joyce8/EMBER2024-capa huggingface dataset:
Function at 0x784730
Capabilities:
Encrypt data using twofish

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13d, pe_nt_image_headers64
lea rbx, [0x008c2130]
lea rdi, [0x008ddf00]
movzx rsi, byte [rbx]
mov dword [rsp + 0x38], esi
mov ecx, esi
call fcn.00782e40
mov dword [rsp + 0x30], eax
mov ecx, esi
call fcn.00782e60
mov dword [rsp + 0x28], eax
movzx rsi, byte [rbx + 0x100]
mov dword [rsp + 0x3c], esi
mov ecx, esi
call fcn.00782e40
mov r14d, eax
mov dword [rsp + 0x34], r14d
mov ecx, esi
call fcn.00782e60
mov dword [rsp + 0x2c], eax
mov ecx, r14d
shl ecx, 8
mov edx, esi
or edx, ecx
mov ecx, eax
shl ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x18
or edx, ecx
mov dword [rdi], edx
mov ecx, dword [rsp + 0x28]
mov edx, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x38]
mov r9d, ecx
shl r9d, 8
mov r10d, ecx
or r10d, r9d
mov r9d, edx
shl r9d, 0x10
or r10d, r9d
mov r9d, r8d
shl r9d, 0x18
or r10d, r9d
mov dword [rdi + 0x400], r10d
shl eax, 8
or r14d, eax
shl esi, 0x10
or r14d, esi
mov eax, dword [rsp + 0x2c]
shl eax, 0x18
or r14d, eax
mov dword [rdi + 0x800], r14d
shl r8d, 8
mov eax, edx
or eax, r8d
shl ecx, 0x10
or eax, ecx
shl edx, 0x18
or eax, edx
mov dword [rdi + 0xc00], eax
add rdi, 4
add rbx, 1
sub r13d, 1
test r13d, r13d
jne 0x78474f
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret

Function at 0x784ecd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
jne 0x784eea
xor eax, eax
jmp 0x784ff1
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x784f54
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x784fef
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.00784e61
movzx eax, al
test eax, eax
je 0x784fea
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x784ff1
jmp 0x784f4a
xor eax, eax
add rsp, 0x68
ret
Function at 0x78e920
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rcx, rbx
mov edx, 0x104
call fcn.00413a70
mov rcx, rsi
call fcn.00413820
mov rsi, rax
mov rcx, qword [rbx]
call fcn.00413820
mov rcx, rsi
mov rdx, rax
mov r8d, 0x104
call sub.kernel32.dll_GetEnvironmentVariableW
mov rcx, rbx
mov edx, eax
call fcn.00413a70
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x794310
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x7943e6
cmp eax, 0xcb
je 0x794377
cmp eax, 0xca
jne 0x794359
mov rcx, rsi
call fcn.00794ad0
cmp dword [rsi + 0x58], 0
je 0x794370
mov dword [rsi + 0x24], 0xcf
mov eax, 1
jmp 0x7943f3
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
jmp 0x7943e6
mov dword [rsi + 0x24], 0xcb
mov rax, qword [rsi + 0x240]
cmp dword [rax + 0x20], 0
je 0x7943da
mov rdx, qword [rsi + 0x10]
jmp 0x794399
add eax, dword [rsi + 0x1a4]
mov dword [rdx + 0xc], eax
test rdx, rdx
je 0x7943a3
mov rcx, rsi
call qword [rdx]
mov rax, qword [rsi + 0x240]
mov rcx, rsi
call qword [rax]
test eax, eax
je 0x7943f1
cmp eax, 2
je 0x7943da
mov rdx, qword [rsi + 0x10]
or eax, 2
cmp eax, 3
jne 0x794399
test rdx, rdx
je 0x794399
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
inc ecx
mov dword [rdx + 8], ecx
cmp ecx, eax
jl 0x794399
jmp 0x794390
mov eax, dword [rsi + 0xac]
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x794400
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x24], 0xcc
je 0x794438
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov dword [rsi + 0x24], 0xcc
mov rdx, qword [rsi + 0x220]
cmp dword [rdx + 0x10], 0
je 0x7944dd
lea r14, [rsi + 0xa8]
mov eax, dword [rsi + 0xa8]
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jae 0x7944ae
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x79447a
mov dword [rdx + 8], eax
mov dword [rdx + 0xc], ecx
mov rcx, rsi
call qword [rdx]
mov eax, dword [rsi + 0xa8]
mov edi, eax
mov rax, qword [rsi + 0x228]
xor ebx, ebx
xor edx, edx
xor r9d, r9d
mov rcx, rsi
mov r8, r14
call qword [rax + 8]
mov eax, dword [rsi + 0xa8]
cmp eax, edi
je 0x7944f1
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jb 0x794460
mov rdx, qword [rsi + 0x220]
mov rcx, rsi
call qword [rdx + 8]
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov rdx, qword [rsi + 0x220]
xor eax, eax
cmp dword [rdx + 0x10], 0
jne 0x794456
cmp dword [rsi + 0x5c], 1
mov eax, 0xce
sbb eax, 0
mov dword [rsi + 0x24], eax
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x794670
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov edi, edx
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x7946a7
cmp eax, 0xcf
je 0x7946a7
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
test edi, edi
mov eax, 1
cmovg eax, edi
mov rcx, qword [rsi + 0x240]
cmp dword [rcx + 0x24], 0
je 0x7946c9
mov ecx, dword [rsi + 0xac]
cmp eax, ecx
cmovg eax, ecx
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp 0x794400

Function at 0x7b9a70
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov dword [rbp + 0x34], edx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
xor ecx, ecx
mov edx, dword [rbp + 0x34]
lea r8, [rbp + 0x58]
call sub.shell32.dll_SHGetSpecialFolderLocation_1
test eax, 0x80000000
jne 0x7b9ad8
mov rcx, rbp
lea rdx, [rbp + 0x48]
mov r8, qword [rbp + 0x58]
call fcn.007b99d0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.00412a90
mov rcx, rbp
lea rdx, [rbp + 0x58]
call fcn.007b9910
jmp 0x7b9ae1
mov rcx, qword [rbp + 0x28]
call fcn.00412400
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x7b9b14
mov eax, dword [rbp + 0x34]
sub eax, 0x1a
test eax, eax
je 0x7b9afc
sub eax, 2
test eax, eax
jne 0x7b9b14
lea rcx, [rbp + 0x40]
xor edx, edx
call fcn.00409ca0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0043b030
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x7b9b3b
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.004481f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.00412a90
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.004124e0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x7b9c30
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rdx
mov rcx, qword [rbp + 0x90]
call fcn.004125d0
mov rax, qword [rbp + 0x98]
mov qword [rax], 0
nop
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x90]
call fcn.007b9f20
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x40]
call fcn.00412b20
nop
mov rcx, qword [rbp + 0x90]
call fcn.00413820
mov rbx, rax
mov rcx, rbx
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x7b9ccc
call sub.kernel32.dll_GetLastError_1
mov dword [rbp + 0x6c], eax
jmp 0x7b9cd3
mov dword [rbp + 0x6c], 0
mov eax, dword [rbp + 0x6c]
cmp eax, 7
ja 0x7b9cf3
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x007b9eb0]
test dl, al
setne al
jmp 0x7b9cf5
xor eax, eax
test al, al
je 0x7b9d11
mov dword [rbp + 0x6c], 0
mov rcx, qword [rbp + 0x98]
call fcn.00412400
jmp 0x7b9e33
lea rcx, [rbp + 0x38]
mov edx, dword [rbp + 0x6c]
xor r8, r8
call fcn.00442b50
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x38]
call fcn.00412a90
mov rcx, rbx
call sub.kernel32.dll_GetFileAttributesW_1
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], 0xffffffff
je 0x7b9e32
mov eax, dword [rbp + 0x5c]
and eax, 1
cmp eax, 1
jne 0x7b9e32
mov rcx, qword [rbp + 0x90]
call fcn.00413820
mov rbx, rax
mov rcx, rbx
mov edx, dword [rbp + 0x5c]
sub edx, 1
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x7b9e33
mov rcx, rbx
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x7b9df4
mov eax, dword [rbp + 0x6c]
cmp eax, 7
ja 0x7b9da5
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x007b9eb1]
test dl, al
setne al
jmp 0x7b9da7
xor eax, eax
test al, al
jne 0x7b9ddf
call sub.kernel32.dll_GetLastError_1
mov dword [rbp + 0x6c], eax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x6c]
xor r8, r8
call fcn.00442b50
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x30]
call fcn.00412a90
mov rcx, rbx
mov edx, dword [rbp + 0x5c]
call sub.kernel32.dll_SetFileAttributesW
jmp 0x7b9e32
mov dword [rbp + 0x6c], 0
mov rcx, qword [rbp + 0x98]
call fcn.00412400
jmp 0x7b9e32
mov dword [rbp + 0x6c], 0
jmp 0x7b9e32
nop
lea rcx, [rbp + 0x28]
mov edx, 4
call fcn.004124e0
lea rcx, [rbp + 0x90]
call fcn.00412400
mov eax, dword [rbp + 0x6c]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x7ba100
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov qword [rbp + 0x98], r9
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0x80]
call fcn.004125d0
nop
mov byte [rbp + 0x67], 0
mov rax, qword [rbp + 0x88]
mov dword [rax], 0
mov rax, qword [rbp + 0x90]
mov dword [rax], 0
mov rax, qword [rbp + 0x98]
mov dword [rax], 0
mov rax, qword [rbp + 0xa0]
mov dword [rax], 0
cmp qword [rbp + 0x80], 0
jne 0x7ba1b2
lea rcx, [rbp + 0x30]
xor edx, edx
call fcn.00409ca0
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x30]
call fcn.007b9f20
jmp 0x7ba1d2
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x80]
call fcn.007b9f20
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.00412b20
nop
mov rcx, qword [rbp + 0x80]
call fcn.00413820
mov rcx, rax
mov qword [rbp + 0x20], rcx
lea rdx, [rbp + 0x5c]
call sub.version.dll_GetFileVersionInfoSizeW_1
mov dword [rbp + 0x60], eax
cmp dword [rbp + 0x60], 1
jb 0x7ba2b5
mov ecx, dword [rbp + 0x60]
call fcn.00409260
mov qword [rbp + 0x68], rax
nop
mov rcx, qword [rbp + 0x20]
xor edx, edx
mov r8d, dword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call sub.version.dll_GetFileVersionInfoW_1
mov rcx, qword [rbp + 0x68]
lea rdx, [0x007ba340]
lea r8, [rbp + 0x50]
lea r9, [rbp + 0x5c]
call sub.version.dll_VerQueryValueW_1
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax + 8]
call fcn.007b9510
mov rcx, qword [rbp + 0x88]
movzx eax, ax
mov dword [rcx], eax
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax + 8]
call fcn.007b9500
mov rcx, qword [rbp + 0x90]
movzx eax, ax
mov dword [rcx], eax
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax + 0xc]
call fcn.007b9510
mov rcx, qword [rbp + 0x98]
movzx eax, ax
mov dword [rcx], eax
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax + 0xc]
call fcn.007b9500
mov rcx, qword [rbp + 0xa0]
movzx eax, ax
mov dword [rcx], eax
mov byte [rbp + 0x67], 1
nop
mov rcx, qword [rbp + 0x68]
call fcn.00409290
jmp 0x7ba2b4
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.004124e0
lea rcx, [rbp + 0x80]
call fcn.00412400
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x7bc310
Capabilities:
Create process on windows

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], rbp
nop
mov byte [rbp + 0x6f], 0
lea rcx, [rbp + 0x50]
lea rdx, [0x007bc2f8]
call fcn.0041b860
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x60], rax
mov rcx, qword [rbp + 0x60]
mov dl, 3
movzx r8, word [0x007bc46c]
xor r9, r9
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x30], 0
call fcn.006ab920
cmp eax, 6
jne 0x7bc40a
nop
xor ecx, ecx
xor edx, edx
lea r8, [0x007bc46e]
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
call sub.shell32.dll_ShellExecuteW
mov byte [rbp + 0x6f], 1
jmp 0x7bc409
nop
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.004124e0
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x7bc6a0
Capabilities:
Get common file path

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x58], rbp
nop
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
mov rcx, qword [rax + 0xc0]
mov dl, 1
call fcn.0043ac60
mov byte [rbp + 0x7f], al
nop
cmp byte [rbp + 0x7f], 0
jne 0x7bc858
lea rcx, [rbp + 0x70]
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
mov rdx, qword [rax + 0xc0]
call fcn.0043b0a0
mov rax, qword [0x008d07f8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x48]
call fcn.00758090
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
call fcn.0043b030
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
lea rcx, [rax + 0xc0]
mov rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x70]
call fcn.00413c10
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
mov rcx, qword [rax + 0xc0]
mov dl, 1
call fcn.0043ac60
mov byte [rbp + 0x7f], al
cmp byte [rbp + 0x7f], 0
jne 0x7bc858
xor ecx, ecx
mov edx, 0x23
lea r8, [rbp + 0x68]
call sub.shell32.dll_SHGetSpecialFolderLocation
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
test eax, 0x80000000
je 0x7bc79e
mov byte [rbp + 0x7f], 0
jmp 0x7bc858
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8, qword [rbp + 0x68]
call fcn.007bc600
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
call fcn.004481f0
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
lea rcx, [rax + 0xc0]
mov edx, 3
mov r8, qword [rbp + 0x40]
lea r9, [0x007bc928]
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.00413d40
mov rcx, rbp
lea rdx, [rbp + 0x68]
call fcn.007bc540
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
mov rcx, qword [rax + 0xc0]
mov dl, 1
call fcn.0043ac60
mov byte [rbp + 0x7f], al
nop
cmp byte [rbp + 0x7f], 0
jne 0x7bc830
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
lea rcx, [rax + 0xc0]
call fcn.00412400
jmp 0x7bc865
mov rax, qword [0x008d07f8]
mov rax, qword [rax]
lea rax, [rax + 0x230]
mov rcx, qword [0x008c71f0]
mov qword [rax + 8], rcx
lea rcx, [0x007bc960]
mov qword [rax], rcx
jmp 0x7bc865
xor ecx, ecx
mov rdx, qword [rbp + 0x58]
call fcn.007bc890
jmp 0x7bc866
nop
lea rcx, [rbp + 0x38]
mov edx, 4
call fcn.004124e0
lea rcx, [rbp + 0x70]
call fcn.00412400
movzx rax, byte [rbp + 0x7f]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x47fdf0
Capabilities:
Access peb ldr_data
Get process heap flags
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x70
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov r8, qword [rax + 0x20]
movzx eax, word [r8]
cmp eax, 0x5a4d
jne 0x47ff14
movsxd rax, dword [r8 + 0x3c]
cmp dword [r8 + rax], 0x4550
jne 0x47ff34
mov edx, ecx
mov eax, dword [r8 + rax + 0x88]
mov ecx, dword [r8 + rax]
movups xmm0, xmmword [r8 + rax + 4]
mov r9, qword [r8 + rax + 0x14]
mov dword [rsp + 0x30], ecx
movups xmmword [rsp + 0x34], xmm0
mov qword [rsp + 0x44], r9
mov rcx, qword [r8 + rax + 0x1c]
mov qword [rsp + 0x4c], rcx
mov eax, dword [r8 + rax + 0x24]
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x58]
lea r9, [rsp + 0x30]
call fcn.00480110
cmp qword [rsp + 0x58], 0
jne 0x47ff5e
movzx eax, word [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
jmp 0x47fead
add rcx, 2
cmp rcx, 0xfe
je 0x47fee9
cmp byte [rdx + rcx + 1], 0xf
jne 0x47fec2
cmp byte [rdx + rcx + 2], 5
jne 0x47fec2
cmp byte [rdx + rcx + 3], 0xc3
je 0x47fedd
cmp byte [rdx + rcx + 2], 0xf
jne 0x47fea0
cmp byte [rdx + rcx + 3], 5
jne 0x47fea0
cmp byte [rdx + rcx + 4], 0xc3
jne 0x47fea0
add rcx, 2
jmp 0x47fee0
inc rcx
add rdx, rcx
add rsp, 0x70
pop rsi
ret
lea rax, [0x0063ffb8]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_retrieving_syscall_address
lea r9, [0x0063fec8]
lea r8, [rsp + 0x30]
mov edx, 0x24
call fcn.0051e6b0
ud2
mov esi, 0x19
mov ecx, 0x19
mov edx, 1
call fcn.00422020
test rax, rax
jne 0x47ff89
mov ecx, 0x19
jmp 0x47ff52
mov esi, 0x18
mov ecx, 0x18
mov edx, 1
call fcn.00422020
test rax, rax
jne 0x47ffa0
mov ecx, 0x18
mov edx, 1
call fcn.0050fe70
ud2
lea rax, [0x0063ff78]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_getting_syscall_number
lea r9, [0x0063fec8]
lea r8, [rsp + 0x30]
mov edx, 0x20
call fcn.0051e6b0
ud2
movups xmm0, xmmword [0x0063ffd9]
movups xmmword [rax + 9], xmm0
movups xmm0, xmmword [str.____INVALID_DOS_SIGNATURE____INVALID_NT_SIGNATURE]
movups xmmword [rax], xmm0
jmp 0x47ffb8
movups xmm0, xmmword [0x0063ffe9]
movups xmmword [rax], xmm0
movabs rcx, 0x45525554414e4749
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
lea rax, [0x0063ff40]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_exporting_DLLsyscall_src_syscall_resolve.rs
lea r9, fcn.0047fcc0
lea r8, [rsp + 0x30]
mov edx, 0x17
call fcn.0051e6b0
jmp 0x480007
ud2
Function at 0x489050
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.005430f0
sub rsp, rax
movaps xmmword [rsp + 0x1080], xmm6
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rbx, [rsp + 0x80]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x30]
mov qword [rsp + 0x58], r13
lea rbp, [0x004dd660]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x48920e
mov r14d, 0xffffffff
lea rbx, [rsp + 0x40]
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x489100
cmp dword [rsp + 0x34], 0
jne 0x489213
mov r15d, dword [rsp + 0x38]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], r15
test r15, r15
je 0x489213
cmp r15d, 0x1000
ja 0x489253
xor r12d, r12d
nop dword [rax]
mov r8, r15
sub r8, r12
lea rdx, [rsp + r12]
add rdx, 0x80
cmp r8, r14
cmovae r8, r14
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x48920e
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4891a0
cmp dword [rsp + 0x34], 0
jne 0x489213
mov eax, dword [rsp + 0x38]
add r12, rax
cmp r12, r15
je 0x4891cd
jbe 0x489150
jmp 0x48923f
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea rdx, [rsp + 0x80]
mov r8d, 0x1000
mov r9, rbx
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x489100
call sub.kernel32.dll_GetLastError
mov rcx, rdi
call fcn.00543234
mov rcx, rsi
call fcn.00543234
movaps xmm6, xmmword [rsp + 0x1080]
add rsp, 0x1098
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x006411c0]
mov rcx, r12
mov rdx, r15
call fcn.0053def0
jmp 0x489267
lea r8, [0x006411c0]
mov edx, 0x1000
mov rcx, r15
call fcn.0053de60
ud2

Function at 0x489fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x00545010]
jmp fcn.004e13f0

Function at 0x48a170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x00545030]
jmp fcn.004e11a0
Function at 0x48da00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x48da30
test ecx, ecx
jne 0x48da80
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x48da3c
test ecx, ecx
jne 0x48da80
mov rcx, rdi
call fcn.0048d8e0
movzx eax, al
test bpl, bpl
jne 0x48da87
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x48da73.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x0048dbf8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x48da73.2
xor eax, eax
test bpl, bpl
je 0x48da4c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x48dbd9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x48daba
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x48db39
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x48db00
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x48db1b
inc rax
dec rdi
cmp rax, 1
jne 0x48dae0
jmp 0x48db39
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x48db1b
cmp ebx, 0x5c
je 0x48db1b
inc rax
dec rdi
cmp rax, 1
jne 0x48db00
jmp 0x48db39
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x48dbe7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x48db63
mov al, 9
cmp rdx, 2
je 0x48db67
cmp rdx, 1
jne 0x48db77
cmp byte [r8], 0x2e
jne 0x48db77
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x48db77
mov al, 0xa
jmp 0x48db77
cmp byte [r8], 0x2e
jne 0x48db77
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x48da73.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x48da73.2
mov ecx, 2
jmp case.0x48da73.2
lea r8, [0x00641748]
call fcn.0053ddd0
ud2
lea r8, [0x00641760]
call fcn.0053ddd0
ud2

Function at 0x4922c0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx]
mov rsi, qword [rdi + 0x18]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x4922d8
dec ecx
jmp 0x4922e2
mov rcx, rsi
call fcn.004be160
mov ecx, eax
mov edx, 1
call sub.kernel32.dll_TlsSetValue
mov edx, 0x20
mov r8d, 8
mov rcx, rdi
call fcn.00422030
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x49230a
dec ecx
jmp 0x492314
mov rcx, rsi
call fcn.004be160
mov ecx, eax
xor esi, esi
xor edx, edx
call sub.kernel32.dll_TlsSetValue
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret