joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d3d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
xor esi, esi
test rdx, rdx
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rbp, r9
mov rbx, r8
mov r13d, esi
mov r12, rdx
je 0x49d5bf
test r8, r8
je 0x49d5bf
test r9, r9
je 0x49d5bf
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x40], r15
test rcx, rcx
lea r15, [rsi - 1]
je 0x49d56d
mov rdi, qword [rsp + 0xb8]
mov r13d, dword [r9]
mov qword [r11 - 0x58], rcx
test rdi, rdi
je 0x49d46b
lea rax, [r11 - 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov qword [r11 - 0x68], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d56d
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x98]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rdi, rdi
mov r14d, eax
je 0x49d4a1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x98]
cmp ecx, 2
jne 0x49d51f
mov eax, 2
mul r13
cmovo rax, r15
mov rcx, rax
call fcn.004a5e00
test rax, rax
mov r12, rax
je 0x49d518
mov r8d, r13d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
mov rdx, r12
sub rcx, r12
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x49d4e1
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov dword [rbp], ecx
mov rcx, r12
call fcn.004a6f90
mov ecx, dword [rsp + 0x98]
jmp 0x49d51f
mov ecx, dword [rsp + 0x98]
test r14d, r14d
mov r14, qword [rsp + 0x50]
jne 0x49d56d
cmp ecx, 1
je 0x49d538
cmp ecx, 7
je 0x49d538
cmp ecx, 2
jne 0x49d53d
mov esi, 1
mov eax, esi
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x49d5bb
xor eax, eax
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
add ecx, ecx
cmp ecx, r13d
ja 0x49d53f
sub rbx, rdx
nop
nop
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rbx + rdx - 2], ax
jne 0x49d5a0
mov dword [rbp], ecx
mov eax, 1
jmp 0x49d53f
xor eax, eax
jmp 0x49d53f
xor eax, eax
jmp 0x49d549
Function at 0x49d5d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
xor ebx, ebx
test rdx, rdx
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov rdi, r9
mov rsi, r8
mov r13, rdx
mov r12d, ebx
je 0x49d6b7
test r8, r8
je 0x49d6b7
test r9, r9
je 0x49d6b7
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x49d698
cmp qword [rsp + 0x98], rbx
mov r12d, dword [r9]
mov qword [r11 - 0x38], rcx
je 0x49d656
mov rdx, qword [rsp + 0x98]
lea rax, [r11 - 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [r11 - 0x48], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d698
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp qword [rsp + 0x98], rbx
mov edi, eax
je 0x49d688
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x49d698
cmp dword [rsp + 0x78], 3
sete bl
mov eax, ebx
jmp 0x49d6b9
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x49d6b7
mov r8d, r12d
mov rcx, rsi
call fcn.004aaf50
mov eax, 1
jmp 0x49d6b9
xor eax, eax
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret

Function at 0x49d6e0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
test rcx, rcx
mov qword [r11 - 0x20], r12
mov rsi, r9
mov r12d, r8d
mov rbp, rdx
je 0x49d7cf
test rdx, rdx
je 0x49d7cf
test r9, r9
je 0x49d7cf
mov qword [r11 - 8], rbx
xor ebx, ebx
mov qword [r11 - 0x38], rcx
cmp qword [rsp + 0xb8], rbx
je 0x49d790
mov rdx, qword [rsp + 0xb8]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x38]
xor r8d, r8d
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x49d78b
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x88
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0xb0]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rsp + 0xb8], rbx
mov esi, eax
je 0x49d7c6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x49d76c
xor eax, eax
jmp 0x49d774
Function at 0x49d7e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
sub rsp, 0x488
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
xor ebx, ebx
test r8, r8
mov qword [r11 - 0x10], rsi
mov rbp, rdx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x50], rcx
mov qword [r11 - 0x18], rdi
mov rsi, r8
je 0x49d8f6
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x49d8f6
lea rax, [rsp + 0x48]
mov r9d, 0x10008
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d8f6
nop
nop
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov edi, eax
je 0x49d8d4
test eax, eax
jne 0x49d8e2
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
call fcn.0049d7e0
mov edi, 0x3f2
test eax, eax
cmovne edi, ebx
test edi, edi
je 0x49d870
jmp 0x49d8e2
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete bl
mov eax, ebx
jmp 0x49d8f8
xor eax, eax
mov rdi, qword [rsp + 0x470]
mov rsi, qword [rsp + 0x478]
mov rbp, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x488
ret

Function at 0x49d940
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [rsp + 0x80]
mov dword [r9], r8d
mov r8, qword [rsp + 0x88]
mov dword [r8], eax
mov qword [rsp + 0x38], r8
mov r10, rdx
mov edx, dword [rcx + 0x1c]
xor ebx, ebx
mov r8, r10
lea eax, [rdx + 1]
mov dword [rcx + 0x1c], eax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x49d9b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub rsp, 0x28
mov r10, rdx
mov edx, dword [rcx + 0x1c]
mov r9d, r8d
lea eax, [rdx + 1]
mov r8, r10
mov dword [rcx + 0x1c], eax
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x49dc20
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov r11, rsp
sub rsp, 0x78
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
test rcx, rcx
mov qword [r11 - 0x18], rdi
mov rsi, rdx
mov rdi, r9
je 0x49dcd7
test rdx, rdx
je 0x49dcd7
xor ebx, ebx
test r9, r9
mov qword [r11 - 0x28], rcx
je 0x49dc97
lea rax, [r11 + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x28]
mov rdx, rdi
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x49dcd9
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x90]
mov r9d, 4
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
mov esi, eax
je 0x49dcd0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
jmp 0x49dcd9
xor ebx, ebx
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x49de50
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [0x00527f9c], 0
jne 0x49dfb0
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call fcn.004a8900
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49dfb0
mov eax, dword [rsp + 0x30]
cmp eax, 1
jne 0x49defa
cmp dword [rsp + 0x24], 4
jne 0x49dfa6
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x49dece
mov dword [0x00527f98], 2
jmp 0x49dfa6
cmp eax, 0xa
jne 0x49dee2
mov dword [0x00527f98], 3
jmp 0x49dfa6
cmp eax, 0x5a
jne 0x49dfa6
mov dword [0x00527f98], 4
jmp 0x49dfa6
cmp eax, 2
jne 0x49dfa6
mov edx, dword [rsp + 0x24]
cmp edx, 4
jne 0x49df1b
mov dword [0x00527f98], 5
jmp 0x49dfa6
cmp edx, 5
jne 0x49df56
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x49df34
mov dword [0x00527f98], 6
jmp 0x49dfa6
cmp eax, 1
jne 0x49df45
mov dword [0x00527f98], 7
jmp 0x49dfa6
cmp eax, 2
jne 0x49df80
mov dword [0x00527f98], 8
jmp 0x49dfa6
cmp edx, 6
jne 0x49df8f
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x49df6f
mov dword [0x00527f98], 9
jmp 0x49dfa6
cmp eax, 1
jne 0x49df80
mov dword [0x00527f98], 0xa
jmp 0x49dfa6
jbe 0x49dfa6
mov ecx, 0xb
mov dword [0x00527f98], ecx
jmp 0x49dfa6
mov eax, dword [0x00527f98]
mov ecx, 0xb
cmp edx, 6
cmova eax, ecx
mov dword [0x00527f98], eax
mov dword [0x00527f9c], 1
mov eax, dword [0x00527f98]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x158
ret
Function at 0x49e370
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x308
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov qword [r11 + 0x20], rbx
lea r9, [r11 - 0x228]
mov qword [r11 - 8], rdi
mov rbx, r8
mov edi, edx
sub r9, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [r9 + rcx - 2], ax
jne 0x49e3b0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.004a8900
test rbx, rbx
lea rax, [rsp + 0x50]
cmovne rax, rbx
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
mov word [rsp + 0xb0], di
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rdi, qword [rsp + 0x300]
mov rbx, qword [rsp + 0x328]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x308
ret
Function at 0x49eee0
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rbx, rcx
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov edx, eax
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test rdi, rdi
mov rbx, qword [rsp + 0x30]
je 0x49ef46
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, ebp
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x49f270
Capabilities:
Get session user name

Disassembly:
mov r11, rsp
sub rsp, 0x288
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov dword [rcx], 1
mov rsi, rcx
lea rcx, [rsp + 0x62]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], bx
call fcn.004a8900
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x49f39e
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.00438d90
cmp qword [rax + 0x20], 8
jb 0x49f2f7
mov rdx, qword [rax + 8]
jmp 0x49f2fb
lea rdx, [rax + 8]
xor ecx, ecx
lea r9, [rsp + 0x20]
mov qword [rsp + 0x2a8], rdi
lea r8d, [rcx + 1]
call sub.NETAPI32.dll_NetUserGetInfo
cmp qword [rsp + 0x58], 8
mov edi, eax
jb 0x49f327
mov rcx, qword [rsp + 0x40]
call fcn.004a6f90
test edi, edi
je 0x49f37d
lea r8, [rsp + 0x28]
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x28], rbx
call sub.NETAPI32.dll_NetWkstaUserGetInfo
test eax, eax
mov edi, eax
jne 0x49f363
mov rcx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
lea r8d, [rax + 1]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x18]
call sub.NETAPI32.dll_NetUserGetInfo
mov edi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x49f372
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x49f37d
mov rcx, qword [rsp + 0x20]
jmp 0x49f38c
mov rcx, qword [rsp + 0x20]
mov ebx, 1
mov eax, dword [rcx + 0x14]
mov dword [rsi], eax
test rcx, rcx
mov rdi, qword [rsp + 0x2a8]
je 0x49f39e
call sub.NETAPI32.dll_NetApiBufferFree
mov rsi, qword [rsp + 0x2a0]
mov eax, ebx
mov rbx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x288
ret
Function at 0x4a2d90
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbx, rcx
xor edx, edx
add rcx, 0x38
mov r8d, 0x840
mov qword [rsp + 0x48], rdi
call fcn.004a8900
xor edi, edi
lea rcx, str.DXVA2.DLL
mov dword [rbx + 0x878], edi
mov dword [rbx + 0x87c], edi
mov dword [rbx + 0x880], edi
mov dword [rbx + 0x884], edi
mov dword [rbx + 0x888], edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 8], rax
je 0x4a2eb7
lea rdx, str.GetNumberOfPhysicalMonitorsFromHMONITOR
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.GetPhysicalMonitorsFromHMONITOR
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.DestroyPhysicalMonitors
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.GetMonitorBrightness
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.SetMonitorBrightness
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
mov qword [rbx + 0x30], rax
je 0x4a2e74
cmp qword [rbx + 0x18], rdi
je 0x4a2e74
cmp qword [rbx + 0x20], rdi
je 0x4a2e74
cmp qword [rbx + 0x28], rdi
je 0x4a2e74
test rax, rax
jne 0x4a2eb7
test rcx, rcx
je 0x4a2e7d
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], rdi
je 0x4a2e87
mov qword [rbx + 0x18], rdi
cmp qword [rbx + 0x20], rdi
je 0x4a2e91
mov qword [rbx + 0x20], rdi
cmp qword [rbx + 0x28], rdi
je 0x4a2e9b
mov qword [rbx + 0x28], rdi
test rax, rax
je 0x4a2ea4
mov qword [rbx + 0x30], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x4a2eb7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 8], rdi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x4a3530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x20], r9d
mov rax, rsp
sub rsp, 0xa8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
mov esi, r9d
mov rbx, r8
movzx r8d, dx
xor r9d, r9d
lea rdx, [0x004f8790]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x4a375f
xor r15d, r15d
mov dword [rsp + 0x50], r15d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x58], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x004f8788]
call fcn.004d5d20
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.004d4d50
mov qword [rsp + 0x38], rax
lea r8, [0x004a3380]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.004daf30
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004d5030
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004d5eb0
movzx r11d, al
sub r11d, 2
je 0x4a3647
cmp r11d, 1
jne 0x4a365c
mov rcx, qword [rsp + 0x30]
call fcn.004d6440
lea r8d, [r15 + 0x10]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004d5e60
test eax, eax
jne 0x4a365c
mov edx, 0xff
lea r8d, [r15 + 1]
mov rcx, qword [rsp + 0x30]
call fcn.004d5ef0
jmp 0x4a365c
mov edx, 0xff
mov r8d, 1
mov rcx, qword [rsp + 0x30]
call fcn.004d5ef0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004d5450
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004d5e80
mov r14d, eax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.004d5e90
mov r13d, eax
mov edi, eax
mov eax, 8
mul r13
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.004a5e00
mov rbp, rax
test r13d, r13d
je 0x4a36de
lea r12d, [r14*4]
mov rbx, rax
mov rsi, r13
mov rcx, r12
call fcn.004a5e00
mov qword [rbx], rax
add rbx, 8
sub rsi, 1
jne 0x4a36c2
mov esi, dword [rsp + 0xc8]
mov rdx, rbp
mov rcx, qword [rsp + 0x30]
call fcn.004d5950
mov ecx, SafeArrayAllocDescriptor
call fcn.004a7ed0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x4a3722
mov ecx, dword [rsp + 0xd0]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], esi
mov r9d, r13d
mov r8d, r14d
mov rdx, rbp
mov rcx, rax
call fcn.004a5480
mov r15, rax
test r13d, r13d
je 0x4a3742
mov rbx, rbp
nop
nop
mov rcx, qword [rbx]
call fcn.004a8850
add rbx, 8
sub rdi, 1
jne 0x4a3730
mov rcx, rbp
call fcn.004a8850
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.004d5d40
mov rax, r15
mov rbx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
add rsp, 0xa8
ret
Function at 0x4a5b54
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.004a8900
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x00400000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.004a8900
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x4a5be7
cmp dword [rsp + 0x24], 5
jb 0x4a5c01
jmp 0x4a5bfd
cmp dword [rsp + 0x30], esi
jne 0x4a5c01
cmp dword [rsp + 0x24], 4
ja 0x4a5bfd
jne 0x4a5c01
cmp dword [rsp + 0x28], 0
jbe 0x4a5c01
mov byte [rbx + 0x18], sil
lea rax, [0x004f8918]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.004a5994
movzx ecx, byte [0x00527d48]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x00527d48], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004a7100
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x4a7cd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x00528478]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.004b6ae0
test rax, rax
je 0x4a7d24
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x4a7db9
mov ecx, 2
call fcn.004b7200
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.004a8900
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4a7da5
test ebx, ebx
jne 0x4a7da5
lea ecx, [rax + 2]
call fcn.004b7200
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret