joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bdb0
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
sub rsp, 0x648
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov r12, rcx
call qword [sym.imp.USER32.dll_GetParent]
xor edi, edi
test rax, rax
mov rbp, rax
je 0x48bdfd
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
mov rsi, rax
jmp 0x48be00
mov rsi, rdi
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, r12
mov word [rsp + 0x20], di
mov word [rsp + 0x220], di
mov word [rsp + 0x420], di
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [rsp + 0x20]
lea rcx, str.HwndWrapper
mov r8d, 0xb
call fcn.00494140
mov ecx, 0x4000
test eax, eax
cmove edi, ecx
test rbp, rbp
je 0x48be82
lea rdx, [rsp + 0x220]
mov r8d, 0x100
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetClassNameW]
test rsi, rsi
je 0x48be82
lea rdx, [rsp + 0x420]
mov r8d, 0x100
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClassNameW]
cmp qword [str._WwB], 0
mov qword [rsp + 0x658], rbx
lea rbx, str._WwB
je 0x48bf00
nop
nop
bt dword [rbx + 8], 8
jae 0x48bec0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x48c00e
bt dword [rbx + 8], 9
jae 0x48bee0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x48c00e
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x48c00e
add rbx, 0x10
cmp qword [rbx], 0
jne 0x48bea0
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, r12
mov word [rsp + 0x20], 0
mov word [rsp + 0x220], 0
mov word [rsp + 0x420], 0
call qword [sym.imp.USER32.dll_GetWindowTextW]
test rbp, rbp
je 0x48bf67
lea rdx, [rsp + 0x220]
mov r8d, 0x100
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
test rsi, rsi
je 0x48bf67
lea rdx, [rsp + 0x420]
mov r8d, 0x100
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp qword [str.Mouse_Data], 0
lea rbx, str.Mouse_Data
je 0x48bfcc
bt dword [rbx + 8], 8
jae 0x48bf94
mov rcx, qword [rbx]
lea rdx, [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x48c00e
bt dword [rbx + 8], 9
jae 0x48bfb0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x48c00e
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x48c00e
add rbx, 0x10
cmp qword [rbx], 0
jne 0x48bf78
mov eax, edi
mov r12, qword [rsp + 0x638]
mov rdi, qword [rsp + 0x640]
mov rsi, qword [rsp + 0x668]
mov rbp, qword [rsp + 0x660]
mov rbx, qword [rsp + 0x658]
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x648
ret
mov eax, dword [rbx + 8]
or eax, edi
jmp 0x48bfce
Function at 0x48c5c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x20], r9d
mov rax, rsp
sub rsp, 0xa8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov esi, r9d
mov rbx, r8
movzx r8d, dx
xor r9d, r9d
lea rdx, [0x004e0688]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x48c7ef
xor r15d, r15d
mov dword [rsp + 0x50], r15d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x58], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x004e0680]
call fcn.004be630
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.004bd660
mov qword [rsp + 0x38], rax
lea r8, [0x0048c410]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.004c3840
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004bd940
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004be7c0
movzx r11d, al
sub r11d, 2
je 0x48c6d7
cmp r11d, 1
jne 0x48c6ec
mov rcx, qword [rsp + 0x30]
call fcn.004bed50
lea r8d, [r15 + 0x10]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004be770
test eax, eax
jne 0x48c6ec
mov edx, 0xff
lea r8d, [r15 + 1]
mov rcx, qword [rsp + 0x30]
call fcn.004be800
jmp 0x48c6ec
mov edx, 0xff
mov r8d, 1
mov rcx, qword [rsp + 0x30]
call fcn.004be800
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004bdd60
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004be790
mov r14d, eax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004be7a0
mov r13d, eax
mov edi, eax
mov eax, 8
mul r13
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.0048efe0
mov rbp, rax
test r13d, r13d
je 0x48c76e
lea r12d, [r14*4]
mov rbx, rax
mov rsi, r13
mov rcx, r12
call fcn.0048efe0
mov qword [rbx], rax
add rbx, 8
sub rsi, 1
jne 0x48c752
mov esi, dword [rsp + 0xc8]
mov rdx, rbp
mov rcx, qword [rsp + 0x30]
call fcn.004be260
mov ecx, SafeArrayAllocDescriptor
call fcn.004910b0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x48c7b2
mov ecx, dword [rsp + 0xd0]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], esi
mov r9d, r13d
mov r8d, r14d
mov rdx, rbp
mov rcx, rax
call fcn.0048e510
mov r15, rax
test r13d, r13d
je 0x48c7d2
mov rbx, rbp
nop
nop
mov rcx, qword [rbx]
call fcn.00491a30
add rbx, 8
sub rdi, 1
jne 0x48c7c0
mov rcx, rbp
call fcn.00491a30
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.004be650
mov rax, r15
mov rbx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
add rsp, 0xa8
ret
Function at 0x48ea0c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.00491ae0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x00400000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.00491ae0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x48ea9f
cmp dword [rsp + 0x24], 5
jb 0x48eab9
jmp 0x48eab5
cmp dword [rsp + 0x30], esi
jne 0x48eab9
cmp dword [rsp + 0x24], 4
ja 0x48eab5
jne 0x48eab9
cmp dword [rsp + 0x28], 0
jbe 0x48eab9
mov byte [rbx + 0x18], sil
lea rax, [0x004e07b8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.0048e84c
movzx ecx, byte [0x0050cb68]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x0050cb68], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004902e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x490eb0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x0050d278]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.0049ef10
test rax, rax
je 0x490f04
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x490f99
mov ecx, 2
call fcn.0049f630
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.00491ae0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x490f85
test ebx, ebx
jne 0x490f85
lea ecx, [rax + 2]
call fcn.0049f630
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x490fc0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5b8
mov rcx, qword [0x0050d278]
call fcn.0049ef10
test rax, rax
je 0x490ff5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
add rsp, 0x5b8
ret
mov ecx, 2
mov qword [rsp + 0x5b0], rbx
call fcn.0049f630
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.00491ae0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x49107e
test ebx, ebx
jne 0x49107e
lea ecx, [rax + 2]
call fcn.0049f630
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x5b8
ret

Function at 0x4955f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [0x0050d2a0]
call fcn.0049ef10
test rbp, rbp
mov rdi, rax
jne 0x49563e
call fcn.0049aa50
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbp
mov dword [rax], 0x16
call fcn.00490eb0
lea eax, [rbp + 0x16]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rax, rax
mov qword [rsp + 0x40], rbx
mov dword [rbp], 0
mov qword [rsp + 0x48], r12
jne 0x49570d
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r12, rax
jne 0x495696
call fcn.0049aa50
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r12
mov dword [rax], 0x16
call fcn.00490eb0
lea eax, [r12 + 0x16]
jmp 0x495731
lea rdx, [0x004e1bc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
jne 0x4956e8
call fcn.0049aa50
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0049aa00
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rbx], eax
call fcn.00490eb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0049aa00
jmp 0x495731
mov rcx, rax
call fcn.0049ed50
mov rbx, rax
call fcn.0049ee20
xchg qword [0x0050d2a0], rbx
cmp rbx, rax
je 0x49570d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, 4
mov rcx, rbp
call rdi
test eax, eax
jne 0x49572f
call fcn.0049aa50
mov dword [rax], 0xc
call fcn.0049aa50
mov eax, dword [rax]
jmp 0x495731
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x498d10
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x498d37
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x498d37
mov ecx, eax
call fcn.0049aab0
or eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x498fd0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x49903d
cmp dword [0x0050d380], 1
jne 0x49901f
call fcn.0049fb90
mov ecx, 0x12
call fcn.0049f950
mov ecx, 0xff
call fcn.0049dec0
mov eax, 0xff
jmp 0x49926c
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x49906e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x49926c
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x4990a0
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x0050d394], r13d
mov dword [0x0050d39c], eax
mov dword [0x0050d3a0], esi
mov dword [0x0050d3a4], r12d
mov dword [0x0050d398], edi
cmp word [0x00400000], 0x5a4d
jne 0x499132
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x4990f7
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x499142
cmp word [rax + 0x18], 0x20b
je 0x49910a
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x499142
cmp dword [rax + 0x84], 0xe
ja 0x49911e
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x499142
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xc0], ebx
jmp 0x499142
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
lea rdi, [0x00400000]
mov ecx, 1
call fcn.004a6b80
test eax, eax
jne 0x499172
cmp dword [0x0050d380], 1
jne 0x49915e
call fcn.0049fb90
mov ecx, 0x1c
call fcn.0049f950
mov ecx, 0xff
call fcn.0049dec0
call fcn.0049f410
test eax, eax
jne 0x49919d
cmp dword [0x0050d380], 1
jne 0x499189
call fcn.0049fb90
mov ecx, 0x10
call fcn.0049f950
mov ecx, 0xff
call fcn.0049dec0
call fcn.004aeb30
nop
call fcn.004a9250
test eax, eax
jns 0x4991b6
mov ecx, 0x1b
call fcn.0049de90
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x0050f3c8], rax
call fcn.004ae960
mov qword [0x0050d370], rax
call fcn.004ae850
test eax, eax
jns 0x4991e2
mov ecx, 8
call fcn.0049de90
call fcn.004ae4c0
test eax, eax
jns 0x4991f5
mov ecx, 9
call fcn.0049de90
mov ecx, 1
call fcn.0049e000
test eax, eax
je 0x49920a
mov ecx, eax
call fcn.0049de90
call fcn.004ae430
test byte [rsp + 0x6c], 1
je 0x49921e
movzx r9d, word [rsp + 0x70]
jmp 0x499224
mov r9d, 0xa
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.004589b0
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x499242
mov ecx, eax
call fcn.0049e210
call fcn.0049e230
jmp 0x499263
mov eax, edi
jmp 0x49926c
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.00692000
add rsp, 0x28
jmp 0x498fd0
Function at 0x49eca7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00507af8]
jne 0x4902fa
rol rcx, 0x10
test cx, 0xffff
jne 0x4902f6
repz ret
ror rcx, 0x10
jmp 0x49ec00
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0050d4b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0050d5a8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x49ec85
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0050d4b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x49eca7
mov rax, qword [rsp + 0x88]
mov qword [0x0050d5a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0050d548], rax
mov rax, qword [0x0050d5a8]
mov qword [0x0050d420], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0050d530], rax
mov dword [0x0050d410], 0xc0000409
mov dword [0x0050d414], 1
mov rax, qword [0x00507af8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00507b00]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0050d4a8], eax
mov ecx, 1
call fcn.0049f630
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004e25c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0050d4a8], 0
jne 0x49ed2e
mov ecx, 1
call fcn.0049f630
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x49f950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x49f98e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x49f970
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x49fb75
mov ecx, 3
call fcn.004b1e90
cmp eax, 1
je 0x49fb2c
mov ecx, 3
call fcn.004b1e90
test eax, eax
jne 0x49f9c5
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x49fb2c
cmp edi, 0xfc
je 0x49fb75
mov qword [rsp + 0x50], rbp
lea rbp, [0x0050d990]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.0049f580
test eax, eax
je 0x49fa09
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.00490dd0
lea rdx, [0x0050d9a9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x0050daad], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x49fa59
lea r8, str._program_name_unknown_
lea rcx, [0x0050d9a9]
mov edx, 0x2fb
call fcn.0049f580
test eax, eax
je 0x49fa59
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.00490dd0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x0050d9a9]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x49faa8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x0050dca4]
lea r9d, [rax + 3]
lea r8, [0x004e2bb4]
sub rdx, rcx
call fcn.004ad720
test eax, eax
je 0x49faa8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.00490dd0
lea r8, [0x004e2bb0]
mov edx, 0x314
mov rcx, rbp
call fcn.004b0590
test eax, eax
je 0x49fad4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.00490dd0
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.004b0590
test eax, eax
je 0x49fb04
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.00490dd0
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.004b1c30
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x49fb75
cmp rax, 0xffffffffffffffff
je 0x49fb75
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x49fb90
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.004b1e90
cmp eax, 1
je 0x49fbc2
mov ecx, 3
call fcn.004b1e90
test eax, eax
jne 0x49fc76
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x49fc76
mov qword [rsp + 0x48], rbx
lea rbx, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x49fbee
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x49fbd8
jmp 0x49fc62
cmp edi, 0x17
jae 0x49fc62
mov ecx, 3
call fcn.004b1e90
cmp eax, 1
je 0x49fc19
mov ecx, 3
call fcn.004b1e90
test eax, eax
jne 0x49fc62
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x49fc62
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x49fc62
cmp rax, 0xffffffffffffffff
je 0x49fc62
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.0049f950
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x4adcd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x0050df50]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x4add2c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x4add0c
mov dword [0x0050df50], 1
jmp 0x4add3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4add26
mov dword [0x0050df50], 2
jmp 0x4adda9
mov eax, dword [0x0050df50]
cmp eax, 1
jne 0x4adda0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x4add7a
cmp word [rdi], bp
mov rax, rdi
je 0x4add59
add rax, 2
cmp word [rax], bp
jne 0x4add47
add rax, 2
cmp word [rax], bp
jne 0x4add47
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.0049a7d0
test rax, rax
mov rbx, rax
jne 0x4add81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4ade9b
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.00493e00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x4ade9b
cmp eax, 2
je 0x4adda9
test eax, eax
jne 0x4add7a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x4add7a
cmp byte [rax], bpl
mov rbx, rax
je 0x4addf8
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4add7a
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x4addc0
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.0049a840
test rax, rax
mov r12, rax
jne 0x4ade1d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x4ade9b
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x4ade85
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4adeae
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x4ade30
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.00494180
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x4ade96