joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b890
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, rcx
mov ecx, 0x50
mov rbx, r8
mov r13, rdx
mov qword [rsp + 0xb8], r9
call fcn.0049cf50
mov rbp, rax
mov rax, qword [rsp + 0xb8]
test rbx, rbx
mov dword [rax], 0
je 0x40b9ea
cmp dword [rbx], 0x2e
jne 0x40b9b1
mov r8, qword [rbx + 0x10]
xor esi, esi
test r8, r8
je 0x40b994
mov edi, 0xa
lea r14, [rsp + 0x4c]
jmp 0x40b923
mov qword [rbp + rsi*8], r8
mov rbx, qword [rbx + 0x18]
mov esi, r15d
test rbx, rbx
je 0x40b990
cmp dword [rbx], 0x2e
jne 0x40b9b1
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x40b990
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rdx, r13
mov rcx, r12
call fcn.0040b130
test rax, rax
mov r8, rax
je 0x40b970
lea r15d, [rsi + 1]
cmp r15d, edi
jb 0x40b900
lea edx, [rdi + 0xa]
mov rcx, rbp
mov qword [rsp + 0x38], rax
mov rdi, rdx
shl rdx, 3
call fcn.0049cfd0
mov r8, qword [rsp + 0x38]
mov rbp, rax
jmp 0x40b900
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x40b9de
mov rax, qword [rsp + 0xb8]
mov dword [rax], 1
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x40b911
nop
shl rsi, 3
mov qword [rbp + rsi], 0
mov rax, rbp
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.Unexpected_type_in_v3_arglist_demangling_n
lea r9, [rax + 0x60]
mov r8d, 0x29
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbp
xor ebp, ebp
call fcn.0049fd58
jmp 0x40b99d
mov rcx, rbp
xor ebp, ebp
call fcn.0049fd58
jmp 0x40b99d
xor esi, esi
jmp 0x40b994
Function at 0x4158d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov r8, rcx
mov rsi, rdx
je 0x415945
lea rdx, str._s:_supported_targets:
mov rcx, rsi
call sub.msvcrt.dll_fprintf
call fcn.00424390
mov r8, qword [rax]
mov rbp, rax
lea rbx, [rax + 8]
lea rdi, [0x004adb6f]
test r8, r8
je 0x415928
nop dword [rax]
add rbx, 8
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_fprintf
mov r8, qword [rbx - 8]
test r8, r8
jne 0x415910
mov rdx, rsi
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.0049fd58
lea rcx, str.Supported_targets:
mov r9, rdx
mov r8d, 0x12
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x4158f2
Function at 0x415ec0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
call fcn.004153d0
mov rcx, rax
call sub.msvcrt.dll__mktemp
test rax, rax
mov rbx, rax
je 0x415ef0
mov rcx, rax
call sub.msvcrt.dll__mkdir
test eax, eax
jne 0x415ef0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x416140
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rbp, str.cause_of_error_unknown
mov rsi, rcx
mov r13, rdx
mov r12, r8
mov rdi, r9
call fcn.0041a400
test eax, eax
jne 0x416240
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
call rbx
lea rcx, [rax + 0x30]
call sub.msvcrt.dll_fflush
lea rax, [rsp + 0x90]
mov r14, qword [0x004e90b0]
mov qword [rsp + 0x28], rax
call rbx
lea rdx, [rax + 0x60]
mov rcx, r14
call sub.msvcrt.dll_fputs
test r13, r13
je 0x416250
test rsi, rsi
je 0x416270
test r12, r12
je 0x416250
mov r12, qword [r12]
test r12, r12
je 0x416250
call rbx
lea rdx, str.:__s__s_
lea rcx, [rax + 0x60]
mov r9, r12
mov r8, rsi
call sub.msvcrt.dll_fprintf
test rdi, rdi
je 0x41621a
call rbx
lea rcx, [0x004addd9]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
call rbx
lea rcx, [rax + 0x60]
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call rbx
lea rdx, str.:__s_n
lea rcx, [rax + 0x60]
mov r8, rbp
call sub.msvcrt.dll_fprintf
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, eax
call fcn.0041a410
mov rbp, rax
jmp 0x41616e
call rbx
lea rdx, str.:__s
lea rcx, [rax + 0x60]
mov r8, rsi
call sub.msvcrt.dll_fprintf
jmp 0x4161e2
mov rcx, r13
call fcn.00416050
mov rsi, rax
jmp 0x4161b4
Function at 0x4218d0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test rdx, rdx
mov r12, rdx
mov rbp, rcx
sete dl
test r8, r8
mov rdi, r8
sete al
or dl, al
jne 0x421a19
test rcx, rcx
je 0x421a19
lea rdx, [0x004af442]
mov rcx, r8
call fcn.0041c380
test rax, rax
mov rsi, rax
je 0x421a39
lea r14, [0x004e4420]
lea r13, [0x004af4e0]
xor ebx, ebx
mov r9, rsi
mov r8d, 0x2000
mov edx, 1
mov rcx, r14
call sub.msvcrt.dll_fread
test rax, rax
je 0x421981
add rax, r14
not ebx
cmp rax, r14
mov edx, ebx
jbe 0x42197b
lea rcx, [0x004e4420]
nop
mov r8d, edx
xor r8b, byte [rcx]
add rcx, 1
shr edx, 8
movzx r8d, r8b
xor edx, dword [r13 + r8*4]
cmp rax, rcx
jne 0x421960
mov ebx, edx
not ebx
jmp 0x421931
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rcx, rdi
call fcn.0049b930
mov rcx, rax
mov r15, rax
call sub.msvcrt.dll_strlen
lea rsi, [rax + 4]
mov r14, rax
and rsi, 0xfffffffffffffffc
lea r13, [rsi + 4]
mov rcx, r13
call fcn.0041fc20
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x421a08
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rdi + r14]
mov r8, rsi
xor edx, edx
sub r8, r14
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 8]
lea rdx, [rdi + rsi]
mov ecx, ebx
call qword [rax + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, r12
mov rcx, rbp
call fcn.004227e0
test eax, eax
je 0x421a27
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 5
call fcn.0041a6d0
xor eax, eax
jmp 0x421a08
mov rcx, rdi
mov dword [rsp + 0x3c], eax
call fcn.0049fd58
mov eax, dword [rsp + 0x3c]
jmp 0x421a08
mov ecx, 1
call fcn.0041a6d0
xor eax, eax
jmp 0x421a08
Function at 0x4226b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, dword [rcx + 0x18]
mov eax, dword [r8 + 0x10]
mov rbx, rdx
xor edx, edx
mov r9, qword [rcx]
div r10d
mov edx, edx
lea rax, [r9 + rdx*8]
mov rdx, qword [rax]
test rdx, rdx
je 0x41f4a0
cmp r8, rdx
jne 0x41f498
jmp 0x41f4c3
cmp r8, rax
je 0x41f4c0
mov rdx, rax
mov rax, qword [rdx]
test rax, rax
jne 0x41f490
lea r8, str.bfd_hash_rename
lea rcx, str._builds_idf_crosstool_NG_.build_HOST_x86_64_w64_mingw32_riscv32_esp_elf_src_binutils_bfd_hash.c
mov edx, 0x244
call fcn.0041a670
nop dword [rax + rax]
mov rax, rdx
mov rdx, qword [r8]
test rbx, rbx
mov qword [rax], rdx
mov qword [r8 + 8], rbx
je 0x41f531
movzx ecx, byte [rbx]
xor eax, eax
lea rdx, [rbx + 1]
test ecx, ecx
je 0x41f4ff
nop
mov r11d, ecx
add rdx, 1
shl r11d, 0x11
add ecx, r11d
add eax, ecx
mov ecx, eax
shr ecx, 2
xor eax, ecx
movzx ecx, byte [rdx - 1]
test ecx, ecx
jne 0x41f4e0
sub rdx, rbx
sub edx, 1
add eax, edx
shl edx, 0x11
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
xor edx, edx
mov dword [r8 + 0x10], eax
div r10d
mov eax, edx
lea rax, [r9 + rax*8]
mov rdx, qword [rax]
mov qword [r8], rdx
mov qword [rax], r8
add rsp, 0x20
pop rbx
ret
lea rcx, str._builds_idf_crosstool_NG_.build_HOST_x86_64_w64_mingw32_riscv32_esp_elf_src_binutils_bfd_hash.c
mov edx, 0x1b6
call fcn.0041a650
movzx eax, byte [pe_dos_header]
ud2
mov rax, qword [rcx + 0xf8]
lea r8, [rcx - 0x18]
mov qword [rcx], rdx
add rax, 0x60
mov rcx, rax
jmp 0x41f460

Function at 0x4241d0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rax, rcx
mov rbx, rdx
je 0x424220
lea rdi, str.default
mov ecx, 8
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
je 0x424231
test rbx, rbx
je 0x424260
and byte [rbx + 0x44], 0xbf
mov rcx, rax
call fcn.004240b0
test rax, rax
je 0x42426d
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x4241e2
mov rax, qword [0x004a5610]
test rax, rax
je 0x424252
test rbx, rbx
je 0x42420f
or byte [rbx + 0x44], 0x40
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [0x004a5620]
mov rax, qword [rax]
jmp 0x42423d
mov rcx, rax
call fcn.004240b0
test rax, rax
jne 0x42420f
xor eax, eax
jmp 0x42420f
Function at 0x431590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rbx, rdx
mov rdi, rcx
mov rsi, r8
lea rcx, [rbx + 0x10]
mov rax, qword [rax + 0x370]
movzx ebp, byte [rax + 0x3cd]
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov rax, qword [rdi]
and ebp, 1
call qword [rax + 0x98]
mov word [rsi + 0x30], ax
mov rax, qword [rdi]
lea rcx, [rbx + 0x12]
call qword [rax + 0x98]
mov word [rsi + 0x32], ax
mov rax, qword [rdi]
lea rcx, [rbx + 0x14]
call qword [rax + pe_nt_image_headers64]
test bpl, bpl
mov dword [rsi + 0x28], eax
lea rcx, [rbx + 0x18]
mov rax, qword [rdi]
jne 0x4316b0
call qword [rax + pe_nt_image_headers64]
mov qword [rsi + 0x10], rax
mov rax, qword [rdi]
lea rcx, [rbx + 0x1c]
call qword [rax + pe_nt_image_headers64]
mov qword [rsi + 0x18], rax
mov rax, qword [rdi]
lea rcx, [rbx + 0x20]
call qword [rax + pe_nt_image_headers64]
mov qword [rsi + 0x20], rax
mov rax, qword [rdi]
lea rcx, [rbx + 0x24]
call qword [rax + pe_nt_image_headers64]
mov dword [rsi + 0x2c], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x28]
call qword [rax + 0x98]
mov dword [rsi + 0x34], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x2a]
call qword [rax + 0x98]
mov dword [rsi + 0x38], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x2c]
call qword [rax + 0x98]
mov dword [rsi + 0x3c], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x2e]
call qword [rax + 0x98]
mov dword [rsi + 0x40], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x30]
call qword [rax + 0x98]
mov dword [rsi + 0x44], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x32]
call qword [rax + 0x98]
mov dword [rsi + 0x48], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [rax + 0x88]
mov qword [rsi + 0x10], rax
jmp 0x43160f

Function at 0x435970
Capabilities:
Hash data using djb2

Disassembly:
movzx edx, byte [rcx]
mov eax, 0x1505
lea r8, [rcx + 1]
test dl, dl
je 0x435998
mov ecx, eax
add r8, 1
shl ecx, 5
add edx, ecx
add eax, edx
movzx edx, byte [r8 - 1]
test dl, dl
jne 0x435980
repz ret
repz ret
Function at 0x45a890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [rsp + 0x60]
mov rbx, r8
mov r8, qword [r9 + 8]
mov r11, rcx
mov ecx, dword [r9 + 0x40]
mov r10, rdx
mov rax, qword [r8 + 8]
shr rax, cl
test eax, eax
je 0x45a980
mov eax, eax
cmp rax, qword [r9 + 0x28]
jb 0x45a940
sub rax, qword [r9 + 0x30]
mov rdx, qword [r9 + 0x38]
mov r9, qword [rdx + rax*8]
test r9, r9
jne 0x45a8e4
jmp 0x45a989
mov r9, qword [r9 + 0x28]
movzx eax, byte [r9 + 0x18]
sub eax, 6
cmp al, 1
jbe 0x45a8e0
movzx edx, byte [r9 + 0x65]
or byte [r9 + 0x64], 0x20
mov rax, r9
test dl, 0x20
je 0x45a910
mov rax, qword [rax + 0x70]
or byte [rax + 0x64], 0x20
test byte [rax + 0x65], 0x20
jne 0x45a902
test rsi, rsi
je 0x45a964
and edx, 0x10
je 0x45a964
mov rax, qword [r9 + 0x80]
movzx edx, byte [rax + 0x2c]
shr dl, 3
xor edx, 1
and edx, 1
mov dword [rsi], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov rdx, rax
shl rdx, 5
add rdx, qword [r9 + 0x18]
movzx ecx, byte [rdx + 0x14]
shr cl, 4
test cl, cl
jne 0x45a8c3
mov qword [rsp + 0x60], rdx
xor r9d, r9d
jmp 0x45a96d
mov qword [rsp + 0x60], 0
mov rdx, r11
mov rcx, r10
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [r11 + 0x20]
mov rdx, qword [r10 + 0xf8]
lea rcx, str._F_P:_corrupt_input:__pB_n
call qword [rax + 0x58]
xor eax, eax
jmp 0x45a930
Function at 0x478330
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8d, 1
mov rdx, rcx
lea rcx, [0x004e8680]
jmp fcn.0041f2f0

Function at 0x478eb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x44]
mov rdi, rcx
mov rbp, rdx
mov esi, r8d
mov ebx, r9d
test eax, eax
jne 0x478fc0
mov r14d, dword [rcx + 0x40]
xor r13d, r13d
test r14d, r14d
je 0x478f10
lea eax, [r14 - 1]
xor r13d, r13d
lea r8, [rdx + rax + 1]
nop
add rdx, 1
movzx ecx, byte [rdx - 1]
mov eax, ecx
shl eax, 0x11
add eax, ecx
add r13d, eax
mov eax, r13d
shr eax, 2
xor r13d, eax
cmp rdx, r8
jne 0x478ef0
xor edx, edx
mov eax, r13d
div dword [rdi + 0x18]
mov rax, qword [rdi]
mov edx, edx
mov r12, qword [rax + rdx*8]
test r12, r12
je 0x478f80
mov r15d, r14d
jmp 0x478f39
mov r12, qword [r12]
test r12, r12
je 0x478f80
cmp r13d, dword [r12 + 0x10]
jne 0x478f30
cmp r14d, dword [r12 + 0x18]
jne 0x478f30
mov rcx, qword [r12 + 8]
mov r8, r15
mov rdx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x478f30
cmp dword [r12 + 0x1c], esi
jae 0x478fa5
test ebx, ebx
je 0x479085
mov dword [r12 + 0x18], 0
mov dword [r12 + 0x1c], 0
jmp 0x478f88
test ebx, ebx
je 0x479085
mov r8d, r13d
mov rdx, rbp
mov rcx, rdi
call fcn.0041f100
test rax, rax
mov r12, rax
je 0x478fa5
mov dword [rax + 0x18], r14d
mov dword [rax + 0x1c], esi
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9d, dword [rcx + 0x40]
cmp r9d, 1
je 0x47908d
lea r13d, [r9 - 1]
xor r12d, r12d
xor eax, eax
mov r10, rdx
add r13, 1
test r9d, r9d
je 0x479080
nop word [rax + rax]
movzx edx, byte [r10]
lea r8, [r10 + 1]
xor ecx, ecx
mov r11, r8
test dl, dl
je 0x47900e
jmp 0x479040
add r11, 1
cmp byte [r11 - 1], 0
jne 0x479040
add ecx, 1
cmp r9d, ecx
jne 0x479003
mov r14d, r12d
imul r14d, r9d
add eax, r12d
shl r12d, 0x11
add eax, r12d
mov r13d, eax
shr r13d, 2
xor r13d, eax
add r14d, r9d
jmp 0x478f10
lea r11, [r10 + r13]
jmp 0x479058
movzx edx, byte [r8]
add r8, 1
movzx ecx, dl
mov r10, r8
mov edx, ecx
shl edx, 0x11
add edx, ecx
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
cmp r8, r11
jne 0x479050
add r12d, 1
test r9d, r9d
jne 0x478ff0
xor r14d, r14d
jmp 0x47901d
xor r12d, r12d
jmp 0x478fa5
lea r8, [rdx + 1]
movzx edx, byte [rdx]
test edx, edx
je 0x4790dd
xor r14d, r14d
xor eax, eax
nop dword [rax]
mov ecx, edx
add r14d, 1
add r8, 1
shl ecx, 0x11
add edx, ecx
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
movzx edx, byte [r8 - 1]
test edx, edx
jne 0x4790a0
mov r13d, r14d
add eax, r14d
shl r13d, 0x11
add eax, r13d
mov r13d, eax
shr r13d, 2
xor r13d, eax
jmp 0x479031
xor r13d, r13d
xor r14d, r14d
jmp 0x479031
Function at 0x493960
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov esi, edx
mov rbx, rcx
movzx edx, byte [rax]
cmp dl, 0x5f
je 0x4939a7
test esi, esi
jne 0x493981
cmp dl, 0x5a
je 0x49398e
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
add rax, 1
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x18], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.00493230
lea rdx, [rax + 1]
mov qword [rcx + 0x18], rdx
cmp byte [rax + 1], 0x5a
jne 0x493981
add rax, 2
mov edx, esi
mov qword [rcx + 0x18], rax
call fcn.00493230
test esi, esi
mov rdi, rax
je 0x493983
test byte [rbx + 0x10], 1
je 0x493983
mov rdx, qword [rbx + 0x18]
cmp byte [rdx], 0x2e
jne 0x493983
movzx eax, byte [rdx + 1]
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x493a5e
cmp al, 0x5f
je 0x493a5e
sub eax, 0x30
cmp al, 9
ja 0x493983
movzx eax, byte [rdx]
mov r8, rdx
cmp al, 0x2e
jne 0x493a34
nop dword [rax + rax]
movzx eax, byte [r8 + 1]
sub eax, 0x30
cmp al, 9
ja 0x493a34
movzx eax, byte [r8 + 2]
lea r9, [r8 + 2]
mov r8, r9
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x4939f7
add r8, 1
movzx eax, byte [r8]
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x493a20
cmp al, 0x2e
je 0x493a00
mov qword [rbx + 0x18], r8
mov rcx, rbx
sub r8d, edx
call fcn.0048b640
mov r8, rdi
mov r9, rax
mov edx, 0x4e
mov rcx, rbx
call fcn.0048aff0
mov rdi, rax
jmp 0x4939d1
movzx eax, byte [rdx + 2]
lea r8, [rdx + 2]
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x493a80
nop
add r8, 1
movzx eax, byte [r8]
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x493a70
cmp al, 0x5f
je 0x493a70
jmp 0x4939f7
Function at 0x49c150
Capabilities:
Query environment variable

Disassembly:
mov r9d, 1
jmp fcn.0049bc60

Function at 0x49c170
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x004e8700]
test rax, rax
je 0x49c190
add rsp, 0x28
pop rbx
pop rsi
ret
xor edx, edx
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rsi
test eax, eax
mov ebx, eax
jne 0x49c1c5
mov rax, qword [0x004e8700]
test rax, rax
jne 0x49c182
nop
lea rcx, [0x004d78b0]
call fcn.0049d020
mov qword [0x004e8700], rax
jmp 0x49c182
mov ecx, eax
call fcn.0049cf50
mov ecx, ebx
mov qword [0x004e8700], rax
mov rdx, rax
call rsi
test eax, eax
jne 0x49c1a3
mov rcx, qword [0x004e8700]
call fcn.0049fd58
mov qword [0x004e8700], 0
jmp 0x49c1b0

Function at 0x49d9e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x004e8d64]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x49daf8
mov rax, qword [0x004e8d68]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x49da2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x49dade
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x49da10
mov rcx, rsi
call fcn.0049e640
test rax, rax
mov r12, rax
je 0x49db30
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x004e8d68]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.0049e790
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004e8d68]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x49db13
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x49dad7
sub eax, 4
and eax, 0xfffffffb
je 0x49dad7
add rbx, qword [0x004e8d68]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x49daff
add dword [0x004e8d64], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x49da37
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0049d970
mov rax, qword [0x004e8d68]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 8]
call fcn.0049d970
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0049d970
nop
Function at 0x49e2b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004e9040]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004e9020]
test rbx, rbx
je 0x49e304
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x49e2fb
test rsi, rsi
je 0x49e2fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x49e2e0
lea rcx, [0x004e9040]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x49e640
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x004d8370]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x49e660
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.0049e520
test eax, eax
je 0x49e658
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x49e6bd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x49e6b4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x49e658
add rdx, 0x28
cmp rdx, r9
jne 0x49e6a0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x49e980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x49eb0c
cmp byte [rbx], 0
je 0x49ead4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x49eaf0
test al, 0x10
je 0x49ead4
lea rdi, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rdi
mov rsi, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rsi]
add rsi, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x49e9de
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rsi + 2]
mov ecx, eax
cmove rsi, rdx
add cl, al
sbb rsi, 3
sub rsi, rdi
lea rcx, [rsi + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x49eaff
lea r9, [rax + 0x244]
lea rbp, [rsi + 1]
mov rdx, rdi
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov r9, rax
je 0x49ea70
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x2f
je 0x49ea70
cmp al, 0x5c
je 0x49ea70
mov r8d, 0x5c
mov word [r9 + rsi], r8w
mov rsi, rbp
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [r9 + rsi], ax
mov word [rbx + 0x12c], dx
lea rdx, [rbx + 0x130]
mov word [rbx + 0x12e], cx
xor eax, eax
mov ecx, 0x20
mov rdi, rdx
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov dword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x49eac5
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x49eac5
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x49eac5
Function at 0x412f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4130eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0057c188]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412fc5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412fd4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x412ff3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413003
cmp rbx, 0x1000
jae 0x412fcb
jmp 0x41306d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413015
xor edx, edx
jmp 0x413064
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0057c188]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x412ff9
jmp 0x412fe8
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0057c188]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00480c1e]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00480f17]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00482796]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS