joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464250
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
movzx eax, word [rcx]
mov r10, qword [rsp + 0x80]
shr ax, 4
movzx r11d, ax
xor eax, 0x7f
movzx eax, ax
mov r13d, dword [r10 + r11*4]
mov r14d, dword [r10 + rax*4]
movzx eax, word [rcx + 2]
shr ax, 4
movzx r11d, ax
xor eax, 0x7f
test r8d, r8d
movzx eax, ax
mov r15d, dword [r10 + r11*4]
mov eax, dword [r10 + rax*4]
mov dword [rsp + 0xc], eax
je 0x464313
lea ebx, [rdx*8]
mov r12, r9
xor edi, edi
lea rbp, [rcx + 4]
add rbx, rbx
nop word [rax + rax]
mov eax, edi
xor r11d, r11d
or eax, 8
nop dword [rax + rax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
mov esi, edx
and eax, 0x7ff
lea rsi, [rbp + rsi*2]
movzx esi, word [rsi + rbx]
xor eax, esi
sar eax, 4
cdqe
add r11d, dword [r10 + rax*4]
cmp edx, 1
mov eax, edx
jne 0x4642d0
add edi, 1
add r11d, r13d
cmp edi, 8
mov dword [r12], r11d
je 0x464324
add r12, 4
cmp r8d, edi
jne 0x4642c0
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r8d, 8
jbe 0x464313
lea rsi, [rcx + 0x104]
lea rbp, [r9 + 0x20]
lea r12d, [r14 + r15]
nop dword [rax]
lea eax, [rdi - 8]
xor r11d, r11d
or eax, 8
nop dword [rax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
mov r13d, edx
and eax, 0x7ff
lea r13, [rsi + r13*2]
movzx r13d, word [r13 + rbx]
xor eax, r13d
sar eax, 4
cdqe
add r11d, dword [r10 + rax*4]
cmp edx, 1
mov eax, edx
jne 0x464350
add edi, 1
add r11d, r12d
cmp edi, 0x10
mov dword [rbp], r11d
je 0x46439b
add rbp, 4
cmp r8d, edi
jne 0x464340
jmp 0x464313
cmp r8d, 0x10
jbe 0x464313
mov eax, dword [rsp + 0xc]
add r9, 0x40
sub r8d, 0x10
xor ebx, ebx
add rcx, 0x204
lea edi, [r14 + rax]
nop
mov eax, ebx
xor r11d, r11d
or ah, 1
nop dword [rax + rax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
mov esi, edx
and eax, 0x7ff
movzx esi, word [rcx + rsi*2]
xor eax, esi
sar eax, 4
cdqe
add r11d, dword [r10 + rax*4]
cmp edx, 1
mov eax, edx
jne 0x4643d0
add r11d, edi
add ebx, 1
add r9, 4
mov dword [r9 - 4], r11d
cmp r8d, ebx
jne 0x4643c0
jmp 0x464313
Function at 0x4644d0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x200
xor r12d, r12d
mov ebp, 4
lea r11, [rcx + 0x32810]
mov rsi, rcx
mov rdi, rsp
lea rbx, [rcx + 0x34444]
nop dword [rax]
movzx ecx, byte [rsi + r12 + 0x30814]
mov r8d, ebp
xor r10d, r10d
mov rdx, rcx
shr ecx, 1
mov eax, edx
sub ecx, 1
and eax, 1
or eax, 2
movzx eax, al
shl eax, cl
sub r8d, eax
sub rax, rdx
test ecx, ecx
lea r13, [rax + rax - 2]
je 0x464578
mov edx, 1
nop dword [rax + rax]
mov eax, edx
mov r9d, r8d
add edx, edx
lea rax, [rbx + rax*2]
and r9d, 1
shr r8d, 1
movzx eax, word [rax + r13]
mov r14d, r9d
or edx, r9d
neg r14d
and r14d, 0x7ff
xor eax, r14d
sar eax, 4
cdqe
add r10d, dword [r11 + rax*4]
sub ecx, 1
jne 0x464540
add ebp, 1
mov dword [rdi + r12*4 + 0x10], r10d
add r12, 1
cmp ebp, 0x80
jne 0x464500
lea r13, [rsi + 0x336a4]
lea r9, [rsi + 0x332a4]
mov r10, r13
lea rbx, [rsi + 0x34244]
mov eax, dword [rsi + 0xa8]
xor ebp, ebp
test eax, eax
je 0x46461f
mov eax, ebp
xor r8d, r8d
lea r12, [r9 + rax*4]
mov eax, ebp
or eax, 0x40
mov ecx, eax
and eax, 1
shr ecx, 1
neg eax
mov edx, ecx
and eax, 0x7ff
movzx edx, word [rbx + rdx*2]
xor edx, eax
mov eax, ecx
sar edx, 4
movsxd rdx, edx
add r8d, dword [r11 + rdx*4]
cmp ecx, 1
jne 0x4645c2
mov dword [r12], r8d
mov eax, dword [rsi + 0xa8]
add ebp, 1
cmp eax, ebp
ja 0x4645b4
cmp eax, 0xe
jbe 0x46461f
mov edx, 0xe
mov eax, edx
mov ecx, edx
add edx, 1
shr eax, 1
sub eax, 5
shl eax, 4
add dword [r9 + rcx*4], eax
cmp dword [rsi + 0xa8], edx
ja 0x464604
mov eax, dword [r9]
mov dword [r10], eax
mov eax, dword [r9 + 4]
mov dword [r10 + 4], eax
mov eax, dword [r9 + 8]
mov dword [r10 + 8], eax
mov eax, dword [r9 + 0xc]
mov dword [r10 + 0xc], eax
xor eax, eax
nop
movzx ecx, byte [rsi + rax + 0x30814]
mov edx, dword [rdi + rax*4 + 0x10]
add edx, dword [r9 + rcx*4]
mov dword [r10 + rax*4 + 0x10], edx
add rax, 1
cmp rax, 0x7c
jne 0x464640
add r9, 0x100
add r10, 0x200
sub rbx, 0xffffffffffffff80
cmp r13, r9
jne 0x4645a8
mov dword [rsi + 0xa0], 0
add rsp, 0x200
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x46b310
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x80]
lea rdi, [rcx + 0x32810]
test eax, eax
mov rbx, rcx
je 0x46b410
mov eax, dword [rbx + 0x44]
mov ecx, dword [rbx + 0x68]
lea r8d, [rax - 1]
mov eax, 1
shl eax, cl
mov dword [rbx + 0x39194], r8d
test eax, eax
mov dword [rbx + 0x3494c], r8d
je 0x46b402
lea r12d, [rax - 1]
xor esi, esi
lea r13, [rbx + 0x34548]
add r12, 1
lea rbp, [rbx + 0x34950]
mov r9, rbp
mov edx, esi
mov qword [rsp + 0x20], rdi
mov rcx, r13
call fcn.00464250
mov r8d, dword [rbx + 0x3494c]
add rbp, 0x440
mov dword [rbx + rsi*4 + 0x38d50], r8d
add rsi, 1
cmp r12, rsi
jne 0x46b373
mov ecx, dword [rbx + 0x68]
mov eax, 1
shl eax, cl
test eax, eax
je 0x46b402
mov r8d, dword [rbx + 0x39194]
lea r12d, [rax - 1]
xor esi, esi
lea r13, [rbx + 0x38d90]
add r12, 1
lea rbp, [rbx + 0x39198]
mov r9, rbp
mov edx, esi
mov qword [rsp + 0x20], rdi
mov rcx, r13
call fcn.00464250
mov r8d, dword [rbx + 0x39194]
add rbp, 0x440
mov dword [rbx + rsi*4 + 0x3d598], r8d
add rsi, 1
cmp r12, rsi
jne 0x46b3d1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call fcn.004644d0
movzx r9d, word [rbx + 0x3452a]
lea rdi, [rbx + 0x32810]
xor ecx, ecx
lea r8, [rbx + 0x34528]
nop dword [rax]
mov eax, ecx
mov r11d, ecx
and eax, 1
shr r11d, 1
mov edx, eax
and r11d, 1
neg eax
or edx, 2
mov esi, r11d
and eax, 0x7ff
mov r10d, edx
neg esi
xor eax, r9d
movzx r10d, word [r8 + r10*2]
and esi, 0x7ff
sar eax, 4
cdqe
mov eax, dword [rdi + rax*4]
xor r10d, esi
sar r10d, 4
movsxd r10, r10d
add eax, dword [rdi + r10*4]
mov r10d, eax
lea eax, [rdx + rdx]
or eax, r11d
mov r11d, ecx
shr r11d, 2
mov edx, eax
and r11d, 1
movzx edx, word [r8 + rdx*2]
mov esi, r11d
neg esi
and esi, 0x7ff
xor edx, esi
sar edx, 4
movsxd rdx, edx
add r10d, dword [rdi + rdx*4]
mov edx, r10d
lea r10d, [rax + rax]
mov eax, r11d
or eax, r10d
mov r10d, ecx
movzx eax, word [r8 + rax*2]
shr r10d, 3
neg r10d
and r10d, 0x7ff
xor eax, r10d
sar eax, 4
cdqe
add edx, dword [rdi + rax*4]
mov dword [rbx + rcx*4 + 0x33ea4], edx
add rcx, 1
cmp rcx, 0x10
jne 0x46b430
mov dword [rbx + 0xa4], 0
jmp 0x46b334
Function at 0x47ea30
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x3c]
mov rbx, rcx
mov r9, r8
mov dword [rsp + 0x20], 0
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rdx, rax
mov qword [rbx], rax
xor eax, eax
test rdx, rdx
je 0x47ea70
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
test eax, eax
cmove eax, edx
add rsp, 0x40
pop rbx
ret
Function at 0x4a3d30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rsi, qword [0x00828ba0]
mov r8d, 4
mov rdi, qword [rsi]
mov rbp, rcx
mov rbx, rdx
mov edx, 1
lea rcx, str.
mov r9, qword [rdi]
call sub.msvcrt.dll_fwrite
mov rdx, qword [rdi]
mov rcx, rbp
call sub.msvcrt.dll_fputs
mov r9, qword [rdi]
mov r8d, 9
mov edx, 1
lea rcx, str._Memory_
call sub.msvcrt.dll_fwrite
lea rdi, [rsp + 0x20]
lea rcx, [rbx + 0xfffff]
lea rdx, [rdi + 0x20]
shr rcx, 0x14
call fcn.004a8b40
cmp byte [rsp + 0x40], 0
je 0x4a3e4d
xor edx, edx
jmp 0x4a3db3
mov edx, r8d
lea r8d, [rdx + 1]
cmp byte [rsp + r8 + 0x40], 0
mov rax, r8
jne 0x4a3db0
cmp eax, 6
ja 0x4a3e5e
cmp edx, 5
mov byte [rsp + 0x3f], 0x20
je 0x4a3e64
add edx, 3
mov byte [rsp + 0x3e], 0x20
cmp edx, 7
je 0x4a3e6a
cmp edx, 6
mov byte [rsp + 0x3d], 0x20
je 0x4a3e70
cmp edx, 5
mov byte [rsp + 0x3c], 0x20
je 0x4a3e76
cmp edx, 4
mov byte [rsp + 0x3b], 0x20
je 0x4a3e7c
cmp edx, 3
mov byte [rsp + 0x3a], 0x20
je 0x4a3e82
mov byte [rsp + 0x39], 0x20
lea rcx, [rdi + 0x19]
mov rax, qword [rsi]
mov rdx, qword [rax]
call sub.msvcrt.dll_fputs
mov rax, qword [rsi]
mov r8d, 3
mov edx, 1
lea rcx, [0x0081062f]
mov r9, qword [rax]
call sub.msvcrt.dll_fwrite
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov byte [rsp + 0x3f], 0x20
mov edx, 2
mov byte [rsp + 0x3e], 0x20
jmp 0x4a3dea
lea rcx, [rdi + 0x20]
jmp 0x4a3e1b
lea rcx, [rdi + 0x1f]
jmp 0x4a3e1b
lea rcx, [rdi + 0x1e]
jmp 0x4a3e1b
lea rcx, [rdi + 0x1d]
jmp 0x4a3e1b
lea rcx, [rdi + 0x1c]
jmp 0x4a3e1b
lea rcx, [rdi + 0x1b]
jmp 0x4a3e1b
lea rcx, [rdi + 0x1a]
jmp 0x4a3e1b
Function at 0x4aebe0
Capabilities:
Create directory

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov r12, rcx
mov r14d, edx
mov rbx, r8
mov rbp, r9
call r13
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
shl esi, 0xc
shl eax, 0xe
xor esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, r12
mov rcx, rbx
xor esi, eax
call fcn.004780f0
test r14b, r14b
je 0x4aedc7
jmp 0x4aec96
lea rdx, str..tmp
mov rcx, rbx
call fcn.00478460
mov rcx, qword [rbx]
call fcn.004b0d60
test al, al
jne 0x4aeddc
mov rdx, qword [rbx]
xor r8d, r8d
mov rcx, rbp
call fcn.004b19b0
test al, al
jne 0x4aee26
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x4aec7f
cmp eax, 0xb7
jne 0x4aedf3
add edi, 1
cmp edi, 0x64
je 0x4aedf3
mov rdx, r12
mov rcx, rbx
call fcn.004780f0
mov ecx, esi
mov edx, esi
and ecx, 0xf
shr edx, 4
lea r8d, [rcx + 0x37]
cmp ecx, 0xa
lea eax, [rcx + 0x30]
cmovae eax, r8d
and edx, 0xf
lea r8d, [rdx + 0x37]
mov word [rsp + 0x20], ax
mov eax, esi
lea ecx, [rdx + 0x30]
shr eax, 8
cmp edx, 0xa
mov edx, r8d
cmovb edx, ecx
and eax, 0xf
lea r8d, [rax + 0x37]
mov word [rsp + 0x22], dx
mov edx, esi
lea ecx, [rax + 0x30]
shr edx, 0xc
cmp eax, 0xa
mov eax, r8d
cmovb eax, ecx
and edx, 0xf
lea r8d, [rdx + 0x37]
mov word [rsp + 0x24], ax
mov eax, esi
lea ecx, [rdx + 0x30]
shr eax, 0x10
cmp edx, 0xa
mov edx, r8d
cmovb edx, ecx
and eax, 0xf
lea r8d, [rax + 0x37]
mov word [rsp + 0x26], dx
mov edx, esi
lea ecx, [rax + 0x30]
shr edx, 0x14
cmp eax, 0xa
mov eax, r8d
cmovb eax, ecx
and edx, 0xf
lea r8d, [rdx + 0x37]
mov word [rsp + 0x28], ax
mov eax, esi
lea ecx, [rdx + 0x30]
shr eax, 0x18
cmp edx, 0xa
mov edx, r8d
cmovb edx, ecx
and eax, 0xf
mov word [rsp + 0x2a], dx
lea r8d, [rax + 0x37]
mov edx, esi
lea ecx, [rax + 0x30]
shr edx, 0x1c
cmp eax, 0xa
mov eax, r8d
cmovb eax, ecx
cmp edx, 0xa
mov word [rsp + 0x2c], ax
lea ecx, [rdx + 0x37]
lea eax, [rdx + 0x30]
cmovae eax, ecx
xor r10d, r10d
test rbp, rbp
mov word [rsp + 0x30], r10w
mov word [rsp + 0x2e], ax
je 0x4aedaa
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
je 0x4aee40
mov rcx, qword [rbx]
lea edx, [rax + 1]
mov r8d, 0x2e
xor r9d, r9d
mov word [rcx + rax*2], r8w
mov eax, edx
mov word [rcx + rax*2], r9w
mov dword [rbx + 8], edx
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.00478460
call r13
mov edx, 1
add eax, 2
cmove eax, edx
add esi, eax
test rbp, rbp
jne 0x4aec34
mov rcx, qword [rbx]
call fcn.004b0d60
test al, al
je 0x4aee13
add edi, 1
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x64
jne 0x4aec8b
mov rax, qword [rbx]
xor edx, edx
mov dword [rbx + 8], 0
mov word [rax], dx
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4aec69
mov eax, 1
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbx
call fcn.00477b00
mov eax, dword [rbx + 8]
jmp 0x4aed8c
Function at 0x4aef70
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x4aef90
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x4aefb0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x4af020
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x4af040
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, rcx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4af068
test al, 0x10
jne 0x4af210
mov rcx, rbx
call fcn.004b3270
test al, al
mov ebp, eax
je 0x4af090
xor ebp, ebp
mov eax, ebp
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r12, [rsp + 0x30]
mov rcx, rbx
call fcn.004b33d0
mov rdx, rbx
mov rcx, r12
mov r14d, eax
call fcn.00477fd0
mov rcx, r12
call fcn.00478dd0
test eax, eax
js 0x4af0da
mov ecx, dword [rsp + 0x38]
lea edx, [rcx - 1]
cmp edx, eax
jne 0x4af0da
cmp ecx, 1
je 0x4af281
mov rax, qword [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x38], edx
mov word [rax + rdx*2], cx
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.00478040
mov ebx, dword [rsp + 0x38]
lea r15, [rsp + 0x50]
mov rsi, qword [rsp + 0x30]
lea rax, [r15 + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov qword [rsp + 0x28], rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
xor edx, edx
mov rcx, rsi
call r13
test eax, eax
je 0x4af190
cmp ebx, dword [rsp + 0x48]
jge 0x4af290
mov rax, qword [rsp + 0x40]
lea edx, [rbx + 1]
lea rcx, [rax + rdx*2]
call fcn.004b2a10
mov rdx, qword [rsp + 0x40]
mov rcx, r12
lea ebx, [rbx + rax + 1]
test eax, eax
cmovs ebx, dword [rsp + 0x48]
mov r8d, ebx
call fcn.00478600
xor edx, edx
mov rcx, qword [rsp + 0x30]
call r13
test eax, eax
jne 0x4af11c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x4af16f
call fcn.007da030
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x4af078
call fcn.007da030
jmp 0x4af078
call rdi
cmp eax, 0xb7
je 0x4af220
call rdi
cmp eax, 0xb7
je 0x4af160
mov rcx, r12
call fcn.00478dd0
test eax, eax
mov ebx, eax
jle 0x4af160
cmp eax, 1
je 0x4af1f0
lea eax, [rbx + 1]
cmp r14d, eax
jae 0x4af160
cmp ebx, dword [rsp + 0x38]
jae 0x4af1e0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
xor edx, edx
mov dword [rsp + 0x38], ebx
mov word [rsi + rax*2], dx
jmp 0x4af110
mov rsi, qword [rsp + 0x30]
jmp 0x4af110
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
cmp ax, 0x5c
je 0x4af160
cmp ax, 0x2f
jne 0x4af1b9
jmp 0x4af160
mov ebp, 1
jmp 0x4af078
mov rcx, r15
call fcn.004b0260
mov rcx, qword [rsp + 0x28]
call fcn.00477f50
mov rdx, rsi
mov rcx, r15
call fcn.004b02c0
test al, al
jne 0x4af260
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x4af19d
call fcn.007da030
jmp 0x4af19d
mov rcx, qword [rsp + 0x78]
mov esi, dword [rsp + 0x70]
test rcx, rcx
je 0x4af273
call fcn.007da030
and esi, 0x10
je 0x4af19d
jmp 0x4af11c
mov ebp, 1
jmp 0x4af16f
mov ebp, 1
jmp 0x4af160
Function at 0x4af2e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4af2fc
mov edx, eax
and edx, 0x11
cmp edx, 1
je 0x4af310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4af2fc
jmp 0x4af30a
Function at 0x4af7f0
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x230
xor edx, edx
mov rax, qword [rcx]
mov dword [rcx + 8], 0
lea rdi, [rsp + 0x20]
mov rsi, rcx
xor ecx, ecx
mov word [rax], dx
mov rdx, rdi
mov word [rsp + 0x20], cx
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, rdi
mov rcx, rsi
mov ebx, eax
call fcn.004780f0
sub ebx, 1
cmp ebx, 0x103
setbe al
add rsp, 0x230
pop rbx
pop rsi
pop rdi
ret
Function at 0x4b0fe0
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rcx + 8]
lea ebx, [rax - 1]
mov rdi, rcx
shl rbx, 3
test eax, eax
je 0x4b1031
mov rax, qword [rdi]
mov rsi, qword [rax + rbx]
test rsi, rsi
je 0x4b1027
mov rcx, qword [rsi]
test rcx, rcx
je 0x4b101a
call fcn.007da030
mov edx, 0x10
mov rcx, rsi
call fcn.007da070
sub rbx, 8
cmp rbx, 0xfffffffffffffff8
jne 0x4b1001
xor edx, edx
xor ecx, ecx
mov dword [rdi + 8], 0
mov rsi, qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call rsi
test eax, eax
mov ebx, eax
je 0x4b1090
mov ecx, eax
add rcx, rcx
call fcn.007da080
mov ecx, ebx
mov r14, rax
mov rdx, rax
call rsi
test eax, eax
mov ebp, eax
je 0x4b1069
cmp ebx, eax
jae 0x4b1094
xor ebx, ebx
mov rcx, r14
call fcn.007da030
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x4b1073
lea r13, [rsp + 0x30]
mov rcx, r13
call fcn.00477f50
mov rsi, r14
mov ebx, 1
xor edx, edx
jmp 0x4b10bd
lea eax, [rbx + 1]
add rsi, 2
cmp ebp, ebx
jbe 0x4b110b
mov ebx, eax
cmp word [rsi], 0
jne 0x4b10b0
lea rdx, [r14 + rdx*2]
mov rcx, r13
call fcn.004780f0
mov ecx, 0x10
call fcn.007da0a0
mov rdx, r13
mov rcx, rax
mov r12, rax
call fcn.00478040
mov eax, dword [rdi + 8]
cmp eax, dword [rdi + 0xc]
je 0x4b1130
mov r9, qword [rdi]
mov edx, eax
add rsi, 2
add eax, 1
cmp ebp, ebx
mov qword [r9 + rdx*8], r12
mov edx, ebx
mov dword [rdi + 8], eax
lea eax, [rbx + 1]
ja 0x4b10bb
mov rcx, qword [rsp + 0x30]
cmp edx, ebp
sete bl
test rcx, rcx
je 0x4b106b
call fcn.007da030
jmp 0x4b106b
mov edx, eax
shr edx, 2
lea ecx, [rax + rdx + 1]
mov r15, rcx
shl rcx, 3
call fcn.007da080
mov r9, rax
mov eax, dword [rdi + 8]
mov r10, qword [rdi]
test eax, eax
jne 0x4b1178
test r10, r10
je 0x4b116c
mov rcx, r10
mov qword [rsp + 0x28], r9
call fcn.007da030
mov eax, dword [rdi + 8]
mov r9, qword [rsp + 0x28]
mov qword [rdi], r9
mov dword [rdi + 0xc], r15d
jmp 0x4b10f2
mov rdx, r10
mov rcx, r9
mov qword [rsp + 0x28], r10
lea r8, [rax*8]
call sub.msvcrt.dll_memcpy
mov r10, qword [rsp + 0x28]
mov r9, rax
jmp 0x4b1157

Function at 0x4b1350
Capabilities:
Get file size

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rcx, qword [rcx]
mov rsi, rdx
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b1390
mov eax, dword [rsp + 0x2c]
shl rax, 0x20
add rax, rbx
mov qword [rsi], rax
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b136e
xor eax, eax
jmp 0x4b1381

Function at 0x4b1790
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov eax, 0x400000
cmp r8d, 0x400000
mov rbx, r9
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
mov dword [rsp + 0x3c], 0
lea r9, [rsp + 0x3c]
cmova r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x3c]
test eax, eax
setne al
mov dword [rbx], edx
add rsp, 0x40
pop rbx
ret
Function at 0x4b17f0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, 0x400000
mov r14, rcx
mov rsi, rdx
mov ebx, r8d
mov dword [r9], 0
lea r13, [rsp + 0x3c]
mov rdi, r9
jmp 0x4b1831
test edx, edx
je 0x4b1874
mov eax, edx
add rsi, rax
sub ebx, edx
je 0x4b1874
cmp ebx, 0x400000
mov r8d, ebp
mov r9, r13
mov rcx, qword [r14]
cmovbe r8d, ebx
mov dword [rsp + 0x3c], 0
mov rdx, rsi
mov qword [rsp + 0x20], 0
call r12
mov edx, dword [rsp + 0x3c]
add dword [rdi], edx
test eax, eax
jne 0x4b1824
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 1
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x4b1b90
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, 0x400000
mov r14, rcx
mov rsi, rdx
mov ebx, r8d
mov dword [r9], 0
lea r13, [rsp + 0x3c]
mov rdi, r9
jmp 0x4b1bd1
test edx, edx
je 0x4b1c14
mov eax, edx
add rsi, rax
sub ebx, edx
je 0x4b1c14
cmp ebx, 0x400000
mov r8d, ebp
mov r9, r13
mov rcx, qword [r14]
cmovbe r8d, ebx
mov dword [rsp + 0x3c], 0
mov rdx, rsi
mov qword [rsp + 0x20], 0
call r12
mov edx, dword [rsp + 0x3c]
add dword [rdi], edx
test eax, eax
jne 0x4b1bc4
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 1
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x4b26b0
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x230
xor edx, edx
mov rax, qword [rcx]
mov dword [rcx + 8], 0
lea rdi, [rsp + 0x20]
mov rsi, rcx
xor ecx, ecx
mov word [rax], dx
mov rdx, rdi
mov word [rsp + 0x20], cx
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, rdi
mov rcx, rsi
mov ebx, eax
call fcn.004780f0
sub ebx, 1
cmp ebx, 0x103
setbe al
add rsp, 0x230
pop rbx
pop rsi
pop rdi
ret
Function at 0x4b6f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebp, 2
lea rdi, [rsp + 0x20]
mov rbx, rcx
mov r9d, dword [rbx + 0x30]
test r9d, r9d
je 0x4b703e
nop word cs:[rax + rax]
mov eax, dword [rbx + 0x34]
mov r8, qword [rbx + 0x38]
lea rcx, [rax + rax*2]
mov rdx, rax
mov rax, qword [r8 + 0x88]
lea r12, [rax + rcx*8]
cmp qword [r12], 0
jne 0x4b703e
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x4b70e5
cmp edx, dword [rax]
mov esi, 2
je 0x4b70e5
mov rcx, qword [rbx + 0x40]
mov r9d, esi
mov r8, rdi
mov qword [rsp + 0x20], 0
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
je 0x4b7060
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x4b70f0
mov esi, eax
mov rax, qword [rcx]
call qword [rax + 0x10]
test esi, esi
jne 0x4b7040
xor esi, esi
cmp byte [rbx + 0x1b], 0
mov eax, dword [rbx + 0x34]
je 0x4b6fee
mov rcx, qword [rbx + 0x38]
mov edx, eax
xor esi, esi
lea rdx, [rdx + rdx*2]
mov r8, qword [rcx + 0x88]
mov ecx, dword [rbx + 0x1c]
lea rdx, [r8 + rdx*8]
not ecx
cmp dword [rdx + 0xc], ecx
setne sil
lea esi, [rsi + rsi*2]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x4b7008
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, dword [rbx + 0x34]
mov qword [rbx + 0x10], 0
mov rdx, qword [rbx + 0x28]
mov byte [rbx + 0x1a], 0
test rdx, rdx
je 0x4b7058
cmp dword [rdx], eax
je 0x4b7050
mov rcx, qword [rbx + 0x40]
add eax, 1
mov edx, esi
mov dword [rbx + 0x34], eax
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
mov esi, eax
jne 0x4b7040
mov r9d, dword [rbx + 0x30]
test r9d, r9d
jne 0x4b6f40
xor esi, esi
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add rdx, 4
mov qword [rbx + 0x28], rdx
sub dword [rbx + 0x30], 1
jmp 0x4b7019
mov r13, qword [rsp + 0x20]
test r13, r13
je 0x4b7074
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 8]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x4b7083
mov rax, qword [rcx]
call qword [rax + 0x10]
movzx eax, byte [rbx + 0x19]
mov qword [rbx + 0x10], r13
mov dword [rbx + 0x1c], 0xffffffff
test al, al
je 0x4b70a9
movzx eax, byte [r12 + 0x12]
test al, al
je 0x4b70a9
movzx eax, byte [r12 + 0x11]
xor eax, 1
mov byte [rbx + 0x1b], al
mov rax, qword [r12]
test esi, esi
mov byte [rbx + 0x1a], 1
mov qword [rbx + 0x20], rax
jne 0x4b70c4
cmp qword [rsp + 0x20], 0
je 0x4b7101
mov rcx, qword [rbx + 0x40]
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x20]
mov esi, eax
test rcx, rcx
je 0x4b6fb5
jmp 0x4b6faf
movzx esi, byte [rbx + 0x18]
jmp 0x4b6f7e
mov esi, eax
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rbx + 0x38]
mov eax, dword [rbx + 0x34]
cmp eax, dword [rdx + 0x120]
jae 0x4b711d
mov rdx, qword [rdx + 0x118]
cmp byte [rdx + rax], 0
jne 0x4b70c4
cmp byte [r12 + 0x11], 0
cmove esi, ebp
jmp 0x4b70c4