joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
mov r12, r9
call fcn.004cb030
call fcn.00491aa0
lea r8, str.WAVE
mov rcx, qword [rax + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rbx, rbx
mov rbp, rax
je 0x482ca9
test rax, rax
je 0x482ca9
mov qword [rsp + 0xa0], rdi
call fcn.00491aa0
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
call fcn.00491aa0
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [rsp + 0x20]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x24], 0x204d454d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WINMM.dll_mmioOpenW]
lea rdx, [rsi + 0x260]
mov r9d, 0x20
xor r8d, r8d
mov rcx, rax
mov rbx, rax
mov dword [rsi + 0x268], 0x45564157
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x482c9a
lea r9d, [rax + 0x10]
lea r8, [rsi + 0x260]
lea rdx, [rsi + 0x24c]
mov rcx, rbx
mov dword [rsi + 0x24c], 0x20746d66
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x482c9a
lea rdx, [rsi + 0x24c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
lea r8, [rsi + 0x260]
lea rdx, [rsi + 0x238]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
mov dword [rsi + 0x238], 0x61746164
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x482c9a
lea rdx, [rsi + 0x238]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x258]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x250]
lea rdx, [rsi + 0x210]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x250], eax
jne 0x482c9a
cmp word [rsi + 0x212], 1
jne 0x482c9a
cmp word [rsi + 0x21e], 0x10
jne 0x482c9a
mov eax, dword [rsi + 0x23c]
mov rdx, r12
mov rcx, rsi
mov dword [rsi + 0xd4], eax
call fcn.00482cb0
test eax, eax
jne 0x482c81
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
mov rcx, rsi
call fcn.004831d0
xor eax, eax
mov rdi, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov dword [rsi + 0xd0], 1
mov dword [rsi + 0xdc], 0
mov rax, rbx
jmp 0x482c5f
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x482c5f
xor eax, eax
jmp 0x482c67
Function at 0x482cb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
lea rdx, [rcx + 0x10]
lea rcx, [0x00483080]
call sub.DSOUND.dll_DirectSoundEnumerateW
mov r11, qword [rsi + 0x10]
test r11, r11
je 0x482d0f
nop
mov rdx, qword [r11]
cmp rdx, qword [rsi + 0x288]
jne 0x482cfd
mov rdx, qword [r11 + 8]
cmp rdx, qword [rsi + 0x290]
jne 0x482cfd
xor eax, eax
jmp 0x482d02
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x482d21
mov r11, qword [r11 + 0x18]
test r11, r11
jne 0x482ce0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
mov rcx, rsi
mov qword [rsi + 0x18], r11
call fcn.00482dd0
test eax, eax
je 0x482d0f
xor ebx, ebx
lea rdi, [rsi + 0x68]
nop
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rdi], rax
je 0x482d0f
add rbx, 1
add rdi, 8
cmp rbx, 4
jl 0x482d40
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x60], rax
je 0x482d0f
lea rax, [rsi + 0x90]
lea r8, [0x00482f90]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rsi + 0x88], rax
je 0x482d0f
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x486300
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, r8
mov rdi, rcx
test r8, r8
jne 0x486326
xor eax, eax
jmp 0x486462
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x40]
call fcn.00419c30
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48643e
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x486408
cmp dword [rsp + 0x30], 4
jne 0x486408
mov eax, dword [rsp + 0x80]
mov dword [rbx], eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4863f1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x486401
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x486462
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x48642a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x48643a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x486462
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x486460
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x486490
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov ebx, r9d
mov qword [rsp + 0x40], 0
mov rdx, r8
lea rcx, [rsp + 0x38]
call fcn.00419c30
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWARESRS_LabsAPO
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48659b
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x486562
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x48654e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x48655e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4865bf
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x486584
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x486594
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4865bf
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4865bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x48ec80
Capabilities:
Get file size
Read .ini file

Disassembly:
push rsi
sub rsp, 0x50
test rdx, rdx
mov rsi, rcx
jne 0x48ec96
xor eax, eax
add rsp, 0x50
pop rsi
ret
mov qword [rcx + 8], rdx
mov rcx, qword [0x0053fc08]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rdi
xor edi, edi
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x48ee30
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
setne dil
test edi, edi
je 0x48ee30
mov eax, 2
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov r13, 0xffffffffffffffff
mul rbp
cmovo rax, r13
mov rcx, rax
call fcn.0049044c
test rax, rax
mov r12, rax
jne 0x48ed50
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
mov word [rax], 0
mov rax, qword [0x0053fc08]
lea r8, [0x004f7838]
mov qword [rsp + 0x28], rax
mov r9, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r8, str.SetCount
lea rdx, str.DefLevel
lea rcx, [0x0053fac0]
xor r9d, r9d
call fcn.004a0ffc
mov rbx, r12
mov dword [rsi + 0x10], eax
cmp word [r12], 0
je 0x48edc6
mov rdx, rbx
mov rcx, rsi
call fcn.0048f140
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], ax
jne 0x48eda4
cmp dword [rsi + 0x18], 0
je 0x48edee
add dword [rsi + 0x10], 1
mov r9d, dword [rsi + 0x10]
lea r8, str.SetCount
lea rdx, str.DefLevel
lea rcx, [0x0053fac0]
call fcn.004a108c
cmp dword [rsi + 0x14], 0
jne 0x48ee1e
lea r8, str.Finished
lea rdx, str.DefLevel
lea rcx, [0x0053fac0]
mov r9d, 1
call fcn.004a108c
mov dword [0x0053fa60], 1
mov rcx, r12
call fcn.00490454
mov eax, 1
jmp 0x48ed31
xor eax, eax
jmp 0x48ed3b
Function at 0x492400
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x492436
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4924ed
call fcn.0049d8dc
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x492455
mov ecx, 0x80004005
call fcn.004034c0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x118]
mov rdx, rsi
mov rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.004ca2b0
test eax, eax
je 0x4924c0
cmp eax, 0xc
je 0x4924ba
cmp eax, 0x16
je 0x4924b4
cmp eax, 0x22
je 0x4924b4
cmp eax, 0x50
je 0x4924c0
call fcn.0049c5dc
int3
call fcn.0049c5dc
int3
call fcn.0049c594
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x4924eb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x494608
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.004ae324
test rax, rax
mov rsi, rax
je 0x49467d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rbx, rbx
movzx edi, ax
je 0x494678
cmp dword [rbx], 0x38
jb 0x494678
mov rax, qword [rbp + 0x40]
or dword [rbx + 4], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x30], 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x494678
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x494684
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x49b84c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x49b8a6
call fcn.00491aa0
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x49b8a6
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x49b8c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.0049b2cc
test rdi, rdi
mov esi, eax
je 0x49b8c6
test rbx, rbx
je 0x49b8c6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4a0ffc
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x4a106c
call fcn.004a0f7c
test rax, rax
mov rsi, rax
jne 0x4a1028
mov eax, edi
jmp 0x4a1082
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x4a1024
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x4a4a0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x28
mov r13, rdx
mov r12, rcx
call fcn.00491aa0
mov rbx, qword [rax + 0x18]
mov r8d, 0xf1
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x4a4a46
xor eax, eax
jmp 0x4a4b1f
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rdi, rax
je 0x4a4a3f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x4a4a3f
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.00490410
xor r9d, r9d
cmp word [rbx + 6], r9w
mov rbp, rax
jbe 0x4a4ab9
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
add r9d, 1
add r8, 2
mov dword [rdx], ecx
movzx eax, word [rbx + 6]
add rdx, 4
cmp r9d, eax
jl 0x4a4a9e
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r12
call fcn.004a3390
mov rcx, rbp
mov esi, eax
call fcn.00490454
test esi, esi
je 0x4a4b14
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x70], eax
add eax, 7
mov dword [rsp + 0x74], ecx
mov r8, qword [rsp + 0x70]
mov dword [rsp + 0x78], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x7c], eax
mov rdx, qword [rsp + 0x78]
mov rcx, r12
call fcn.004a3c10
mov rdx, r13
mov rcx, r12
call fcn.004a3ce0
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4ab720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x4ab73e
mov rdi, qword [rdx + 0x10]
jmp 0x4ab78f
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rdi, rax
jne 0x4ab75f
call fcn.0049cabc
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rdi, rax
jne 0x4ab779
call fcn.0049cabc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
jne 0x4ab78f
call fcn.0049cabc
call fcn.00491aa0
cmp qword [rax + 0x68], 0
je 0x4ab7a9
mov rdx, rdi
mov rcx, rbp
call fcn.004a9f18
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.004ab4d8
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
mov rsi, rax
je 0x4ab7d3
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp + 0xb8], 0
test rsi, rsi
je 0x4ab7e2
mov rdi, rsi
mov qword [rbp + 0xb8], rsi
mov qword [rbx + 0x10], rdi
or dword [rbx + 4], 1
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4c78b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x4c791d
cmp dword [0x0053e8a0], 1
jne 0x4c78ff
call fcn.004cd2c0
mov ecx, 0x12
call fcn.004cd080
mov ecx, 0xff
call fcn.004cbbe0
mov eax, 0xff
jmp 0x4c7b4b
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4c794e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x4c7b4b
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x4c7980
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x0053e8ac], r13d
mov dword [0x0053e8b4], eax
mov dword [0x0053e8b8], esi
mov dword [0x0053e8bc], r12d
mov dword [0x0053e8b0], edi
cmp word [0x00400000], 0x5a4d
jne 0x4c7a12
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x4c79d7
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x4c7a22
cmp word [rax + 0x18], 0x20b
je 0x4c79ea
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x4c7a22
cmp dword [rax + 0x84], 0xe
ja 0x4c79fe
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x4c7a22
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xc0], ebx
jmp 0x4c7a22
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
lea rdi, [0x00400000]
mov ecx, 1
call fcn.004ceb00
test eax, eax
jne 0x4c7a52
cmp dword [0x0053e8a0], 1
jne 0x4c7a3e
call fcn.004cd2c0
mov ecx, 0x1c
call fcn.004cd080
mov ecx, 0xff
call fcn.004cbbe0
call fcn.004ce9e0
test eax, eax
jne 0x4c7a7d
cmp dword [0x0053e8a0], 1
jne 0x4c7a69
call fcn.004cd2c0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.004cd080
mov ecx, 0xff
call fcn.004cbbe0
call fcn.004ce210
nop
call fcn.004cdee0
test eax, eax
jns 0x4c7a96
mov ecx, 0x1b
call fcn.004cbbb0
call fcn.004cddc0
mov qword [0x00540e88], rax
call fcn.004cdbc0
mov qword [0x0053e898], rax
call fcn.004cd950
test eax, eax
jns 0x4c7ac1
mov ecx, 8
call fcn.004cbbb0
call fcn.004cd620
test eax, eax
jns 0x4c7ad4
mov ecx, 9
call fcn.004cbbb0
mov ecx, 1
call fcn.004cbd20
test eax, eax
je 0x4c7ae9
mov ecx, eax
call fcn.004cbbb0
call fcn.004cd5c0
test byte [rsp + 0x6c], 1
je 0x4c7afd
movzx r9d, word [rsp + 0x70]
jmp 0x4c7b03
mov r9d, 0xa
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.004e43ac
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x4c7b21
mov ecx, eax
call fcn.004cbf30
call fcn.004cbf50
jmp 0x4c7b42
mov eax, edi
jmp 0x4c7b4b
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.004ceb60
add rsp, 0x28
jmp 0x4c78b0
Function at 0x4c9d20
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xb0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xc0], rdi
mov rax, qword [0x00535d58]
xor rax, rbp
mov qword [rbp + 0x70], rax
mov eax, dword [rsp]
sub rsp, 0x10
xor ebx, ebx
lea r13, [rsp + 0x30]
lea r8d, [rbx + 0x30]
lea rdx, [rbp + 0x10]
mov eax, dword [r13]
mov rcx, r13
mov dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4c9e8c
mov r14, qword [rbp + 0x18]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x44]
lea rcx, [rbp]
call fcn.004cbc80
test eax, eax
je 0x4c9dba
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.004cf0d0
mov ecx, dword [rbp]
cmp ecx, 2
jne 0x4c9e02
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x4c9dff
lea rdx, str.SetThreadStackGuarantee
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x4c9dff
lea rcx, [rbp + 4]
mov dword [rbp + 4], ebx
call rax
cmp eax, 1
jne 0x4c9dff
mov eax, dword [rbp + 4]
test eax, eax
cmovne ebx, eax
mov ecx, dword [rbp]
mov r15d, 1
lea r8d, [rdi - 1]
lea edx, [rbx + rdi - 1]
cmp ecx, r15d
mov eax, r8d
mov esi, 0x104
not eax
cmove esi, r15d
and edx, eax
je 0x4c9e27
add edx, edi
lea eax, [rdi + rdi]
mov ebx, r8d
cmp edx, eax
not rbx
cmovb edx, eax
and rbx, r13
mov eax, 0x11
mov r12d, edx
sub rbx, r12
cmp ecx, r15d
cmove edi, eax
mov eax, edi
add rax, r14
cmp rbx, rax
jb 0x4c9e8c
mov r9d, 4
mov r8d, 0x1000
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x4c9e8c
lea r9, [rbp + 8]
mov r8d, esi
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4c9e8c
mov eax, r15d
jmp 0x4c9e8e
xor eax, eax
mov rcx, qword [rbp + 0x70]
xor rcx, rbp
call fcn.004c7bc0
mov rbx, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xb8]
mov rdi, qword [rbp + 0xc0]
lea rsp, [rbp + 0x80]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x4cba00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
test r8, r8
mov rbp, r9
mov rsi, r8
mov r12d, edx
mov r13, rcx
jne 0x4cba4c
call fcn.004cb550
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rax], 0x16
call fcn.004cf170
xor eax, eax
jmp 0x4cbaf2
mov qword [rsp + 0x50], rdi
call fcn.004e6400
mov edx, 0x2d8
mov ecx, 1
call fcn.004d12b0
test rax, rax
mov rdi, rax
je 0x4cbad8
call fcn.004ce770
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.004ce550
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
test rcx, rcx
lea r8, [rsp + 0x60]
mov rdx, r12
cmovne r8, rcx
mov r9, rdi
mov rcx, r13
mov qword [rsp + 0x28], r8
lea r8, [0x004cb960]
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov qword [rdi + 8], 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x4cbaed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.004c90e0
test ebx, ebx
je 0x4cbaeb
mov ecx, ebx
call fcn.004cb5b0
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret