joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429310
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.004290d0
mov ebx, eax
mov rax, qword [0x004652b8]
cmp byte [rax], 0
je 0x42943f
mov rcx, qword [0x004650a0]
call fcn.00406900
call fcn.00405a40
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x004292d0]
mov r8d, 1
movsxd r9, esi
call fcn.00410430
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x004294cc]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x429482
mov rcx, qword [0x0046c270]
call fcn.00410990
mov rcx, rax
mov rax, qword [0x00465048]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW
xor ecx, ecx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x004292d0]
call fcn.00410600
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x42b470
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov qword [rbp + 0x98], r9
nop
mov byte [rbp + 0x67], 0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
call fcn.0040c3e0
lea rcx, [rbp + 0x58]
call fcn.0040c6a0
mov rcx, qword [rbp + 0x58]
call fcn.0040d710
mov rcx, rax
lea rdx, [rbp + 0x50]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x42b580
mov ecx, dword [rbp + 0x54]
call fcn.00405700
mov qword [rbp + 0x68], rax
nop
mov rcx, qword [rbp + 0x58]
call fcn.0040d710
mov rcx, rax
mov edx, dword [rbp + 0x50]
mov r8d, dword [rbp + 0x54]
mov r9, qword [rbp + 0x68]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42b576
mov rcx, qword [rbp + 0x68]
lea rdx, [0x0042b5d8]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x44]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42b576
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x40], eax
mov rax, qword [rbp + 0x88]
mov ecx, dword [rbp + 0x40]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x48]
movzx ecx, word [rcx + 0x10]
mov dword [rax], ecx
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x14]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x98]
mov ecx, dword [rbp + 0x3c]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov byte [rbp + 0x67], 1
nop
mov rcx, qword [rbp + 0x68]
call fcn.00405730
nop
lea rcx, [rbp + 0x58]
call fcn.0040bcf0
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x42c8f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040c580
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.004146e0
mov esi, eax
cmp esi, 0x104
jbe 0x42c94b
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00405700
mov rdi, rax
jmp 0x42c94f
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.004146e0
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x42c9a5
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x42c986
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x42c9b7
mov rcx, rdi
call fcn.00405730
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x432670
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
mov edx, 0x58
xor r8, r8
call fcn.004069b0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x432dc0
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov byte [rbx], 0
mov esi, 0x3e8
Function at 0x435030
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
xor ecx, ecx
movzx r8, r8b
sub r8d, 1
mov eax, ecx
cmp eax, r8d
ja 0x4350b9
sub r8d, ecx
add r8d, 1
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov r9d, ecx
lea r10, [0x00462040]
mov r11d, ecx
movzx r11, byte [rdx + r11]
lea rbx, [0x00462440]
mov esi, ecx
add esi, 1
mov esi, esi
movzx rsi, byte [rdx + rsi]
mov r10d, dword [r10 + r11*4]
xor r10d, dword [rbx + rsi*4]
lea r11, [0x00462840]
mov ebx, ecx
add ebx, 2
mov ebx, ebx
movzx rbx, byte [rdx + rbx]
xor r10d, dword [r11 + rbx*4]
lea r11, [0x00462c40]
add ecx, 3
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
xor r10d, dword [r11 + rcx*4]
mov dword [rdx + r9], r10d
add eax, 1
sub r8d, 1
test r8d, r8d
jne 0x43504a
nop
pop rbx
pop rsi
ret
Function at 0x435610
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
test rax, rax
je 0x43561c
mov rax, qword [rax - 8]
mov r9, qword [rdx]
mov r8, r9
test r8, r8
je 0x43562b
mov r8, qword [r8 - 8]
movsxd r10, eax
cmp r8, r10
jge 0x43563f
mov rax, r9
test rax, rax
je 0x43563f
mov rax, qword [rax - 8]
xor r8, r8
mov r9d, eax
sub r9d, 1
mov eax, r8d
cmp eax, r9d
jg 0x435679
sub r9d, r8d
add r9d, 1
movsxd r8, eax
mov r10, qword [rcx]
lea r10, [r10 + r8]
mov r11, qword [rdx]
movzx r8, byte [r11 + r8]
xor byte [r10], r8b
add eax, 1
sub r9d, 1
test r9d, r9d
jne 0x435658
nop
ret

Function at 0x436cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
mov rdx, r8
mov r8, r9
call sub.kernel32.dll_FindResourceW
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x436d59
mov rcx, rsi
mov rdx, rax
call sub.kernel32.dll_LoadResource
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x436d59
mov rcx, rax
call sub.kernel32.dll_LockResource
mov rdi, rax
mov rcx, rsi
mov rdx, qword [rbx + 0x10]
call sub.kernel32.dll_SizeofResource
mov rcx, rbx
mov rdx, rdi
movsxd r8, eax
call fcn.00436ce0
mov byte [rbx + 8], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x437810
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x80], rcx
lea rcx, [rbp + 0x80]
call fcn.0040bf00
nop
xor eax, eax
mov byte [rbp + 0x4f], al
mov rcx, qword [rbp + 0x80]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x437908
mov rcx, rbx
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x437895
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x437908
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x0042eec0]
call fcn.00410600
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x0042eec0]
mov r8d, 1
mov r9, qword [rbp + 0x58]
call fcn.00410430
mov dword [rbp + 0x54], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x4378fa
mov rcx, rbx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x58]
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov al, 1
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x80]
call fcn.0040bd90
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x4384a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x4384c9
mov rcx, qword [0x004650a0]
lea rdx, [0x004384f8]
call fcn.004080c0
mov rcx, rax
call fcn.00408220
call fcn.00405a40
mov ecx, 1
xor edx, edx
mov r8d, ebx
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4384a9
add rsp, 0x20
pop rbx
ret
Function at 0x439600
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x68]
mov rax, qword [0x00465110]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439808]
call fcn.0040d230
mov rcx, qword [rbp + 0x68]
call fcn.0042fbc0
test al, al
je 0x4397a3
mov rcx, 0xffffffff80000001
lea rdx, [0x0043982e]
lea r8, [rbp + 0x78]
call sub.advapi32.dll_RegOpenKeyW
mov rax, qword [0x00465110]
mov rax, qword [rax + 0x80]
test rax, rax
je 0x439698
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00465110]
mov rdx, qword [rdx + 0x80]
mov r8d, eax
call fcn.004328d0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x50]
call fcn.00432810
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x60]
call fcn.0040d150
mov rcx, qword [rbp + 0x48]
call fcn.0040d180
mov rsi, rax
lea rcx, [rbp + 0x40]
mov rax, qword [0x00465110]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439808]
call fcn.0040d230
mov rax, qword [rbp + 0x40]
xor ebx, ebx
test rax, rax
je 0x439707
mov ebx, dword [rax - 4]
shr ebx, 1
lea rcx, [rbp + 0x38]
mov rax, qword [0x00465110]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439808]
call fcn.0040d230
mov rcx, qword [rbp + 0x38]
call fcn.0040d180
mov rcx, qword [rbp + 0x78]
mov rdx, rsi
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add ebx, ebx
mov dword [rsp + 0x28], ebx
call sub.advapi32.dll_RegSetValueExW
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_RegCloseKey
lea rcx, [rbp + 0x30]
mov rax, qword [0x00465110]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439808]
call fcn.0040d230
mov rcx, qword [rbp + 0x30]
call fcn.0040d180
xor ecx, ecx
lea rdx, [0x0043988a]
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x30]
mov edx, 4
call fcn.0040be70
lea rcx, [rbp + 0x60]
call fcn.0040bd40
lea rcx, [rbp + 0x68]
call fcn.0040bd90
lea rsp, [rbp + 0x80]
pop rbx
pop rsi
pop rbp
ret
Function at 0x4398a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
mov rax, qword [0x00465110]
lea rcx, [rax + 0x98]
mov rdx, qword [0x0042eec0]
call fcn.00410600
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x439933
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x00439ba4]
mov rax, qword [0x00465110]
mov r9, qword [rax + 0x118]
lea rax, [0x00439bd8]
mov qword [rsp + 0x20], rax
call fcn.0040d530
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.0040d820
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00438b50
lea rcx, [rbp + 0x48]
mov rax, qword [0x00465110]
mov rdx, qword [rax + 0x118]
lea r8, [0x00439bd8]
call fcn.0040d230
mov rcx, qword [rbp + 0x48]
call fcn.0040d180
mov rcx, rax
mov edx, 0x80000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x4399bd
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x439b45
lea rcx, [0x00439c0c]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
jmp 0x439b45
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x4399db
lea rcx, [0x00439c54]
mov dl, 1
call fcn.00438b50
mov rcx, rbx
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x439a1d
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x439a10
lea rcx, [0x00439c90]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x439b45
mov rax, qword [0x00465110]
lea rcx, [rax + 0x98]
mov rdx, qword [0x0042eec0]
mov r8d, 1
mov r9, qword [rbp + 0x60]
call fcn.00410430
mov dword [rbp + 0x6c], 0
jmp 0x439b12
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x439a93
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x439b12
lea rcx, [0x00439ce0]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
jmp 0x439b12
mov rcx, rbx
mov rax, qword [0x00465110]
mov rdx, qword [rax + 0x98]
mov r8d, dword [rbp + 0x60]
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x439ae5
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x439b12
lea rcx, [0x00439d4c]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
jmp 0x439b12
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
je 0x439b12
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x439b12
lea rcx, [0x00439da8]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
jne 0x439a4d
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x439b44
lea rcx, [0x00439e14]
mov dl, 1
call fcn.00438b50
nop
lea rcx, [rbp + 0x48]
call fcn.0040bd90
lea rcx, [rbp + 0x50]
call fcn.0040bcf0
lea rcx, [rbp + 0x58]
call fcn.0040bd90
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x43a460
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x90], rcx
lea rcx, [rbp + 0x90]
call fcn.0040bf00
nop
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x43a4ec
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x0043a730]
mov rax, qword [0x00465110]
mov r9, qword [rax + 0x118]
lea rax, [0x0043a778]
mov qword [rsp + 0x20], rax
call fcn.0040d530
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.0040d820
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00438b50
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x90]
lea r8, [0x0043a778]
call fcn.0040d230
mov rcx, qword [rbp + 0x48]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x43a56f
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x43a6b4
lea rcx, [0x0043a7ac]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
jmp 0x43a6b4
mov dword [rbp + 0x6c], 0
jmp 0x43a66d
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x43a5c4
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x43a66d
lea rcx, [0x0043a808]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
jmp 0x43a66d
mov rax, qword [0x00465110]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x43a5db
mov rax, qword [rax - 8]
mov rcx, rbx
mov rdx, qword [0x00465110]
mov rdx, qword [rdx + 0x98]
mov r8d, eax
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x43a62c
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x43a66d
lea rcx, [0x0043a874]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
jmp 0x43a66d
mov rax, qword [0x00465110]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x43a643
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
je 0x43a66d
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x43a66d
lea rcx, [0x0043a8cc]
mov dl, 1
call fcn.00438b50
xor ecx, ecx
call fcn.00438d90
mov rax, qword [0x00465110]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x43a684
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
jne 0x43a57b
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00465110]
cmp byte [rax + 0x134], 0
je 0x43a6b3
lea rcx, [0x0043a938]
mov dl, 1
call fcn.00438b50
nop
lea rcx, [rbp + 0x48]
call fcn.0040bd90
lea rcx, [rbp + 0x50]
call fcn.0040bcf0
lea rcx, [rbp + 0x58]
call fcn.0040bd90
lea rcx, [rbp + 0x90]
call fcn.0040bd90
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x43faf0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
mov rbp, rsp
mov rbx, rcx
mov esi, edx
call fcn.0042b3d0
cmp eax, 2
jne 0x43fb30
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x20]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x20]
call fcn.0040fc10
jmp 0x43fb5e
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x220]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x220]
mov r8d, pe_nt_image_headers64
call fcn.0040d7b0
mov rax, rbx
lea rsp, [rbp + 0x420]
pop rbx
pop rsi
pop rbp
ret

Function at 0x43fb70
Capabilities:
Get keyboard layout

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
nop
mov rcx, qword [rbp + 0x80]
lea rdx, [0x0043fd3c]
call fcn.0040c440
mov qword [rbp + 0x58], 0
xor ecx, ecx
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
jbe 0x43fc72
mov ecx, dword [rbp + 0x54]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov ecx, ecx
call fcn.00405700
mov qword [rbp + 0x58], rax
nop
mov ecx, dword [rbp + 0x54]
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov rcx, qword [rbp + 0x80]
call fcn.0040bd90
xor eax, eax
mov ebx, dword [rbp + 0x54]
sub ebx, 1
mov dword [rbp + 0x50], eax
cmp dword [rbp + 0x50], ebx
ja 0x43fc5c
sub ebx, eax
add ebx, 1
mov rax, qword [rbp + 0x58]
mov ecx, dword [rbp + 0x50]
movzx eax, word [rax + rcx*8]
mov dword [rbp + 0x4c], eax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x4c]
call fcn.0043faf0
lea rcx, [rbp + 0x30]
lea rdx, [0x0043fd60]
call fcn.0040d9b0
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040d850
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.0040d1a0
add dword [rbp + 0x50], 1
sub ebx, 1
test ebx, ebx
jne 0x43fc0a
nop
nop
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x54]
add edx, edx
add edx, edx
add edx, edx
mov edx, edx
call fcn.00405730
mov dword [rbp + 0x44], 0
mov rax, qword [rbp + 0x80]
mov rax, qword [rax]
test rax, rax
je 0x43fc91
mov eax, dword [rax - 4]
shr eax, 1
mov dword [rbp + 0x44], eax
mov rcx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax]
mov r8d, 1
mov r9d, dword [rbp + 0x44]
sub r9d, 4
call fcn.0040d650
nop
lea rcx, [rbp + 0x28]
call fcn.0040bd90
lea rcx, [rbp + 0x30]
call fcn.0040bcf0
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x4430d0
Capabilities:
Clear file content

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0xa0], r8
lea rcx, [rbp + 0xa0]
call fcn.0040bf00
nop
mov al, 1
mov byte [rbp + 0x5f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x443171
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0xa0]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x68]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x4431fd
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x44319b
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x443210
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xa0]
call fcn.0042f4c0
mov rcx, qword [rbp + 0x60]
call fcn.0040d180
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x44310c
nop
xor eax, eax
mov byte [rbp + 0x5f], al
nop
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040be70
lea rcx, [rbp + 0xa0]
call fcn.0040bd90
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x443310
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x28]
add dword [rax], 1
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x28]
mov edx, dword [rax]
call fcn.004306d0
mov eax, 1
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x443344
nop
xor eax, eax
movsxd r9, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rdx, byte [rcx + r9]
mov ecx, edx
shl ecx, 4
movzx rcx, cl
shr ecx, 4
movzx r8, cl
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rcx, byte [rcx + r8]
mov r10, qword [rbp + 0x20]
mov r10, qword [r10]
mov byte [r10 + r8], dl
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov byte [rdx + r9], cl
add eax, 1
cmp eax, 0x10
jne 0x44336a
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx + 0xf]
xor byte [rcx], dl
add eax, 1
cmp eax, 0xf
jne 0x4433b6
nop
mov rax, qword [rbp + 0x38]
movzx rcx, byte [rax + 3]
shl ecx, 6
movzx rcx, cl
shr ecx, 6
xor eax, eax
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movsxd r8, eax
lea rdx, [rdx + r8]
mov r8, qword [rbp + 0x38]
movzx r9, cl
movzx r8, byte [r8 + r9]
xor byte [rdx], r8b
add eax, 1
cmp eax, 0x10
jne 0x4433f0
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x38]
mov r8d, eax
and r8d, 0x80000003
jns 0x443443
sub r8d, 1
or r8d, 0xfffffffc
add r8d, 1
movsxd r8, r8d
movzx rdx, byte [rdx + r8]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x443419
nop
nop
lea rcx, [rbp + 0x38]
mov rdx, qword [0x0042eec0]
call fcn.00410600
lea rsp, [rbp + 0x40]
pop rbp
ret