joyce8/EMBER2024-capa huggingface dataset:
Function at 0x368ad80f0
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x18]
mov qword [rax], 0
mov qword [rbp - 0x10], 0
mov dword [rbp - 8], 0
lea rax, [0x368ae1350]
mov qword [rbp - 0x20], rax
lea rax, [0x368ae1378]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
mov r9d, 1
mov r8d, 2
mov rdx, rax
mov ecx, 0
call fcn.368adb2ec
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x368ad81b4
lea r8, [rbp - 0x10]
mov ecx, dword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x10]
mov r9, r8
mov r8d, ecx
mov rcx, rax
call fcn.368ad8221
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x368ad81b7
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.368ad81df
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
je 0x368ad81ba
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x18]
mov qword [rax], rdx
mov dword [rbp - 4], 1
jmp 0x368ad81bb
nop
jmp 0x368ad81bb
nop
jmp 0x368ad81bb
nop
cmp dword [rbp - 4], 0
jne 0x368ad81d6
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x368ad81d6
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.368ada0a6
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x368ade1a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, rcx
lea rax, [rbp + 0x28]
mov ecx, 2
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call fcn.368adee40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rbp - 8]
mov ecx, 2
call fcn.368adee40
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x368ade210
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movsxd rsi, dword [0x368ae62e4]
mov rbx, rcx
test esi, esi
jle 0x368ade340
mov rax, qword [0x368ae62e8]
xor r9d, r9d
add rax, 0x18
nop dword [rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x368ade25b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x368ade2e3
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x368ade240
mov rcx, rbx
call fcn.368adeab0
mov rdi, rax
test rax, rax
je 0x368ade362
mov rax, qword [0x368ae62e8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.368adebf0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x368ae62e8]
lea rdx, [rbp - 0x30]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x368ade347
mov eax, dword [rbp - 0xc]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x368ade2dc
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x368ade2f0
add dword [0x368ae62e4], 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 2
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x368ae62e8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x368ade2dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.368ade1a0
nop word [rax + rax]
xor esi, esi
jmp 0x368ade268
mov rax, qword [0x368ae62e8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.368ade1a0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.368ade1a0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x368ade6e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, [0x368ae6320]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x368ae6300]
test rbx, rbx
je 0x368ade745
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rbx]
call r12
mov rsi, rax
call rdi
test rsi, rsi
je 0x368ade73c
test eax, eax
jne 0x368ade73c
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x368ade720
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x368adeab0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x368ae1990]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x368adead0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x368adead8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x368adead0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x368adeb2d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x368adeb24
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x368adead0
add rax, 0x28
cmp rax, r9
jne 0x368adeb10
xor eax, eax
ret

Function at 0x368adeb30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x368ae1990]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x368adeb4f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x368adeb58
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x368adeb4f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x368adebf0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x368ae1990]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x368adec0f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x368adec18
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001b88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bd2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bd4
xor al, al
add rsp, 0x28
ret
Function at 0x4157e8
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
xor r15d, r15d
cmp qword [0x004e30d8], r15
jne 0x41583f
lea rdx, [0x0047b0a0]
mov ecx, 0x200000
call fcn.0042267c
mov qword [0x004e30d8], rax
test rax, rax
je 0x415a32
mov word [rax], r15w
cmp qword [0x004ee5f0], r15
mov ebx, 4
jne 0x41586a
mov r9d, ebx
mov edx, 0x22000
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x004ee5f0], rax
lea r12, [0x004e1aa0]
mov rcx, r12
call fcn.00413bd4
call fcn.00414770
call fcn.00414c1c
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x88
call fcn.00424830
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, rax
lea r9, [0x004ee650]
lea rdx, [rbp - 0x60]
call fcn.00414e30
xor edx, edx
lea rcx, [rbp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.00424830
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x58]
call fcn.00424830
mov r8d, dword [0x004e1f20]
lea rcx, [rsp + 0x30]
mov rdx, qword [0x004e1f18]
add r8d, r8d
mov byte [rbp - 0x68], r15b
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
call fcn.00460ea4
mov r8d, ebx
lea rdx, [0x004e306c]
lea rcx, [rsp + 0x30]
call fcn.00460ea4
mov r8d, ebx
lea rdx, [0x004eeb20]
lea rcx, [rsp + 0x30]
call fcn.00460ea4
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415960
mov r8d, ebx
lea rdx, [rbp + 0x3c]
lea rcx, [rsp + 0x30]
call fcn.00460ea4
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x60]
call fcn.00415410
mov rcx, qword [0x004e30d8]
lea rdx, str.Filename____:
call fcn.00423b70
test rax, rax
je 0x415a28
lea rdx, [0x00490974]
mov rcx, rax
call fcn.00423b70
mov r14, rax
test rax, rax
je 0x415a28
lea rcx, [rsp + 0x30]
call fcn.00460f88
or rbx, 0xffffffffffffffff
cmp byte [rbp - 0x68], r15b
je 0x415a02
mov edi, r15d
lea rsi, [rbp - 0x78]
movzx r8d, byte [rsi]
lea ecx, [rdi + rdi]
mov eax, ecx
lea r9, [0x00486270]
add rax, 0xab8
mov dword [rsp + 0x20], r8d
mov edx, 0x27
mov r8, rbx
sub edx, ecx
lea rcx, [r12 + rax*2]
call fcn.004020a8
inc edi
inc rsi
cmp edi, 0x10
jb 0x4159c0
mov word [0x004e3050], r15w
jmp 0x415a0a
mov word [0x004e3010], r15w
lea rdx, [0x004e3010]
inc rbx
cmp word [rdx + rbx*2], r15w
jne 0x415a11
lea r8, [rbx + rbx]
lea rcx, [r14 + 2]
call fcn.00424180
lea rcx, [rsp + 0x30]
call fcn.00460e70
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x416220
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
test rdx, rdx
je 0x4164b8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x968]
sub rsp, 0xa68
xor r15d, r15d
mov r14, rdx
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x40], r15
lea esi, [r15 + 3]
mov rcx, r14
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or rbx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rbx
je 0x4164a9
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4162ac
cmp dword [rsp + 0x44], r15d
jne 0x416318
cmp dword [rsp + 0x40], 0x10000000
ja 0x416318
lea rax, [0x004e3010]
mov r8, rbx
mov qword [rsp + 0x30], rax
lea r9, [0x004942e8]
mov rax, qword [0x004e1cf8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov edx, 0x103
mov rax, qword [0x004e1ad8]
mov qword [rsp + 0x20], rax
call fcn.004020a8
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], esi
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, rbx
jne 0x416320
mov rcx, rdi
jmp 0x4164a3
mov r9d, 2
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x4c]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rbp + 0x9a0]
mov dword [rbp + 0x9b8], 0x50000
mov r8d, 4
mov dword [rsp + 0x48], eax
lea rdx, [rbp + 0x9b8]
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc rbx
cmp word [r14 + rbx*2], r15w
jne 0x41636b
inc ebx
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x9a0]
mov dword [rbp + 0x9a8], ebx
mov r8d, 4
lea rdx, [rbp + 0x9a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, r14
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.0042e77c
mov edx, dword [rbp + 0x9a8]
lea r8, [0x00489ec0]
add edx, edx
lea rcx, [rsp + 0x50]
call fcn.00460dac
mov r8d, dword [rbp + 0x9a8]
lea r9, [rbp + 0x9a0]
add r8d, r8d
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp + 0x9a0]
mov qword [rsp + 0x20], r15
mov r8d, 4
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, r15d
mov dword [rbp + 0x9b0], r15d
mov r14d, r15d
jmp 0x416471
mov r8d, dword [rbp + 0x9b0]
test r8d, r8d
je 0x416497
lea rcx, [rbp + 0x160]
mov edx, r8d
mov eax, r14d
lea r9, [0x00494300]
and eax, 0xf
inc r14d
add bl, byte [r9 + rax*4]
xor byte [rcx], bl
movsx ebx, byte [rcx]
inc rcx
sub rdx, 1
jne 0x416433
lea r9, [rbp + 0x9a0]
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x160]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp + 0x9b0]
mov qword [rsp + 0x20], r15
mov r8d, 0x800
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41641d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xa68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x453a68
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
xor ebx, ebx
movzx ebp, r9w
mov rdi, r8
mov rsi, rdx
test rdx, rdx
je 0x453b64
cmp word [rdx], bx
je 0x453b64
movzx r9d, bp
call fcn.00453928
test al, al
je 0x453ab2
mov al, 1
jmp 0x453b66
xorps xmm0, xmm0
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x60]
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x20]
mov dword [rsp + 0x2c], 6
xor edx, edx
mov rcx, rsi
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x453b64
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x453b64
mov rax, rcx
cmp dword [rax + 4], ebp
je 0x453b0f
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x453aff
jmp 0x453b5a
mov rdx, qword [rax + 0x20]
mov eax, 0x17
cmp bp, ax
jne 0x453b46
movups xmm0, xmmword [rdx + 8]
mov word [rdi], ax
movdqu xmmword [rdi + 8], xmm0
mov rax, qword [rdi + 8]
sub rax, qword [0x004bb158]
jne 0x453b41
mov rax, qword [rdi + 0x10]
sub rax, qword [0x004bb160]
test rax, rax
jmp 0x453b57
mov eax, dword [rdx + 4]
mov dword [rdi + 4], eax
mov eax, 2
mov word [rdi], ax
cmp dword [rdx + 4], ebx
setne bl
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov al, bl
jmp 0x453b66
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x45679c
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x128
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
lea rdx, [rsp + 0x20]
call fcn.0045811c
test al, al
je 0x4567ee
cmp byte [rsp + 0x20], 0x65
jne 0x4567cf
cmp byte [rsp + 0x21], 0x6e
jne 0x4567cf
cmp byte [rsp + 0x22], 0
je 0x4567ee
lea r9, [rsp + 0x20]
mov edx, 0x3f
lea r8, str._s_en
lea rcx, [0x004e1914]
call fcn.004090c0
jmp 0x456831
lea rcx, [0x004e1914]
mov edx, 0x3f
lea r8, [0x0048fcf8]
sub r8, rcx
lea rax, [rdx + 0x7fffffbf]
test rax, rax
je 0x456823
mov al, byte [r8 + rcx]
test al, al
je 0x456823
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x456804
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
add rsp, 0x128
ret
Function at 0x4595b8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x230]
mov rsi, rcx
xor edi, edi
test rbx, rbx
je 0x45962e
mov eax, dword [rbx + 4]
test eax, eax
je 0x459622
mov rcx, qword [rsi + 0x228]
xor r8d, r8d
mov rdx, qword [rbx + 0x10]
mov dword [rsp + 0x40], r8d
cmp rcx, 0xffffffffffffffff
je 0x45961a
test rdx, rdx
je 0x45961a
and qword [rsp + 0x20], r8
lea r9, [rsp + 0x40]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb r8d, r8d
and r8d, dword [rsp + 0x40]
mov eax, dword [rbx + 4]
cmp r8d, eax
jne 0x45962a
mov rbx, qword [rbx + 0x18]
add edi, eax
jmp 0x4595d3
xor eax, eax
jmp 0x459630
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x459b14
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0x240], 0
mov rdi, rcx
je 0x459c10
mov dword [rcx + 0x250], r8d
lea r14, [rcx + 0x248]
mov qword [r14], rdx
lea rbx, [rcx + 0x2dc]
test rdx, rdx
jne 0x459b5a
xor eax, eax
jmp 0x459b64
mov ecx, dword [rbx]
mov r8d, r8d
call fcn.0046387c
mov dword [rbx], eax
lea rsi, [rdi + 0x2ac]
cmp dword [rdi + 0x250], 0
jbe 0x459c0c
cmp dword [rdi + 0x268], 0
jne 0x459be1
mov rcx, qword [rdi + 0x228]
xor eax, eax
mov r8d, dword [rsi]
mov rdx, qword [rdi + 0x2d0]
mov dword [rsp + 0x40], eax
cmp rcx, 0xffffffffffffffff
je 0x459bc2
test rdx, rdx
je 0x459bc2
test r8d, r8d
je 0x459bc2
and qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [rsp + 0x40]
cmp eax, dword [rsi]
jne 0x459c10
mov rax, qword [rdi + 0x2d0]
and dword [rsi], 0
mov qword [rdi + 0x260], rax
mov dword [rdi + 0x268], 0x100000
mov rbx, qword [rdi + 0x270]
xor edx, edx
mov rcx, r14
call fcn.004670f0
mov ecx, dword [rdi + 0x270]
sub ecx, ebx
add dword [rsi], ecx
test eax, eax
je 0x459b6d
cmp eax, 2
sete al
jmp 0x459c12
mov al, 1
jmp 0x459c12
xor al, al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x45a284
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
movsxd rbx, r8d
test r8d, r8d
jle 0x45a2a8
mov r9d, eax
mov byte [rsp + r9 + 0x40], dl
inc r9
shr rdx, 8
cmp r9, rbx
jl 0x45a297
mov rcx, qword [rcx + 0x228]
mov dword [rsp + 0x50], eax
cmp rcx, 0xffffffffffffffff
je 0x45a2e0
test r8d, r8d
je 0x45a2e0
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8d, ebx
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x50]
mov eax, ecx
cmp eax, ebx
sete al
add rsp, 0x30
pop rbx
ret

Function at 0x45a2f4
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
movsxd rbx, r8d
test r8d, r8d
jle 0x45a317
mov r9d, eax
mov byte [rsp + r9 + 0x40], dl
inc r9
shr edx, 8
cmp r9, rbx
jl 0x45a307
mov rcx, qword [rcx + 0x228]
mov dword [rsp + 0x50], eax
cmp rcx, 0xffffffffffffffff
je 0x45a34f
test r8d, r8d
je 0x45a34f
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8d, ebx
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x50]
mov eax, ecx
cmp eax, ebx
sete al
add rsp, 0x30
pop rbx
ret
Function at 0x45b898
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x208
call fcn.00424830
xor r9d, r9d
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rbp - 0x60]
call fcn.00413960
test al, al
jne 0x45b9eb
call fcn.0040bf18
test al, al
je 0x45b9eb
and dword [rbp + 0x3d0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x3e0]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45b96c
mov rcx, qword [rbp + 0x3e0]
lea rax, [rbp + 0x3d8]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x3d0]
mov dword [rbp + 0x3d8], r9d
lea edx, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp + 0x3e0]
test eax, eax
jne 0x45b95d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45b96c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x3d0], 0
jne 0x45b9eb
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x70]
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x208
call fcn.00424830
lea rax, [rbp + 0x1b0]
mov dword [rsp + 0x30], WSAStartup
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1b0]
lea rax, [0x00486284]
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x50], rax
mov r8d, 0x103
lea rax, str.runas
xor ecx, ecx
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
sete al
jmp 0x45b9ed
mov al, 1
add rsp, 0x4c0
pop rbp
ret
Function at 0x45ca70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r15
sub rsp, 0x30
mov rbp, rcx
mov ebx, edx
xor ecx, ecx
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
lea r8, [0x00494a48]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x45cc4a
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp eax, 0x10
jbe 0x45cc4a
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x45cc4a
mov edx, ebx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x45cc4a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x45cc20
and qword [rsp + 0x50], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.00424180
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x45cc17
mov rbx, qword [rsp + 0x50]
lea ecx, [rax + 0x18]
call qword [sym.imp.gdiplus.dll_GdipAlloc]
mov rdi, rax
test rax, rax
je 0x45cb8b
and qword [rsp + 0x20], 0
lea rax, [0x00494a58]
lea rdx, [rsp + 0x20]
mov qword [rdi], rax
mov rcx, rbx
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [rdi + 0x10], eax
mov rax, qword [rsp + 0x20]
mov qword [rdi + 8], rax
jmp 0x45cb8d
xor edi, edi
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + select]
test rdi, rdi
je 0x45cc17
mov r9d, dword [rsp + 0x70]
lea rcx, [rbp + 0x48]
and qword [rsp + 0x28], 0
mov edx, 0x1e0
mov r8d, 0xfc
call fcn.0041b04c
test al, al
je 0x45cc0a
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x28]
mov rcx, qword [rdi + 8]
call qword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x45cbdd
mov dword [rdi + 0x10], eax
jmp 0x45cc0a
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x45cc0a
mov r8d, dword [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test rbx, rbx
je 0x45cc07
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r15b, 1
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r15b, r15b
je 0x45cc4a
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov dword [rbp + 0x58], eax
mov al, 1
mov dword [rbp + 0x5c], 0
mov byte [rbp + 0x60], 0
jmp 0x45cc4c
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r13
pop rdi
ret