joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b800
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x38
mov rax, qword [0x006d1040]
mov qword [rcx + 0xc0], 0
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
xor edx, edx
movabs rdx, 0x6a09e667f3bcc908
mov qword [rcx], rdx
movabs rdx, 0xbb67ae8584caa73b
mov qword [rcx + 8], rdx
movabs rdx, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rdx
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rdx
movabs rdx, 0x510e527fade682d1
mov qword [rcx + 0x20], rdx
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rdx
movabs rdx, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rdx
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rdx
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rax]
jne 0x44b89e
add rsp, 0x38
ret
call fcn.00582f30
nop
nop
nop word cs:[rax + rax]

Function at 0x44bbc0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, qword [0x006d1040]
movabs r8, 0xff00000000
movabs r9, 0xff0000000000
mov rsi, rcx
mov rcx, qword [rcx + 0xc0]
mov rdi, rdx
mov qword [rsp + 0x20], 0
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rdx, [rcx*8]
mov rax, rcx
shl rax, 0xb
and rax, r8
mov r8, rdx
shr r8, 0x38
or rax, r8
mov r8, rcx
shl r8, 0x3b
or rax, r8
mov r8, rcx
shl r8, 0x1b
and r8, r9
movabs r9, 0xff000000000000
or rax, r8
mov r8, rcx
shl r8, 0x2b
and r8, r9
or rax, r8
mov r8, rdx
shr r8, 0x28
and r8d, 0xff00
or rax, r8
mov r8, rdx
shr rdx, 8
shr r8, 0x18
and edx, 0xff000000
and r8d, 0xff0000
or rax, r8
mov r8d, 0xef
sub r8, rcx
or rax, rdx
lea rdx, [0x00690760]
and r8d, 0x7f
mov rcx, rsi
mov qword [rsp + 0x28], rax
add r8, 1
call fcn.0044b8b0
lea rdx, [rsp + 0x20]
mov r8d, 0x10
mov rcx, rsi
call fcn.0044b8b0
mov rax, qword [rsi]
bswap rax
mov qword [rdi], rax
mov rax, qword [rsi + 8]
bswap rax
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x10]
bswap rax
mov qword [rdi + 0x10], rax
mov rax, qword [rsi + 0x18]
bswap rax
mov qword [rdi + 0x18], rax
mov rax, qword [rsi + 0x20]
bswap rax
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
bswap rax
mov qword [rdi + 0x28], rax
mov rax, qword [rsi + 0x30]
bswap rax
mov qword [rdi + 0x30], rax
mov rax, qword [rsi + 0x38]
bswap rax
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x44bbab
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call fcn.00582f30
nop
nop
nop dword [rax]
nop word cs:[rax + rax]
sub rsp, 0x38
mov rdx, qword [0x006d1040]
mov rax, rcx
mov qword [rax + 0xc0], 0
mov rcx, qword [rdx]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rdx]
jne 0x44bc61
add rsp, 0x38
ret
call fcn.00582f30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x46c7e0
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rbx, rcx
mov rsi, rdx
xor ecx, ecx
xor edx, edx
call r12
mov ecx, eax
mov ebp, eax
add rcx, rcx
test eax, eax
jne 0x46c813
mov ecx, 2
mov ebp, 1
call fcn.00670520
mov ecx, ebp
mov rdi, rax
mov rdx, rax
call r12
test eax, eax
jne 0x46c8a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebp, eax
je 0x46c8a0
test rsi, rsi
je 0x46c90a
mov dword [rsi], eax
lea rax, [0x006d1310]
mov byte [rsi + 4], 1
mov qword [rsi + 8], rax
lea rax, [rbx + 0x10]
mov rcx, rdi
mov qword [rbx], rax
call sub.msvcrt.dll_wcslen
lea r12, [rax + rax]
mov rbp, rax
mov rsi, r12
sar rsi, 1
cmp rsi, 7
ja 0x46c8d0
cmp rsi, 1
mov rax, qword [rbx]
je 0x46c8c0
test rsi, rsi
jne 0x46c8f4
xor edx, edx
mov qword [rbx + 8], rsi
mov rcx, rdi
mov word [rax + rbp*2], dx
call fcn.006704f0
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rsi, rsi
je 0x46c84d
lea rax, [0x006d1310]
mov dword [rsi], 0
mov byte [rsi + 4], 0
mov qword [rsi + 8], rax
jmp 0x46c84d
movzx edx, word [rdi]
mov word [rax], dx
jmp 0x46c87d
movabs rax, 0x3fffffffffffffff
cmp rsi, rax
ja 0x46c997
lea rcx, [rsi + rsi + 2]
call fcn.00670540
mov qword [rbx], rax
mov qword [rbx + 0x10], rsi
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
jmp 0x46c87d
mov ecx, 0x48
lea rsi, [rsp + 0x30]
mov ebx, ebp
call fcn.00670680
lea rdx, str.boost::filesystem::current_path
mov r12, rax
mov rcx, rsi
movabs rax, 0x100000000
or rbx, rax
call fcn.0046c220
lea rax, [0x006d1310]
lea r8, [rsp + 0x20]
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rbx
add rsi, 0x10
mov qword [rsp + 0x28], rax
call fcn.005a8e50
mov rcx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x46c96e
call fcn.00670500
lea r8, [0x005a9500]
lea rdx, [0x006d32e0]
mov rcx, r12
call fcn.00670ef0
mov rbx, rax
mov rcx, rdi
call fcn.006704f0
mov rcx, rbx
call fcn.0058e700
lea rcx, [0x0069244a]
call fcn.0065f820
mov rcx, r12
mov rbx, rax
call fcn.00670a50
jmp 0x46c987
Function at 0x46cc00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rdi, rdx
mov rbp, r8
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ebx, eax
je 0x46cd65
test ah, 4
jne 0x46cc90
test rbp, rbp
je 0x46cc4d
lea rax, [0x006d1310]
mov dword [rbp], 0
mov byte [rbp + 4], 0
mov qword [rbp + 8], rax
mov edx, ebx
and ebx, 0x10
mov rcx, rdi
jne 0x46cc80
call fcn.0046c2c0
mov dword [rsi], 2
mov dword [rsi + 4], eax
mov rax, rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.0046c2c0
mov dword [rsi], 3
mov dword [rsi + 4], eax
jmp 0x46cc65
mov r14, qword [rdi]
lea r12, [rsp + 0x50]
lea rax, [r12 + 0x10]
test r14, r14
mov qword [rsp + 0x50], rax
je 0x46cd80
mov rcx, r14
call sub.msvcrt.dll_wcslen
lea r8, [rax + rax]
mov r15, rax
mov r13, r8
sar r13, 1
cmp r13, 7
ja 0x46cd90
cmp r13, 1
mov rcx, qword [rsp + 0x50]
je 0x46cde0
test r13, r13
jne 0x46cdc0
xor eax, eax
mov qword [rsp + 0x58], r13
xor r9d, r9d
mov word [rcx + r15*2], ax
mov r8d, 7
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x50]
add r12, 0x10
mov r13, rax
cmp rcx, r12
je 0x46cd2e
call fcn.00670500
cmp r13, 0xffffffffffffffff
je 0x46cd65
mov rcx, rdi
call fcn.0046c0a0
test al, al
jne 0x46cdd2
mov edx, ebx
mov rcx, rdi
call fcn.0046c2c0
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46cc65
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.0046cab0
jmp 0x46cc65
lea rcx, [0x006923d0]
call fcn.0065f680
nop dword [rax]
movabs rax, 0x3fffffffffffffff
cmp r13, rax
ja 0x46ce0a
lea rcx, [r13 + r13 + 2]
mov qword [rsp + 0x48], r8
call fcn.00670540
mov r8, qword [rsp + 0x48]
mov rcx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r13
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x50]
jmp 0x46cce2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46cc32
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x46cce2
mov rcx, rbx
call fcn.0058e700
lea rcx, [0x0069244a]
call fcn.0065f820
mov rbx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46ce02
Function at 0x46cec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rsi, r8
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov edx, eax
je 0x46cf90
test rsi, rsi
je 0x46cefe
lea rax, [0x006d1310]
mov dword [rsi], 0
mov byte [rsi + 4], 0
mov qword [rsi + 8], rax
test dh, 4
jne 0x46cf40
test dl, 0x10
mov rcx, rdi
jne 0x46cf24
call fcn.0046c2c0
mov dword [rbx + 4], eax
mov rax, rbx
mov dword [rbx], 2
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call fcn.0046c2c0
mov dword [rbx + 4], eax
mov rax, rbx
mov dword [rbx], 3
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rcx, rdi
mov dword [rsp + 0x2c], edx
call fcn.0046c0a0
test al, al
mov rcx, rdi
mov edx, dword [rsp + 0x2c]
je 0x46cf70
call fcn.0046c2c0
mov dword [rbx + 4], eax
mov rax, rbx
mov dword [rbx], 4
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call fcn.0046c2c0
mov dword [rbx + 4], eax
mov rax, rbx
mov dword [rbx], 9
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.0046cab0
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x46d0c0
Capabilities:
Create directory

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46d111
test rbx, rbx
mov eax, 1
je 0x46d102
lea rdi, [0x006d1310]
mov dword [rbx], 0
mov byte [rbx + 4], 0
mov qword [rbx + 8], rdi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r12, [rsp + 0x40]
lea rdi, [0x006d1310]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, r12
mov ebp, eax
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x34], 0
mov qword [rsp + 0x38], rdi
call fcn.0046cc00
cmp dword [rsp + 0x40], 3
je 0x46d174
test ebp, ebp
setne r14b
test rbx, rbx
je 0x46d18e
xor eax, eax
mov dword [rbx], ebp
mov byte [rbx + 4], r14b
mov qword [rbx + 8], rdi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
test rbx, rbx
je 0x46d102
mov dword [rbx], 0
mov byte [rbx + 4], 0
mov qword [rbx + 8], rdi
jmp 0x46d102
mov ecx, 0x48
mov ebx, ebp
call fcn.00670680
lea rdx, str.boost::filesystem::create_directory
mov r13, rax
movzx eax, r14b
shl rax, 0x20
mov rcx, r12
or rbx, rax
call fcn.0046c220
lea r9, [rsp + 0x20]
mov rdx, r12
mov rcx, r13
mov r8, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rdi
call fcn.005a8f70
mov rcx, qword [rsp + 0x40]
add r12, 0x10
cmp rcx, r12
je 0x46d1e7
call fcn.00670500
lea r8, [0x005a9500]
lea rdx, [0x006d32e0]
mov rcx, r13
call fcn.00670ef0
mov rbx, rax
mov rcx, r13
call fcn.00670a50
mov rcx, rbx
call fcn.0058e700
nop
nop dword [rax + rax]
nop word cs:[rax + rax]
Function at 0x474e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
cmp rdx, 2
mov rbx, rcx
jbe 0x474ec0
mov rcx, qword [rcx]
cmp word [rcx + 2], 0x3a
je 0x474f10
cmp rdx, 4
jbe 0x474ef0
movzx r8d, word [rcx]
mov r9, rcx
cmp r8w, 0x2f
sete al
cmp r8w, 0x5c
sete r8b
or al, r8b
je 0x474eb0
movzx r8d, word [rcx + 2]
cmp r8w, 0x2f
je 0x474e8a
cmp r8w, 0x5c
jne 0x474eb0
cmp word [rcx + 4], 0x3f
je 0x474f92
movzx ecx, word [r9 + 4]
cmp cx, 0x2f
sete al
cmp cx, 0x5c
sete cl
or al, cl
je 0x474f30
xor eax, 1
movzx eax, al
neg rax
add rsp, 0x30
pop rbx
ret
jne 0x474ef0
mov rcx, qword [rcx]
movzx edx, word [rcx]
cmp dx, 0x5c
sete al
cmp dx, 0x2f
sete dl
or al, dl
je 0x474eb0
movzx edx, word [rcx + 2]
cmp dx, 0x5c
je 0x474f03
cmp dx, 0x2f
jne 0x474eb0
jmp 0x474f03
cmp rdx, 4
je 0x475020
test rdx, rdx
jne 0x47505b
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rcx + 4]
cmp ax, 0x5c
je 0x474f24
cmp ax, 0x2f
jne 0x474e50
mov eax, 2
jmp 0x474eb9
lea rcx, [0x006929da]
mov qword [rsp + 0x28], rdx
call sub.msvcrt.dll_wcslen
test rax, rax
mov r10, rax
je 0x474f03
mov r11, qword [rbx + 8]
cmp r11, 2
jbe 0x474f03
mov rbx, qword [rbx]
mov rdx, qword [rsp + 0x28]
mov eax, 2
movzx r9d, word [rbx + rax*2]
lea rcx, [0x006929da]
mov r8, r10
nop
cmp r9w, word [rcx]
je 0x475010
add rcx, 2
sub r8, 1
jne 0x474f70
add rax, 1
cmp r11, rax
jne 0x474f60
jmp 0x474f03
movzx eax, word [rcx + 6]
cmp ax, 0x2f
je 0x474fa6
cmp ax, 0x5c
jne 0x474e95
lea rcx, [0x006929da]
mov qword [rsp + 0x28], rdx
call sub.msvcrt.dll_wcslen
test rax, rax
mov r10, rax
je 0x474f03
mov r11, qword [rbx + 8]
cmp r11, 4
jbe 0x474f03
mov rbx, qword [rbx]
mov rdx, qword [rsp + 0x28]
mov eax, 4
nop
movzx r9d, word [rbx + rax*2]
lea rcx, [0x006929da]
mov r8, r10
nop
cmp r9w, word [rcx]
je 0x475010
add rcx, 2
sub r8, 1
jne 0x474ff0
add rax, 1
cmp rax, r11
jne 0x474fe0
jmp 0x474f03
cmp rdx, rax
ja 0x474eb9
jmp 0x474f03
mov r9, qword [rbx]
movzx ecx, word [r9]
cmp cx, 0x2f
sete al
cmp cx, 0x5c
sete cl
or al, cl
je 0x474eb0
movzx ecx, word [r9 + 2]
cmp cx, 0x2f
je 0x474e95
cmp cx, 0x5c
je 0x474e95
jmp 0x474eb0
mov rax, qword [rbx]
movzx edx, word [rax]
cmp dx, 0x2f
sete al
cmp dx, 0x5c
sete dl
or eax, edx
jmp 0x474eb0
Function at 0x48dfa0
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r9, qword [rcx]
xor edx, edx
lea r8, [0x0048d630]
mov rbx, rcx
mov dword [rsp + 0x20], 4
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x48dfe1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx]
lock add dword [rax + 8], 1
mov rdi, qword [rbx]
mov rcx, qword [rdi + 0x10]
mov rax, rdi
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x48e006
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rdi + 0x10], rsi
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x491590
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x006750f0]
mov r12, rdx
mov rbp, r8
mov rdi, r9
cmp ecx, 0xffffffff
je 0x491613
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov r13, rax
je 0x491613
mov rbx, qword [r13 + 0x38]
lea r15, [r13 + 0x30]
test rbx, rbx
jne 0x4915e5
jmp 0x491628
mov rax, qword [rbx + 0x10]
mov ecx, 1
test rax, rax
je 0x4915f9
mov rbx, rax
mov rdx, qword [rbx + 0x20]
cmp rsi, rdx
jb 0x4915d4
mov rax, qword [rbx + 0x18]
xor ecx, ecx
test rax, rax
jne 0x4915e2
test cl, cl
jne 0x49162b
cmp rsi, rdx
ja 0x491642
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.004909b0
mov r13, rax
mov rbx, qword [r13 + 0x38]
lea r15, [r13 + 0x30]
test rbx, rbx
jne 0x4915e5
mov rbx, r15
cmp qword [r13 + 0x40], rbx
je 0x491647
mov rcx, rbx
call fcn.0065f540
mov rdx, qword [rax + 0x20]
cmp rsi, rdx
jbe 0x491602
test rbx, rbx
je 0x491602
cmp r15, rbx
mov r14d, 1
jne 0x491690
mov ecx, 0x40
call fcn.00670540
mov r9, r15
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], r12
mov qword [rax + 0x30], rbp
mov qword [rax + 0x38], rdi
mov r8, rbx
mov rdx, rax
mov ecx, r14d
call fcn.006604b0
add qword [r13 + 0x50], 1
jmp 0x491602
xor r14d, r14d
cmp rsi, qword [rbx + 0x20]
setb r14b
jmp 0x491652

Function at 0x492d20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [0x0072dbe0]
test eax, eax
je 0x492d40
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.OPENSSL_ia32cap
mov dword [0x0072dbe0], 1
call sub.msvcrt.dll_getenv
test rax, rax
je 0x492de2
movzx esi, byte [rax]
xor ebx, ebx
lea r8, [rsp + 0x28]
lea rdx, str._I64i
cmp sil, 0x7e
sete bl
add rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_sscanf
test eax, eax
je 0x492db0
cmp sil, 0x7e
je 0x492dd0
mov rax, qword [rsp + 0x28]
mov edx, eax
shr rax, 0x20
or dh, 4
mov dword [0x00732b64], eax
mov dword [0x00732b60], edx
add rsp, 0x38
pop rbx
pop rsi
ret
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_strtoul
mov eax, eax
mov qword [rsp + 0x28], rax
jmp 0x492d86
call fcn.00494420
mov rdx, qword [rsp + 0x28]
not rdx
and rax, rdx
jmp 0x492d91
call fcn.00494420
jmp 0x492d91
Function at 0x4935c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test r8, r8
je 0x4937e0
mov r10, rcx
lea r9, [r8 - 1]
mov r11d, 0x11
neg r10
and r10d, 0xf
lea rax, [r10 + 0xf]
cmp rax, 0x11
cmovb rax, r11
cmp r9, rax
jb 0x493810
test r10, r10
je 0x493846
movzx eax, byte [rcx]
xor al, byte [rdx]
cmp r10, 1
mov esi, eax
je 0x4937f0
movzx eax, byte [rcx + 1]
xor al, byte [rdx + 1]
or esi, eax
cmp r10, 2
je 0x493800
movzx eax, byte [rcx + 2]
xor al, byte [rdx + 2]
or esi, eax
cmp r10, 3
je 0x4937d1
movzx eax, byte [rcx + 3]
xor al, byte [rdx + 3]
or esi, eax
cmp r10, 4
je 0x493820
movzx eax, byte [rcx + 4]
xor al, byte [rdx + 4]
or esi, eax
cmp r10, 5
je 0x493830
movzx eax, byte [rcx + 5]
xor al, byte [rdx + 5]
or esi, eax
cmp r10, 6
je 0x493850
movzx eax, byte [rcx + 6]
xor al, byte [rdx + 6]
or esi, eax
cmp r10, 7
je 0x49385b
movzx eax, byte [rcx + 7]
xor al, byte [rdx + 7]
or esi, eax
cmp r10, 8
je 0x49383b
movzx eax, byte [rcx + 8]
xor al, byte [rdx + 8]
or esi, eax
cmp r10, 9
je 0x493866
movzx eax, byte [rcx + 9]
xor al, byte [rdx + 9]
or esi, eax
cmp r10, 0xa
je 0x493871
movzx eax, byte [rcx + 0xa]
xor al, byte [rdx + 0xa]
or esi, eax
cmp r10, 0xb
je 0x49387c
movzx eax, byte [rcx + 0xb]
xor al, byte [rdx + 0xb]
or esi, eax
cmp r10, 0xc
je 0x493887
movzx eax, byte [rcx + 0xc]
xor al, byte [rdx + 0xc]
or esi, eax
cmp r10, 0xd
je 0x493892
movzx eax, byte [rcx + 0xd]
xor al, byte [rdx + 0xd]
or esi, eax
cmp r10, 0xf
jne 0x49389d
movzx eax, byte [rdx + 0xe]
mov r9d, 0xf
xor al, byte [rcx + 0xe]
or esi, eax
nop word [rax + rax]
mov rbp, r8
pxor xmm1, xmm1
sub rbp, r10
lea rax, [rcx + r10]
lea rbx, [rdx + r10]
mov rdi, rbp
xor r10d, r10d
xor r11d, r11d
shr rdi, 4
nop
movdqu xmm0, xmmword [rbx + r10]
add r11, 1
pxor xmm0, xmmword [rax + r10]
add r10, 0x10
cmp rdi, r11
por xmm1, xmm0
ja 0x493740
movdqa xmm0, xmm1
mov r10, rbp
and r10, 0xfffffffffffffff0
psrldq xmm0, 8
por xmm1, xmm0
add r9, r10
movdqa xmm0, xmm1
psrldq xmm0, 4
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 1
por xmm1, xmm0
movaps xmmword [rsp], xmm1
movzx eax, byte [rsp]
or eax, esi
cmp rbp, r10
je 0x4937c5
nop word [rax + rax]
movzx r10d, byte [rcx + r9]
xor r10b, byte [rdx + r9]
add r9, 1
or eax, r10d
cmp r8, r9
ja 0x4937b0
movzx eax, al
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, 3
jmp 0x493720
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, 1
jmp 0x493720
mov r9d, 2
jmp 0x493720
xor eax, eax
xor r9d, r9d
jmp 0x4937b0
mov r9d, 4
jmp 0x493720
mov r9d, 5
jmp 0x493720
mov r9d, 8
jmp 0x493720
xor r9d, r9d
xor esi, esi
jmp 0x493720
mov r9d, 6
jmp 0x493720
mov r9d, 7
jmp 0x493720
mov r9d, 9
jmp 0x493720
mov r9d, 0xa
jmp 0x493720
mov r9d, 0xb
jmp 0x493720
mov r9d, 0xc
jmp 0x493720
mov r9d, 0xd
jmp 0x493720
mov r9d, 0xe
jmp 0x493720
Function at 0x4965f0
Capabilities:
Capture screenshot

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
call fcn.00495950
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x496640
call fcn.00492df0
test eax, eax
jle 0x496640
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DISPLAY
call qword [sym.imp.GDI32.dll_CreateDCW]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rbx, qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r12, rax
mov edx, 8
mov rcx, rdi
call rbx
mov r14d, eax
mov edx, 0xa
mov rcx, rdi
call rbx
mov r8d, 0x10
mov edx, r14d
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov r13, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r12
mov qword [rsp + 0x68], rax
call rax
lea r8, [rsp + 0x90]
mov edx, 0x20
mov rcx, r13
mov qword [rsp + 0x60], rax
call qword [sym.imp.GDI32.dll_GetObjectW]
mov esi, dword [rsp + 0x9c]
movzx eax, word [rsp + 0xa0]
lea rdx, str.rand_win.c
imul esi, dword [rsp + 0x98]
mov r8d, 0x306
imul esi, eax
mov ecx, esi
call fcn.00493db0
test rax, rax
mov rbx, rax
je 0x4967bf
cmp ebp, 0x10
jle 0x4967b7
sub ebp, 0x11
mov eax, esi
xor r15d, r15d
and ebp, 0xfffffff0
mov qword [rsp + 0x58], rax
lea eax, [rbp + 0x10]
lea rbp, [rsp + 0x70]
mov dword [rsp + 0x54], eax
nop word [rax + rax]
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x38], r15d
mov rcx, r12
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rdi
add r15d, 0x10
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.GDI32.dll_BitBlt]
mov r8, rbx
mov edx, esi
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetBitmapBits]
call fcn.0049ae60
mov rdx, qword [rsp + 0x58]
xor r9d, r9d
mov r8, rbp
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.0049a300
pxor xmm2, xmm2
mov edx, 0x14
mov rcx, rbp
call fcn.004956b0
cmp dword [rsp + 0x54], r15d
jne 0x496730
mov rcx, rbx
call fcn.00494240
mov rdx, qword [rsp + 0x60]
mov rcx, r12
mov rax, qword [rsp + 0x68]
call rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
mov rbx, qword [sym.imp.GDI32.dll_DeleteDC]
call rbx
mov rcx, rdi
call rbx
jmp 0x496623
Function at 0x4b81e0
Capabilities:
Check if file exists

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
cmp byte [rcx], 0
mov rsi, rcx
mov rdi, rdx
je 0x4b8420
mov rdx, rcx
xor eax, eax
jmp 0x4b8218
test eax, eax
js 0x4b8420
add rdx, 1
add eax, 1
cmp byte [rdx], 0
jne 0x4b8210
and eax, 0x7fffffff
lea ebx, [rax + 1]
mov edx, 8
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, ebx
mov r8, rsi
mov r12, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call r12
test eax, eax
mov ecx, eax
mov edx, 8
jle 0x4b8430
movsxd rax, ecx
lea rax, [rax + rax + 0x1e]
and rax, 0xfffffffffffffff0
call fcn.0058e300
sub rsp, rax
mov r9d, ebx
mov r8, rsi
lea r13, [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r13
call r12
test eax, eax
je 0x4b8380
xor r9d, r9d
cmp byte [rdi], 0
mov rax, rdi
jne 0x4b82b9
jmp 0x4b8490
test r9d, r9d
js 0x4b8490
add rax, 1
add r9d, 1
cmp byte [rax], 0
jne 0x4b82b0
and r9d, 0x7fffffff
add r9d, 1
lea rbx, [rbp - 0x50]
xor edx, edx
mov dword [rsp + 0x28], 8
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call r12
test eax, eax
je 0x4b8380
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov r12, rax
je 0x4b8348
lea rcx, [0x00675740]
call fcn.004b65b0
test rax, rax
mov rbx, rax
je 0x4b84d2
xor edx, edx
mov rcx, rax
call fcn.004b68a0
mov r9, r12
mov r8d, 1
mov edx, 0x6a
mov rcx, rbx
call fcn.004b7030
jmp 0x4b840b
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 2
je 0x4b8364
call rbx
cmp dword [rax], 9
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4b838e
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
jne 0x4b830b
nop word [rax + rax]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call r13
lea r9, str.bss_file.c
mov r8d, eax
mov edx, 1
mov ecx, 2
mov dword [rsp + 0x20], 0xa9
call fcn.00498ab0
lea rax, [0x006a8223]
lea r9, [0x006a8217]
lea rdx, str.fopen_
mov r8, rsi
mov ecx, 5
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
call fcn.00499a10
call rbx
cmp dword [rax], 2
je 0x4b8454
lea r9, str.bss_file.c
mov dword [rsp + 0x20], 0xae
mov r8d, 2
mov edx, 0x6d
mov ecx, 0x20
xor ebx, ebx
call fcn.00498ab0
mov rax, rbx
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov ebx, 1
jmp 0x4b822c
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
cmp eax, 0x3ec
je 0x4b84a0
call r13
cmp eax, 0x459
jne 0x4b8387
jmp 0x4b8364
lea r9, str.bss_file.c
mov dword [rsp + 0x20], 0xac
mov r8d, pe_nt_image_headers64
mov edx, 0x6d
mov ecx, 0x20
xor ebx, ebx
call fcn.00498ab0
mov rax, rbx
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov r9d, 1
jmp 0x4b82d1
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, ebx
mov r8, rsi
call r12
test eax, eax
mov ecx, eax
jle 0x4b8441
xor edx, edx
jmp 0x4b8266
mov rcx, r12
call sub.msvcrt.dll_fclose
jmp 0x4b840b