joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418e8d
Capabilities:
Delete file
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1d0
lea rcx, [rbp - 0x1d0]
mov edx, 0x1ba
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov word [rbp - 2], 0
push qword [0x009d6ddc]
push 0x1ba
lea rax, [rbp - 0x1d0]
push rax
movzx eax, word [rbp - 2]
push rax
push 3
push 0x6e05f2
call fcn.0040ece8
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x418ef2
cmp dword [rbp - 8], 0xffffff12
jne 0x418fa7
cmp dword [rbp - 8], 0
jl 0x418fa5
test byte [rbp - 0x12e], 0xff
jne 0x418f9a
mov qword [rbp - 0x1a8], 0xffffffffffffffff
mov qword [rbp - 0x1a0], 0xffffffffffffffff
mov qword [rbp - 0x198], 0xffffffffffffffff
mov qword [rbp - 0x190], 0xffffffffffffffff
mov dword [rbp - 0x167], 0
xor eax, eax
mov qword [rbp - 0x163], rax
mov qword [rbp - 0x15b], rax
mov qword [rbp - 0x153], rax
mov qword [rbp - 0x14b], rax
mov byte [rbp - 0x143], 0
push rax
push qword [0x009d6ddc]
push 0x1ba
lea rax, [rbp - 0x1d0]
push rax
push 3
push 0x6e05f2
call fcn.0040ee0a
pop rcx
cmp eax, 0
jne 0x418fa9
push qword [rbp - 0x1d0]
push 0x3e8
call fcn.0045704d
mov word [rbp - 2], 4
jmp 0x418eb8
leave
ret
int 5
int 5

Function at 0x418fab
Capabilities:
Delete file
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
imul eax, dword [rbp + 0x28], 2
mov rcx, qword [rbp + 0x20]
mov edx, eax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 4], 0
jmp 0x418ffa
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x28]
jae 0x41901d
mov rbx, qword [rbp + 0x20]
mov esi, dword [rbp - 4]
cmp esi, dword [rbp + 0x18]
jae 0x41901d
mov rdi, qword [rbp + 0x10]
movzx esi, byte [rdi + rsi]
mov word [rbx + rax*2], si
inc dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x18]
jge 0x419017
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x18]
jae 0x41901b
mov rbx, qword [rbp + 0x10]
movzx eax, byte [rbx + rax]
cmp eax, 0
jne 0x418fd7
leave
ret 0x20
int 5
int 5
Function at 0x41901f
Capabilities:
Delete file
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x550
push 0x105
lea rax, [rbp - 0x220]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.0045721c
push 0x105
lea rax, [rbp - 0x220]
push rax
call fcn.0045185b
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x41910b
push rax
push 0x105
lea rax, [rbp - 0x220]
push rax
lea rax, [rbp - 0x550]
push rax
call fcn.004572a4
pop rcx
cmp eax, 0
jne 0x41908e
movzx eax, word [rbp - 0x244]
cmp eax, 2
je 0x41910b
dec dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, 0x105
jae 0x419165
mov word [rbp + rax*2 - 0x220], 0
jmp 0x4190c8
dec dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, 0x105
jae 0x419169
mov word [rbp + rax*2 - 0x220], 0
cmp dword [rbp - 4], 0
jle 0x419106
mov eax, dword [rbp - 4]
dec eax
cmp eax, 0x105
jae 0x419167
movzx eax, word [rbp + rax*2 - 0x220]
cmp eax, 0x2f
je 0x419106
mov eax, dword [rbp - 4]
dec eax
cmp eax, 0x105
jae 0x419167
movzx eax, word [rbp + rax*2 - 0x220]
cmp eax, 0x5c
jne 0x4190ac
jmp 0x419057
cmp dword [rbp - 4], 0
jne 0x41911d
mov eax, dword [0x006fb080]
mov dword [rbp - 0x220], eax
mov qword [rbp - 0x10], 0
push 0
push 0
lea rax, [rbp - 0x10]
push rax
lea rax, [rbp - 0x220]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
add rsp, 0x20
mov eax, dword [rbp - 0x10]
movsxd rbx, dword [rbp - 0xc]
shl rbx, 0x20
add rax, rbx
leave
ret 0x10
int 5
int 5
int 5

Function at 0x41916b
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x210
push 0x105
lea rax, [rbp - 0x210]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.0045721c
sub rsp, 0x18
lea rax, [rbp - 0x210]
push rax
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
add rsp, 0x20
cmp eax, 0
jne 0x4191b6
call fcn.0042464b
leave
ret 0x10
xor eax, eax
leave
ret 0x10
Function at 0x425760
Capabilities:
Set current directory

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x210
push 0x105
lea rax, [rbp - 0x210]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.0045721c
sub rsp, 0x18
lea rax, [rbp - 0x210]
push rax
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
add rsp, 0x20
cmp eax, 0
jne 0x4257ab
call fcn.0042464b
leave
ret 0x10
xor eax, eax
leave
ret 0x10

Function at 0x4257eb
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push rax
push 0
lea rax, [rbp - 4]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
movsxd rax, dword [rbp + 0x20]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
add rsp, 0x30
cmp eax, 0
jne 0x425834
call fcn.0042464b
leave
ret 0x18
mov eax, dword [rbp - 4]
leave
ret 0x18

Function at 0x426469
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [rbp + 0x10]
mov dword [rbp - 4], eax
cmp dword [rbp + 0x10], 0
jge 0x426486
xor eax, eax
leave
ret 0x20
movzx eax, byte [rbp + 0x18]
mov byte [rbp - 0x21], al
mov eax, 0x10
mov bl, byte [rbp - 0x21]
jmp 0x42649b
mov byte [rbp + rax - 0x20], bl
dec eax
jns 0x426497
jmp 0x4264c4
push rax
push qword [rbp + 0x28]
push 0x10
lea rax, [rbp - 0x20]
push rax
call qword [rbp + 0x20]
pop rcx
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x4264c0
mov eax, dword [rbp - 8]
leave
ret 0x20
sub dword [rbp - 4], 0x10
cmp dword [rbp - 4], 0x10
jge 0x4264a1
push rax
push qword [rbp + 0x28]
mov eax, dword [rbp - 4]
mov dword [rbp - 0x24], eax
mov eax, 0x10
sub eax, dword [rbp - 0x24]
jb 0x4264ee
push qword [rbp - 0x24]
lea rax, [rbp - 0x20]
push rax
call qword [rbp + 0x20]
pop rcx
leave
ret 0x20
int 5
Function at 0x4264f0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], eax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov dword [rbp - 8], 0x14
mov byte [rbp - 1], 0
cmp qword [rbp - 0x18], 0
jge 0x42656f
mov rax, qword [rbp - 0x18]
movabs rbx, 0x8000000000000000
cmp rax, rbx
jne 0x426560
mov rax, qword [rbp + 0x10]
mov rbx, qword [0x006fd6c0]
mov rsi, qword [0x006fd6c8]
mov edi, dword [0x006fd6d0]
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov dword [rax + 0x10], edi
mov eax, 0x14
leave
ret 0x10
mov byte [rbp - 1], 1
mov rax, qword [rbp - 0x18]
neg rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rbx, 0xa
cqo
idiv rbx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
shl rax, 1
mov rbx, qword [rbp - 0x18]
sub rbx, rax
mov rax, qword [rbp - 0x20]
shl rax, 3
sub rbx, rax
mov ebx, ebx
mov dword [rbp - 0xc], ebx
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
dec dword [rbp - 8]
mov eax, dword [rbp - 8]
cmp eax, 0x14
jae 0x426650
mov ebx, dword [rbp - 0xc]
add ebx, 0x30
mov byte [rbp + rax - 0x38], bl
cmp qword [rbp - 0x18], 0
je 0x4265cb
jmp 0x42656f
test byte [rbp - 1], 0xff
je 0x4265e1
dec dword [rbp - 8]
mov eax, dword [rbp - 8]
cmp eax, 0x14
jae 0x426652
mov byte [rbp + rax - 0x38], 0x2d
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov dword [rax + 0x10], ebx
mov eax, 0x14
sub eax, dword [rbp - 8]
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
mov dword [rbp - 0x3c], eax
mov eax, 0x14
sub eax, dword [rbp - 0x3c]
jb 0x426654
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 0x10]
mov dword [rbp - 0x40], ebx
mov ebx, 0x14
sub ebx, dword [rbp - 0x40]
jb 0x426654
cmp ebx, dword [rbp - 8]
jb 0x426654
mov ebx, dword [rbp - 8]
mov esi, dword [rbp - 0x40]
cmp esi, dword [rbp - 0x3c]
jne 0x426654
mov r8d, esi
lea rdx, [rbp + rbx - 0x38]
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov eax, dword [rbp - 0x10]
leave
ret 0x10
int 5
int 5
int 5
Function at 0x426656
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
mov dword [rbp - 4], 0x10
dec dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, 0x10
jae 0x426732
mov ebx, dword [rbp - 0x10]
and ebx, 0xf
cmp ebx, 0x10
jae 0x426732
movzx ebx, byte [rbx + str.0123456789abcdef_float_array_id_mesh_positions_array_d__count__d__]
mov byte [rbp + rax - 0x20], bl
mov rax, qword [rbp - 0x10]
sar rax, 4
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
sete al
cmp dword [rbp - 4], 0
sete bl
or al, bl
test al, al
jne 0x4266c6
jmp 0x42667a
mov eax, 0x10
sub eax, dword [rbp - 4]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov eax, dword [rbp - 8]
mov dword [rbp - 0x24], eax
mov eax, 0x10
sub eax, dword [rbp - 0x24]
jb 0x426734
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 8]
mov dword [rbp - 0x28], ebx
mov ebx, 0x10
sub ebx, dword [rbp - 0x28]
jb 0x426734
cmp ebx, dword [rbp - 4]
jb 0x426734
mov ebx, dword [rbp - 4]
mov esi, dword [rbp - 0x28]
cmp esi, dword [rbp - 0x24]
jne 0x426734
mov r8d, esi
lea rdx, [rbp + rbx - 0x20]
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov eax, dword [rbp - 8]
leave
ret 0x10
int 5
int 5

Function at 0x426dec
Capabilities:
Move file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x420
push 0x105
lea rax, [rbp - 0x210]
push rax
push qword [rbp + 0x28]
push qword [rbp + 0x20]
call fcn.0045721c
push 0x105
lea rax, [rbp - 0x420]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.0045721c
push rax
push rax
lea rax, [rbp - 0x420]
push rax
lea rax, [rbp - 0x210]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_MoveFileW]
add rsp, 0x20
cmp eax, 0
jne 0x426e5a
call fcn.0042464b
leave
ret 0x20
xor eax, eax
leave
ret 0x20

Function at 0x426e60
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x210
push 0x105
lea rax, [rbp - 0x210]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.0045721c
push rax
push rax
push 0
lea rax, [rbp - 0x210]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
add rsp, 0x20
cmp eax, 0
jne 0x426eb0
call fcn.0042464b
leave
ret 0x10
xor eax, eax
leave
ret 0x10
Function at 0x42c968
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
push 0x105
lea rax, [rbp - 0x110]
push rax
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.004929a3
push rax
push 0
push pe_nt_image_headers64
push 2
push 0
push 0
push 0xffffffff80000000
lea rax, [rbp - 0x110]
push rax
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
add rsp, 0x40
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
je 0x42ca07
sub rsp, 0x18
push qword [rbp - 8]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
sub rsp, 0x18
lea rax, [rbp - 0x110]
push rax
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
add rsp, 0x20
cmp eax, 0
je 0x42ca07
xor eax, eax
leave
ret 0x10
push rax
push 0
push 2
push 2
push 0
push 0
push 0xffffffff80000000
lea rax, [rbp - 0x110]
push rax
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
add rsp, 0x40
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
je 0x42ca80
sub rsp, 0x18
push qword [rbp - 8]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
sub rsp, 0x18
lea rax, [rbp - 0x110]
push rax
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
add rsp, 0x20
cmp eax, 0
je 0x42ca80
xor eax, eax
leave
ret 0x10
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetLastError]
add rsp, 0x20
neg eax
leave
ret 0x10
Function at 0x42d246
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, dword [rbp + 0x18]
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
and eax, 0xffff
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
shr eax, 0x10
and eax, 0xffff
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x10], 0
jmp 0x42d2cb
mov eax, dword [rbp - 0x10]
cmp eax, dword [rbp + 0x18]
jae 0x42d2e9
mov rbx, qword [rbp + 0x10]
movzx eax, byte [rbx + rax]
add dword [rbp - 8], eax
cmp dword [rbp - 8], 0xfff1
jb 0x42d2a2
sub dword [rbp - 8], 0xfff1
mov eax, dword [rbp - 8]
add dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0xfff1
jb 0x42d2c8
sub dword [rbp - 0xc], 0xfff1
cmp dword [rbp - 0xc], 0xfff1
jb 0x42d2c8
sub dword [rbp - 0xc], 0xfff1
inc dword [rbp - 0x10]
mov eax, dword [rbp - 4]
dec dword [rbp - 4]
cmp eax, 0
ja 0x42d27f
mov eax, dword [rbp - 0xc]
shl eax, 0x10
add eax, dword [rbp - 8]
mov rbx, qword [rbp + 0x20]
mov dword [rbx], eax
leave
ret 0x18
int 5
Function at 0x42e20d
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x18]
cmp dword [rax + 0x40], 0
jne 0x42e23c
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov word [rax + 0x10], bx
mov eax, 0xffffffff
leave
ret 0x10
push rax
push qword [rbp + 0x18]
call fcn.0040b260
pop rcx
mov rax, qword [rbp + 0x18]
cmp dword [rax + 0x40], 0
jne 0x42e274
push rax
push qword [rbp + 0x18]
call fcn.0040ba36
pop rcx
mov rax, qword [rbp + 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov word [rax + 0x10], bx
mov eax, 0xffffffff
leave
ret 0x10
mov rax, qword [rbp + 0x18]
mov rax, qword [rax + 0x30]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lock inc dword [rax]
cmp dword [rax + 4], 0x2e
jne 0x42e31e
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov cx, word [rax + 0x18]
mov qword [rbx], rsi
mov qword [rbx + 8], rdi
mov word [rbx + 0x10], cx
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 8]
lock inc dword [rbx]
cmp dword [rbx + 4], 0x2e
jne 0x42e320
mov qword [rbp - 0x10], rbx
mov rbx, qword [rbx + 8]
mov rbx, qword [rbx]
mov qword [rax + 0x30], rbx
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp + 0x18]
cmp qword [rax + 0x30], 0
jne 0x42e2f9
mov rax, qword [rbp + 0x18]
mov qword [rax + 0x38], 0
mov rax, qword [rbp + 0x18]
dec dword [rax + 0x40]
mov rax, qword [rbp - 8]
mov ebx, 0x2e
call fcn.006df099
push rax
push qword [rbp + 0x18]
call fcn.0040ba36
pop rcx
xor eax, eax
leave
ret 0x10
int 5
int 5
Function at 0x42e322
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [rbp + 0x18]
cmp qword [rax + 0x10], 0
jle 0x42e442
mov rax, qword [rbp + 0x10]
movzx eax, word [rax + 0x10]
cmp eax, 0
jne 0x42e352
mov eax, 0xffffb1df
leave
ret 0x10
mov rax, qword [rbp + 0x10]
movzx eax, word [rax + 0x10]
shl eax, 8
mov rbx, qword [rbp + 0x10]
movzx ebx, word [rbx + 0x10]
shr ebx, 8
add eax, ebx
mov word [rbp - 4], ax
push rax
push qword [rbp + 0x10]
call fcn.0049413d
pop rcx
mov byte [rbp - 1], al
test byte [rbp - 1], 0xff
je 0x42e3e7
mov rax, qword [rbp + 0x18]
cmp qword [rax], 0
jg 0x42e394
mov eax, 0xffffb1db
leave
ret 0x10
mov word [rbp - 0x20], 0x17
movzx eax, word [rbp - 4]
mov word [rbp - 0x1e], ax
mov dword [rbp - 0x1c], 0
mov rax, qword [rbp + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov dword [rbp - 8], 0
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x10]
mov ecx, dword [rbp - 8]
mov qword [rax + 0x19], rbx
mov qword [rax + 0x21], rsi
mov qword [rax + 0x29], rdi
mov dword [rax + 0x31], ecx
jmp 0x42e432
mov rax, qword [rbp + 0x18]
cmp qword [rax + 8], 0
jg 0x42e3fb
mov eax, 0xffffb1da
leave
ret 0x10
mov word [rbp - 0x20], 2
movzx eax, word [rbp - 4]
mov word [rbp - 0x1e], ax
mov rax, qword [rbp + 0x10]
mov ebx, dword [rax + 0xc]
mov dword [rbp - 0x1c], ebx
mov rax, qword [0x006e0789]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
mov qword [rax + 0x35], rbx
mov qword [rax + 0x3d], rsi
mov rax, qword [rbp + 0x18]
mov bl, byte [rbp - 1]
mov byte [rax + 0x18], bl
xor eax, eax
leave
ret 0x10
int 5
Function at 0x42e444
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x20]
cmp qword [rax + 0x10], 0
jle 0x42e536
mov rax, qword [rbp + 0x20]
test byte [rax + 0x18], 0xff
je 0x42e4ad
mov dword [rbp - 8], 0x1c
lea rax, [rbp - 8]
push rax
mov rax, qword [rbp + 0x20]
lea rax, [rax + 0x19]
push rax
push 0
push qword [rbp + 0x18]
push qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
push qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [sym.imp.ws2_32.dll_sendto]
add rsp, 0x30
mov dword [rbp - 4], eax
jmp 0x42e4f1
mov dword [rbp - 8], 0x10
lea rax, [rbp - 8]
push rax
mov rax, qword [rbp + 0x20]
lea rax, [rax + 0x35]
push rax
push 0
push qword [rbp + 0x18]
push qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
push qword [rax + 8]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [sym.imp.ws2_32.dll_sendto]
add rsp, 0x30
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
jne 0x42e528
call fcn.0042464b
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffd8cd
jne 0x42e519
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x45], 1
mov eax, 0xffffb1e0
leave
ret 0x18
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x45], 0
mov eax, dword [rbp - 4]
leave
ret 0x18
mov rax, qword [rbp + 0x20]
mov byte [rax + 0x45], 0
xor eax, eax
leave
ret 0x18
int 5

Function at 0x44ab9b
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, dword [rbp + 0x10]
cmp eax, 0x401
jae 0x44ac24
imul eax, eax, 0x388
lea rax, [rax + 0x9d6fc0]
mov qword [rbp - 8], rax
movzx eax, byte [rbp + 0x18]
cmp eax, 8
jae 0x44ac26
mov rbx, qword [rbp - 8]
imul eax, eax, 0x60
lea rax, [rbx + rax + 0x20]
mov qword [rbp - 0x10], rax
movzx eax, byte [rbp + 0x18]
cmp eax, 8
jae 0x44ac28
test byte [rax + 0x6e1160], 0xff
jne 0x44ac2a
mov eax, dword [rbp + 0x10]
cmp eax, 0x400
jae 0x44ac2c
test byte [rax + 0xab9380], 0xff
je 0x44ac20
mov rax, qword [rbp - 0x10]
mov byte [rax + 0x48], 1
push rax
movzx eax, byte [rbp + 0x18]
cmp eax, 8
jae 0x44ac2e
push qword [rax*4 + 0x9d66d0]
call fcn.00493e2d
pop rcx
leave
ret 0x10
int 5
int 5
int 5
int 5
int 5
int 5
Function at 0x47b9cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.00505119
mov qword [rbp - 8], rax
push rax
push qword [rbp + 0x40]
push qword [rbp + 0x38]
push qword [rbp + 0x30]
push qword [rbp + 0x28]
mov rax, qword [rbp - 8]
lock inc dword [rax]
cmp dword [rax + 4], 8
jne 0x47ba33
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
push qword [rbp + 0x10]
call fcn.00509768
pop rcx
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp - 8]
mov ebx, 8
call fcn.006df099
leave
ret 0x38
int 5

Function at 0x47ba35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
push rax
push qword [rbp + 0x10]
call fcn.00509933
pop rcx
lock inc dword [rax]
cmp dword [rax + 4], 0x53
jne 0x47bb8b
mov qword [rbp - 8], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov dword [rbp - 0x10], ebx
lea rax, [rax + 8]
mov qword [rbp - 0x18], rax
mov r8d, 0x2c
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp - 0x48]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
push rax
mov rax, qword [rbp + 0x18]
push qword [rax + 0x20]
call fcn.004d5357
pop rcx
mov dword [rbp - 0x28], eax
cmp dword [rbp - 0x10], 0
jne 0x47bab1
mov rax, qword [rbp - 0x18]
mov ebx, dword [rbp - 0x28]
cmp ebx, dword [rax + 0x10]
jg 0x47bb8d
jmp 0x47bb2f
cmp dword [rbp - 0x10], 1
je 0x47bacf
cmp dword [rbp - 0x10], 2
je 0x47bacf
cmp dword [rbp - 0x10], 3
je 0x47bacf
cmp dword [rbp - 0x10], 4
je 0x47bacf
cmp dword [rbp - 0x10], 0xa
jne 0x47bb1a
mov rax, qword [rbp - 0x18]
push rax
push 4
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x10], eax
call fcn.004d5357
pop rcx
mov ebx, dword [rsp]
sub ebx, eax
cmp ebx, dword [rbp - 0x28]
jl 0x47bb8f
cmp dword [rbp - 0x10], 0xa
jne 0x47bb18
push qword [rbp - 0x10]
push qword [rbp - 0x18]
call fcn.005099f4
push qword [rbp - 0x10]
push qword [rbp - 0x18]
call fcn.00509a40
push qword [rbp - 0x10]
push qword [rbp - 0x18]
call fcn.00509aeb
jmp 0x47bb2f
cmp dword [rbp - 0x10], 5
je 0x47bb2f
push 0x4c
push str.set_font___is_only_allowed_on_text__edit__checkbox__radiobutton_and_buttons_n
push 0
push rbp
call fcn.005050b8
cmp dword [rbp - 0x28], 1
jge 0x47bb44
push 0x18
push 0x70be48
push 0
push rbp
call fcn.005050b8
mov rax, qword [rbp - 0x18]
mov r8d, 0x2c
lea rdx, [rbp - 0x48]
lea rcx, [rax + 0x14]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
and dword [rax + 0x3c], 0xffffff
cmp dword [rbp - 0x10], 5
je 0x47bb80
push qword [rbp - 0x10]
push qword [rbp - 0x18]
call fcn.004d66ce
mov rax, qword [rbp - 8]
lock dec dword [rax]
leave
ret 0x10
int 5
int 5
int 5
Function at 0x48a578
Capabilities:
Encrypt data using aes
Enumerate process modules
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x490
push rax
push rax
push 0
push 0x18
mov ecx, dword [rsp]
mov edx, dword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
add rsp, 0x20
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x48a5a9
leave
ret 8
mov dword [rbp - 0x248], 0x238
push rax
push rax
lea rax, [rbp - 0x248]
push rax
push qword [rbp - 8]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_Module32First]
add rsp, 0x20
cmp eax, 0
jne 0x48a5f1
sub rsp, 0x18
push qword [rbp - 8]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
leave
ret 8
push rax
push qword [rbp + 0x10]
call fcn.00489fad
pop rcx
push rax
push qword [rbp + 0x10]
push 0x11
push str.Memory_modules:_r_n
call fcn.004257eb
pop rcx
mov rax, qword [rbp - 0x230]
mov qword [rbp - 0x250], rax
push 0x200
lea rax, [rbp - 0x458]
push rax
push 0x11
push str._16x_to__16x__s_r_n
mov dword [rbp - 0x480], 8
lea rax, [rbp - 0x250]
mov qword [rbp - 0x488], rax
mov eax, dword [rbp - 0x228]
add rax, qword [rbp - 0x250]
mov qword [rbp - 0x490], rax
mov dword [rbp - 0x470], 8
lea rax, [rbp - 0x490]
mov qword [rbp - 0x478], rax
mov dword [rbp - 0x460], 0x100
lea rax, [rbp - 0x218]
mov qword [rbp - 0x468], rax
push 3
lea rax, [rbp - 0x488]
push rax
call fcn.00402463
push rax
push qword [rbp + 0x10]
push 0x200
lea rax, [rbp - 0x458]
push rax
call fcn.00401d50
mov dword [rbp - 0x45c], eax
mov eax, 0x200
sub eax, dword [rbp - 0x45c]
jb 0x48a719
push qword [rbp - 0x45c]
lea rax, [rbp - 0x458]
push rax
call fcn.004257eb
pop rcx
push rax
push rax
lea rax, [rbp - 0x248]
push rax
push qword [rbp - 8]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_Module32Next]
add rsp, 0x20
cmp eax, 0
je 0x48a700
jmp 0x48a60c
sub rsp, 0x18
push qword [rbp - 8]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
leave
ret 8
int 5