joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad01a60
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
lea rdi, [0x4ad2f360]
mov ebp, 0x2000
xor esi, esi
mov rdx, rdi
mov r8d, ebp
mov rbx, rcx
mov word [0x4ad2f360], si
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
je 0x4ad03826
mov rax, rdi
jmp 0x4ad01aa5
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
cmp byte [0x4ad2e0ca], sil
je 0x4ad05de6
lea rdx, [0x4ad2e8dc]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad1017c
lea rdx, str.ERRORLEVEL
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad038e3
lea rdx, str.CMDEXTVERSION
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad1804d
lea rdx, str.CMDCMDLINE
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad18058
lea rdx, str.DATE
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad18063
lea rdx, str.TIME
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
jne 0x4ad05db6
mov r9d, ebp
mov r8, rdi
mov edx, 1
xor ecx, ecx
call fcn.4ad0d510
jmp 0x4ad038d7
movsxd rcx, eax
mov word [rdi + rcx*2], si
jmp 0x4ad01aa0
mov r9d, dword [0x4ad2e188]
lea r8, [0x4ad29830]
mov rdx, rbp
mov rcx, rdi
call fcn.4ad01484
jmp 0x4ad01aa0
lea rdx, str.RANDOM
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad1807b
lea rdx, str.HIGHESTNUMANODENUMBER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x4ad18089
xor eax, eax
jmp 0x4ad01aa5
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.4ad05410
jmp 0x4ad01aa0
mov r9d, 2
jmp 0x4ad038ea
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x4ad01aa5
mov r9d, ebp
mov r8, rdi
mov edx, 1
xor ecx, ecx
call fcn.4ad133d8
nop
jmp 0x4ad038d7
call qword [sym.imp.msvcrt.dll_rand]
mov r9d, eax
jmp 0x4ad038ea
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], esi
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov r9d, dword [rsp + 0x38]
jmp 0x4ad038ea
Function at 0x4ad02c84
Capabilities:
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov r12, rcx
cmp rcx, rbx
je 0x4ad02cb4
cmp qword [0x4ad2e1e8], rbx
je 0x4ad08ee8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
cmp dword [0x4ad2e108], ebx
jne 0x4ad02cb4
mov ecx, 0x20c
call fcn.4ad016dc
mov rsi, rax
cmp rax, rbx
je 0x4ad02cb4
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov r11d, eax
cmp eax, ebx
je 0x4ad02cb4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, dword [0x4ad2e15c]
lea edi, [rcx + r11 + 0xa]
mov rcx, rsi
lea edx, [rdi + rdi]
call fcn.4ad02db8
mov rbp, rax
cmp rax, rbx
je 0x4ad08fad
mov rsi, rax
cmp byte [0x4ad2e0cc], bl
jne 0x4ad1da47
movsxd rbx, edi
lea r8, [0x4ad29da8]
mov rcx, rax
mov rdx, rbx
call fcn.4ad01ac0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov r8, r12
mov rdx, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov dword [0x4ad2e15c], ecx
mov rcx, rbp
call fcn.4ad01ac0
mov byte [0x4ad2e0cc], 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov rcx, rsi
call fcn.4ad01040
nop
jmp 0x4ad02cb4
mov ecx, dword [0x4ad2e15c]
mov r8, r12
sub edi, ecx
lea rcx, [rax + rcx*2]
mov edx, edi
call fcn.4ad01744
jmp 0x4ad08fa4
Function at 0x4ad031f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov edi, 1
xor r14d, r14d
mov dword [rax - 0x40], 0x18
mov dword [rax - 0x30], edi
mov qword [rax - 0x38], r14
lea r12d, [rdi + 2]
mov eax, edx
lea r15d, [rdi + 1]
mov ebp, edx
and eax, r12d
mov r13, rcx
cmp eax, r15d
ja 0x4ad110ce
test dil, dl
jne 0x4ad06bd8
cmp eax, r14d
jne 0x4ad06bb7
mov esi, 0x80000000
mov eax, r12d
mov qword [rsp + 0x30], r14
mov edx, esi
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], 0x80
mov r8d, r12d
mov rcx, r13
cmp ebp, 0x10a
je 0x4ad0d6c7
mov dword [rsp + 0x20], eax
jmp 0x4ad0327f
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x4ad110bb
mov edx, 8
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov esi, eax
test bpl, 8
jne 0x4ad0d634
mov ecx, esi
call fcn.4ad03350
mov eax, esi
jmp 0x4ad032b7
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, [0x4ad29840]
mov esi, 0x40000000
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
mov eax, r15d
cmovne r12d, edi
jmp 0x4ad03253
test dl, 8
je 0x4ad03242
jmp 0x4ad110ce
mov ecx, eax
call fcn.4ad03380
cmp eax, r14d
jne 0x4ad032ac
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, r14d
je 0x4ad032ac
or dword [rsp + 0xa8], 0xffffffff
lea r8, [rsp + 0xa8]
mov r9d, r15d
or edx, 0xffffffff
mov rcx, rdi
mov word [rsp + 0x98], r14w
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4ad1d719
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x98]
mov r8d, 1
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r14d
je 0x4ad1d74e
cmp word [rsp + 0x98], 0x1a
jne 0x4ad032ac
jmp 0x4ad1d772
bts edx, 0x1f
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x4ad03292
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov r8d, r12d
mov edx, esi
mov rcx, r13
jmp 0x4ad0327f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6e
cmove eax, r15d
mov dword [0x4ad2e13c], eax
or eax, 0xffffffff
jmp 0x4ad032b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad2e13c], eax
cmp eax, r14d
je 0x4ad0d689
cmp esi, 0xffffffff
je 0x4ad1d740
mov ecx, esi
call qword [sym.imp.msvcrt.dll__close]
jmp 0x4ad110ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ad110ce
lea r8, [rsp + 0xa8]
mov r9d, r15d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0xa8], r14d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop
jmp 0x4ad0d6b3
or dword [rsp + 0xa8], 0xffffffff
lea r8, [rsp + 0xa8]
mov r9d, r15d
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop
jmp 0x4ad032ac
Function at 0x4ad033c8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov ebx, r8d
mov r15, rdx
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov r12, rcx
lea rsi, [0x4ad3c320]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r14d, 0x1fff
lea rdx, [0x4ad3c320]
mov r9, rbp
cmp ebx, r14d
mov rcx, r12
mov r13d, eax
cmovb r14d, ebx
xor edi, edi
mov dword [0x4ad2e124], 1
mov r8d, r14d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x4ad2e124], edi
cmp eax, edi
je 0x4ad03490
mov ebx, dword [rbp]
cmp ebx, edi
je 0x4ad03490
mov ecx, ebx
mov dword [rsp + 0x70], ebx
jle 0x4ad0351d
cmp ecx, 3
jl 0x4ad0346f
cmp byte [rsi], 0xa
je 0x4ad174fd
cmp byte [rsi], 0xd
je 0x4ad034ee
movzx eax, byte [rsi]
lea rdx, [0x4ad3bec0]
cmp byte [rax + rdx], dil
jne 0x4ad1750c
dec ecx
inc rsi
mov dword [rsp + 0x70], ecx
cmp ecx, edi
jmp 0x4ad03456
xor eax, eax
jmp 0x4ad03494
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp byte [rsi + 1], 0xa
jne 0x4ad0346f
lea rax, [0x4ad3c320]
mov ebx, esi
xor r9d, r9d
sub ebx, eax
xor r8d, r8d
mov rcx, r12
add ebx, 2
mov byte [rsi + 2], dil
lea edx, [rbx + r13]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x4ad2e1a0]
call fcn.4ad034c0
lea r8, [0x4ad3c320]
mov r9d, ebx
cmp eax, edi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
setne dil
mov edx, edi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp], eax
jmp 0x4ad03494
cmp byte [rsi + 1], 0xd
jne 0x4ad0346a
jmp 0x4ad034f8
cmp ecx, 1
je 0x4ad1751d
sub ecx, 2
add rsi, 2
jmp 0x4ad03488
lea rdx, [rsi + 1]
lea r9, [rsp + 0x70]
mov r8d, 1
mov rcx, r12
mov dword [0x4ad2e124], 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x4ad2e124], 1
cmp eax, edi
je 0x4ad1755f
cmp dword [rsp + 0x70], edi
je 0x4ad1755f
inc ebx
jmp 0x4ad0351d
mov dword [rbp], edi
jmp 0x4ad03490
Function at 0x4ad04688
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
push r12
sub rsp, 0x30
mov rax, rdx
xor edx, edx
mov ebp, r8d
mov r8, qword [rsp + 0x60]
mov r12, rcx
xor bl, bl
test r9d, r9d
mov rcx, rax
mov dword [rsp + 0x28], 2
sete dl
and qword [r11 - 0x18], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, qword [rsp + 0x68]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x4ad04720
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad2e13c], eax
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r12
ret
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4ad113da
cmp qword [rdi], 0xffffffffffffffff
je 0x4ad1f11d
mov rcx, qword [rsp + 0x60]
mov edx, ebp
call r12
test eax, eax
je 0x4ad04700
and dword [0x4ad2e13c], 0
mov bl, 1
cmp qword [rdi], 0xffffffffffffffff
je 0x4ad04778
mov r8, qword [0x4ad2e238]
test r8, r8
je 0x4ad0901a
mov edx, dword [0x4ad2e240]
cmp edx, dword [0x4ad2e140]
jge 0x4ad09046
test r8, r8
je 0x4ad04776
mov rax, qword [rdi]
movsxd rcx, edx
inc edx
mov qword [r8 + rcx*8], rax
mov dword [0x4ad2e240], edx
mov bl, 1
test bl, bl
jne 0x4ad046e8
jmp 0x4ad046dc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, rax
jmp 0x4ad09034
mov edx, dword [0x4ad2e240]
mov qword [0x4ad2e238], rax
jmp 0x4ad0475f
lea eax, [rdx + 1]
movsxd rbx, eax
shl rbx, 3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x4ad2e238]
mov r9, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r8, rax
test rax, rax
je 0x4ad1f122
inc dword [0x4ad2e140]
jmp 0x4ad09034
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FindClose]
or qword [rdi], 0xffffffffffffffff
jmp 0x4ad04737
jmp 0x4ad04737
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi]
mov dword [0x4ad2e13c], eax
call qword [sym.imp.KERNEL32.dll_FindClose]
or qword [rdi], 0xffffffffffffffff
xor al, al
jmp 0x4ad046ea
Function at 0x4ad05188
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, 0x3a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], ax
mov eax, 0x5c
xor ebx, ebx
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
seta bl
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call entry0
add rsp, 0x30
pop rbx
ret

Function at 0x4ad05410
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebp, ebp
movzx esi, r8w
movsxd rdi, edx
mov rbx, rcx
cmp r8w, bp
jne 0x4ad0c32e
mov rdx, rcx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x4ad0544d
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call entry0
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0x3d
movzx ecx, si
mov word [rsp + 0x20], ax
call qword [sym.imp.msvcrt.dll_towupper]
lea rcx, [rsp + 0x20]
mov r12d, 0x3a
mov word [rsp + 0x26], bp
mov word [rsp + 0x22], ax
mov word [rsp + 0x24], r12w
call fcn.4ad01a60
cmp rax, rbp
je 0x4ad1db37
mov rdx, rdi
mov r8, rax
mov rcx, rbx
call fcn.4ad01744
nop
jmp 0x4ad0544d
movzx ecx, si
call qword [sym.imp.msvcrt.dll_towupper]
mov word [rbx], ax
lea eax, [r12 + 0x22]
mov word [rbx + 2], r12w
mov word [rbx + 4], ax
mov word [rbx + 6], bp
lea eax, [r12 - 0x39]
jmp 0x4ad0544f

Function at 0x4ad058cc
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x280
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov eax, 0x3a
mov word [rsp + 0x48], cx
lea rcx, [rsp + 0x48]
mov word [rsp + 0x4a], ax
mov eax, 0x5c
xor edi, edi
mov word [rsp + 0x4c], ax
mov word [rsp + 0x4e], di
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad1d8ba
cmp eax, 2
je 0x4ad0595b
cmp eax, 5
je 0x4ad0595b
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
mov r8d, 0x104
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, edi
je 0x4ad1d8c4
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call entry0
add rsp, 0x280
pop rdi
ret
mov eax, 1
jmp 0x4ad0595d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ad0595b
jmp 0x4ad1d8ba
Function at 0x4ad07694
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x40
mov rdi, r9
mov ebx, r8d
mov rsi, rdx
mov r13d, r8d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
cmp byte [0x4ad4a340], 0
mov rbp, rax
jne 0x4ad1cfe0
mov r15d, 0x2000
lea r12, [0x4ad3c320]
cmp ebx, r15d
ja 0x4ad1cffd
test ebx, ebx
je 0x4ad07743
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov ecx, dword [0x4ad2e1a0]
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
and qword [rsp + 0x20], 0
lea ebx, [rax - 1]
mov r9, rdi
mov rdx, r12
mov rcx, rbp
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad1d073
cmp dword [rdi], ebx
jne 0x4ad1d073
mov dword [rdi], r13d
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r13
pop r12
ret
and qword [rsp + 0x20], 0
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad0774b
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov ecx, dword [0x4ad2e1a0]
mov r9d, 0x1000
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
and qword [rsp + 0x20], 0
lea rdx, [0x4ad3c320]
mov r9, rdi
mov r8d, eax
mov rcx, rbp
mov r12d, eax
add rsi, r15
add ebx, 0xffffe000
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad1d073
cmp dword [rdi], r12d
jne 0x4ad1d073
lea r12, [0x4ad3c320]
cmp ebx, r15d
ja 0x4ad1cffd
lea r12, [0x4ad3c320]
jmp 0x4ad076e9
xor eax, eax
jmp 0x4ad0774b
Function at 0x4ad08380
Capabilities:
Set environment variable

Disassembly:
test rcx, rcx
je 0x4ad0848a
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
test eax, eax
je 0x4ad08480
dec eax
mov dword [rcx + 0x18], eax
mov rdi, qword [rcx + rax*8 + 0xd0]
and qword [rcx + rax*8 + 0xd0], 0
test rdi, rdi
je 0x4ad08480
mov rax, qword [rdi]
movzx ecx, word [rax]
cmp cx, 0x61
jae 0x4ad173ed
cmp word [0x4ad3c0a0], cx
jne 0x4ad105a9
mov rcx, qword [rdi]
mov edx, 1
call fcn.4ad07dc0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rdi]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x4ad2e2a0]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.4ad013d4
mov qword [0x4ad2e2a0], rax
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbx]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r11b, byte [rdi + 0x10]
mov al, byte [rdi + 0x11]
mov byte [0x4ad2e0ca], r11b
mov byte [0x4ad2e0cb], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx ecx, cx
sub ecx, 0x40
call fcn.4ad10500
nop
jmp 0x4ad083da
cmp cx, 0x7a
ja 0x4ad083cd
sub cx, 0x20
jmp 0x4ad083cd
Function at 0x4ad0b6a4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x240
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov ecx, 0x48
call fcn.4ad017b8
mov rcx, rax
mov rsi, rax
mov qword [rax], rbx
call fcn.4ad0b410
mov r12, qword [rsi + 0x30]
mov rbp, qword [rsi]
mov rbx, qword [rsi + 0x18]
mov ecx, 0x208
call fcn.4ad017b8
mov edi, 0x104
xor r8d, r8d
mov rcx, rax
mov edx, edi
mov qword [0x4ad2e230], rax
call fcn.4ad05410
lea rcx, [rsp + 0x20]
mov r8, rbp
mov edx, edi
call fcn.4ad045b0
xor r13d, r13d
cmp eax, r13d
jne 0x4ad1d37a
mov r14d, 0x5c
lea rcx, [rsp + 0x20]
mov edx, r14d
call qword [sym.imp.msvcrt.dll_wcsrchr]
lea rcx, [0x4ad3c0a0]
lea rdx, [rsp + 0x20]
mov word [rax + 2], r13w
sub rdx, rcx
lea rax, [rdi + 0x7ffffefa]
cmp rax, r13
je 0x4ad0b77e
movzx eax, word [rdx + rcx]
cmp ax, r13w
je 0x4ad0b77e
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x4ad0b75b
cmp rdi, r13
je 0x4ad1d386
mov word [rcx], r13w
cmp rbx, r13
je 0x4ad0b804
cmp word [rbx], 0x3a
je 0x4ad0b804
cmp word [rbx], r14w
jne 0x4ad0b7d4
cmp rbx, rbp
je 0x4ad1d397
mov rax, rbp
cmp word [rax], r13w
je 0x4ad1d38f
mov rcx, rax
add rax, 2
cmp rax, rbx
jne 0x4ad0b7a8
jmp 0x4ad0b7c0
cmp word [rcx], 0x3a
je 0x4ad1d397
cmp word [rcx], r14w
je 0x4ad1d397
movzx edi, word [rbx]
mov rcx, rbp
mov word [rbx], r13w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad1d3a0
mov eax, r13d
jmp 0x4ad0b7f2
mov dword [0x4ad2e13c], eax
mov word [rbx], di
cmp eax, r13d
jne 0x4ad1d37a
mov rcx, rsi
call fcn.4ad0b410
mov qword [rsi + 0x30], r12
mov rax, rsi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call entry0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rax, 1
jmp 0x4ad0b813
sub rcx, 2
jmp 0x4ad0b787
mov rcx, r13
jmp 0x4ad0b7c0
add rbx, 2
jmp 0x4ad0b7d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
jmp 0x4ad0b7f2
Function at 0x4ad10500
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
add cx, 0x40
mov eax, 0x3d
xor esi, esi
mov word [rsp + 0x22], cx
mov word [rsp + 0x20], ax
mov eax, 0x3a
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], si
mov word [rsp + 0x24], ax
call fcn.4ad01a60
mov rdi, rax
cmp rax, rsi
je 0x4ad1d3d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp al, sil
je 0x4ad1d3c8
lea rcx, [0x4ad3c0a0]
xor r8d, r8d
mov edx, 0x104
call fcn.4ad05410
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call entry0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea ecx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
jmp 0x4ad1d3d9
mov ebx, dword [rsp + 0x20]
movzx eax, word [rsp + 0x22]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x24]
mov word [rsp + 0x36], si
mov word [rsp + 0x32], ax
mov eax, 0x5c
mov word [rsp + 0x34], ax
call fcn.4ad0134c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, esi
jne 0x4ad1d429
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, eax
call fcn.4ad0b8b0
cmp rdi, rsi
je 0x4ad10570
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop
jmp 0x4ad10570
Function at 0x4ad22394
Capabilities:
Patch process command line

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x3f0
xor esi, esi
mov rbx, rcx
mov word [rax + 0x10], si
cmp qword [0x4ad4b390], rsi
jne 0x4ad223ed
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x4ad4b390], rax
cmp rax, rsi
je 0x4ad223e5
lea rdx, [0x4ad2a168]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x4ad4b388], rax
jmp 0x4ad223f4
or qword [0x4ad4b390], 0xffffffffffffffff
mov rax, qword [0x4ad4b388]
cmp rax, rsi
je 0x4ad22534
lea r8, [rsp + 0x38]
mov r9d, 0x30
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call rax
cmp eax, esi
jl 0x4ad22534
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x70]
mov r9d, 0x380
mov rcx, rbx
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, esi
je 0x4ad22534
mov ecx, 0x128
cmp qword [rsp + 0x30], rcx
jb 0x4ad2247b
mov rax, qword [rsp + 0x160]
sub rax, rdi
cmp rax, rcx
jbe 0x4ad2247b
movzx eax, word [rsp + 0x198]
mov word [rsp + 0x418], ax
jmp 0x4ad22534
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x428]
mov r9d, 4
mov rcx, rbx
add rdx, 0x3c
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, esi
je 0x4ad22534
movsxd rcx, dword [rsp + 0x428]
mov rax, qword [rsp + 0x80]
mov edi, 2
lea rdx, [rcx + rax + 4]
lea r8, [rsp + 0x420]
mov r9, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, esi
je 0x4ad22534
movsxd rcx, dword [rsp + 0x428]
mov rax, qword [rsp + 0x80]
lea rdx, [rcx + rax + 0x18]
cmp rdx, rsi
je 0x4ad22534
movzx eax, word [rsp + 0x420]
cmp eax, 0x14c
je 0x4ad22512
cmp eax, 0x8664
jne 0x4ad22534
add rdx, 0x44
cmp rdx, rsi
je 0x4ad22534
lea r8, [rsp + 0x418]
mov r9, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ax, word [rsp + 0x418]
add rsp, 0x3f0
pop rdi
pop rsi
pop rbx
ret