joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49276a
Capabilities:
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
cmp dword [0x017bc5a0], 0
jle 0x492782
xor eax, eax
leave
ret
push 0x17bc5a4
push 1
call fcn.00425894
cmp eax, 0
jne 0x4927d6
push rax
push rax
lea rax, [rbp - 0x1a0]
push rax
push 0x202
mov ecx, dword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.ws2_32.dll_WSAStartup]
add rsp, 0x20
cmp eax, 0
je 0x4927ca
mov dword [0x017bc5a0], 0xffffffff
mov eax, 0xffffb1dc
leave
ret
mov dword [0x017bc5a0], 1
jmp 0x492801
jmp 0x4927e8
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_Sleep]
add rsp, 0x20
cmp dword [0x017bc5a0], 0
je 0x4927d8
cmp dword [0x017bc5a0], 0
jge 0x492801
mov eax, 0xffffb1dc
leave
ret
xor eax, eax
leave
ret

Function at 0x492805
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 4], 1
push rax
push 4
lea rax, [rbp - 4]
push rax
push 8
push 0xffff
push qword [rbp + 0x10]
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.ws2_32.dll_setsockopt]
add rsp, 0x30
cmp eax, 0xffffffff
jne 0x492853
call fcn.0042464b
leave
ret 8
xor eax, eax
leave
ret 8

Function at 0x492859
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 4], 0x400000
push rax
push 4
lea rax, [rbp - 4]
push rax
push 0x1001
push 0xffff
push qword [rbp + 0x10]
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.ws2_32.dll_setsockopt]
add rsp, 0x30
cmp eax, 0xffffffff
jne 0x4928aa
call fcn.0042464b
leave
ret 8
mov dword [rbp - 4], 0x400000
push rax
push 4
lea rax, [rbp - 4]
push rax
push 0x1002
push 0xffff
push qword [rbp + 0x10]
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.ws2_32.dll_setsockopt]
add rsp, 0x30
cmp eax, 0xffffffff
jne 0x4928f0
call fcn.0042464b
leave
ret 8
xor eax, eax
leave
ret 8
Function at 0x492b9d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov dword [rbp - 4], 1
jmp 0x492c71
mov eax, dword [rbp - 4]
cmp eax, 0xf
jae 0x492c88
mov rbx, qword [rbp - 0x10]
shl eax, 4
lea rax, [rbx + rax]
mov qword [rbp - 0x18], rax
mov dword [rbp - 8], 0
jmp 0x492c64
mov rax, qword [rbp - 0x18]
movsxd rbx, dword [rbp - 8]
mov rsi, qword [rbp - 0x18]
movsxd rdi, dword [rbp - 8]
movzx esi, byte [rsi + rdi*4]
cmp esi, 0x100
jae 0x492c8a
mov rdi, qword [rbp - 0x18]
movsxd rcx, dword [rbp - 8]
movzx edi, byte [rdi + rcx*4 + 1]
cmp edi, 0x100
jae 0x492c8a
mov esi, dword [rsi*4 + 0x6f3c10]
xor esi, dword [rdi*4 + 0x7125f0]
mov rdi, qword [rbp - 0x18]
movsxd rcx, dword [rbp - 8]
movzx edi, byte [rdi + rcx*4 + 2]
cmp edi, 0x100
jae 0x492c8a
xor esi, dword [rdi*4 + 0x7129f0]
mov rdi, qword [rbp - 0x18]
movsxd rcx, dword [rbp - 8]
movzx edi, byte [rdi + rcx*4 + 3]
cmp edi, 0x100
jae 0x492c8a
xor esi, dword [rdi*4 + 0x712df0]
mov dword [rax + rbx*4], esi
inc dword [rbp - 8]
cmp dword [rbp - 8], 4
jl 0x492be3
inc dword [rbp - 4]
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 4]
cmp ebx, dword [rax + 0xf0]
jl 0x492bbc
leave
ret 8
int 5
int 5
Function at 0x4c3c7a
Capabilities:
Capture microphone audio

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x130
lea rcx, [rbp - 0x120]
mov edx, 0x116
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 0x120], 0x514
mov eax, dword [0x0175a394]
mov dword [rbp - 0x11c], eax
mov r8d, 0x10e
mov edx, 0x175a398
lea rcx, [rbp - 0x118]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
push 0
push qword [0x00b3a29c]
movzx eax, byte [rbp - 0x10b]
shl eax, 3
add eax, 0x16
mov dword [rbp - 0x124], eax
mov eax, 0x116
sub eax, dword [rbp - 0x124]
jb 0x4c3d12
push qword [rbp - 0x124]
lea rax, [rbp - 0x120]
push rax
call fcn.00482744
leave
ret
int 5
Function at 0x4c56b9
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push 0
push 0
mov r8d, 0x53a1c4
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x4c56fe
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
leave
ret

Function at 0x4c571d
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
movzx eax, byte [rbp + 0x10]
push 0
push 0
mov r9d, eax
mov r8d, 0x53a2cb
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x4c5766
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
leave
ret 8

Function at 0x4d5369
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
mov qword [rbp - 8], rax
cmp qword [0x009d6028], 0
jne 0x4d53a2
leave
ret 0x18
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
push rax
push rax
push qword [rbp - 0x10]
push 0x54ec6a
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.user32.dll_EnumWindows]
add rsp, 0x20
leave
ret 0x18
Function at 0x4fb7df
Capabilities:
Check http status code

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp dword [0x02c508e8], 1
jl 0x4fb83a
mov eax, dword [0x02c508e8]
dec eax
cmp eax, 0x40
jae 0x4fb843
mov rax, qword [rax*8 + 0x2c508f0]
lock inc dword [rax]
cmp dword [rax + 4], 0xc7
jne 0x4fb843
mov qword [rbp - 8], rax
push qword [rax + 8]
push 0x1833f80
call fcn.0056c1e0
mov rbx, qword [rbp - 8]
lock dec dword [rbx]
test al, al
je 0x4fb83a
call fcn.004fd384
call fcn.0056c5a5
mov byte [0x02c508c9], 0
leave
ret
int 5

Function at 0x50b42c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
jmp 0x50b469
mov eax, dword [rbp - 8]
cmp eax, 0x3e8
jae 0x50b47f
mov rbx, qword [rbp + 0x10]
imul eax, eax, 0x138
mov eax, dword [rbx + rax + 0x15c]
add dword [rbp - 4], eax
inc dword [rbp - 8]
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 8]
cmp ebx, dword [rax + 0x4c2f8]
jl 0x50b447
mov eax, dword [rbp - 4]
leave
ret 8
int 5

Function at 0x50b481
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
push qword [rbp + 0x10]
push 7
call fcn.0050e2ce
lock inc dword [rax]
cmp dword [rax + 4], 0x53
jne 0x50b4f0
mov qword [rbp - 8], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov dword [rbp - 0x10], ebx
lea rax, [rax + 8]
mov qword [rbp - 0x18], rax
cmp dword [rbp - 0x10], 7
jne 0x50b4f2
mov rax, qword [rbp - 0x18]
mov ebx, dword [rbp + 0x20]
mov dword [rax + 0x84], ebx
cmp dword [rbp - 0x10], 7
jne 0x50b4f4
mov rax, qword [rbp - 0x18]
mov ebx, dword [rbp + 0x18]
mov dword [rax + 0x88], ebx
push qword [rbp - 0x10]
push qword [rbp - 0x18]
call fcn.004d66ce
mov rax, qword [rbp - 8]
lock dec dword [rax]
leave
ret 0x18
int 5
int 5
int 5
Function at 0x50bcf8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
sub rsp, 0x18
push 0
mov rcx, qword [rsp]
call qword [sym.imp.user32.dll_OpenClipboard]
add rsp, 0x20
cmp eax, 0
jne 0x50bd25
mov eax, 0xffffffff
leave
ret 0x18
sub rsp, 0x20
call qword [sym.imp.user32.dll_EmptyClipboard]
add rsp, 0x20
cmp eax, 0
jne 0x50bd4f
sub rsp, 0x20
call qword [sym.imp.user32.dll_CloseClipboard]
add rsp, 0x20
mov eax, 0xffffffff
leave
ret 0x18
mov eax, dword [rbp + 0x20]
mov dword [rbp - 4], eax
mov eax, dword [rbp + 0x10]
cmp eax, 7
jae 0x50bd6b
cmp eax, 1
jne 0x50bd85
mov dword [rbp - 8], 1
jmp 0x50bd8e
cmp eax, 0xd
jae 0x50bd77
cmp eax, 7
jne 0x50bd85
jmp 0x50bd62
cmp eax, 0xd
jne 0x50bd85
mov dword [rbp - 8], 2
jmp 0x50bd8e
mov dword [rbp - 8], 0
jmp 0x50bd8e
push rax
push rax
mov eax, dword [rbp - 4]
add eax, dword [rbp - 8]
mov eax, eax
push rax
push 2
mov ecx, dword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
add rsp, 0x20
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x50bdcf
sub rsp, 0x20
call qword [sym.imp.user32.dll_CloseClipboard]
add rsp, 0x20
mov eax, 0xffffffff
leave
ret 0x18
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalLock]
add rsp, 0x20
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x50be1b
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.user32.dll_CloseClipboard]
add rsp, 0x20
mov eax, 0xffffffff
leave
ret 0x18
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x20]
jne 0x50bf0b
mov r8d, eax
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
movsxd rbx, dword [rbp - 4]
mov esi, dword [rbp - 8]
lea rax, [rax + rbx]
mov bl, byte [0x006e0745]
jmp 0x50be5a
mov byte [rax + rsi], bl
dec esi
jns 0x50be57
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalUnlock]
add rsp, 0x20
push rax
push rax
push qword [rbp - 0x10]
push qword [rbp + 0x10]
mov ecx, dword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.user32.dll_SetClipboardData]
add rsp, 0x20
cmp rax, 0
jne 0x50bebf
sub rsp, 0x20
call qword [sym.imp.user32.dll_CloseClipboard]
add rsp, 0x20
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
add rsp, 0x20
mov eax, 0xffffffff
leave
ret 0x18
sub rsp, 0x20
call qword [sym.imp.user32.dll_CloseClipboard]
add rsp, 0x20
cmp eax, 0
jne 0x50bef0
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
add rsp, 0x20
mov eax, 0xffffffff
leave
ret 0x18
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
add rsp, 0x20
xor eax, eax
leave
ret 0x18
int 5
Function at 0x50fd6d
Capabilities:
Capture microphone audio

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
jmp 0x50ff00
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x28]
lock inc dword [rax]
cmp dword [rax + 4], 0x80
jne 0x50ff12
mov qword [rbp - 0x20], rax
mov rbx, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov esi, dword [rax]
mov ebx, dword [rbx + 0x30]
cmp ebx, esi
jae 0x50ff12
mov rax, qword [rax + rbx*8 + 8]
mov rbx, qword [rbp - 0x20]
lock dec dword [rbx]
lock inc dword [rax]
cmp dword [rax + 4], 0x81
jne 0x50ff12
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x18]
and eax, 1
cmp eax, 0
jne 0x50fdf1
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
jmp 0x50ff0e
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov dword [rbp - 8], eax
push rax
push 0x30
push qword [rbp - 0x18]
mov rax, qword [rbp + 0x10]
push qword [rax + 0x10]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
call qword [sym.imp.Winmm.dll_waveOutUnprepareHeader]
add rsp, 0x20
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x50fe64
push 0x2c
push str.error:_waveOutUnprepareHeader___returned__d_n
mov dword [rbp - 0x20], 4
lea rax, [rbp - 4]
mov qword [rbp - 0x28], rax
push 1
lea rax, [rbp - 0x28]
push rax
call fcn.0040280b
sub rsp, 0x18
mov rax, qword [rbp + 0x10]
push qword [rax + 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.Winmm.dll_waveOutReset]
add rsp, 0x20
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 8]
sub dword [rax + 0x44], ebx
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 8]
add dword [rax + 0x3c], ebx
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x10]
mov rbx, qword [rbx + 0x20]
lock inc dword [rbx]
cmp dword [rbx + 4], 1
jne 0x50ff14
mov qword [rbp - 0x20], rbx
mov rbx, qword [rbx + 8]
mov esi, dword [rbx]
mov rdi, qword [rbp - 0x20]
lock dec dword [rdi]
cmp esi, dword [rax + 0x3c]
jne 0x50feb2
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x3c], 0
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x38]
mov rax, qword [rbp + 0x10]
inc dword [rax + 0x30]
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x10]
mov rbx, qword [rbx + 0x28]
lock inc dword [rbx]
cmp dword [rbx + 4], 0x80
jne 0x50ff16
mov qword [rbp - 0x20], rbx
mov rbx, qword [rbx + 8]
mov esi, dword [rbx]
mov rdi, qword [rbp - 0x20]
lock dec dword [rdi]
cmp esi, dword [rax + 0x30]
jne 0x50fef9
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x38], 0
jg 0x50fd7d
leave
ret 8
int 5
int 5
int 5
Function at 0x512582
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, dword [rbp + 0x28]
cmp eax, dword [rbp + 0x18]
jge 0x51259a
mov eax, dword [rbp + 0x28]
jmp 0x51259d
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0xc], eax
mov dword [rbp - 8], 0
jmp 0x512667
mov eax, dword [rbp - 8]
cmp eax, dword [rbp + 0x28]
jae 0x5126cd
mov rbx, qword [rbp + 0x20]
movzx eax, word [rbx + rax*2]
mov word [rbp - 2], ax
mov eax, dword [rbp - 8]
cmp eax, dword [rbp + 0x18]
jae 0x5126cf
mov rbx, qword [rbp + 0x10]
movzx eax, word [rbx + rax*2]
mov word [rbp - 4], ax
movzx eax, word [rbp - 2]
movzx ebx, word [rbp - 4]
cmp eax, ebx
jne 0x5125f1
movzx eax, word [rbp - 2]
cmp eax, 0
jne 0x512664
movzx eax, word [rbp - 2]
cmp eax, 0x61
jb 0x51260e
movzx eax, word [rbp - 2]
cmp eax, 0x7a
ja 0x51260e
movzx eax, word [rbp - 2]
add eax, 0xffffffe0
mov word [rbp - 2], ax
movzx eax, word [rbp - 4]
cmp eax, 0x61
jb 0x51262b
movzx eax, word [rbp - 4]
cmp eax, 0x7a
ja 0x51262b
movzx eax, word [rbp - 4]
add eax, 0xffffffe0
mov word [rbp - 4], ax
movzx eax, word [rbp - 2]
movzx ebx, word [rbp - 4]
cmp eax, ebx
jae 0x512640
mov eax, 0xffffffff
leave
ret 0x20
movzx eax, word [rbp - 2]
movzx ebx, word [rbp - 4]
cmp eax, ebx
jbe 0x512655
mov eax, 1
leave
ret 0x20
movzx eax, word [rbp - 2]
cmp eax, 0
jne 0x512664
xor eax, eax
leave
ret 0x20
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0xc]
jl 0x5125ac
mov eax, dword [rbp + 0x28]
cmp eax, dword [rbp + 0x18]
jge 0x51269d
mov eax, dword [rbp - 8]
cmp eax, dword [rbp + 0x18]
jae 0x5126d1
mov rbx, qword [rbp + 0x10]
movzx eax, word [rbx + rax*2]
cmp eax, 0
jne 0x512694
xor eax, eax
jmp 0x512699
mov eax, 0xffffffff
leave
ret 0x20
mov eax, dword [rbp + 0x28]
cmp eax, dword [rbp + 0x18]
jle 0x5126c7
mov eax, dword [rbp - 8]
cmp eax, dword [rbp + 0x28]
jae 0x5126d3
mov rbx, qword [rbp + 0x20]
movzx eax, word [rbx + rax*2]
cmp eax, 0
jne 0x5126be
xor eax, eax
jmp 0x5126c3
mov eax, 1
leave
ret 0x20
xor eax, eax
leave
ret 0x20
int 5
int 5
int 5
int 5
push rbp
mov rbp, rsp
sub rsp, 0x40
and rsp, 0xfffffffffffffff0
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r15
push rax
push rax
push 6
push 0
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
call qword [sym.imp.Ole32.dll_CoInitializeEx]
add rsp, 0x20
push 1
push 0
push 0
push qword [rbp + 0x10]
push str.open
push 0
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.Shell32.dll_ShellExecuteW]
add rsp, 0x30
push rax
push qword [rbp + 0x10]
call fcn.004d57e0
pop rcx
sub rsp, 0x20
call qword [sym.imp.Ole32.dll_CoUninitialize]
add rsp, 0x20
xor eax, eax
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x28]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
mov r14, qword [rbp - 0x10]
mov r15, qword [rbp - 8]
leave
ret
Function at 0x516301
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, dword [rbp + 0x20]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0x3ffffffe
jae 0x5163c6
shl eax, 1
add eax, 4
mov r8d, eax
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov ebx, dword [rbp - 0xc]
mov dword [rax], ebx
call fcn.006defae
mov dword [rax + 4], 8
mov qword [rbp - 8], rax
push rax
mov rax, qword [rbp - 8]
lock inc dword [rax]
cmp dword [rax + 4], 8
jne 0x5163c8
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
push qword [rbp + 0x10]
call fcn.0047dd92
pop rcx
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp - 8]
lock inc dword [rax]
cmp dword [rax + 4], 8
jne 0x5163ca
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
push rbx
lea rax, [rax + 4]
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.0057d9e3
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp - 8]
mov ebx, 8
call fcn.006df099
leave
ret 0x18
int 5
int 5
int 5

Function at 0x5163cc
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 4], 0
jmp 0x516416
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x18]
jae 0x516422
mov rbx, qword [rbp + 0x10]
push rax
mov esi, dword [rbp - 4]
cmp esi, dword [rbp + 0x18]
jae 0x516422
mov rdi, qword [rbp + 0x10]
movzx esi, byte [rdi + rsi]
push rsi
lea rbx, [rbx + rax]
mov qword [rsp + 0x10], rbx
call fcn.004549ce
pop rcx
mov rbx, qword [rsp]
mov byte [rbx], al
inc dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x18]
jl 0x5163e0
leave
ret 0x10
int 5

Function at 0x516424
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
push rax
push rax
push qword [rbp + 0x10]
push 0x208
mov ecx, dword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
add rsp, 0x20
leave
ret 8

Function at 0x517ee4
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x20]
cmp dword [rax], 0x400
ja 0x517f67
mov rax, qword [rbp + 0x18]
cmp dword [rax], 0x400
ja 0x517f67
mov rax, qword [rbp + 0x20]
cmp dword [rax], 0
je 0x517f19
mov rax, qword [rbp + 0x18]
cmp dword [rax], 0
jne 0x517f2f
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x10]
mov dword [rax], 0
leave
ret 0x18
mov rax, qword [rbp + 0x20]
cmp dword [rax], 0x32
jb 0x517f53
mov rax, qword [rbp + 0x18]
cmp dword [rax], 0x32
jb 0x517f53
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.0058a688
pop rcx
jmp 0x517f63
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
push qword [rbp + 0x10]
call fcn.0058abc7
pop rcx
leave
ret 0x18
int 5
Function at 0x517f69
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x28]
lea rax, [rax + 4]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x20]
lea rax, [rax + 4]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x18]
lea rax, [rax + 4]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x20]
mov eax, dword [rax]
cmp eax, dword [rbx]
jae 0x517fc2
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
mov dword [rbp - 0xc], eax
jmp 0x517fd4
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0x800
ja 0x518106
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp + 0x10]
ja 0x518106
cmp dword [rbp + 0x10], 0x800
ja 0x518106
mov dword [rbp - 0x10], 0
mov dword [rbp - 4], 0
jmp 0x51803e
mov rax, qword [rbp - 0x20]
movsxd rbx, dword [rbp - 4]
movzx eax, byte [rax + rbx]
mov rbx, qword [rbp - 0x28]
movsxd rsi, dword [rbp - 4]
movzx ebx, byte [rbx + rsi]
add eax, ebx
add dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x30]
movsxd rbx, dword [rbp - 4]
mov sil, byte [rbp - 0x10]
mov byte [rax + rbx], sil
sar dword [rbp - 0x10], 8
inc dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, dword [rbp - 8]
jb 0x51800a
mov rax, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x20]
mov eax, dword [rax]
cmp eax, dword [rbx]
jae 0x51808c
mov eax, dword [rbp - 8]
mov dword [rbp - 4], eax
jmp 0x518082
mov rax, qword [rbp - 0x28]
movsxd rbx, dword [rbp - 4]
movzx eax, byte [rax + rbx]
add dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x30]
movsxd rbx, dword [rbp - 4]
mov sil, byte [rbp - 0x10]
mov byte [rax + rbx], sil
sar dword [rbp - 0x10], 8
inc dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, dword [rbp - 0xc]
jb 0x51805c
jmp 0x5180d0
mov rax, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x20]
mov eax, dword [rax]
cmp eax, dword [rbx]
jbe 0x5180d0
mov eax, dword [rbp - 8]
mov dword [rbp - 4], eax
jmp 0x5180c8
mov rax, qword [rbp - 0x20]
movsxd rbx, dword [rbp - 4]
movzx eax, byte [rax + rbx]
add dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x30]
movsxd rbx, dword [rbp - 4]
mov sil, byte [rbp - 0x10]
mov byte [rax + rbx], sil
sar dword [rbp - 0x10], 8
inc dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, dword [rbp - 0xc]
jb 0x5180a2
cmp dword [rbp - 0x10], 0
je 0x5180f7
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp + 0x10]
jne 0x5180e7
mov eax, 0xffffffff
leave
ret 0x20
mov eax, dword [rbp - 0xc]
inc dword [rbp - 0xc]
mov rbx, qword [rbp - 0x30]
cdqe
mov byte [rbx + rax], 1
mov rax, qword [rbp + 0x18]
mov ebx, dword [rbp - 0xc]
mov dword [rax], ebx
xor eax, eax
leave
ret 0x20
int 5
Function at 0x518108
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
mov rax, qword [rbp + 0x10]
cmp dword [rax], 0x400
jbe 0x51811e
xor al, al
leave
ret 8
mov rax, qword [rbp + 0x10]
cmp dword [rax], 0
jbe 0x51814b
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
dec eax
cmp eax, 0x400
jae 0x518151
mov rbx, qword [rbp + 0x10]
movzx eax, byte [rbx + rax + 4]
cmp eax, 0
jne 0x51814b
xor al, al
leave
ret 8
mov al, 1
leave
ret 8
int 5
Function at 0x5184ba
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
mov rax, qword [rbp + 0x10]
cmp dword [rax], 0x400
ja 0x5184d8
push rax
push qword [rbp + 0x10]
call fcn.0058b15b
pop rcx
leave
ret 8
int 5

Function at 0x5184da
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1b0
push rax
lea rax, [rbp - 0x168]
push rax
call fcn.0058b1c5
pop rcx
push rax
lea rax, [rbp - 0x168]
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.0058b22a
pop rcx
lea rax, [rbp - 0x168]
push rax
lea rax, [rbp - 0x1a8]
push rax
call fcn.0058b3f6
mov rcx, qword [rbp + 0x10]
mov edx, 0x40
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
push 0x40
push 0x40
call fcn.00416bdc
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov dword [rbp - 0x1ac], eax
mov eax, 0x40
sub eax, dword [rbp - 0x1ac]
jb 0x51859e
mov rax, qword [rbp + 0x10]
mov ebx, dword [rbp - 4]
mov dword [rbp - 0x1b0], ebx
mov ebx, 0x40
sub ebx, dword [rbp - 0x1b0]
jb 0x51859e
mov ebx, dword [rbp - 0x1b0]
cmp ebx, dword [rbp - 0x1ac]
jne 0x51859e
mov r8d, ebx
lea rdx, [rbp - 0x1a8]
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
leave
ret 0x18
int 5

Function at 0x5185a0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x38]
cmp eax, dword [rbp + 0x28]
jne 0x518611
mov eax, dword [rbp + 0x38]
cmp eax, dword [rbp + 0x18]
jne 0x518613
mov dword [rbp - 4], 0
jmp 0x518605
mov rax, qword [rbp - 0x20]
movsxd rbx, dword [rbp - 4]
mov rsi, qword [rbp - 0x10]
movsxd rdi, dword [rbp - 4]
movzx esi, byte [rsi + rdi]
mov rdi, qword [rbp - 0x18]
movsxd rcx, dword [rbp - 4]
movzx edi, byte [rdi + rcx]
xor esi, edi
mov byte [rax + rbx], sil
inc dword [rbp - 4]
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x38]
jl 0x5185dc
leave
ret 0x30
int 5
int 5