joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008974
Capabilities:
Terminate process

Disassembly:
mov rax, rcx
lea rcx, [rdx + 0xf]
mov r8, rdx
neg r8
and r8, rcx
test rdx, rdx
mov ecx, 0x10
cmovne rcx, r8
sub rax, rcx
cmp rdx, 0x11
jl 0x1800089a0
movzx ecx, word [rax - 2]
sub rax, rcx
mov ecx, dword [0x180014180]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
lea rcx, [rcx + 8]
mov rdx, rax
jmp fcn.18000869a

Function at 0x180009136
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx]
mov rax, qword [rcx]
test rax, rax
je 0x18000916e
mov ecx, dword [0x180014180]
mov rdx, qword gs:[0x58]
mov rdi, qword [rdx + rcx*8]
mov rcx, rsi
call rax
cmp byte [rdi + 0x2ac8], 0
jne 0x180009181
mov rcx, qword [rsi]
movsx rdx, word [rcx + 0x10]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.180008974
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x180009189
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rbx, rax
mov edx, 1
mov rcx, rdi
mov r8, rsi
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush

Function at 0x18000937c
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
mov rdi, rax
lea rcx, str.could_not_load:
mov edx, 1
mov r8d, 0x10
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov ecx, 2
call rbx
mov rcx, qword [rsi + 8]
add rcx, 8
cmp qword [rsi], 0
mov rsi, rax
lea rdi, [0x180010e80]
cmovne rdi, rcx
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov edx, 1
mov rcx, rdi
mov r8, rax
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x18000943a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
lea rcx, str._n_bad_format__library_may_be_wrong_architecture_
mov edx, 1
mov r8d, 0x30
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, [0x18000faf6]
mov rcx, rax
call fcn.180007906
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x18000945f
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.180007906
mov ecx, 2
call rdi
mov rcx, rax
mov rdx, rsi
call fcn.180007906
mov ecx, 2
call rdi
lea rdx, [0x18000faf6]
mov rcx, rax
call fcn.180007906
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x180009ad4
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx]
mov qword [rcx], rdx
test rsi, rsi
je 0x180009b09
lea rdx, [rsi - 0x10]
mov rax, qword [rsi - 0x10]
cmp rax, 0x10
jae 0x180009b10
mov r8, qword [rsi]
mov cl, 1
call fcn.1800089c2
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.180009136
nop
add rsp, 0x20
pop rsi
ret
add rax, 0xfffffffffffffff0
mov qword [rsi - 0x10], rax
mov r8, qword [rsi]
xor ecx, ecx
add rsp, 0x20
pop rsi
jmp fcn.1800089c2

Function at 0x180009cd8
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movabs rbx, 0x4000000000000000
mov rax, qword [rcx]
test rax, rax
jle 0x180009d44
mov ecx, dword [0x180014180]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
lea rdi, [rcx + 8]
mov r14d, 0x10
xor r15d, r15d
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx + r14]
test rdx, rdx
je 0x180009d38
test qword [rdx], rbx
jne 0x180009d38
mov rcx, rdi
call fcn.18000869a
mov rax, qword [rsi]
inc r15
add r14, 0x10
cmp r15, rax
jl 0x180009d1b
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x180009d7c
test qword [rdx], rbx
jne 0x180009d7c
mov eax, dword [0x180014180]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [rax + 8]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.18000869a
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18000dc27
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.18000ca15
nop
add rsp, 0x28
jmp fcn.18000cd67
Function at 0x1400d9280
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400d92bc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400d92c6
add rdi, rbx
sub rsi, rbx
jne 0x1400d929a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14008d5e0
int3

Function at 0x1400d92d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14017e028]
xor rax, rsp
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
xor eax, eax
lea rcx, [0x140168e80]
movaps xmm0, xmmword [rsp + rax + 0x20]
xorps xmm0, xmmword [rax + rcx]
movaps xmmword [rsp + rax + 0x20], xmm0
add rax, 0x10
cmp rax, 0x30
jne 0x1400d930b
lea rdi, [rsi + 0xf8]
mov eax, dword [0x14018a254]
lea rcx, [rsp + 0x20]
bt eax, 0x19
jae 0x1400d9391
mov edx, 0x100
mov r8, rsi
call fcn.1400166a0
lea rax, [0x1400151a0]
test rdi, rdi
je 0x1400d935e
lea rcx, [0x140014440]
mov qword [rdi], rcx
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008fec0
nop
add rsp, 0x58
pop rdi
pop rsi
ret
bt eax, 9
jae 0x1400d93b9
mov edx, 0x100
mov r8, rsi
call fcn.140017890
lea rax, [0x140017d60]
test rdi, rdi
je 0x1400d935e
lea rcx, [0x140017a60]
jmp 0x1400d935b
mov rdx, rsi
call fcn.140124b10
lea rax, [0x140125460]
test rdi, rdi
je 0x1400d935e
lea rcx, [0x1401244a0]
jmp 0x1400d935b

Function at 0x1400db05d
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14008d2b8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14010a9e0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.14008e2ac
mov qword [rbx], rax
test rax, rax
je 0x1400db0b4
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400dc4b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400dc4db
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock inc dword [rsi]
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, rsi
call fcn.140120bb0
lock dec dword [rsi]
je 0x1400dc4fa
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.140120b50
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400013b0

Function at 0x14010b6d0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edx, 1
jmp fcn.140006530
Function at 0x406948
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x406956
and edx, 0x3fff
jmp fcn.004068a0

Function at 0x40695c
Capabilities:
Delete directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a170
mov ebx, eax
cmp eax, 1
je 0x40698c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40698c
mov al, 1
jmp 0x4069dd
test ebx, ebx
je 0x4069db
lea rcx, [rsp + 0x28]
call fcn.00403208
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a7ec
test al, al
je 0x4069d1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x4069dd
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x406a04
Capabilities:
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
call fcn.0040a170
mov esi, eax
mov rcx, rbp
call fcn.0040a170
mov edi, eax
mov ebx, 1
cmp esi, ebx
je 0x406a53
cmp eax, ebx
je 0x406a53
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x406a53
mov al, bl
jmp 0x406ae1
test esi, esi
jne 0x406a5f
test edi, edi
je 0x406adf
lea rcx, [rsp + 0x48]
call fcn.00403208
nop
lea rcx, [rsp + 0x38]
call fcn.00403208
nop
cmp esi, ebx
je 0x406a7d
cmp edi, ebx
jne 0x406a7f
xor bl, bl
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rcx, r12
call fcn.0040a82c
test al, al
je 0x406aca
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406ae1
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x406c84
Capabilities:
Create directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a170
mov ebx, eax
cmp eax, 1
je 0x406cc3
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x406cb6
mov al, 1
jmp 0x406d16
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406d14
test ebx, ebx
je 0x406d14
lea rcx, [rsp + 0x28]
call fcn.00403208
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a7ec
test al, al
je 0x406d0a
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406d16
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x406d48
Capabilities:
Delete file

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.00407d4c
cmp eax, 0xffffffff
je 0x406d7e
test al, 0x10
jne 0x406d7e
test al, 1
je 0x406d7e
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call fcn.004068a0
test al, al
je 0x406def
mov rcx, rbx
call fcn.0040a170
mov edi, eax
cmp eax, 1
je 0x406d9e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406d9e
mov al, 1
jmp 0x406def
test edi, edi
je 0x406ded
lea rcx, [rsp + 0x28]
call fcn.00403208
nop
cmp edi, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.0040a7ec
test al, al
je 0x406de3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406def
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x406e18
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x406ef8
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.0040339c
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
Function at 0x406f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rbp, r9
mov rsi, r8
mov r12b, dl
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
shl ebx, 2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edi, ebx
shl edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
xor r13d, edi
xor edi, edi
lea r15d, [rdi + 1]
mov ebx, edi
mov rdx, r14
mov rcx, rsi
call fcn.0040339c
cmp r12b, dil
je 0x407033
mov r10d, r13d
mov r9, rdi
mov r11d, 8
mov r8d, r10d
shr r10d, 4
and r8d, 0xf
cmp r8d, 0xa
lea eax, [r8 + 0x37]
lea edx, [r8 + 0x30]
movzx ecx, al
movzx eax, dl
cmovb ecx, eax
mov byte [rsp + r9 + 0x20], cl
add r9, r15
sub r11, r15
jne 0x406fb9
cmp rbp, rdi
mov byte [rsp + r9 + 0x20], dil
je 0x407016
mov eax, dword [rsi + 8]
cmp dword [rsi + 0xc], eax
jne 0x407000
mov rcx, rsi
call fcn.00402fec
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov word [rcx + rdx*2], 0x2e
add edx, r15d
mov word [rcx + rdx*2], di
mov dword [rsi + 8], edx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.00403670
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 2
cmove eax, r15d
add r13d, eax
cmp rbp, rdi
mov r12b, r15b
je 0x40704a
lea rdx, str..tmp
mov rcx, rsi
call fcn.00403670
mov rcx, qword [rsi]
call fcn.00408794
cmp al, dil
je 0x407064
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x407098
cmp rbp, rdi
je 0x407079
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbp
call fcn.00409248
jmp 0x407081
mov rcx, qword [rsi]
call fcn.00406c84
cmp al, dil
jne 0x4070c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x407098
cmp eax, 0xb7
jne 0x4070a4
add ebx, r15d
cmp ebx, 0x64
jb 0x406f99
mov rax, qword [rsi]
mov dword [rsi + 8], edi
mov word [rax], di
xor al, al
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov al, r15b
jmp 0x4070af
Function at 0x407d4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a170
mov ebx, eax
cmp eax, 1
je 0x407d79
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407dca
test ebx, ebx
je 0x407dc5
lea rcx, [rsp + 0x28]
call fcn.00403208
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a7ec
test al, al
je 0x407dbb
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x407dca
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, 0xffffffff
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x40881c
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rcx
movsxd rbx, dword [rcx + 8]
mov rdi, rbx
test ebx, ebx
je 0x40886c
shl rdi, 3
add ebx, 0xffffffff
sub rdi, 8
mov rax, qword [r12]
mov rsi, qword [rdi + rax]
test rsi, rsi
je 0x408868
mov rcx, qword [rsi]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x408844
mov dword [r12 + 8], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test eax, eax
je 0x408960
mov rcx, rdi
xor ebx, ebx
mov qword [rsp + 0x80], rbx
test eax, eax
je 0x4088ad
add rcx, rcx
call fcn.00402130
mov rbx, rax
mov qword [rsp + 0x80], rax
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x408956
cmp eax, edi
ja 0x408956
lea rcx, [rsp + 0x28]
call fcn.00403208
nop
xor r13d, r13d
xor edi, edi
test esi, esi
je 0x408937
mov rbp, rbx
cmp word [rbp], 0
jne 0x40892d
lea rdx, [rbx + r13*2]
lea rcx, [rsp + 0x28]
call fcn.0040339c
lea r13d, [rdi + 1]
mov ecx, 0x10
call fcn.00402130
mov qword [rsp + 0x88], rax
test rax, rax
je 0x408920
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.00403314
jmp 0x408922
xor eax, eax
mov rdx, rax
mov rcx, r12
call fcn.0040b8f0
inc edi
add rbp, 2
cmp edi, esi
jb 0x4088e1
cmp r13d, esi
sete dil
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
nop
mov rcx, rbx
call sub.msvcrt.dll_free
mov al, dil
jmp 0x408960
mov rcx, rbx
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x408a04
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 8], 0
mov rbx, rdx
je 0x408a23
cmp byte [rcx + 9], 0
je 0x408a23
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x408a57
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x408a46
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408a46
xor al, al
jmp 0x408a59
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x408af4
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x408b30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x0046c070]
cmp r8d, eax
cmova r8d, eax
jmp fcn.00408af4

Function at 0x408bf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x0046c070]
mov rcx, qword [rcx]
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x408c98
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.00408a60
xor ebx, ebx
cmp al, bl
je 0x408cc0
cmp qword [rsp + 0x50], rdi
je 0x408cc4
xor al, al
jmp 0x408cd2
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x409f80
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.0040339c
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret

Function at 0x40abb0
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x0044f9f0]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40ac16
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call rax
test eax, eax
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rax, qword [rsp + 0x48]
setne bpl
mov qword [rdi], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40ac68
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
imul rcx, rax
test bpl, bpl
mov qword [rbx], rcx
jne 0x40ac66
mov eax, dword [rsp + 0x38]
imul rax, rcx
mov qword [rsi], rax
mov eax, dword [rsp + 0x3c]
imul rax, qword [rbx]
mov qword [rdi], rax
mov al, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b45c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov r11, rsp
sub rsp, 0x40
mov rax, qword [r8]
mov dword [r8 + 8], 0
mov rsi, rcx
mov word [rax], 0
mov rcx, qword [rcx]
lea rax, [r11 + 0x30]
mov rbx, r8
mov qword [r11 - 0x18], rax
lea r9, [r11 - 0x10]
xor r8d, r8d
mov qword [r11 - 0x20], 0
mov rdi, rdx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x70], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b4bb
cmp eax, 0xea
jne 0x40b531
mov edx, dword [rsp + 0x70]
cmp edx, dword [rbx + 0xc]
mov dword [rsp + 0x78], edx
jbe 0x40b4d0
mov rcx, rbx
call fcn.00402f64
mov rax, qword [rbx]
lea rcx, [rsp + 0x78]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rbx]
cmp ecx, dword [rsp + 0x78]
cmova ecx, dword [rsp + 0x78]
mov dword [rsp + 0x70], ecx
shr rcx, 1
mov word [rdx + rcx*2], 0
xor ecx, ecx
cmp word [rdx], cx
je 0x40b52e
add rdx, 2
inc ecx
cmp word [rdx], 0
jne 0x40b522
mov dword [rbx + 8], ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x40b5e0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
call fcn.0040b5b8
xor r8d, r8d
cmp eax, r8d
je 0x40b61f
cmp qword [rsp + 0x20], r8
je 0x40b61f
mov rcx, r8
lea eax, [r8 + 0x40]
mov rdx, qword [rsp + 0x20]
shr rdx, cl
inc rcx
and edx, 1
add r8d, edx
dec rax
jne 0x40b604
mov eax, r8d
jmp 0x40b62e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x40b634
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
movabs rax, 0x100000000
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
mov qword [rcx], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40b676
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov al, 1
add rsp, 0x60
pop rbx
ret