rcx
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x40], r8
test bh, 0xc0
jne 0x437071
mov rax, qword [0x0045ceb0]
mov ecx, 0xc000
and ecx, dword [rax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
shr eax, 8
mov edi, 3
cmp eax, 6
ja 0x43709c
shl rax, 0x28
sar rax, 0x28
lea rcx, [0x0044ec30]
mov edi, dword [rcx + rax*4]
test bh, 1
je 0x4370c1
lea rax, [rbp + 0x48]
mov qword [rbp - 0x18], rax
mov al, byte [0x00458680]
and al, byte [rbp + 0x40]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x4370d1
mov rcx, r14
call sub.KERNEL32_GetFileAttributesA
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x4370ea
cmp al, 2
je 0x4370f1
cmp al, 1
jne 0x4371cf
mov edx, 0x40000000
jmp 0x4370f6
mov edx, 0x80000000
jmp 0x4370f6
mov edx, 0xc0000000
mov eax, ebx
and eax, 0x70
add eax, 0xfffffff0
shr eax, 4
cmp eax, 3
mov esi, 3
cmovb esi, eax
xor r8d, r8d
cmp edx, 0x80000000
sete r8b
test bl, 4
cmove r8d, esi
mov dword [rbp - 0x18], 0x18
mov qword [rbp - 0x10], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [rbp - 8], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x30], 0
lea r9, [rbp - 0x18]
mov rcx, r14
call sub.KERNEL32_CreateFileA
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x4371af
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov ecx, esi
call fcn.00436fa0
mov edx, edi
or edx, 0x2000
test eax, eax
cmove edx, edi
and edx, 0xfffff8ff
mov ecx, esi
call fcn.00438810
cmp eax, 0xffffffff
jne 0x4371d9
mov ecx, 4
call fcn.00439090
mov rcx, rsi
call sub.KERNEL32_CloseHandle
mov eax, 0xffffffff
jmp 0x4371d9
call sub.KERNEL32_GetLastError
movzx eax, ax
test bh, 1
mov edx, 0x50
mov ecx, 2
cmovne ecx, edx
cmp eax, 0x6e
cmovne ecx, eax
jmp 0x4371d4
mov ecx, 1
call fcn.00439090
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x4371f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15d, r8d
mov rdi, rdx
mov r12d, ecx
cmp dword [0x0045c690], r12d
jbe 0x43725b
lea eax, [r15 + 1]
xor r14d, r14d
cmp eax, 2
jb 0x4373eb
movsxd rax, r12d
lea rcx, [0x0045c6a0]
mov qword [rbp - 0x10], rax
mov eax, dword [rcx + rax*4]
test ah, 0x40
jne 0x437275
mov ecx, r12d
mov rdx, rdi
mov r8d, r15d
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.00437a40
mov ecx, 0xfffffffa
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.00439090
test ah, 2
jne 0x4373eb
xor r14d, r14d
mov qword [rbp - 0x20], r15
mov dword [rbp + 4], r12d
nop dword [rax]
mov ebx, r15d
sub ebx, r14d
mov ecx, r12d
mov rdx, rdi
mov r8d, ebx
call fcn.00437a40
mov esi, eax
cmp esi, 0xffffffff
je 0x4373e5
test esi, esi
je 0x4373eb
mov r8d, esi
mov edx, 0x1a
mov rcx, rdi
call fcn.00436c40
mov r13, rax
test r13, r13
je 0x4372ea
mov rax, qword [rbp - 0x10]
lea rcx, [0x0045c6a0]
or byte [rcx + rax*4 + 1], 2
mov esi, r13d
sub esi, edi
je 0x4373eb
lea edx, [rsi - 1]
cmp byte [rdi + rdx], 0xd
jne 0x43730d
add rdx, rdi
mov r8d, 1
mov ecx, r12d
call fcn.00437a40
cmp eax, 0xffffffff
je 0x4373e5
mov qword [rbp - 0x18], r13
mov dword [rbp], ebx
mov dword [rbp - 4], r14d
mov qword [rbp - 0x28], rsi
mov eax, esi
lea rbx, [rdi + rax]
lea rsi, [rdi + rax - 1]
mov r14, rdi
mov qword [rbp - 0x30], rdi
jmp 0x43733c
inc r13
mov eax, r12d
add r14, rax
mov rdi, r13
mov r8, rbx
sub r8, rdi
mov edx, 0xd
mov rcx, rdi
call fcn.00436c40
test rax, rax
mov r13, rbx
je 0x43735a
mov r13, rax
mov r12, r13
sub r12, rdi
cmp rdi, r14
je 0x437373
mov r8d, r12d
mov rcx, r14
mov rdx, rdi
call fcn.00436050
cmp r13, rsi
jb 0x437330
mov rdi, qword [rbp - 0x30]
sub r14, rdi
add r12, r14
mov r14d, dword [rbp - 4]
add r14d, r12d
mov rax, qword [rbp - 0x28]
cmp eax, dword [rbp]
jae 0x4373c0
cmp qword [rbp - 0x18], 0
jne 0x4373eb
mov rax, qword [rbp - 0x10]
lea rcx, [0x0045c6a0]
mov eax, dword [rcx + rax*4]
mov ecx, 0x2000
and eax, ecx
or eax, r12d
je 0x4373cc
jmp 0x4373eb
cmp qword [rbp - 0x18], 0
jne 0x4373eb
test r12d, r12d
jne 0x4373eb
mov eax, r12d
add rdi, rax
mov r15, qword [rbp - 0x20]
cmp r14d, r15d
mov r12d, dword [rbp + 4]
jb 0x437290
jmp 0x4373eb
mov r14d, 0xffffffff
mov eax, r14d
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x437a40
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x0045c690], ecx
jbe 0x437a7c
movsxd rax, ecx
lea rcx, [0x00460530]
movsxd rcx, dword [rcx + rax*4]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call sub.KERNEL32_ReadFile
cmp eax, 1
jne 0x437a8d
mov eax, dword [rbp - 4]
jmp 0x437a86
mov ecx, 6
call fcn.00439090
nop
add rsp, 0x30
pop rbp
ret
call sub.KERNEL32_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x437a86
jmp 0x437a81
Function at 0x437ad0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x0045c690], ecx
jbe 0x437b0c
movsxd rax, ecx
lea rcx, [0x00460530]
movsxd rcx, dword [rcx + rax*4]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call sub.KERNEL32_WriteFile
cmp eax, 1
jne 0x437b18
mov eax, dword [rbp - 4]
jmp 0x437b1d
mov ecx, 6
call fcn.00439090
jmp 0x437b1d
call fcn.00439140
nop
add rsp, 0x30
pop rbp
ret

Function at 0x43ac10
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call sub.KERNEL32_DeleteFileA
cmp eax, 1
jne 0x43ac2c
xor eax, eax
add rsp, 0x20
pop rbp
ret
add rsp, 0x20
pop rbp
jmp fcn.00439140

Function at 0x43aeb0
Capabilities:
Timestomp file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rdi, rdx
call fcn.00439a40
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x43aef7
test rdi, rdi
je 0x43aefe
mov rcx, qword [rdi]
lea rdx, [rbp - 8]
call fcn.0043ac40
cmp eax, 1
jne 0x43af31
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x10]
call fcn.0043ac40
cmp eax, 1
je 0x43af1e
jmp 0x43af31
mov ecx, 0xffffffff
jmp 0x43af3e
lea rdi, [rbp - 0x20]
mov rcx, rdi
call sub.KERNEL32_GetLocalTime
lea rdx, [rbp - 8]
mov rcx, rdi
call sub.KERNEL32_SystemTimeToFileTime
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
lea r8, [rbp - 8]
lea rdx, [rbp - 0x10]
mov rcx, rsi
mov r9, rdx
call sub.KERNEL32_SetFileTime
xor ecx, ecx
test eax, eax
jne 0x43af3e
call fcn.00439140
mov ecx, eax
mov eax, ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x43c490
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, edx
call sub.KERNEL32_GetFileAttributesA
mov ecx, eax
cmp ecx, 0xffffffff
je 0x436cad
xor eax, eax
test sil, 2
je 0x436ca6
and ecx, 1
je 0x436ca6
call fcn.004450d0
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x28
pop rsi
pop rbp
ret
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.00439140
jmp 0x436c70