joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4138c0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040e4d0
mov rcx, qword [rbp + 0x90]
call fcn.0040e4d0
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040e340
cmp qword [rbp + 0x90], 0
je 0x413a86
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040e9f0
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x413971
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x4139ab
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x4139a4
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.00410630
jmp 0x4139ab
sub eax, 1
test eax, eax
jne 0x413976
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.00413490
cmp qword [rbp + 0x68], 0
je 0x4139e9
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.00413640
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040e970
jmp 0x413a85
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.00412be0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.00413640
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040e970
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x413a5e
cmp byte [0x00d56e68], 0
jne 0x413a5e
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00412be0
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.00413640
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040e970
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x413a85
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.00413780
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040e970
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040e420
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040e420
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4147c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x4147e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x414804
cmp eax, 1
jae 0x414809
cmp ecx, 5
jbe 0x414815
mov dword [0x00d529b0], 0x7f
jmp 0x41481f
mov dword [0x00d529b0], 0x409
add rsp, 0x28
ret
Function at 0x414a70
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00414a60
mov ebx, eax
test ebx, ebx
je 0x414abb
cmp dword [0x00c9f4a4], 0xffffffff
jne 0x414a94
mov ecx, 0xe2
call fcn.0040dff0
mov ecx, ebx
call fcn.00414a40
test rax, rax
jne 0x414aad
mov ecx, 0xe2
call fcn.0040dff0
jmp 0x414abb
mov ecx, dword [0x00c9f4a4]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x414ad0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00d56f44], 0
je 0x414b0b
mov ecx, dword [0x00c9f4a4]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x414b1f
call fcn.00414a70
mov ecx, dword [0x00c9f4a4]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x414b1f
mov rax, qword [0x00d56f78]
jmp 0x414b1f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x00c9f4a4]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x42f260
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
nop
mov ecx, 0x104
lea rdx, [rbp + 0x254]
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x42f37c
lea rbx, [rbp + 0x254]
mov word [rbx + 4], 0
mov rcx, rbx
lea rdx, [rbp + 0x48]
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x42f362
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x48]
mov r8d, 0x106
call fcn.004100c0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov r8d, 1
call fcn.004108f0
test eax, eax
jle 0x42f362
xor rsi, rsi
cmp qword [rbp + 0x40], 0
je 0x42f312
mov rax, qword [rbp + 0x40]
mov esi, dword [rax - 4]
xor rdi, rdi
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x42f325
mov rax, qword [rbp + 0x28]
mov edi, dword [rax - 4]
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.00410060
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, esi
add r8d, 1
mov r9d, edi
sub r9d, esi
call fcn.00410630
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.00410420
jmp 0x42f37b
add rbx, 2
cmp word [rbx], 0
jne 0x42f35e
add rbx, 4
test rbx, rbx
je 0x42f37b
cmp word [rbx], 0
jne 0x42f2b2
nop
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.0040e420
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x468]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x432210
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
mov rcx, qword [rbp + 0x20]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x28]
test eax, 0x400
je 0x4322c3
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x4322c3
or eax, 0xffffffff
mov dword [rbp + 0x28], eax
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.0042f870
test al, al
je 0x4322c3
mov rcx, qword [rbp + 0x48]
call fcn.00432d10
test al, al
je 0x4322af
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00432980
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0043ee50
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.00410420
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x28], eax
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e420
lea rcx, [rbp + 0x48]
call fcn.0040e340
mov eax, dword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x432340
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x2c], edx
mov byte [rbp + 0x3f], r8b
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
xor rax, rax
mov dword [rbp + 0x28], eax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x30]
call fcn.0040e9f0
movzx rax, byte [rbp + 0x3f]
test al, al
je 0x4323ff
mov rcx, qword [rbp + 0x30]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
test eax, 0x400
je 0x4323ff
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x50]
call fcn.0042f870
test al, al
je 0x4323ff
mov rcx, qword [rbp + 0x50]
call fcn.00432d10
test al, al
je 0x4323f2
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x30]
call fcn.00432980
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
call fcn.0043ee50
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x50]
call fcn.00410420
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.0040e9f0
mov rcx, qword [rbp + 0x58]
call fcn.0040ffc0
mov rcx, rax
mov edx, dword [rbp + 0x2c]
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x43241f
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x28], eax
nop
lea rcx, [rbp + 0x40]
mov edx, 4
call fcn.0040e420
mov eax, dword [rbp + 0x28]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x432470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x48], 0
nop
xor rax, rax
mov byte [rbp + 0x2f], al
mov rcx, qword [rbp + 0x20]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x432526
mov eax, ebx
test eax, 0x400
je 0x43251a
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x48]
call fcn.0042f870
test al, al
je 0x43251a
mov rcx, qword [rbp + 0x48]
call fcn.00432d10
test al, al
je 0x432507
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00432980
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0043ee50
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
call fcn.00410420
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
test ebx, 1
setne al
mov byte [rbp + 0x2f], al
nop
lea rcx, [rbp + 0x30]
xor r15b, r8b
ret 2
add byte [rax], al
call fcn.0040e420
lea rcx, [rbp + 0x48]
call fcn.0040e340
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x58]
pop rax

Function at 0x432700
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne sil
test sil, sil
jne 0x432772
call sub.kernel32.dll_GetLastError_2
mov edi, eax
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43276b
mov ecx, eax
test ecx, 0x400
je 0x43276b
test eax, 0x10
je 0x43276b
mov rcx, rbx
call fcn.0040ffc0
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
setne sil
jmp 0x432772
mov ecx, edi
call sub.kernel32.dll_SetLastError
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x432dc0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.0040ffc0
mov rcx, rax
xor rdx, rdx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x43b660
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x43b687
movzx rax, word [rbp + 0x2c]
jmp 0x43b689
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x43ce10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.0043cbb0
mov ebx, eax
mov rax, qword [0x00d51938]
cmp byte [rax], 0
je 0x43cf48
mov rcx, qword [0x00d50f28]
call fcn.00409740
call fcn.00406b90
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043cdd0]
mov r8d, 1
movsxd r9, esi
call fcn.00411e80
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x0043cfe8]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x43cf8e
mov rcx, qword [0x00d56f48]
call fcn.004121f0
mov rcx, rax
mov rax, qword [0x00d50d98]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043cdd0]
call fcn.00412060
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x43e7e0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
nop
mov dword [rbp + 0x54], 0xffffffff
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x70]
call fcn.0040e9f0
lea rcx, [rbp + 0x48]
call fcn.0040eca0
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
lea rdx, [rbp + 0x40]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x43e891
mov ecx, dword [rbp + 0x44]
call fcn.00406850
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.0040ffc0
mov rcx, rax
mov edx, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43e887
mov rcx, qword [rbp + 0x58]
lea rdx, [0x0043e904]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x34]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43e887
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x54], eax
nop
mov rcx, qword [rbp + 0x58]
call fcn.00406880
nop
lea rcx, [rbp + 0x48]
call fcn.0040e340
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x43f700
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040eb80
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.004147a0
mov esi, eax
cmp esi, 0x104
jbe 0x43f75d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00406850
mov rdi, rax
jmp 0x43f761
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.004147a0
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x43f7b4
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x43f798
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x43f7c6
mov rcx, rdi
call fcn.00406880
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x4ab510
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb5
mov r8, rcx
xor rdx, rdx
mov ecx, edx
and ecx, 0x3f
mov r9, r8
shr r9, cl
and r9b, 0xff
xor al, r9b
add edx, 1
cmp edx, 8
jne 0x4ab518
nop
ret

Function at 0x4eecf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov qword [rbp + 0x60], r8
mov rcx, rsi
mov rdx, qword [rbp + 0x60]
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x20], 0
jne 0x4eed27
mov rcx, rbp
call fcn.004eebe0
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_LoadResource
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x28], 0
jne 0x4eed46
mov rcx, rbp
call fcn.004eebe0
mov rcx, qword [rbx + 0x28]
call sub.kernel32.dll_LockResource
mov rdi, rax
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call sub.kernel32.dll_SizeofResource
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call fcn.004ee060
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x500590
Capabilities:
Resume thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x19], 0
jne 0x5005c3
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x500621
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x1d], 0
jne 0x500621
mov rax, qword [rbp + 0x20]
cmp byte [rax + 0x68], 0
jne 0x500621
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x1b], 0
mov byte [rax + 0x19], 0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x50064b
lea rcx, [rbp + 0x38]
mov rdx, qword [0x00d517a8]
call fcn.004146d0
mov rcx, qword [0x004c2da8]
mov dl, 1
mov r8, qword [rbp + 0x38]
call fcn.0043d050
mov rcx, rax
call fcn.0040d3b0
jmp 0x50064b
lea rcx, [rbp + 0x30]
mov rdx, qword [0x00d517a8]
call fcn.004146d0
mov rcx, qword [0x004c2da8]
mov dl, 1
mov r8, qword [rbp + 0x30]
call fcn.0043d050
mov rcx, rax
call fcn.0040d3b0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e420
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x500b00
Capabilities:
Suspend thread

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x50]
movzx rax, byte [rax + 0x1b]
mov byte [rbp + 0x3f], al
nop
mov rax, qword [rbp + 0x50]
mov byte [rax + 0x1b], 1
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x10]
call sub.kernel32.dll_SuspendThread
mov rcx, qword [rbp + 0x50]
test eax, eax
setge dl
call fcn.00500460
jmp 0x500b5b
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x500b80
Capabilities:
Resume thread

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rbx + 0x10]
call sub.kernel32.dll_ResumeThread
mov esi, eax
mov rcx, rbx
test esi, esi
setge dl
call fcn.00500460
cmp esi, 1
jne 0x500baa
mov byte [rbx + 0x1b], 0
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x504720
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x00d5bef0], 0
jne 0x5047d5
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x00d5bee8]
mov qword [rbx], rax
lea rcx, [0x00cb0660]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.00406ce0
lea rax, [0x005046e0]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.00504710
mov dword [rsi + 1], eax
mov rax, qword [0x00d5bef0]
mov qword [rsi + 5], rax
mov qword [0x00d5bef0], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x504793
mov qword [0x00d5bee8], rbx
mov rax, qword [0x00d5bef0]
mov rsi, qword [0x00d5bef0]
mov rcx, qword [rsi + 5]
mov qword [0x00d5bef0], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x144f27700
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x144f2770d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x144f2771d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x144f27705
lea eax, [rcx + 1]
jmp 0x144f2772b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x144f2773e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x144f27724
sub eax, 3
jb 0x144f2775e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x144f277ad
sar eax, 1
movsxd rbp, eax
jb 0x144f27794
jmp 0x144f2776c
add ebx, ebx
jne 0x144f2776a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x144f27794
inc ecx
add ebx, ebx
jne 0x144f2777a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x144f27794
call r11
adc ecx, ecx
add ebx, ebx
jne 0x144f2778d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x144f2777c
add ecx, 2
jmp 0x144f27799
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.144f276c2
jmp 0x144f2770d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x4f23000]
mov eax, dword [rdi]
or eax, eax
je 0x144f2780d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4f2749c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x144f277bd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x144f27807
mov qword [rbx], rax
add rbx, 8
jmp 0x144f277dd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x144f27851
cmp al, 0xef
ja 0x144f27839
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x144f27819
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x144f27828
mov eax, dword [rdi]
add rdi, 4
jmp 0x144f27828
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.144f278d0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.144f278d0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x144f278c0
sub rsp, 0xffffffffffffff80
jmp 0x140001125

Function at 0x140001b38
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b82
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b82
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b82
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b82
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b82
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b84
xor al, al
add rsp, 0x28
ret