joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032190
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]

Function at 0x140032890
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400328dc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400328d4
cmp dword [rcx + 0x3c], edx
jl 0x1400328d4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400328d4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400328dc
mov rax, rdx
add rsp, 0x18
ret
Function at 0x4024b8
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x00457018]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 8
mov rax, qword [rax]
mov rcx, qword [rcx]
cmp rax, rcx
jb 0x4025b6
mov rax, qword [rbp - 8]
add rax, 0x10
mov eax, dword [rax]
cmp eax, 0
jl 0x40254c
mov eax, 0x2000
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
add rax, 0x10
mov rcx, qword [rbp - 8]
add rcx, 0x44c
mov edx, dword [rbp - 0xc]
mov r8, rdx
mov r11, rcx
mov eax, dword [rax]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jge 0x402547
mov eax, 0
mov dword [rbp - 0xc], eax
jmp 0x402554
mov eax, 0
mov dword [rbp - 0xc], eax
mov rax, qword [section..bss]
add rax, 0x648
mov qword [rbp - 0x18], rax
mov eax, dword [rax]
mov ecx, dword [rbp - 0xc]
add eax, ecx
mov rcx, qword [rbp - 0x18]
mov dword [rcx], eax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 0x44c
mov qword [rax], rcx
mov rax, qword [rbp - 8]
add rax, 8
mov rcx, qword [rbp - 8]
add rcx, 0x44c
mov edx, dword [rbp - 0xc]
movsxd rdx, edx
add rcx, rdx
mov qword [rax], rcx
mov rax, qword [rbp - 8]
add rax, 8
mov rax, qword [rax]
mov ecx, 0x5c
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 8
mov rax, qword [rax]
mov rcx, qword [rcx]
cmp rax, rcx
jae 0x4025e0
mov rax, qword [rbp - 8]
mov rax, qword [rax]
movzx eax, byte [rax]
jmp 0x4025fc
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 8
mov rcx, qword [rcx]
mov qword [rax], rcx
mov eax, 0xffffffff
jmp 0x4025fc
leave
ret
Function at 0x4024c3
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x00457018]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 8
mov rax, qword [rax]
mov rcx, qword [rcx]
cmp rax, rcx
jb 0x4025b6
mov rax, qword [rbp - 8]
add rax, 0x10
mov eax, dword [rax]
cmp eax, 0
jl 0x40254c
mov eax, 0x2000
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
add rax, 0x10
mov rcx, qword [rbp - 8]
add rcx, 0x44c
mov edx, dword [rbp - 0xc]
mov r8, rdx
mov r11, rcx
mov eax, dword [rax]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jge 0x402547
mov eax, 0
mov dword [rbp - 0xc], eax
jmp 0x402554
mov eax, 0
mov dword [rbp - 0xc], eax
mov rax, qword [section..bss]
add rax, 0x648
mov qword [rbp - 0x18], rax
mov eax, dword [rax]
mov ecx, dword [rbp - 0xc]
add eax, ecx
mov rcx, qword [rbp - 0x18]
mov dword [rcx], eax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 0x44c
mov qword [rax], rcx
mov rax, qword [rbp - 8]
add rax, 8
mov rcx, qword [rbp - 8]
add rcx, 0x44c
mov edx, dword [rbp - 0xc]
movsxd rdx, edx
add rcx, rdx
mov qword [rax], rcx
mov rax, qword [rbp - 8]
add rax, 8
mov rax, qword [rax]
mov ecx, 0x5c
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 8
mov rax, qword [rax]
mov rcx, qword [rcx]
cmp rax, rcx
jae 0x4025e0
mov rax, qword [rbp - 8]
mov rax, qword [rax]
movzx eax, byte [rax]
jmp 0x4025fc
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 8]
add rcx, 8
mov rcx, qword [rcx]
mov qword [rax], rcx
mov eax, 0xffffffff
jmp 0x4025fc
leave
ret
Function at 0x4341d2
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x10], eax
mov eax, 1
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x10]
add rax, 0x530
mov ecx, dword [rbp - 0xc]
mov eax, dword [rax]
cmp ecx, eax
jge 0x43430d
jmp 0x434223
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x4341f9
mov rax, qword [rbp + 0x10]
add rax, 0x528
mov ecx, dword [rbp - 0xc]
movsxd rcx, ecx
shl rcx, 2
mov rdx, qword [rbp + 0x20]
add rdx, rcx
mov edx, dword [rdx]
movsxd rdx, edx
shl rdx, 3
mov rax, qword [rax]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
add rax, 0x28
mov eax, dword [rax]
cmp eax, 8
je 0x434308
mov rax, qword [rbp - 8]
add rax, 0x2c
mov eax, dword [rax]
and eax, 2
cmp eax, 0
je 0x434308
mov rax, qword [rbp - 8]
add rax, 0x44
mov ecx, dword [rbp - 0x10]
mov eax, dword [rax]
cmp ecx, eax
jae 0x4342ba
mov rax, qword [rbp + 0x18]
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fputc
mov eax, dword [rbp - 0x10]
mov ecx, eax
add eax, 1
mov dword [rbp - 0x10], eax
jmp 0x43427e
mov rax, qword [rbp - 8]
add rax, 0x3c
mov eax, dword [rax]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
add rax, 8
mov ecx, dword [rbp - 0x14]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x18]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rax, qword [rax]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov eax, dword [rbp - 0x10]
mov ecx, dword [rbp - 0x14]
add eax, ecx
mov dword [rbp - 0x10], eax
jmp 0x434216
mov eax, 0
leave
ret
Function at 0x4341dd
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x10], eax
mov eax, 1
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x10]
add rax, 0x530
mov ecx, dword [rbp - 0xc]
mov eax, dword [rax]
cmp ecx, eax
jge 0x43430d
jmp 0x434223
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x4341f9
mov rax, qword [rbp + 0x10]
add rax, 0x528
mov ecx, dword [rbp - 0xc]
movsxd rcx, ecx
shl rcx, 2
mov rdx, qword [rbp + 0x20]
add rdx, rcx
mov edx, dword [rdx]
movsxd rdx, edx
shl rdx, 3
mov rax, qword [rax]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
add rax, 0x28
mov eax, dword [rax]
cmp eax, 8
je 0x434308
mov rax, qword [rbp - 8]
add rax, 0x2c
mov eax, dword [rax]
and eax, 2
cmp eax, 0
je 0x434308
mov rax, qword [rbp - 8]
add rax, 0x44
mov ecx, dword [rbp - 0x10]
mov eax, dword [rax]
cmp ecx, eax
jae 0x4342ba
mov rax, qword [rbp + 0x18]
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fputc
mov eax, dword [rbp - 0x10]
mov ecx, eax
add eax, 1
mov dword [rbp - 0x10], eax
jmp 0x43427e
mov rax, qword [rbp - 8]
add rax, 0x3c
mov eax, dword [rax]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
add rax, 8
mov ecx, dword [rbp - 0x14]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x18]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rax, qword [rax]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov eax, dword [rbp - 0x10]
mov ecx, dword [rbp - 0x14]
add eax, ecx
mov dword [rbp - 0x10], eax
jmp 0x434216
mov eax, 0
leave
ret

Function at 0x4347c1
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 0x10]
sub rax, rcx
shl rax, 0x20
shr rax, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
jge 0x43483a
mov rax, qword [rbp - 0x18]
jmp 0x434874
mov rax, qword [rbp - 0x18]
cmp rax, 0
jne 0x434851
mov rax, qword [rbp - 0x10]
jmp 0x434874
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
add rax, rcx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
jmp 0x4347ee
leave
ret
Function at 0x4347cc
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 0x10]
sub rax, rcx
shl rax, 0x20
shr rax, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
jge 0x43483a
mov rax, qword [rbp - 0x18]
jmp 0x434874
mov rax, qword [rbp - 0x18]
cmp rax, 0
jne 0x434851
mov rax, qword [rbp - 0x10]
jmp 0x434874
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
add rax, rcx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
jmp 0x4347ee
leave
ret
Function at 0x43d431
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x20]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rcx, qword [rbp + 0x10]
mov r10, rcx
mov qword [rbp - 0x20], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
shl rax, 0x20
shr rax, 0x20
mov dword [rbp - 0x10], eax
mov rcx, qword [rbp - 0x20]
mov ecx, dword [rcx]
add ecx, eax
mov rax, qword [rbp - 0x20]
mov dword [rax], ecx
mov rax, qword [rbp + 0x20]
add rax, 8
mov eax, dword [rax]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0
jle 0x43d525
jmp 0x43d4d6
mov eax, dword [rbp - 0x14]
sub eax, 2
mov dword [rbp - 0x14], eax
jmp 0x43d4ba
mov eax, dword [rbp - 0x14]
cmp eax, 2
jl 0x43d4f6
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 2
mov qword [rbp - 8], rax
jmp 0x43d502
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
jmp 0x43d507
movzx ecx, word [rcx]
mov eax, ecx
mov ecx, dword [rbp - 0xc]
add ecx, eax
mov dword [rbp - 0xc], ecx
mov eax, dword [rbp - 0xc]
shr eax, 0x10
mov ecx, dword [rbp - 0xc]
add ecx, eax
and ecx, 0xffff
mov dword [rbp - 0xc], ecx
jmp 0x43d4cb
mov rax, qword [rbp + 0x20]
add rax, 8
mov ecx, dword [rbp - 0xc]
mov dword [rax], ecx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp - 0x10]
cmp eax, ecx
jne 0x43d545
jmp 0x43d54f
mov eax, 0xffffffff
jmp 0x43d554
mov eax, 0
leave
ret
Function at 0x43d43c
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x20]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rcx, qword [rbp + 0x10]
mov r10, rcx
mov qword [rbp - 0x20], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
shl rax, 0x20
shr rax, 0x20
mov dword [rbp - 0x10], eax
mov rcx, qword [rbp - 0x20]
mov ecx, dword [rcx]
add ecx, eax
mov rax, qword [rbp - 0x20]
mov dword [rax], ecx
mov rax, qword [rbp + 0x20]
add rax, 8
mov eax, dword [rax]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0
jle 0x43d525
jmp 0x43d4d6
mov eax, dword [rbp - 0x14]
sub eax, 2
mov dword [rbp - 0x14], eax
jmp 0x43d4ba
mov eax, dword [rbp - 0x14]
cmp eax, 2
jl 0x43d4f6
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 2
mov qword [rbp - 8], rax
jmp 0x43d502
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
jmp 0x43d507
movzx ecx, word [rcx]
mov eax, ecx
mov ecx, dword [rbp - 0xc]
add ecx, eax
mov dword [rbp - 0xc], ecx
mov eax, dword [rbp - 0xc]
shr eax, 0x10
mov ecx, dword [rbp - 0xc]
add ecx, eax
and ecx, 0xffff
mov dword [rbp - 0xc], ecx
jmp 0x43d4cb
mov rax, qword [rbp + 0x20]
add rax, 8
mov ecx, dword [rbp - 0xc]
mov dword [rax], ecx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp - 0x10]
cmp eax, ecx
jne 0x43d545
jmp 0x43d54f
mov eax, 0xffffffff
jmp 0x43d554
mov eax, 0
leave
ret

Function at 0x43d556
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x130
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov eax, dword [rax]
sub ecx, eax
mov dword [rbp - 0x108], ecx
movabs rax, 0x100
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x108]
cmp eax, 0
jle 0x43d621
mov eax, 0x100
mov r11, rax
mov eax, dword [rbp - 0x108]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043d2a3
mov dword [rbp - 0x104], eax
mov ecx, dword [rbp - 0x108]
sub ecx, eax
mov dword [rbp - 0x108], ecx
mov eax, dword [rbp - 0x104]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx]
mov r9, rcx
movabs rcx, 1
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
jmp 0x43d5a8
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov dword [rax], ecx
leave
ret
Function at 0x43d561
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x130
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov eax, dword [rax]
sub ecx, eax
mov dword [rbp - 0x108], ecx
movabs rax, 0x100
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x108]
cmp eax, 0
jle 0x43d621
mov eax, 0x100
mov r11, rax
mov eax, dword [rbp - 0x108]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043d2a3
mov dword [rbp - 0x104], eax
mov ecx, dword [rbp - 0x108]
sub ecx, eax
mov dword [rbp - 0x108], ecx
mov eax, dword [rbp - 0x104]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx]
mov r9, rcx
movabs rcx, 1
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
jmp 0x43d5a8
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov dword [rax], ecx
leave
ret

Function at 0x44006b
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, 0
mov r8, rax
mov eax, dword [rbp + 0x18]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__lseek
mov eax, dword [rbp + 0x28]
mov r8, rax
mov rax, qword [rbp + 0x20]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov ecx, dword [rbp + 0x28]
cmp ecx, eax
sete al
movzx eax, al
leave
ret
Function at 0x444ddb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [0x0045453d]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00443e6e
cmp eax, 0
sete al
movzx eax, al
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
je 0x444e91
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, str.error
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00443e6e
cmp eax, 0
je 0x444e91
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x444e77
jmp 0x444e81
mov eax, 4
jmp 0x444e86
mov eax, 3
mov dword [rbp - 4], eax
mov eax, 1
mov dword [rbp - 8], eax
mov eax, 0xffffffff
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
cmp rax, 0
je 0x444fb1
jmp 0x444ec9
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov qword [rbp - 0x18], rax
jmp 0x444ea1
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x444f08
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x444f03
jmp 0x444ebb
jmp 0x444f24
mov rax, qword [rbp - 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
jne 0x444f24
jmp 0x444ebb
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
mov rcx, qword [rbp + 0x10]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
movzx ecx, byte [rcx]
mov edx, dword [rbp - 8]
and ecx, edx
mov rdx, qword [rbp - 0x18]
add rdx, 2
movzx edx, word [rdx]
and edx, 2
cmp edx, 0
setne dl
movzx edx, dl
mov qword [rbp - 0x30], rax
mov eax, dword [rbp - 4]
xor eax, edx
or ecx, eax
mov rax, qword [rbp - 0x30]
mov byte [rax], cl
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x444fac
mov eax, 0
mov dword [rbp - 0xc], eax
lea rax, [0x00454548]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x444fac
jmp 0x444fb1
jmp 0x444ebb
mov eax, dword [rbp - 0xc]
leave
ret
Function at 0x444de6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [0x0045453d]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00443e6e
cmp eax, 0
sete al
movzx eax, al
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
je 0x444e91
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, str.error
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00443e6e
cmp eax, 0
je 0x444e91
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x444e77
jmp 0x444e81
mov eax, 4
jmp 0x444e86
mov eax, 3
mov dword [rbp - 4], eax
mov eax, 1
mov dword [rbp - 8], eax
mov eax, 0xffffffff
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
cmp rax, 0
je 0x444fb1
jmp 0x444ec9
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov qword [rbp - 0x18], rax
jmp 0x444ea1
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x444f08
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x444f03
jmp 0x444ebb
jmp 0x444f24
mov rax, qword [rbp - 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
jne 0x444f24
jmp 0x444ebb
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
mov rcx, qword [rbp + 0x10]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
movzx ecx, byte [rcx]
mov edx, dword [rbp - 8]
and ecx, edx
mov rdx, qword [rbp - 0x18]
add rdx, 2
movzx edx, word [rdx]
and edx, 2
cmp edx, 0
setne dl
movzx edx, dl
mov qword [rbp - 0x30], rax
mov eax, dword [rbp - 4]
xor eax, edx
or ecx, eax
mov rax, qword [rbp - 0x30]
mov byte [rax], cl
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x444fac
mov eax, 0
mov dword [rbp - 0xc], eax
lea rax, [0x00454548]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x444fac
jmp 0x444fb1
jmp 0x444ebb
mov eax, dword [rbp - 0xc]
leave
ret
Function at 0x448d6e
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
lea rax, str.C_INCLUDE_PATH
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x448dba
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004433ca
lea rax, str.CPATH
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x448df7
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044337b
lea rax, str.LIBRARY_PATH
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x448e34
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004439d7
leave
ret
Function at 0x449e18
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
jmp 0x449f5d
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
movsxd rdx, edx
mov qword [rax], rdx
jmp 0x44a033
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov qword [rax], rdx
jmp 0x44a033
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
jmp 0x44a033
mov rax, qword [rbp + 0x20]
add rax, 8
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x20]
add rax, 8
mov eax, dword [rax]
movsxd rax, eax
add rax, 4
sub rax, 1
shr rax, 2
shl rax, 2
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
jmp 0x44a033
mov eax, 2
mov dword [rbp - 0xc], eax
jmp 0x449f1f
mov eax, 2
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 0x18]
mov rcx, rax
add rax, 4
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 8]
mov rdx, rax
add rax, 4
mov qword [rbp - 8], rax
mov edx, dword [rdx]
mov dword [rcx], edx
mov eax, dword [rbp - 0xc]
add eax, 0xffffffff
mov dword [rbp - 0xc], eax
cmp eax, 0
jne 0x449f1f
jmp 0x44a033
jmp 0x44a033
cmp edx, 0xc8
jg 0x449fda
cmp edx, 0xc8
jge 0x449eb7
cmp edx, 0xc0
je 0x449e5e
cmp edx, 0xc1
je 0x449e5e
cmp edx, 0xc2
je 0x449e5e
cmp edx, 0xc3
je 0x449e7e
cmp edx, 0xc4
je 0x449f0a
cmp edx, 0xc5
je 0x449f0a
cmp edx, 0xc6
je 0x449e5e
cmp edx, 0xc7
je 0x449e7e
jmp 0x449f58
cmp edx, 0xc9
je 0x449eb7
cmp edx, 0xca
je 0x449e9b
cmp edx, 0xcb
je 0x449f0a
cmp edx, 0xcc
je 0x449f17
cmp edx, 0xcd
je 0x449eb7
cmp edx, 0xce
je 0x449eb7
cmp edx, 0xcf
je 0x449e5e
jmp 0x449f58
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
leave
ret