joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416860
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.00411eb0
movzx rax, word [rbp + 0x4e]
cmp word [0x00df00a8], ax
ja 0x416948
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x00df04a8]
mov word [rbp + 0x4e], ax
ja 0x416948
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x416947
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x00df00a8]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x416901
mov ecx, eax
sub ecx, 1
jmp 0x416942
lea rdx, [0x00df00a8]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x416923
mov r8d, eax
add r8d, 1
jmp 0x416942
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x00df00b0]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.00416700
jmp 0x416947
cmp ecx, r8d
jae 0x4168d0
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x416a2a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x416a2a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00413e90
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.00413e90
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00413e90
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x00416a84]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x00416a94]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.00414310
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.00411f90
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret
Function at 0x416ca0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x00f2bc90]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x00f2bcb8], ax
jne 0x416d0b
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00f2bcba]
mov r8d, 0x55
call fcn.00413e90
lea rcx, [0x00f2bc90]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x416e16
lea rcx, [0x00f2bc90]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.00411eb0
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x416dd0
cmp byte [0x00f2bc88], 0
je 0x416d64
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.00416b30
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.00412500
jmp 0x416dd0
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.00416860
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.00412500
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x416dd0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x416daf
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00416e64]
call fcn.00414100
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.00416860
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.00414100
lea rcx, [0x00f2bc90]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x00f2bcb8], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.00413d90
lea rcx, [0x00f2bcba]
mov edx, 0xaa
mov r8, rax
call fcn.00416620
lea rcx, [0x00f2bc90]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.00411f90
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x417840
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.00412040
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00413e90
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.004141f0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00417660
test al, al
jne 0x41790e
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00413e90
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.004141f0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00417660
test al, al
jne 0x41790e
mov rcx, qword [rbp + 0x20]
call fcn.00411eb0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00411f90
lea rcx, [rbp + 0x70]
call fcn.00411eb0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x417980
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.00412040
mov rcx, qword [rbp + 0x90]
call fcn.00412040
nop
mov rcx, qword [rbp + 0x28]
call fcn.00411eb0
cmp qword [rbp + 0x90], 0
je 0x417b46
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.00412580
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x417a31
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x417a6b
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x417a64
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.00414400
jmp 0x417a6b
sub eax, 1
test eax, eax
jne 0x417a36
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.00417550
cmp qword [rbp + 0x68], 0
je 0x417aa9
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.00417700
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.00412500
jmp 0x417b45
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.00416ca0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.00417700
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.00412500
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x417b1e
cmp byte [0x00f2bc88], 0
jne 0x417b1e
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00416ca0
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.00417700
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.00412500
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x417b45
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.00417840
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.00412500
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.00411f90
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.00411f90
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x41a460
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.0041a450
mov ebx, eax
test ebx, ebx
je 0x41a4ab
cmp dword [0x00df0f60], 0xffffffff
jne 0x41a484
mov ecx, 0xe2
call fcn.00411b60
mov ecx, ebx
call fcn.0041a430
test rax, rax
jne 0x41a49d
mov ecx, 0xe2
call fcn.00411b60
jmp 0x41a4ab
mov ecx, dword [0x00df0f60]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret
Function at 0x41a4c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x00f2bd64], 0
je 0x41a4fb
mov ecx, dword [0x00df0f60]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41a50f
call fcn.0041a460
mov ecx, dword [0x00df0f60]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41a50f
mov rax, qword [0x00f2bd98]
jmp 0x41a50f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x00df0f60]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x46e6b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rcx, rbx
call fcn.00413d90
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x46e762
mov ecx, eax
test ecx, 0x400
je 0x46e757
test sil, sil
jne 0x46e6ef
mov al, 1
jmp 0x46e78c
test eax, 0x10
je 0x46e6ff
xor rax, rax
jmp 0x46e78c
mov rcx, rbx
call fcn.00413d90
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
cmp rax, 0xffffffffffffffff
je 0x46e74a
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x46e78c
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x20
sete al
jmp 0x46e78c
test eax, 0x10
sete al
jmp 0x46e78c
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x46e785
cmp eax, 3
je 0x46e785
cmp eax, 0x7b
je 0x46e785
mov rcx, rbp
mov rdx, rbx
call fcn.0046e660
test al, al
jne 0x46e78a
xor rax, rax
jmp 0x46e78c
mov al, 1
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rbp
ret

Function at 0x46ebd0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
call fcn.00413d90
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne sil
test sil, sil
jne 0x46ec42
call sub.kernel32.dll_GetLastError_2
mov edi, eax
mov rcx, rbx
call fcn.00413d90
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x46ec3b
mov ecx, eax
test ecx, 0x400
je 0x46ec3b
test eax, 0x10
je 0x46ec3b
mov rcx, rbx
call fcn.00413d90
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW_1
test eax, eax
setne sil
jmp 0x46ec42
mov ecx, edi
call sub.kernel32.dll_SetLastError
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x576840
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x00f31818], 0
jne 0x5768f5
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x00f31810]
mov qword [rbx], rax
lea rcx, [0x00e116dc]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.004093d0
lea rax, [0x00576800]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.00576830
mov dword [rsi + 1], eax
mov rax, qword [0x00f31818]
mov qword [rsi + 5], rax
mov qword [0x00f31818], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x5768b3
mov qword [0x00f31810], rbx
mov rax, qword [0x00f31818]
mov rsi, qword [0x00f31818]
mov rcx, qword [rsi + 5]
mov qword [0x00f31818], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x5c6440
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.00413d90
mov rcx, qword [rbx + 8]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
mov rcx, rbx
mov edx, eax
call fcn.005c59e0
add rsp, 0x20
pop rbx
ret
Function at 0x6a28f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x6a2932
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x6a2903
nop
ret
Function at 0x8823a0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x8825d2
mov rcx, qword [0x0051eb08]
mov dl, 1
call fcn.00552240
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.00411eb0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x8825aa
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.007590b0
test al, al
je 0x882594
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x00882664]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.0046fa70
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x882594
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x008826d2]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x882587
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00413e90
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x882587
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00413e90
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x882448
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.005520f0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.00411eb0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x883960
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x00f32d08]
cmp byte [rax + 0x151], 0
jne 0x883a03
cmp qword [0x00f32d40], 0
jne 0x8839a6
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x00e532e0]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x00f32d40], rax
cmp qword [0x00f32d38], 0
jne 0x8839c8
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x00f32d38], rax
cmp qword [0x00f32d48], 0
jne 0x883a03
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x00e532d8]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x00f32d48], rax
add rsp, 0x48
ret

Function at 0x884ef0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2c8], 0
je 0x884fdb
cmp dword [rbx + 0x120], 0
jne 0x884fd1
mov rax, qword [rbx + 0x2c8]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x00884dd0]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x118]
cmp dword [rax + 0x10], 0
je 0x884fd1
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x884f7f
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x118]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x884fd0
mov rcx, qword [rbx + 0x118]
mov edx, esi
call fcn.0054af10
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x884f90
nop
lea rax, [rbx + 0x120]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x8852f0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x00f32d08]
cmp qword [rax + 0x2c8], 0
je 0x8854b6
test sil, sil
jne 0x8853d8
cmp dword [rbx + 0x130], 0
jne 0x8853c9
mov rcx, rbx
call fcn.00889ae0
lea rcx, [0x008851c0]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x88538b
mov rax, qword [0x00f32d08]
cmp byte [rax + 0x18b], 0
je 0x88538b
mov rcx, qword [rbx + 0x198]
call fcn.004159c0
mov rdi, rax
test edi, edi
jl 0x88538a
mov rax, qword [rbx + 0x198]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x88536c
nop
mov rax, qword [rbx + 0x128]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x8853c8
mov rcx, qword [rbx + 0x128]
mov edx, edi
call fcn.0054af10
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x88539c
nop
lea rax, [rbx + 0x130]
add dword [rax], 1
jmp 0x8854b6
cmp dword [rbx + 0x130], 0
jle 0x8854b6
lea rax, [rbx + 0x130]
sub dword [rax], 1
cmp dword [rbx + 0x130], 0
jne 0x8854b6
cmp qword [rbx + 0xa8], 0
je 0x88544b
mov rax, qword [0x00f32d08]
cmp byte [rax + 0x18b], 0
je 0x88544b
mov rcx, qword [rbx + 0x198]
call fcn.004159c0
mov rdi, rax
test edi, edi
jl 0x88544a
mov rax, qword [rbx + 0x198]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x885429
nop
mov rax, qword [rbx + 0x128]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x885488
mov rcx, qword [rbx + 0x128]
mov edx, edi
call fcn.0054af10
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x88545c
nop
mov rax, qword [rbx + 0x128]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x198]
mov rdx, qword [0x0086f138]
mov r8d, 1
xor r9, r9
call fcn.00415d50
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0xac5cc0
Capabilities:
Check os version

Disassembly:
push rbp
push rbx
sub rsp, 0x148
mov rbp, rsp
mov bl, 0xb
mov dword [rbp + 0x2c], 0x114
lea rcx, [rbp + 0x2c]
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0xac5dae
mov eax, dword [rbp + 0x3c]
sub eax, 1
test eax, eax
je 0xac5cfd
sub eax, 1
test eax, eax
jne 0xac5dae
jmp 0xac5d30
cmp dword [rbp + 0x30], 4
jne 0xac5dae
cmp dword [rbp + 0x34], 0
jne 0xac5d15
xor rbx, rbx
jmp 0xac5dae
cmp dword [rbp + 0x34], 0xa
jne 0xac5d22
mov bl, 1
jmp 0xac5dae
cmp dword [rbp + 0x34], 0x5a
jne 0xac5dae
mov bl, 2
jmp 0xac5dae
cmp dword [rbp + 0x30], 4
jne 0xac5d40
cmp dword [rbp + 0x34], 0
jne 0xac5d40
mov bl, 3
jmp 0xac5dae
cmp dword [rbp + 0x30], 5
jne 0xac5d50
cmp dword [rbp + 0x34], 0
jne 0xac5d50
mov bl, 4
jmp 0xac5dae
cmp dword [rbp + 0x30], 5
jne 0xac5d60
cmp dword [rbp + 0x34], 1
jne 0xac5d60
mov bl, 5
jmp 0xac5dae
cmp dword [rbp + 0x30], 5
jne 0xac5d70
cmp dword [rbp + 0x34], 2
jne 0xac5d70
mov bl, 6
jmp 0xac5dae
cmp dword [rbp + 0x30], 6
jne 0xac5d80
cmp dword [rbp + 0x34], 0
jne 0xac5d80
mov bl, 7
jmp 0xac5dae
cmp dword [rbp + 0x30], 6
jne 0xac5d90
cmp dword [rbp + 0x34], 1
jne 0xac5d90
mov bl, 8
jmp 0xac5dae
cmp dword [rbp + 0x30], 6
jne 0xac5da0
cmp dword [rbp + 0x34], 2
jne 0xac5da0
mov bl, 9
jmp 0xac5dae
cmp dword [rbp + 0x30], 0xa
jne 0xac5dae
cmp dword [rbp + 0x34], 0
jne 0xac5dae
mov bl, 0xa
mov eax, ebx
lea rsp, [rbp + 0x148]
pop rbx
pop rbp
ret

Function at 0xad1930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x28
mov rbp, rsp
mov rbx, rcx
call fcn.00ad82f0
cmp byte [rax + 0xd9], 0
je 0xad1956
mov rcx, rbx
mov dl, 1
call fcn.0046e6b0
jmp 0xad1972
mov rcx, rbx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0xad196b
test eax, 0x10
je 0xad1970
xor rax, rax
jmp 0xad1972
mov al, 1
lea rsp, [rbp + 0x28]
pop rbx
pop rbp
ret
Function at 0xc633a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r13d, r9d
call fcn.00ad82f0
cmp byte [rax + 0xd8], 0
je 0xc633ff
call fcn.00c62df0
test al, al
je 0xc633ff
lea rcx, [rbp + 0x38]
mov rdx, rsi
mov r8, rdi
mov r9d, r13d
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov rax, qword [0x00f58be0]
mov qword [rsp + 0x28], rax
call fcn.00c630a0
jmp 0xc63546
cmp qword [rbp + 0x90], 0
jne 0xc63480
mov ecx, 1
cmp ecx, r13d
jg 0xc6347a
add r13d, 1
movzx rax, byte [rsi + 3]
movzx rdx, byte [rsi]
imul eax, edx
mov r8d, 0xff
xor edx, edx
div r8d
mov byte [rdi + 2], al
movzx rax, byte [rsi + 3]
movzx rdx, byte [rsi + 1]
imul eax, edx
mov r8d, 0xff
xor edx, edx
div r8d
mov byte [rdi + 1], al
movzx rax, byte [rsi + 3]
movzx rdx, byte [rsi + 2]
imul eax, edx
mov r8d, 0xff
xor edx, edx
div r8d
mov byte [rdi], al
add rsi, 4
add rdi, 3
add ecx, 1
cmp ecx, r13d
jne 0xc63418
nop
jmp 0xc63546
mov ecx, 1
cmp ecx, r13d
jg 0xc63545
add r13d, 1
mov r8, qword [rbp + 0x90]
movzx rax, byte [rsi + 3]
movzx rdx, byte [rsi]
imul eax, edx
mov r9d, 0xff
xor edx, edx
div r9d
movzx rdx, byte [rdi + 2]
sub eax, edx
mov edx, dword [r8]
imul edx, eax
shr edx, 0x12
add byte [rdi + 2], dl
mov r8, qword [rbp + 0x90]
movzx rax, byte [rsi + 3]
movzx rdx, byte [rsi + 1]
imul eax, edx
mov r9d, 0xff
xor edx, edx
div r9d
movzx rdx, byte [rdi + 1]
sub eax, edx
mov edx, dword [r8]
imul edx, eax
shr edx, 0x12
add byte [rdi + 1], dl
mov r8, qword [rbp + 0x90]
movzx rax, byte [rsi + 3]
movzx rdx, byte [rsi + 2]
imul eax, edx
mov r9d, 0xff
xor edx, edx
div r9d
movzx rdx, byte [rdi]
sub eax, edx
mov edx, dword [r8]
imul edx, eax
shr edx, 0x12
add byte [rdi], dl
add rsi, 4
add rdi, 3
add qword [rbp + 0x90], 4
add ecx, 1
cmp ecx, r13d
jne 0xc63493
nop
mov rax, rbx
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0xdd4d00
Capabilities:
Persist via run registry key

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], rbp
mov byte [rbp + 0x50], cl
nop
nop
cmp byte [rbp + 0x50], 0
je 0xdd4d97
mov rcx, qword [0x005c38e0]
mov dl, 1
call fcn.005c5770
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x38]
mov rdx, 0xffffffff80000001
call fcn.005c5a30
nop
nop
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00dd4ed0]
xor r8, r8
call fcn.005c5c50
test al, al
je 0xdd4d8b
mov rax, qword [0x00f25958]
mov rcx, qword [rax]
lea rdx, [rbp + 0x20]
call fcn.00888290
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00dd4f3c]
mov r8, qword [rbp + 0x20]
call fcn.005c6aa0
jmp 0xdd4d8b
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040eab0
jmp 0xdd4e00
mov rcx, qword [0x005c38e0]
mov dl, 1
call fcn.005c5770
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x38]
mov rdx, 0xffffffff80000001
call fcn.005c5a30
nop
nop
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00dd4ed0]
xor r8, r8
call fcn.005c5c50
test al, al
je 0xdd4dec
mov rcx, qword [rbp + 0x38]
lea rdx, [0x00dd4f3c]
call fcn.005c6440
jmp 0xdd4dec
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040eab0
jmp 0xdd4e00
nop
lea rcx, [rbp + 0x20]
call fcn.00411eb0
lea rsp, [rbp + 0x40]
pop rbp
ret