joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a6be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov esi, 1
mov ebp, dword [rsp + 0x88]
xor r11d, r11d
mov r12, rcx
mov ecx, dword [rsp + 0x80]
inc r9d
lea rax, [r12 + rdx]
mov r10, r12
xor edx, edx
mov qword [rsp + 8], rax
lea eax, [rcx + 1]
shl esi, cl
lea edi, [rsi + 1]
lea ebx, [rcx - 5]
mov ecx, 4
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
lea r14, [rax - 2]
cmp r11d, r9d
jae 0x5a6da4
cmp edi, 1
jle 0x5a6da4
test edx, edx
mov eax, r11d
je 0x5a6d16
mov edx, r11d
xor r13d, r13d
add rdx, rdx
add rdx, r8
lea eax, [r11 + r13]
cmp r9d, eax
jbe 0x5a6c80
inc r13
cmp word [rdx + r13*2 - 2], 0
je 0x5a6c60
mov r13d, 0xffff
shl r13d, cl
jmp 0x5a6ca6
jne 0x5a6c75
or rax, 0xffffffffffffffff
jmp 0x5a6de1
add ebx, r13d
test ebp, ebp
je 0x5a6cb1
movzx edx, bh
mov byte [r10], bl
mov r11d, r15d
mov byte [r10 + 1], dl
shr ebx, 0x10
add r10, 2
lea r15d, [r11 + 0x18]
cmp r15d, eax
jbe 0x5a6c8b
jmp 0x5a6cc2
cmp r10, r14
jbe 0x5a6c92
mov rax, 0xffffffffffffffba
jmp 0x5a6de1
lea r13d, [r11 + 3]
lea edx, [rcx + 2]
cmp r13d, eax
ja 0x5a6ce1
mov r15d, 3
mov r11d, r13d
shl r15d, cl
mov ecx, edx
add ebx, r15d
jmp 0x5a6cc2
mov r15d, eax
sub r15d, r11d
mov r11d, r15d
shl r11d, cl
add ebx, r11d
cmp edx, 0x10
jle 0x5a6d14
test ebp, ebp
jne 0x5a6cfe
cmp r10, r14
ja 0x5a6cb6
movzx edx, bh
mov byte [r10], bl
sub ecx, 0xe
mov byte [r10 + 1], dl
shr ebx, 0x10
add r10, 2
jmp 0x5a6d16
mov ecx, edx
lea r11d, [rax + 1]
movsx eax, word [r8 + rax*2]
lea r13d, [rsi + rsi - 1]
sub r13d, edi
mov r15d, eax
sar r15d, 0x1f
mov edx, r15d
xor edx, eax
sub edx, r15d
lea r15d, [rax + 1]
sub edi, edx
cmp esi, r15d
jg 0x5a6d44
add r15d, r13d
mov eax, r15d
shl eax, cl
add ecx, dword [rsp + 4]
add ebx, eax
xor eax, eax
cmp r15d, r13d
setl al
xor edx, edx
sub ecx, eax
dec r15d
sete dl
test edi, edi
jle 0x5a6c82
cmp esi, edi
jle 0x5a6d75
dec dword [rsp + 4]
sar esi, 1
jmp 0x5a6d69
cmp ecx, 0x10
jle 0x5a6c37
test ebp, ebp
jne 0x5a6d8b
cmp r10, r14
ja 0x5a6cb6
movzx eax, bh
mov byte [r10], bl
sub ecx, 0x10
mov byte [r10 + 1], al
shr ebx, 0x10
add r10, 2
jmp 0x5a6c37
dec edi
jne 0x5a6c82
test ebp, ebp
jne 0x5a6dc2
mov rdx, qword [rsp + 8]
sub rdx, 2
cmp r10, rdx
ja 0x5a6cb6
movzx eax, bh
mov r8d, 8
mov byte [r10], bl
mov byte [r10 + 1], al
lea eax, [rcx + 7]
cdq
idiv r8d
cdqe
add rax, r10
sub rax, r12
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x62ea30
Capabilities:
Reference sql statements

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor edi, edi
movsxd rbp, edx
mov rbx, rcx
mov qword [rsp + 0xf0], r8
lea r13, [rcx + rbp*8]
mov r12, rbp
mov r14, r9
cmp qword [r13 + 0x28], 0
jne 0x62ec01
cmp ebp, 0xa
lea rdi, [rsp + 0x38]
lea rsi, str.SELECT__s_FROM__s_T_WHERE_T._Q_____AND_T._Q_____ORDER_BY_T._Q_ASC
mov ecx, 0x16
rep movsd dword [rdi], dword [rsi]
mov rsi, qword [rbx]
ja case.0x62ea97.5
lea rdx, [0x007a4d44]
mov eax, ebp
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov rdx, qword [rsi + 0x60]
mov r8, qword [rsi + 0x48]
mov rcx, qword [rsp + 0x88]
call fcn.00698900
test rax, rax
mov r15, rax
mov r9d, 5
jne 0x62eba6
mov edi, 7
jmp 0x62ec01
mov r9, qword [rsi + 0x50]
mov r8, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rsp + rbp*8 + 0x38]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
call fcn.00698900
jmp 0x62eb87
mov r9, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x60]
mov r8, qword [rsi + 0x48]
mov rcx, qword [rsp + 0x48]
call fcn.00698900
test rax, rax
mov r15, rax
mov r9d, 1
jne 0x62eba6
jmp 0x62eac0
mov eax, dword [rsi + 0x18]
lea r15d, [rax + 1]
lea ecx, [r15 + r15 + 1]
movsxd rcx, ecx
call fcn.00698860
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x62eac0
cmp r15d, eax
lea rcx, [rax + rax]
jle 0x62eb4e
mov byte [rdi + rax*2], 0x3f
mov byte [rdi + rax*2 + 1], 0x2c
inc rax
jmp 0x62eb37
mov byte [rdi + rcx - 1], 0
mov rcx, qword [rsp + rbp*8 + 0x38]
mov r9, rdi
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call fcn.00698900
mov rcx, rdi
mov r15, rax
call fcn.00697980
jmp 0x62eb8a
mov rdx, qword [rsi + 8]
mov rcx, qword [rsp + rbp*8 + 0x38]
mov r8, qword [rsi + 0x10]
call fcn.00698900
mov r15, rax
test r15, r15
je 0x62eac0
xor r9d, r9d
cmp r12d, 3
setge r9b
lea r9d, [r9*4 + 1]
mov rax, qword [rbx]
or r8d, 0xffffffff
mov rdx, r15
inc dword [rax + 0x78]
lea rax, [rbx + rbp*8 + 0x28]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov rcx, qword [rsi]
call fcn.00698d40
mov edi, eax
mov rax, qword [rbx]
mov rcx, r15
dec dword [rax + 0x78]
call fcn.00697980
test edi, edi
je 0x62ec01
test r14, r14
je 0x62ec01
mov rcx, qword [rsi]
call fcn.006971d0
lea rcx, [0x0079fcd7]
mov rdx, rax
call fcn.00698900
mov qword [r14], rax
mov rcx, qword [r13 + 0x28]
mov rax, qword [rsp + 0xf0]
mov qword [rax], rcx
call fcn.00699140
mov eax, edi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x63e7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebp, dword [rcx + 0x80]
movsxd rdx, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x78]
mov rsi, rdx
imul rdx, rdx, 0x38
call fcn.00673770
test rax, rax
mov r8, rax
jne 0x63e7e6
mov eax, 7
jmp 0x63e882
movsxd rdi, ebp
mov ecx, esi
imul rdi, rdi, 0x38
sub ecx, ebp
movsxd rcx, ecx
imul rcx, rcx, 0x38
lea rdx, [rax + rdi]
xor eax, eax
mov rdi, rdx
rep stosb byte [rdi], al
mov qword [rbx + 0x78], r8
mov rdi, rdx
cmp ebp, esi
jge 0x63e880
mov rax, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x20]
cmp qword [rax], 0
mov dword [rdi + 0x18], ecx
je 0x63e827
mov rax, qword [rbx + 0x60]
test rax, rax
jg 0x63e82d
mov eax, dword [rbx + 0xb8]
mov qword [rdi], rax
mov eax, dword [rbx + 0x3c]
mov dword [rdi + 0x1c], eax
call fcn.006510d0
test rax, rax
mov qword [rdi + 0x10], rax
mov dword [rdi + 0x20], 1
je 0x63e7dc
mov rax, qword [rbx + 0x128]
test rax, rax
je 0x63e872
mov edx, dword [rax + 0x58]
mov dword [rdi + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rdi + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rdi + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rdi + 0x30], eax
inc ebp
add rdi, 0x38
mov dword [rbx + 0x80], ebp
jmp 0x63e80a
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6491a0
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov rbx, rcx
mov r12d, edx
mov rdi, r8
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov rbp, r9
mov qword [rsp + 0x48], rax
movsxd rax, edx
lea rsi, [rcx + rax*8]
cmp qword [rsi + 0x28], 0
jne 0x6491f2
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.00649620
mov qword [rsi + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x6492ac
mov rsi, qword [rsi + 0x28]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.006947f0
mov rcx, rsi
call fcn.00699ec0
cmp eax, 0x65
jne 0x64924e
lea rdx, str.__parent
lea rax, str.__rowid
test r12d, r12d
mov r9, rbp
mov r8, rdi
mov rcx, rbx
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.006490a0
jmp 0x64929b
cmp eax, 0x64
jne 0x64929b
xor edx, edx
mov rcx, rsi
call fcn.00695650
cmp rbp, rax
mov r9, rax
je 0x64929b
lea rdx, str.__rowid
lea rax, str.__parent
test r12d, r12d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rdi
mov r8, rdi
cmove rdx, rax
mov rcx, rbx
mov qword [rsp + 0x20], rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
call fcn.006490a0
mov rcx, rsi
call fcn.00699140
cmp dword [rbx + 0x40], 0
jne 0x6492ac
mov dword [rbx + 0x40], eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6675e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
cmp ecx, 0x7f
jg 0x6675fb
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x66769f
add ecx, 0x20
jmp 0x66769f
cmp ecx, 0xffff
jg 0x667691
lea rbx, [0x007abac0]
or rax, 0xffffffffffffffff
xor r11d, r11d
mov r10d, 0xa2
mov r9, rbx
lea r8d, [r10 + r11]
sar r8d, 1
movsxd rsi, r8d
movzx esi, word [rbx + rsi*4]
cmp ecx, esi
js 0x667639
lea r11d, [r8 + 1]
movsxd rax, r8d
jmp 0x66763d
lea r10d, [r8 - 1]
cmp r11d, r10d
jle 0x66761e
movzx r8d, word [r9 + rax*4]
movzx r10d, byte [r9 + rax*4 + 3]
add r10d, r8d
cmp ecx, r10d
jge 0x66767d
mov al, byte [r9 + rax*4 + 2]
xor r8d, ecx
mov r9d, eax
and r9d, 1
test r9d, r8d
jne 0x66767d
shr al, 1
lea r8, [0x007ae920]
and eax, 0x7f
add cx, word [r8 + rax*2]
movzx ecx, cx
test edx, edx
je 0x66769f
cmp edx, 2
sete dl
movzx edx, dl
pop rbx
pop rsi
jmp fcn.00644800
lea eax, [rcx - 0x10400]
cmp eax, 0x27
ja 0x66769f
add ecx, 0x28
mov eax, ecx
pop rbx
pop rsi
ret
Function at 0x6a3550
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
movzx r12d, byte [rcx + 0x5b]
xor ebp, ebp
xor esi, esi
mov rbx, rcx
mov byte [rcx + 0x58], 1
dec r12d
cmp esi, r12d
jge 0x6a364a
movzx eax, byte [rbx + 0x5a]
lea eax, [rsi + rax + 1]
cdq
idiv r12d
movsxd rdi, edx
imul rax, rdi, 0x68
cmp dword [rbx + rax + 0x68], 0
lea rbp, [rbx + rax + 0x60]
jne 0x6a35a5
imul rdi, rdi, 0x68
cmp qword [rbx + rdi + 0x60], 0
je 0x6a35b6
inc esi
jmp 0x6a356d
mov rcx, rbp
call fcn.006a36a0
test eax, eax
je 0x6a3595
jmp 0x6a366f
lea rax, [rbx + 0x60]
mov rdi, rbp
movabs rdx, 0x4ec4ec4ec4ec4ec5
mov rcx, qword [rbp + 0x28]
sub rdi, rax
movups xmm0, xmmword [rbx + 0x38]
mov rax, rdi
sar rax, 3
imul rax, rdx
test rcx, rcx
mov byte [rbx + 0x5a], al
mov rax, qword [rbx + 0x48]
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
mov qword [rbx + 0x38], 0
mov dword [rbx + 0x48], 0
je 0x6a360e
mov qword [rbx + 0x40], rcx
call fcn.0066dc10
mov dword [rbx + 0x54], eax
jmp 0x6a3627
cmp qword [rbx + 0x40], 0
je 0x6a3627
movsxd rcx, dword [rbx + 0x54]
call fcn.0066dab0
test rax, rax
mov qword [rbx + 0x40], rax
je 0x6a3643
lea rdx, [0x006a3680]
mov r8, rbp
mov rcx, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.0067fb00
mov eax, 7
jmp 0x6a366f
jne 0x6a35b6
movsxd rsi, esi
lea rdx, [rbx + 0x38]
imul rsi, rsi, 0x68
lea rcx, [rbx + rsi + 0x60]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.006a3720
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6af070
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rax, dword [rcx + 0xc]
xor r9d, r9d
xor r11d, r11d
lea r10d, [rax + 1]
add rax, qword [rcx]
mov bl, byte [rdx + r9]
xor byte [rax], bl
movsxd rax, r10d
cmp dword [rcx + 8], r10d
cmovle rax, r11
inc r9
cmp r8d, r9d
jg 0x6af07b
add dword [rcx + 0x10], r8d
mov dword [rcx + 0xc], eax
pop rbx
ret

Function at 0x6b0360
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov r12d, r8d
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], r8d
mov rsi, rdx
mov r8, rdx
mov rdi, r9
mov r9, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [rsp + 0x30], ebp
mov rbx, rcx
call fcn.0066e190
test r12d, r12d
jne 0x6b03cc
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov r9, rdi
mov r8, rsi
mov rcx, rbx
mov dword [rsp + 0x90], ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.0066e190
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x401550
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x260
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x28], 0x238
lea rsi, [rsp + 0x28]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4015c2
mov rbp, qword [sym.imp.msvcrt.dll__wcsicmp]
lea rdi, [rsi + 0x2c]
lea r12, str.codeblocks.exe
mov rdx, r12
mov rcx, rdi
call rbp
test eax, eax
jne 0x4015b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4015cd
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40159a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4015db
Capabilities:
Create directory
Set environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x480
lea rdx, [0x0040e040]
mov sil, 1
lea rbx, [rsp + 0x28]
lea r12, [rsp + 0x230]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str.AppData
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, r12
mov rcx, rbx
mov rbp, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rbp
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x40165c
mov ecx, 1
call qword [fcn.00407f70]
lea rdx, str.Creating_AppData_directory__ls_n
mov r8, rbx
mov rcx, rax
call fcn.00408210
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne sil
mov rcx, rdi
mov rdi, qword [sym.imp.KERNEL32.dll_FindClose]
call rdi
test sil, sil
jne 0x401674
xor eax, eax
jmp 0x40172b
lea rdx, [0x0040e040]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str.AppDatacodeblocks
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, r12
mov rcx, rbx
call rbp
cmp rax, 0xffffffffffffffff
mov rbp, rax
jne 0x4016d1
mov ecx, 1
call qword [fcn.00407f70]
lea rdx, str.Creating_directory__ls_n
mov r8, rbx
mov rcx, rax
call fcn.00408210
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne sil
mov rcx, rbp
call rdi
test sil, sil
je 0x40166d
lea rdx, [0x0040e040]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str.AppData
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov ecx, 1
call qword [fcn.00407f70]
lea rdx, str.Setting___APPDATA___to__ls_n
mov r8, rbx
mov rcx, rax
call fcn.00408210
lea rcx, str.APPDATA
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x480
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x401739
Capabilities:
Enumerate files on windows
Query environment variable
Set environment variable

Disassembly:
push r15
mov eax, 0x64a8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.00403280
sub rsp, rax
lea rdx, [0x0040e040]
mov bl, 1
lea rdi, [rsp + 0x4a0]
lea rbp, [rsp + 0x250]
mov rcx, rdi
call sub.msvcrt.dll_wcscpy
lea rdx, str.tool
mov rcx, rdi
call sub.msvcrt.dll_wcscat
mov rdx, rbp
mov rcx, rdi
mov r12, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call r12
cmp rax, 0xffffffffffffffff
mov rsi, rax
jne 0x4017b7
mov ecx, 1
xor ebx, ebx
call qword [fcn.00407f70]
lea rdx, str.No_tool_subdirectory._n
mov rcx, rax
call fcn.00408210
mov rcx, rsi
mov r14, qword [sym.imp.KERNEL32.dll_FindClose]
call r14
test bl, bl
je 0x40197c
lea rbx, [rsp + 0x48]
mov rdx, rdi
lea rsi, [rsp + 0x24a0]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str..
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rdx, rbp
mov rcx, rbx
call r12
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x401908
mov r15, qword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [rsp + 0x250], 0x10
je 0x4018f7
lea r13, [rbp + 0x2c]
lea rdx, [0x0040a14e]
mov rcx, r13
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x4018f7
lea rdx, [0x0040a152]
mov rcx, r13
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x4018f7
lea rdx, [0x0040a158]
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0040a15c]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_wcscat
lea rdx, [0x0040a160]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x4018f7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x0040a160]
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov rdx, rbp
mov rcx, r12
call r15
test eax, eax
jne 0x40181b
lea rbx, [rsp + 0x44a0]
mov rcx, r12
call r14
mov r8d, 0x1000
mov rdx, rbx
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40194a
lea rdx, [0x0040a158]
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov ecx, 1
call qword [fcn.00407f70]
lea rdx, str._nSetting_path:__ls_n_n
mov r8, rsi
mov rcx, rax
call fcn.00408210
lea rcx, str.PATH
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne bl
mov eax, ebx
add rsp, 0x64a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x401992
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x898
xor esi, esi
lea rbx, [rsp + 0x230]
mov rdx, rcx
mov rbp, rcx
lea rdi, [rsp + 0x640]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str..
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
mov r14, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call r14
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x401a6c
mov r15, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea r13, [rdi + 0x2c]
lea rbx, [rsp + 0x438]
test byte [rsp + 0x640], 0x10
je 0x401a5f
lea rdx, [0x0040a14e]
mov rcx, r13
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401a5f
lea rdx, [0x0040a152]
mov rcx, r13
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401a5f
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0040a15c]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rcx, rbx
call fcn.00401992
add esi, eax
mov rdx, rdi
mov rcx, r12
call r15
test eax, eax
jne 0x401a00
lea rbx, [rsp + 0x28]
mov rcx, r12
mov r13, qword [sym.imp.KERNEL32.dll_FindClose]
call r13
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str.._tf
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
call r14
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x401b31
mov r15, qword [sym.imp.GDI32.dll_AddFontResourceW]
lea r14, [rdi + 0x2c]
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0040a15c]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rcx, rbx
call r15
mov ecx, 1
test eax, eax
je 0x401b19
call qword [fcn.00407f70]
mov r8, r14
inc esi
lea rdx, str._nInstalled_font__ls
mov rcx, rax
call fcn.00408210
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401ab5
jmp 0x401b31
call qword [fcn.00407f70]
lea rdx, str._nInstallation_of__ls_failed_n
mov r8, rbx
mov rcx, rax
call fcn.00408210
mov rcx, r12
call r13
mov eax, esi
add rsp, 0x898
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x401bc9
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x8a8
xor esi, esi
lea rbx, [rsp + 0x240]
mov rdx, rcx
mov rbp, rcx
lea rdi, [rsp + 0x650]
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str..
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
mov r14, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call r14
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x401ca3
mov r15, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea r13, [rdi + 0x2c]
lea rbx, [rsp + 0x448]
test byte [rsp + 0x650], 0x10
je 0x401c96
lea rdx, [0x0040a14e]
mov rcx, r13
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401c96
lea rdx, [0x0040a152]
mov rcx, r13
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401c96
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0040a15c]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rcx, rbx
call fcn.00401bc9
add esi, eax
mov rdx, rdi
mov rcx, r12
call r15
test eax, eax
jne 0x401c37
lea rbx, [rsp + 0x38]
mov rcx, r12
mov r13, qword [sym.imp.KERNEL32.dll_FindClose]
call r13
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, str.._tf
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, rdi
mov rcx, rbx
call r14
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x401d38
mov r15, qword [sym.imp.GDI32.dll_RemoveFontResourceW]
lea rax, [rdi + 0x2c]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0040a15c]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rcx, rbx
call r15
mov rdx, rdi
mov rcx, r12
cmp eax, 1
sbb esi, 0xffffffff
call r14
test eax, eax
jne 0x401cf8
mov rcx, r12
call r13
mov eax, esi
add rsp, 0x8a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x402320
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0040e844]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4024a8
mov rax, qword [0x0040e848]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40236c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4023f5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402350
mov rcx, rbx
call fcn.00402fc0
test rax, rax
mov r12, rax
je 0x4024dd
mov rax, qword [0x0040e848]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.004030f0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040e848]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4024c0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4023ee
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402450
add dword [0x0040e844], 1
cmp edi, 8
jae 0x402423
test dil, 4
jne 0x402494
test edi, edi
je 0x402418
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4024af
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x402418
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40243c
jmp 0x402418
add rsi, qword [0x0040e848]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4023ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00408570
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x402418
xor esi, esi
jmp 0x402377
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x402418
mov rax, qword [0x0040e848]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00408570
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00408570
nop
nop dword [rax]

Function at 0x402c30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040eb20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040eb00]
test rbx, rbx
je 0x402c84
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402c7b
test rsi, rsi
je 0x402c7b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402c60
lea rcx, [0x0040eb20]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]