joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4776cb
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
add rax, 8
mov ecx, dword [rax]
cmp ecx, 1
jle 0x4778d4
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
movzx eax, al
cmp eax, 0x22
jne 0x4778d4
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 1
mov r11, rax
lea r10, [rsp + 0x20]
mov rcx, r10
mov rdx, r11
call fcn.004376f3
movzx eax, al
cmp eax, 0x22
je 0x4778d4
lea rax, [0x0050c66b]
mov qword [rbp - 0x88], rax
mov eax, 1
mov dword [rbp - 0x80], eax
mov eax, 1
mov dword [rbp - 0x7c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0xfe10
mov dword [rbp - 0x68], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x64]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x10
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
lea rax, [rbp - 0x60]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [0x0050c66d]
mov qword [rbp - 0x98], rax
mov eax, 1
mov dword [rbp - 0x90], eax
mov eax, 1
mov dword [rbp - 0x8c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x98]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov dword [rbp - 0x38], eax
movabs rax, 0xc
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x34]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x78]
mov r8, rax
mov eax, 2
mov r11, rax
lea rax, [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043dca9
jmp 0x4778dd
mov rax, qword [rbp + 0x10]
jmp 0x4778e1
lea rax, [rbp - 0x28]
mov ecx, 0x10
mov r8, rcx
mov r11, rax
lea rcx, [rbp - 0x18]
mov r10, rcx
mov qword [rbp - 0xa0], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
cmp eax, 0xffffffff
jne 0x477953
call fcn.004786ee
mov eax, dword [rbp - 4]
leave
ret
Function at 0x4792db
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, str.___
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0050c707]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004306c0
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
jne 0x479422
mov eax, 0
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x479453
mov eax, dword [rbp - 0x44]
and eax, 0x10
cmp eax, 0
je 0x479442
mov eax, 1
mov byte [rbp - 0x46], al
movzx eax, byte [rbp - 0x46]
jmp 0x479453
mov eax, 0
mov byte [rbp - 0x47], al
movzx eax, byte [rbp - 0x47]
jmp 0x479453
leave
ret
Function at 0x4792e6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, str.___
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0050c707]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004306c0
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
jne 0x479422
mov eax, 0
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x479453
mov eax, dword [rbp - 0x44]
and eax, 0x10
cmp eax, 0
je 0x479442
mov eax, 1
mov byte [rbp - 0x46], al
movzx eax, byte [rbp - 0x46]
jmp 0x479453
mov eax, 0
mov byte [rbp - 0x47], al
movzx eax, byte [rbp - 0x47]
jmp 0x479453
leave
ret
Function at 0x479455
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x0050c709]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0050c70b]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004306c0
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
je 0x47959d
mov eax, dword [rbp - 0x44]
and eax, 0x400
cmp eax, 0
jne 0x4795a4
mov eax, 0
jmp 0x4795a9
mov eax, 1
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4795b5
leave
ret
Function at 0x479460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x0050c709]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0050c70b]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004306c0
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
je 0x47959d
mov eax, dword [rbp - 0x44]
and eax, 0x400
cmp eax, 0
jne 0x4795a4
mov eax, 0
jmp 0x4795a9
mov eax, 1
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4795b5
leave
ret

Function at 0x4795b7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 4], al
mov eax, 0
mov byte [rbp - 3], al
mov eax, 2
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, 0xffffffff
je 0x479671
mov eax, dword [rbp - 8]
and eax, 0x10
cmp eax, 0
je 0x479657
mov eax, 1
mov byte [rbp - 2], al
mov eax, dword [rbp - 8]
and eax, 0x400
cmp eax, 0
je 0x479671
mov eax, 1
mov byte [rbp - 1], al
movsx eax, word [rbp - 2]
leave
ret
Function at 0x4795c2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 4], al
mov eax, 0
mov byte [rbp - 3], al
mov eax, 2
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.0043f09a
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, 0xffffffff
je 0x479671
mov eax, dword [rbp - 8]
and eax, 0x10
cmp eax, 0
je 0x479657
mov eax, 1
mov byte [rbp - 2], al
mov eax, dword [rbp - 8]
and eax, 0x400
cmp eax, 0
je 0x479671
mov eax, 1
mov byte [rbp - 1], al
movsx eax, word [rbp - 2]
leave
ret
Function at 0x48a17f
Capabilities:
Get hostname

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rbp + 0x10], rcx
mov eax, 0
mov word [rbp - 0x1fe], ax
movabs rax, 0x1fc
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1fc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0xff
mov dword [rbp - 0x204], eax
lea rax, [rbp - 0x204]
mov r11, rax
lea rax, [rbp - 0x1fe]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetComputerNameW
mov byte [rbp - 0x205], al
movzx eax, byte [rbp - 0x205]
cmp eax, 0
jne 0x48a271
call sub.kernel32.dll_GetLastError
mov r11, rax
lea rax, [rbp - 0x228]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00487fa7
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x228]
mov r11, rax
lea rax, [rbp - 0x218]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x218]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x48a2db
lea rax, [rbp - 0x1fe]
mov r11, rax
lea rax, [rbp - 0x248]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043f1a1
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x248]
mov r11, rax
lea rax, [rbp - 0x238]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x238]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x48dead
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x48deb8
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x48deed
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
add rax, 0x10
mov ecx, dword [rax]
mov r11, rcx
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GenerateConsoleCtrlEvent
mov eax, 0x14
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x48def8
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
add rax, 0x10
mov ecx, dword [rax]
mov r11, rcx
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GenerateConsoleCtrlEvent
mov eax, 0x14
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret
Function at 0x48e7d9
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10f0
call fcn.00508718
nop
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x48e872
lea rax, [0x0050cf56]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x48eabf
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x48e89e
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x48e8bc
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x48e92c
lea rax, [0x0050cf57]
mov qword [rbp - 0x50], rax
mov eax, 0
mov dword [rbp - 0x48], eax
mov eax, 1
mov dword [rbp - 0x44], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x50]
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x48eabf
mov eax, 0
mov dword [rbp - 0x54], eax
mov eax, 0
mov byte [rbp - 0x1054], al
movabs rax, 0xfff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1053]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x400
mov r11, rax
lea rax, [rbp - 0x1098]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00407471
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x1098]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov byte [rbp - 0x1099], al
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x54]
mov r9, rax
mov eax, 0x3e8
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
mov byte [rbp - 0x1099], al
mov eax, dword [rbp - 0x54]
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00407571
movzx eax, byte [rbp - 0x1099]
cmp eax, 0
je 0x48ea39
mov eax, dword [rbp - 0x54]
cmp eax, 0
jne 0x48ea3e
jmp 0x48ea43
jmp 0x48e9ad
lea rax, [rbp - 0x1078]
mov r11, rax
lea rax, [rbp - 0x10c0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00407f50
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10c0]
mov r11, rax
lea rax, [rbp - 0x10b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
call fcn.00408143
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10b0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x48e7e4
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10f0
call fcn.00508718
nop
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x48e872
lea rax, [0x0050cf56]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x48eabf
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x48e89e
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x48e8bc
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x48e92c
lea rax, [0x0050cf57]
mov qword [rbp - 0x50], rax
mov eax, 0
mov dword [rbp - 0x48], eax
mov eax, 1
mov dword [rbp - 0x44], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x50]
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x48eabf
mov eax, 0
mov dword [rbp - 0x54], eax
mov eax, 0
mov byte [rbp - 0x1054], al
movabs rax, 0xfff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1053]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x400
mov r11, rax
lea rax, [rbp - 0x1098]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00407471
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x1098]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov byte [rbp - 0x1099], al
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x54]
mov r9, rax
mov eax, 0x3e8
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
mov byte [rbp - 0x1099], al
mov eax, dword [rbp - 0x54]
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00407571
movzx eax, byte [rbp - 0x1099]
cmp eax, 0
je 0x48ea39
mov eax, dword [rbp - 0x54]
cmp eax, 0
jne 0x48ea3e
jmp 0x48ea43
jmp 0x48e9ad
lea rax, [rbp - 0x1078]
mov r11, rax
lea rax, [rbp - 0x10c0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00407f50
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10c0]
mov r11, rax
lea rax, [rbp - 0x10b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
call fcn.00408143
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10b0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x49c6ca
Capabilities:
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x380
mov eax, 0
mov word [rbp - 0x330], ax
mov eax, 0
mov word [rbp - 0x32e], ax
movabs rax, 0xc
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x32c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov byte [rbp - 0x320], al
movabs rax, 0x100
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x31f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov byte [rbp - 0x21f], al
movabs rax, pe_nt_image_headers64
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x21e]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov word [rbp - 0x32c], ax
mov eax, 0
mov word [rbp - 0x32a], ax
movabs rax, 0
mov qword [rbp - 0x328], rax
movabs rax, 6
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x19e]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x198
mov r8, rax
lea rax, [rbp - 0x330]
mov r11, rax
lea rax, [rbp - 0x198]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rbp - 0x198]
mov r11, rax
mov eax, 0x202
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ws2_32.dll_WSAStartup
mov dword [rbp - 0x334], eax
mov eax, dword [rbp - 0x334]
cmp eax, 0
je 0x49c883
lea rax, str.socket:_WSAStartup_failed
mov qword [rbp - 0x348], rax
mov eax, 0x19
mov dword [rbp - 0x340], eax
mov eax, 1
mov dword [rbp - 0x33c], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x348]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00421fc8
leave
ret