joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f06
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0xc11c
mov dword [rbp - 0x24], eax
movabs rax, 0
mov qword [rbp - 0x18], rax
mov eax, 2
mov dword [rbp - 0x1c], eax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0xc], eax
lea rax, [rbp - 0x20]
mov qword [rbp - 8], rax
mov eax, 0
mov dword [rbp - 0x10], eax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
add rcx, 0x30
mov rax, qword [rbp + 0x10]
add rax, 0x68
mov rdx, qword [rbp + 0x10]
add rdx, 0x78
mov qword [rbp - 0x40], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
mov ecx, 0
mov qword [rsp + 0x38], rcx
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov ecx, 0x10
mov qword [rsp + 0x28], rcx
mov ecx, 0
mov qword [rsp + 0x20], rcx
mov ecx, dword [rbp - 0x24]
mov r9, rcx
mov rcx, qword [rbp + 0x18]
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x40]
mov r11, qword [r11]
call r11
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
cmp eax, 0x90312
je 0x40201e
mov eax, dword [rbp - 0x34]
mov r11, rax
lea rax, str.Error__d_returned_by_InitializeSecurityContext__1__n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_wprintf
mov eax, dword [rbp - 0x34]
jmp 0x40214a
mov eax, dword [rbp - 0x20]
cmp eax, 0
je 0x402129
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x402129
mov rax, qword [rbp + 0x10]
add rax, 0x60
mov ecx, 0
mov r9, rcx
mov ecx, dword [rbp - 0x20]
mov r8, rcx
mov rcx, qword [rbp - 0x18]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_send
mov dword [rbp - 0x38], eax
mov eax, dword [rbp - 0x38]
cmp eax, 0xffffffff
je 0x402081
mov eax, dword [rbp - 0x38]
cmp eax, 0
jne 0x4020f5
call sub.ws2_32.dll_WSAGetLastError
mov r11, rax
lea rax, str.Error__d_sending_data_to_server__1__n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_wprintf
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
add rcx, 0x80
mov rax, qword [rbp - 0x18]
mov r10, rax
mov qword [rbp - 0x40], rcx
mov rcx, r10
mov r11, qword [rbp - 0x40]
mov r11, qword [r11]
call r11
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, qword [rbp + 0x10]
add rax, 0x78
mov r10, rax
mov qword [rbp - 0x40], rcx
mov rcx, r10
mov r11, qword [rbp - 0x40]
mov r11, qword [r11]
call r11
mov eax, 0x80090304
jmp 0x40214a
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
add rcx, 0x80
mov rax, qword [rbp - 0x18]
mov r10, rax
mov qword [rbp - 0x40], rcx
mov rcx, r10
mov r11, qword [rbp - 0x40]
mov r11, qword [r11]
call r11
movabs rax, 0
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x20]
mov r8, rax
mov eax, 1
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040214c
leave
ret
Function at 0x422770
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x20]
cmp eax, 0
jg 0x422798
jmp 0x422842
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x20]
movsxd rax, eax
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
call sub.msvcrt.dll___iob_func
add rax, 0x30
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x10]
cmp eax, 2
jne 0x4227de
call sub.msvcrt.dll___iob_func
add rax, 0x60
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
jg 0x4227f1
jmp 0x422842
mov rax, qword [rbp - 0x20]
mov r9, rax
mov rax, qword [rbp - 0x10]
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rax, rcx
mov qword [rbp - 0x10], rax
jmp 0x4227de
leave
ret

Function at 0x42277b
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x20]
cmp eax, 0
jg 0x422798
jmp 0x422842
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x20]
movsxd rax, eax
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
call sub.msvcrt.dll___iob_func
add rax, 0x30
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x10]
cmp eax, 2
jne 0x4227de
call sub.msvcrt.dll___iob_func
add rax, 0x60
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
jg 0x4227f1
jmp 0x422842
mov rax, qword [rbp - 0x20]
mov r9, rax
mov rax, qword [rbp - 0x10]
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rax, rcx
mov qword [rbp - 0x10], rax
jmp 0x4227de
leave
ret
Function at 0x463468
Capabilities:
Parse credit card information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
add rax, 8
mov ecx, dword [rbp - 4]
mov edx, dword [rax]
cmp ecx, edx
jge 0x463631
jmp 0x4634a4
mov eax, dword [rbp - 4]
add eax, 1
mov dword [rbp - 4], eax
jmp 0x46347f
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 4]
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
mov byte [rbp - 5], al
movzx eax, byte [rbp - 5]
cmp eax, 0x21
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x24
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x26
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x5c
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x28
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x29
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x2a
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x2b
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x2c
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x3b
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x3d
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x3a
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x40
jne 0x46358d
jmp 0x46362c
movzx eax, byte [rbp - 5]
cmp eax, 0x5b
je 0x4635a7
movzx eax, byte [rbp - 5]
cmp eax, 0x5d
jne 0x4635ac
jmp 0x46362c
movzx eax, byte [rbp - 5]
cmp eax, 0x25
jne 0x4635be
jmp 0x46362c
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 4]
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
movzx eax, al
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0045a7fb
movzx eax, al
cmp eax, 0
je 0x46362c
mov eax, 0
mov byte [rbp - 6], al
movzx eax, byte [rbp - 6]
jmp 0x46363d
jmp 0x463499
mov eax, 1
mov byte [rbp - 7], al
movzx eax, byte [rbp - 7]
leave
ret
Function at 0x463473
Capabilities:
Parse credit card information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
add rax, 8
mov ecx, dword [rbp - 4]
mov edx, dword [rax]
cmp ecx, edx
jge 0x463631
jmp 0x4634a4
mov eax, dword [rbp - 4]
add eax, 1
mov dword [rbp - 4], eax
jmp 0x46347f
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 4]
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
mov byte [rbp - 5], al
movzx eax, byte [rbp - 5]
cmp eax, 0x21
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x24
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x26
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x5c
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x28
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x29
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x2a
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x2b
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x2c
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x3b
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x3d
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x3a
je 0x463588
movzx eax, byte [rbp - 5]
cmp eax, 0x40
jne 0x46358d
jmp 0x46362c
movzx eax, byte [rbp - 5]
cmp eax, 0x5b
je 0x4635a7
movzx eax, byte [rbp - 5]
cmp eax, 0x5d
jne 0x4635ac
jmp 0x46362c
movzx eax, byte [rbp - 5]
cmp eax, 0x25
jne 0x4635be
jmp 0x46362c
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 4]
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
movzx eax, al
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0045a7fb
movzx eax, al
cmp eax, 0
je 0x46362c
mov eax, 0
mov byte [rbp - 6], al
movzx eax, byte [rbp - 6]
jmp 0x46363d
jmp 0x463499
mov eax, 1
mov byte [rbp - 7], al
movzx eax, byte [rbp - 7]
leave
ret
Function at 0x466caa
Capabilities:
Parse credit card information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
add rax, 8
mov ecx, dword [rbp - 4]
mov edx, dword [rax]
cmp ecx, edx
jge 0x466e65
jmp 0x466ce6
mov eax, dword [rbp - 4]
add eax, 1
mov dword [rbp - 4], eax
jmp 0x466cc1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rbp - 4]
movsxd rcx, ecx
mov rdx, qword [rax]
add rdx, rcx
movzx eax, byte [rdx]
mov byte [rbp - 5], al
movzx eax, byte [rbp - 5]
mov ecx, 0x41
cmp ecx, eax
jg 0x466d1f
movzx eax, byte [rbp - 5]
cmp eax, 0x5a
jg 0x466d1f
jmp 0x466cdb
movzx eax, byte [rbp - 5]
mov ecx, 0x61
cmp ecx, eax
jg 0x466d42
movzx eax, byte [rbp - 5]
cmp eax, 0x7a
jg 0x466d42
jmp 0x466cdb
movzx eax, byte [rbp - 5]
mov ecx, 0x30
cmp ecx, eax
jg 0x466d65
movzx eax, byte [rbp - 5]
cmp eax, 0x39
jg 0x466d65
jmp 0x466cdb
movzx eax, byte [rbp - 5]
cmp eax, 0x2d
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2e
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x5f
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x3a
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x7e
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x21
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x24
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x26
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x5c
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x28
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x29
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2a
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2b
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2c
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x3b
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x3d
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x25
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x40
jne 0x466e54
jmp 0x466cdb
mov eax, 0
mov byte [rbp - 6], al
movzx eax, byte [rbp - 6]
jmp 0x466e71
mov eax, 1
mov byte [rbp - 7], al
movzx eax, byte [rbp - 7]
leave
ret
Function at 0x466cb5
Capabilities:
Parse credit card information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
add rax, 8
mov ecx, dword [rbp - 4]
mov edx, dword [rax]
cmp ecx, edx
jge 0x466e65
jmp 0x466ce6
mov eax, dword [rbp - 4]
add eax, 1
mov dword [rbp - 4], eax
jmp 0x466cc1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rbp - 4]
movsxd rcx, ecx
mov rdx, qword [rax]
add rdx, rcx
movzx eax, byte [rdx]
mov byte [rbp - 5], al
movzx eax, byte [rbp - 5]
mov ecx, 0x41
cmp ecx, eax
jg 0x466d1f
movzx eax, byte [rbp - 5]
cmp eax, 0x5a
jg 0x466d1f
jmp 0x466cdb
movzx eax, byte [rbp - 5]
mov ecx, 0x61
cmp ecx, eax
jg 0x466d42
movzx eax, byte [rbp - 5]
cmp eax, 0x7a
jg 0x466d42
jmp 0x466cdb
movzx eax, byte [rbp - 5]
mov ecx, 0x30
cmp ecx, eax
jg 0x466d65
movzx eax, byte [rbp - 5]
cmp eax, 0x39
jg 0x466d65
jmp 0x466cdb
movzx eax, byte [rbp - 5]
cmp eax, 0x2d
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2e
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x5f
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x3a
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x7e
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x21
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x24
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x26
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x5c
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x28
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x29
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2a
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2b
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x2c
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x3b
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x3d
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x25
je 0x466e4f
movzx eax, byte [rbp - 5]
cmp eax, 0x40
jne 0x466e54
jmp 0x466cdb
mov eax, 0
mov byte [rbp - 6], al
movzx eax, byte [rbp - 6]
jmp 0x466e71
mov eax, 1
mov byte [rbp - 7], al
movzx eax, byte [rbp - 7]
leave
ret
Function at 0x46cba1
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x18]
cmp eax, 0xffffffff
jne 0x46cc55
lea rax, [0x0050c3c1]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 8], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x46cde5
mov eax, dword [rbp + 0x20]
add eax, 1
movsxd rax, eax
mov r10, rax
mov rcx, r10
call fcn.00422be9
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov eax, dword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
cmp eax, 0
jge 0x46cd38
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call fcn.00423c1b
lea rax, [0x0050c3c2]
mov qword [rbp - 0x60], rax
mov eax, 0
mov dword [rbp - 0x58], eax
mov eax, 1
mov dword [rbp - 0x54], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x60]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x50]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x46cde5
mov eax, dword [rbp - 0x34]
movsxd rax, eax
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov eax, 0
mov byte [rcx], al
mov eax, dword [rbp - 0x34]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
lea rax, [rbp - 0x88]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042fb69
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x68], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x64]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x78]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x46cde5
leave
ret
Function at 0x46cbac
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x18]
cmp eax, 0xffffffff
jne 0x46cc55
lea rax, [0x0050c3c1]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 8], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x46cde5
mov eax, dword [rbp + 0x20]
add eax, 1
movsxd rax, eax
mov r10, rax
mov rcx, r10
call fcn.00422be9
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov eax, dword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
cmp eax, 0
jge 0x46cd38
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call fcn.00423c1b
lea rax, [0x0050c3c2]
mov qword [rbp - 0x60], rax
mov eax, 0
mov dword [rbp - 0x58], eax
mov eax, 1
mov dword [rbp - 0x54], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x60]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x50]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x46cde5
mov eax, dword [rbp - 0x34]
movsxd rax, eax
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov eax, 0
mov byte [rcx], al
mov eax, dword [rbp - 0x34]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
lea rax, [rbp - 0x88]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042fb69
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x68], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x64]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x78]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x46cde5
leave
ret
Function at 0x4776c0
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
add rax, 8
mov ecx, dword [rax]
cmp ecx, 1
jle 0x4778d4
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
movzx eax, al
cmp eax, 0x22
jne 0x4778d4
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 1
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
movzx eax, al
cmp eax, 0x22
je 0x4778d4
lea rax, [0x0050c66b]
mov qword [rbp - 0x88], rax
mov eax, 1
mov dword [rbp - 0x80], eax
mov eax, 1
mov dword [rbp - 0x7c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0xfe10
mov dword [rbp - 0x68], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x64]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x10
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
lea rax, [rbp - 0x60]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [0x0050c66d]
mov qword [rbp - 0x98], rax
mov eax, 1
mov dword [rbp - 0x90], eax
mov eax, 1
mov dword [rbp - 0x8c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x98]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov dword [rbp - 0x38], eax
movabs rax, 0xc
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x34]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x78]
mov r8, rax
mov eax, 2
mov r11, rax
lea rax, [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043dca9
jmp 0x4778dd
mov rax, qword [rbp + 0x10]
jmp 0x4778e1
lea rax, [rbp - 0x28]
mov ecx, 0x10
mov r8, rcx
mov r11, rax
lea rcx, [rbp - 0x18]
mov r10, rcx
mov qword [rbp - 0xa0], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
cmp eax, 0xffffffff
jne 0x477953
call fcn.004786ee
mov eax, dword [rbp - 4]
leave
ret