joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440100
Capabilities:
Read file on windows

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x44], r8d
mov qword [rsp + 0x38], r9
call sub.msvcrt.dll__get_osfhandle
mov r13, rax
mov rbx, qword [0x0048a058]
mov rcx, r13
xor rdx, rdx
xor r8, r8
mov r9d, 1
call sub.kernel32.dll_SetFilePointer_1
mov edi, eax
mov rcx, r13
mov rdx, qword [0x0048a058]
mov r8d, dword [rsp + 0x44]
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x44016c
xor rax, rax
jmp 0x440221
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0
jne 0x44017e
xor rax, rax
jmp 0x440221
mov rax, qword [rsp + 0x38]
mov esi, dword [rax]
mov eax, esi
test eax, eax
jbe 0x4401d4
cmp eax, 3
jb 0x4401c9
cmp byte [rbx], 0xa
jne 0x44019b
cmp byte [rbx + 1], 0xd
je 0x4401a6
cmp byte [rbx], 0xd
jne 0x4401c9
cmp byte [rbx + 1], 0xa
jne 0x4401c9
mov byte [rbx + 2], 0
mov esi, ebx
sub esi, dword [0x0048a058]
add esi, 2
mov rcx, r13
mov edx, edi
add edx, esi
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer_1
jmp 0x4401d4
sub eax, 1
add rbx, 1
test eax, eax
ja 0x44018b
nop
mov rax, qword [0x0048a398]
mov ecx, dword [rax]
call fcn.0043b390
mov rcx, qword [0x0048a398]
mov ecx, dword [rcx]
test eax, eax
setne dl
movzx rdx, dl
mov r8, qword [0x0048a058]
mov r9d, esi
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x28], eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x46c5d0
Capabilities:
Parse pe header

Disassembly:
push rsi
push rbx
mov rax, rcx
movsxd r10, dword [rax + 0x3c]
lea rcx, [rcx + r10]
cmp word [rax], 0x5a4d
jne 0x46c5ec
cmp dword [rcx], 0x4550
je 0x46c5f4
mov eax, 1
jmp 0x46c648
lea rax, [rcx + 0x108]
xor r10, r10
xor r11, r11
xor rbx, rbx
movzx esi, word [rcx + 6]
sub esi, 1
cmp ebx, esi
jg 0x46c62f
add esi, 1
cmp dword [rax + 0x14], r10d
jbe 0x46c624
mov r10d, dword [rax + 0x14]
mov r11d, dword [rax + 0x14]
add r11d, dword [rax + 0x10]
add rax, 0x28
add ebx, 1
cmp ebx, esi
jne 0x46c612
nop
mov dword [rdx], r11d
lea rax, [rcx + 0xa8]
mov ecx, dword [rax]
mov dword [r8], ecx
mov eax, dword [rax + 4]
mov dword [r9], eax
xor rax, rax
pop rbx
pop rsi
ret
Function at 0x46c650
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
mov byte [rbp + 0x88], dl
mov qword [rbp + 0x90], r8
mov dword [rbp + 0x98], r9d
cmp byte [rbp + 0x88], 0
je 0x46c69c
mov rcx, qword [rbp + 0x80]
movzx rdx, byte [rbp + 0x88]
call fcn.00407e80
mov qword [rbp + 0x80], rax
nop
cmp qword [rbp + 0x90], 0
jbe 0x46c8ba
cmp dword [rbp + 0xa0], 0
jne 0x46c6c9
mov rcx, qword [rbp + 0x90]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize_1
mov dword [rbp + 0xa0], eax
mov rcx, qword [rbp + 0x90]
xor rdx, rdx
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 0x28], rax
mov rax, qword [rbp + 0x80]
cmp qword [rax + 0x28], 0
jne 0x46c735
mov rcx, qword [rbp + 0x80]
call fcn.0046bd70
mov rcx, qword [0x0046b048]
mov dl, 1
lea r8, [0x0046c94c]
call fcn.00425bd0
mov rcx, rax
call fcn.004094d0
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 0x28]
mov edx, 4
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov rcx, qword [rbp + 0x80]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x80]
cmp qword [rax + 8], 0
jne 0x46c79c
mov rcx, qword [rbp + 0x80]
call fcn.0046bd70
mov rcx, qword [0x0046b048]
mov dl, 1
lea r8, [0x0046c974]
call fcn.00425bd0
mov rcx, rax
call fcn.004094d0
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x54]
lea r8, [rbp + 0x50]
lea r9, [rbp + 0x4c]
call fcn.0046c5d0
test eax, eax
jne 0x46c7cb
cmp dword [rbp + 0x50], 0
jbe 0x46c7cb
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0xa0], eax
mov dword [rbp + 0x58], 0xffffffff
mov eax, dword [rbp + 0x98]
mov ecx, dword [rbp + 0xa0]
sub ecx, 5
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], ecx
jg 0x46c81a
add ecx, 1
mov rax, qword [rbp + 0x80]
mov rax, qword [rax + 8]
movsxd rdx, dword [rbp + 0x5c]
mov eax, dword [rax + rdx]
add eax, 1
cmp eax, 0x4034b51
jne 0x46c811
mov eax, dword [rbp + 0x5c]
mov dword [rbp + 0x58], eax
jmp 0x46c81a
add dword [rbp + 0x5c], 1
cmp dword [rbp + 0x5c], ecx
jne 0x46c7ec
nop
cmp dword [rbp + 0x58], 0
jge 0x46c86a
mov eax, dword [rbp + 0x98]
mov ecx, dword [rbp + 0xa0]
sub ecx, 5
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], ecx
jg 0x46c869
add ecx, 1
mov rax, qword [rbp + 0x80]
mov rax, qword [rax + 8]
movsxd rdx, dword [rbp + 0x5c]
mov eax, dword [rax + rdx]
add eax, 1
cmp eax, 0x6054b51
jne 0x46c860
mov eax, dword [rbp + 0x5c]
mov dword [rbp + 0x58], eax
jmp 0x46c869
add dword [rbp + 0x5c], 1
cmp dword [rbp + 0x5c], ecx
jne 0x46c83b
nop
cmp dword [rbp + 0x58], 0
jge 0x46c899
mov rcx, qword [rbp + 0x80]
call fcn.0046bd70
mov rcx, qword [0x0046b048]
mov dl, 1
lea r8, [0x0046c9a0]
call fcn.00425bd0
mov rcx, rax
call fcn.004094d0
mov rcx, qword [rbp + 0x80]
xor rdx, rdx
mov rax, qword [rbp + 0x80]
mov r8, qword [rax + 8]
mov r9d, dword [rbp + 0xa0]
call fcn.0046bdf0
cmp byte [rbp + 0x88], 0
je 0x46c915
mov rcx, qword [rbp + 0x80]
call fcn.00407ec0
mov qword [rbp + 0x80], rax
jmp 0x46c915
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x46e4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov qword [rsp + 0x40], 0xffffffff80000002
mov qword [rsp + 0x48], 0xffffffff80000001
cmp byte [0x0048988e], 0
je 0x46e51b
mov byte [0x0048988c], 1
xor rsi, rsi
movsxd rax, esi
mov rcx, qword [rsp + rax*8 + 0x40]
lea rdx, [0x0046e75c]
lea r8, [rsp + 0x98]
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x46e743
mov dword [rsp + 0x50], 0
lea rbx, [rsp + 0x58]
mov dword [rsp + 0x54], 0x40
mov rcx, qword [rsp + 0x98]
lea rdx, [0x0046e7a6]
xor r8, r8
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46e5b6
cmp dword [rsp + 0x50], 4
jne 0x46e59b
cmp dword [rbx], 0
setne al
mov byte [0x00489876], al
jmp 0x46e5b6
cmp dword [rsp + 0x50], 1
jne 0x46e5b6
mov rcx, rbx
call sub.msvcrt.dll__wtol
cmp eax, 1
sete al
mov byte [0x00489876], al
mov rcx, qword [rsp + 0x98]
lea rdx, [0x0046e7c6]
xor r8, r8
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46e615
cmp dword [rsp + 0x50], 4
jne 0x46e5fa
cmp dword [rbx], 0
setne al
mov byte [0x0048988c], al
jmp 0x46e615
cmp dword [rsp + 0x50], 1
jne 0x46e615
mov rcx, rbx
call sub.msvcrt.dll__wtol
cmp eax, 1
sete al
mov byte [0x0048988c], al
mov rcx, qword [rsp + 0x98]
lea rdx, [0x0046e7e8]
xor r8, r8
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46e674
cmp dword [rsp + 0x50], 4
jne 0x46e659
cmp dword [rbx], 0
setne al
mov byte [0x0048988d], al
jmp 0x46e674
cmp dword [rsp + 0x50], 1
jne 0x46e674
mov rcx, rbx
call sub.msvcrt.dll__wtol
cmp eax, 1
sete al
mov byte [0x0048988d], al
mov rcx, qword [rsp + 0x98]
lea rdx, [0x0046e80a]
xor r8, r8
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46e6d5
cmp dword [rsp + 0x50], 4
jne 0x46e6b7
movzx rax, word [rbx]
mov word [0x00489894], ax
jmp 0x46e6d5
cmp dword [rsp + 0x50], 1
jne 0x46e6d5
mov rcx, rbx
lea rdx, [rsp + 0x38]
xor r8, r8
call sub.msvcrt.dll_wcstol
mov word [0x00489894], ax
mov rcx, qword [rsp + 0x98]
lea rdx, [0x0046e824]
xor r8, r8
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46e736
cmp dword [rsp + 0x50], 4
jne 0x46e718
movzx rax, word [rbx]
mov word [0x00489896], ax
jmp 0x46e736
cmp dword [rsp + 0x50], 1
jne 0x46e736
mov rcx, rbx
lea rdx, [rsp + 0x38]
xor r8, r8
call sub.msvcrt.dll_wcstol
mov word [0x00489896], ax
mov rcx, qword [rsp + 0x98]
call sub.advapi32.dll_RegCloseKey_1
add esi, 1
cmp esi, 2
jne 0x46e51e
nop
mov al, 1
add rsp, 0xa8
pop rbx
pop rsi
ret
Function at 0x46f480
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov dword [rbp + 0x34], ecx
mov qword [rbp + 0x38], 0
nop
xor rcx, rcx
call fcn.00430580
test eax, eax
je 0x46f495
call fcn.0043ba40
call fcn.0043b6f0
cmp qword [0x004a7fe0], 0
je 0x46f544
xor rax, rax
mov rcx, qword [0x004a7fe0]
mov ebx, dword [rcx + 0x30]
sub ebx, 1
mov dword [0x004a7fe8], eax
cmp dword [0x004a7fe8], ebx
jg 0x46f537
add ebx, 1
lea rcx, [rbp + 0x38]
mov edx, 3
mov r8, qword [0x004a7ff0]
lea r9, [0x0046f5a0]
mov rax, qword [0x004a7fe0]
mov rax, qword [rax + 0x38]
movsxd r10, dword [0x004a7fe8]
lea r10, [r10 + r10*4]
mov rax, qword [rax + r10*8 + 0x20]
mov qword [rsp + 0x20], rax
call fcn.0040ba20
mov rcx, qword [rbp + 0x38]
call fcn.0040b560
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
add dword [0x004a7fe8], 1
cmp dword [0x004a7fe8], ebx
jne 0x46f4da
nop
mov rcx, qword [0x004a7fe0]
call fcn.00407520
mov rcx, qword [0x004a7ff0]
call fcn.0046f260
mov ecx, dword [rbp + 0x34]
call sub.kernel32.dll_ExitProcess_1
nop
lea rcx, [rbp + 0x38]
call fcn.0040a270
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x470df0
Capabilities:
Set current directory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x248
mov rbp, rsp
xor rdi, rdi
mov word [rbp + 0x238], 0x3d
add cx, 0x40
mov word [rbp + 0x23a], cx
mov word [rbp + 0x23c], 0x3a
mov word [rbp + 0x23e], 0
xor rsi, rsi
lea rcx, [rbp + 0x238]
call fcn.0042c4d0
mov rbx, rax
test rbx, rbx
je 0x470e4c
mov rcx, rbx
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
setne sil
test sil, sil
jne 0x470ec7
test rbx, rbx
je 0x470e63
mov ecx, 1
call sub.kernel32.dll_SetErrorMode
mov edi, eax
movzx rax, word [rbp + 0x23a]
mov word [rbp + 0x2e], ax
movzx rax, word [rbp + 0x23c]
mov word [rbp + 0x30], ax
mov word [rbp + 0x32], 0x5c
mov word [rbp + 0x34], 0
lea rcx, [rbp + 0x238]
lea rdx, [rbp + 0x2e]
call fcn.0042c840
lea rcx, [rbp + 0x2e]
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x470ebb
lea rcx, [0x00470ef0]
xor rdx, rdx
lea r8, [rbp + 0x20]
or r9d, 0xffffffff
call fcn.00471010
test rbx, rbx
je 0x470ec7
mov ecx, edi
call sub.kernel32.dll_SetErrorMode
mov rcx, qword [0x0048a610]
xor rdx, rdx
call fcn.0042eb80
lea rsp, [rbp + 0x248]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x471820
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
xor rdi, rdi
mov rcx, rbx
mov edx, 1
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x47184c
call sub.kernel32.dll_GetLastError_2
mov dword [0x00489b18], eax
test esi, esi
je 0x47185a
mov rcx, rbx
call fcn.00471870
mov edi, eax
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x471a80
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov word [rbp + 0x28], cx
mov word [rbp + 0x2a], 0x3a
mov word [rbp + 0x2c], 0x5c
mov word [rbp + 0x2e], 0
lea rcx, [rbp + 0x28]
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x471ab1
xor rax, rax
jmp 0x471ab3
mov al, 1
lea rsp, [rbp + 0x30]
pop rbp
ret

Function at 0x471ac0
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x260
mov rbp, rsp
mov word [rbp + 0x44], cx
mov word [rbp + 0x46], 0x3a
mov word [rbp + 0x48], 0x5c
mov word [rbp + 0x4a], 0
lea rcx, [rbp + 0x44]
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x471af3
mov al, 1
jmp 0x471b50
cmp eax, 2
je 0x471b4d
cmp eax, 5
je 0x471b4d
lea rcx, [rbp + 0x44]
lea rdx, [rbp + 0x4e]
mov r8d, 0x104
lea r9, [rbp + 0x258]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x471b4d
call sub.kernel32.dll_GetLastError_2
cmp eax, 5
jne 0x471b4d
mov al, 1
jmp 0x471b50
xor rax, rax
lea rsp, [rbp + 0x260]
pop rbp
ret

Function at 0x472140
Capabilities:
Set console window title

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov rbx, rcx
test rbx, rbx
je 0x47223e
mov rax, qword [0x0048a128]
cmp qword [rax], 0
jne 0x47223e
mov rax, qword [0x00489f78]
cmp byte [rax], 0
jne 0x47223e
mov ecx, 0x20c
call fcn.00405270
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x47223e
mov rcx, qword [rbp + 0x28]
mov edx, 0x104
call sub.kernel32.dll_GetConsoleTitleW
mov esi, eax
test esi, esi
je 0x47223e
mov rcx, rbx
call fcn.00429e60
lea rcx, [rbp + 0x28]
mov edx, esi
add edx, eax
add edx, dword [0x004a82a4]
add edx, 0xa
add edx, edx
mov edx, edx
call fcn.004052d0
cmp qword [rbp + 0x28], 0
je 0x47223e
mov rax, qword [0x0048a210]
cmp byte [rax], 0
je 0x4721f7
mov rax, qword [rbp + 0x28]
mov ecx, dword [0x004a82a4]
lea rcx, [rax + rcx*2]
mov rdx, rbx
call fcn.00429e80
jmp 0x47222c
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00472248]
call fcn.00429ea0
mov rcx, qword [rbp + 0x28]
call fcn.00429e60
mov dword [0x004a82a4], eax
mov rcx, qword [rbp + 0x28]
mov rdx, rbx
call fcn.00429ea0
mov rax, qword [0x0048a210]
mov byte [rax], 1
mov rcx, qword [rbp + 0x28]
call sub.kernel32.dll_SetConsoleTitleW
mov rcx, qword [rbp + 0x28]
call fcn.004052a0
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rbp
ret
Function at 0x472250
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x47228b
mov rax, qword [0x0048a128]
cmp qword [rax], 0
jne 0x47228b
mov rax, qword [0x0048a210]
cmp byte [rax], 0
je 0x47228b
call sub.kernel32.dll_SetConsoleTitleW
mov dword [0x004a82a4], 0
mov rax, qword [0x0048a210]
mov byte [rax], 0
add rsp, 0x28
ret

Function at 0x472ae0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov rax, qword [rbp + 0x28]
movzx rbx, word [rax]
mov rax, qword [rbp + 0x28]
movzx rax, word [rax + 2]
mov word [rbp + 0x3c], ax
mov rax, qword [rbp + 0x28]
movzx rsi, word [rax + 4]
mov rax, qword [rbp + 0x28]
movzx rax, word [rax + 6]
mov word [rbp + 0x3e], ax
mov qword [rbp + 0x30], rdx
mov r13d, 1
mov rcx, rbp
mov edx, ebx
mov rax, qword [rbp + 0x30]
movzx r8, word [rax]
call fcn.00472a90
mov ebx, eax
mov rcx, qword [rbp + 0x30]
add rcx, 2
mov qword [rbp + 0x30], rcx
movzx rax, word [rbp + 0x3c]
add ax, word [rcx]
mov word [rbp + 0x3c], ax
add rcx, 2
mov qword [rbp + 0x30], rcx
add si, word [rcx]
add rcx, 2
mov qword [rbp + 0x30], rcx
mov rcx, rbp
movzx rdx, word [rbp + 0x3e]
mov rax, qword [rbp + 0x30]
movzx r8, word [rax]
call fcn.00472a90
mov word [rbp + 0x3e], ax
mov rax, qword [rbp + 0x30]
add rax, 2
mov qword [rbp + 0x30], rax
mov edi, ebx
xor di, si
mov rcx, rbp
mov edx, edi
mov rax, qword [rbp + 0x30]
movzx r8, word [rax]
call fcn.00472a90
mov edi, eax
mov rax, qword [rbp + 0x30]
add rax, 2
mov qword [rbp + 0x30], rax
movzx rax, word [rbp + 0x3c]
movzx rcx, word [rbp + 0x3e]
xor ax, cx
mov ecx, edi
add cx, ax
mov eax, ecx
mov rcx, rbp
mov edx, eax
mov rax, qword [rbp + 0x30]
movzx r8, word [rax]
call fcn.00472a90
mov rcx, qword [rbp + 0x30]
add rcx, 2
mov qword [rbp + 0x30], rcx
add di, ax
xor bx, ax
movzx rcx, word [rbp + 0x3e]
xor cx, di
mov word [rbp + 0x3e], cx
movzx rcx, word [rbp + 0x3c]
xor di, cx
xor si, ax
mov word [rbp + 0x3c], si
mov esi, edi
add r13d, 1
cmp r13d, 9
jne 0x472b27
nop
mov rcx, rbp
mov edx, ebx
mov rax, qword [rbp + 0x30]
movzx r8, word [rax]
call fcn.00472a90
mov ebx, eax
mov rax, qword [rbp + 0x30]
add rax, 2
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x28]
mov word [rax], bx
mov rax, qword [rbp + 0x30]
add si, word [rax]
mov rax, qword [rbp + 0x28]
mov word [rax + 2], si
mov rax, qword [rbp + 0x30]
add rax, 2
mov qword [rbp + 0x30], rax
movzx rax, word [rbp + 0x3c]
mov rcx, qword [rbp + 0x30]
add ax, word [rcx]
mov rcx, qword [rbp + 0x28]
mov word [rcx + 4], ax
mov rax, qword [rbp + 0x30]
add rax, 2
mov qword [rbp + 0x30], rax
mov rcx, rbp
movzx rdx, word [rbp + 0x3e]
mov rax, qword [rbp + 0x30]
movzx r8, word [rax]
call fcn.00472a90
mov rcx, qword [rbp + 0x28]
mov word [rcx + 6], ax
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x4733f0
Capabilities:
Get common file path

Disassembly:
push rbp
mov byte [rsp - 0x60], 0
mov byte [rsp - 0x1060], 0
mov byte [rsp - 0x2060], 0
sub rsp, 0x2060
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x3c], edx
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
nop
mov eax, 1
movsxd rcx, eax
mov word [rbp + rcx*2 + 0x5e], 0x20
add eax, 1
cmp eax, 0x1001
jne 0x47343e
nop
mov eax, dword [rbp + 0x3c]
sub eax, 1
cmp eax, 0xffffffff
je 0x473470
test eax, eax
je 0x4734a2
sub eax, 1
test eax, eax
jne 0x4734fb
jmp 0x4734e2
mov ecx, 0x1000
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetTempPathW
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x60]
mov r8d, 0x1000
call fcn.0040a4c0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x58]
call fcn.0041c570
jmp 0x4734fb
xor rcx, rcx
mov edx, 0x1c
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
call sub.SHFolder.dll_SHGetFolderPathW
lea rcx, [rbp + 0x50]
lea rdx, [rbp + 0x60]
mov r8d, 0x1000
call fcn.0040a4c0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x50]
call fcn.0041c570
jmp 0x4734fb
lea rcx, [rbp + 0x48]
xor rdx, rdx
call fcn.004058f0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
call fcn.0041d860
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax]
call fcn.00427680
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x40]
call fcn.0040a830
nop
lea rcx, [rbp + 0x40]
mov edx, 4
call fcn.0040a350
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x2060]
pop rbp
ret
Function at 0x1400015b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r13d, dword [rcx + rax + 0x88]
add r13, rcx
mov rsi, rcx
mov ebp, edx
mov edi, dword [r13 + 0x1c]
mov eax, dword [r13 + 0x20]
test edi, edi
je 0x14000162e
xor r14d, r14d
lea r12, [rcx + rax]
nop dword [rax]
mov eax, dword [r12 + r14*4]
lea rbx, [rsi + rax]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov edx, 0x35
mov r8, rax
mov rax, rbx
add r8, rbx
jmp 0x14000161c
movsx ecx, byte [rax]
add rax, 1
lea ecx, [rcx + rdx*2]
add edx, ecx
cmp r8, rax
jne 0x140001610
cmp ebp, edx
je 0x14000163f
add r14, 1
cmp r14, rdi
jne 0x1400015e8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [r13 + 0x24]
lea rdx, [rsi + r14*2]
movzx eax, word [rdx + rax]
lea rax, [rsi + rax*4]
mov eax, dword [rax + rdi]
add rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400019c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14007f480]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rdi, r8
mov ebp, edx
mov rbx, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x3283c47
mov rcx, rax
mov r12, rax
call fcn.1400015b0
lea rdx, [0x14007f02c]
mov r8d, 0x35
mov r13, rax
lea rcx, [rdx + 0xb]
mov eax, 0x43
jmp 0x140001a27
movsx eax, byte [rdx]
add rdx, 1
lea eax, [rax + r8*2]
add r8d, eax
cmp rcx, rdx
jne 0x140001a20
mov edx, r8d
mov rcx, r12
movsxd r14, ebp
call fcn.1400015b0
mov r9d, 4
mov rdx, r14
xor ecx, ecx
mov r12, rax
mov r8d, 0x3000
call r13
mov r13, rax
xor eax, eax
test ebp, ebp
jle 0x140001a83
nop dword [rax]
mov rdx, rax
and edx, 7
movzx edx, byte [rdi + rdx]
xor dl, byte [rbx + rax]
mov byte [r13 + rax], dl
add rax, 1
cmp r14, rax
jne 0x140001a68
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 2
lea rdx, [0x1400018b0]
call fcn.1400016f0
movsxd rax, dword [0x140004030]
test eax, eax
jle 0x140001ad0
mov edx, dword [0x140004034]
test edx, edx
jle 0x140001ad0
mov rdx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [r13 + rax], rdx
mov rdx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsxd rax, dword [0x140004034]
mov qword [r13 + rax], rdx
lea r9, [rsp + 0x34]
mov r8d, 0x20
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
xor ecx, ecx
mov r9, r13
mov qword [rsp + 0x28], 0
lea r8, [0x140001590]
mov dword [rsp + 0x20], 0
call r12
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x140001b22
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.140001d30
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, qword [0x14007f480]
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
xor eax, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, 0x2a
mov r8d, 0x17
mov edx, 0x402
mov ecx, eax
call qword [sym.imp.USER32.dll_PostThreadMessageA]
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0
mov rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140001b99
cmp dword [rsp + 0x38], 0x402
je 0x140001bb8
mov rax, qword [rsp + 0x68]
sub rax, qword [rbx]
jne 0x140001c3e
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
cmp qword [rsp + 0x40], 0x17
jne 0x140001b99
cmp qword [rsp + 0x48], 0x2a
jne 0x140001b99
mov rdi, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rdi
mov ecx, 0x28a
mov esi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call rdi
sub eax, 0x258
sub eax, esi
cmp eax, 0x12b
ja 0x140001b99
mov rsi, qword [str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
movsxd rdi, dword [rsi + 4]
mov rcx, rdi
call sub.msvcrt.dll_malloc
lea rdx, [rsi + 0x18]
mov r8, rdi
mov r12, rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea r8, [rsi + 8]
mov edx, edi
mov rcx, r12
call fcn.1400019c0
mov rax, qword [rsp + 0x68]
sub rax, qword [rbx]
jne 0x140001c3e
mov rcx, r12
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.140002eb0
call fcn.140001d30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140002050
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002f30
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002f30
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]