joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040db80
Capabilities:
Encode data using base64

Disassembly:
mov r9d, dword [0x100429084]
jmp fcn.10040cef0

Function at 0x10040e5c0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 1
mov rbx, rcx
xor ecx, ecx
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x10040e6b0
xor edi, edi
mov edx, 1
mov ecx, 1
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x10040e680
xor ebp, ebp
mov edx, 1
mov ecx, 2
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x10040e6e0
call sub.msys_2.0.dll___getreent
cmp ebp, 2
mov r12, qword [rax + 0x18]
sete al
cmp edi, 2
sete dl
or eax, edx
mov esi, eax
test r12, r12
je 0x10040e670
cmp edi, 1
je 0x10040e770
cmp ebp, 1
je 0x10040e748
test sil, sil
je 0x10040e675
mov r8, rbx
lea rdx, str._s:_fatal:_unable_to_reopen_standard_input__output__or_error_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov ecx, 3
call sub.msys_2.0.dll_exit
nop word [rax + rax]
test sil, sil
jne 0x10040e65d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x10040e5fc
mov edx, 1
lea rcx, [0x100421783]
xor ebp, ebp
call sub.msys_2.0.dll_open
cmp eax, 1
setne bpl
add ebp, 1
jmp 0x10040e5fe
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x10040e5e2
xor edx, edx
lea rcx, [0x100421783]
mov edi, 1
call sub.msys_2.0.dll_open
cmp eax, 1
sbb edi, 0xffffffff
jmp 0x10040e5e4
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x10040e616
mov edx, 1
lea rcx, [0x100421783]
call sub.msys_2.0.dll_open
cmp eax, 2
je 0x10040e7a8
test ebp, ebp
jne 0x10040e65d
call sub.msys_2.0.dll___getreent
mov r12, qword [rax + 0x10]
test r12, r12
je 0x10040e65d
cmp edi, 1
jne 0x10040e64b
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
jmp 0x10040e64b
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_output_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
test sil, sil
jne 0x10040e64b
jmp 0x10040e675
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_output_reopened_n
mov rcx, r12
cmp ebp, 1
jne 0x10040e810
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msys_2.0.dll_fprintf
cmp ebp, 2
sete al
cmp edi, 2
sete dl
or eax, edx
mov esi, eax
test ebp, ebp
jne 0x10040e670
call sub.msys_2.0.dll___getreent
mov rbp, qword [rax + 0x10]
test rbp, rbp
je 0x10040e670
mov r8, rbx
cmp edi, 1
je 0x10040e81e
lea rdx, str._s:_WARNING:_standard_error_reopened_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
cmp edi, 2
jne 0x10040e675
mov r8, rbx
lea rdx, str._s:_fatal:_unable_to_reopen_standard_input__output__or_error_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
jmp 0x10040e65d
cmp ebp, 2
jne 0x10040e675
jmp 0x10040e64b
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_error_reopened_n
mov rcx, rbp
jmp 0x10040e794
Function at 0x10040e870
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x10040e898
lea rdx, [0x100421783]
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x10040e898
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.10041b180

Function at 0x10040ea00
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov rbx, rdx
mov rsi, rcx
mov edx, 0x2e
mov rcx, rbx
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x10040eac0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.10041b250
test eax, eax
jne 0x10040eac8
mov r9d, dword [rsp + 0x30]
lea rcx, [0x100421ae4]
xor eax, eax
xor r8d, r8d
nop dword [rax + rax]
movzx edx, byte [rbx + rax]
test dl, dl
je 0x10040ea75
cmp byte [rcx - 4], dl
je 0x10040ea90
cmp dl, 0x2e
je 0x10040ea98
cmp dl, 0x2d
jne 0x10040ea75
add rax, 1
add rcx, 8
cmp rax, 0xa
jne 0x10040ea50
mov edx, r8d
mov rcx, rsi
add rsp, 0xa8
pop rbx
pop rsi
jmp 0x10041ae90
or r8d, dword [rcx]
jmp 0x10040ea67
test rax, rax
je 0x10040eab0
mov edx, dword [rcx]
and edx, r9d
or r8d, edx
jmp 0x10040ea67
add rcx, 8
mov eax, 1
jmp 0x10040ea50
xor r9d, r9d
jmp 0x10040ea3f
mov eax, 0xffffffff
add rsp, 0xa8
pop rbx
pop rsi
ret
jmp qword [sym.imp.msys_2.0.dll_chmod]
Function at 0x10040fbb0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, str.GNUPGHOME
lea rsi, str._.gnupg
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x10040fbd8
cmp byte [rax], 0
jne 0x10040fbe8
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rax
call fcn.10040fb30
test rax, rax
mov rsi, rax
cmove rsi, rbx
xor edx, edx
mov rcx, rsi
call fcn.10040ba70
xor edx, edx
lea rcx, str._.gnupg
mov rbx, rax
call fcn.10040ba70
mov rcx, rbx
mov rdi, rax
mov rdx, rax
call fcn.10040bad0
mov rcx, rdi
mov ebp, eax
call sub.msys_gcrypt_20.dll_gcry_free
mov rcx, rbx
call sub.msys_gcrypt_20.dll_gcry_free
test ebp, ebp
je 0x10040fbd8
mov rax, rsi
mov byte [0x1004291c0], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1004117a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
cmp byte [rcx], 0
lea rdx, [rcx + 8]
jne 0x1004117bb
jmp 0x100411820
mov rcx, rax
movzx eax, byte [rcx]
sub eax, 0x30
cmp al, 9
ja 0x100411830
lea rax, [rcx + 1]
cmp rax, rdx
jne 0x1004117b8
xor eax, eax
cmp byte [rcx + 1], 0x54
jne 0x100411820
lea rdx, [rcx + 2]
add rcx, 8
jmp 0x1004117e3
mov rdx, rbx
movzx eax, byte [rdx]
sub eax, 0x30
cmp al, 9
ja 0x100411830
lea rbx, [rdx + 1]
cmp rbx, rcx
jne 0x1004117e0
movzx ecx, byte [rcx]
cmp cl, 0x5a
jne 0x100411806
movzx ecx, byte [rdx + 2]
lea rbx, [rdx + 2]
test cl, cl
je 0x10041184b
jns 0x100411838
cmp cl, 0x2c
setne al
cmp cl, 0x3a
setne dl
and eax, edx
xor eax, 1
movzx eax, al
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
call sub.msys_2.0.dll___locale_ctype_ptr
movsx rdx, byte [rbx]
mov rcx, rdx
test byte [rdx + rax + 1], 8
je 0x10041180c
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x100415470
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rbp, rdx
mov rsi, r8
test rcx, rcx
jne 0x10041549c
jmp 0x100415630
add rbx, 1
movzx edi, byte [rbx]
cmp dil, 0x20
je 0x100415498
cmp dil, 9
je 0x100415498
cmp dil, 0x2d
je 0x100415710
cmp byte [rbx], 0x3f
je 0x100415530
lea rdx, str.help
mov rcx, rbx
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x100415540
lea rcx, str.available_debug_flags:_n
call sub.msys_gpg_error_0.dll_gpgrt_log_info
mov r8, qword [rsi + 8]
test r8, r8
je 0x100415507
lea rbx, str.__5u__s_n
nop dword [rax]
mov edx, dword [rsi]
mov rcx, rbx
add rsi, 0x10
call sub.msys_gpg_error_0.dll_gpgrt_log_info
mov r8, qword [rsi + 8]
test r8, r8
jne 0x1004154f0
cmp dword [rsi], 0x4d
jne 0x1004155f0
mov r12d, dword [rbp]
mov dword [rbp], r12d
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rbx + 1], 0
je 0x1004154cd
jmp 0x1004154ba
sub edi, 0x30
cmp dil, 9
jbe 0x100415600
lea rdx, [0x100422bdf]
mov rcx, rbx
call fcn.10040c2e0
mov r13, rax
test rax, rax
je 0x10041571b
mov r15, qword [rax]
test r15, r15
je 0x1004156ec
lea rdi, [rax + 8]
xor r12d, r12d
lea r14, str.none
jmp 0x100415594
mov r15, qword [rdi]
add rdi, 8
test r15, r15
je 0x1004155e0
cmp byte [r15], 0
je 0x100415588
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x100415680
mov rbx, rsi
jmp 0x1004155c1
mov rdx, qword [rbx + 0x18]
add rbx, 0x10
test rdx, rdx
je 0x100415680
mov rcx, r15
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004155b0
mov eax, dword [rbx]
mov r15, qword [rdi]
add rdi, 8
or r12, rax
test r15, r15
jne 0x100415594
nop
mov rcx, r13
call sub.msys_gcrypt_20.dll_gcry_free
jmp 0x100415625
xor ecx, ecx
call sub.msys_2.0.dll_exit
nop word [rax + rax]
call sub.msys_2.0.dll___errno
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rax], 0
call fcn.10041b360
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1004156d7
or r12d, dword [rbp]
jmp 0x100415514
test rdx, rdx
je 0x100415518
lea rcx, str.enabled_debug_flags:
lea rbx, [0x100422bb5]
call sub.msys_gpg_error_0.dll_gpgrt_log_info
mov rdx, qword [rsi + 8]
test rdx, rdx
jne 0x10041566d
jmp 0x1004156a0
mov rdx, qword [rsi + 0x18]
add rsi, 0x10
test rdx, rdx
je 0x1004156a0
mov eax, dword [rbp]
and eax, dword [rsi]
je 0x100415660
mov rcx, rbx
call sub.msys_gpg_error_0.dll_gpgrt_log_printf
jmp 0x100415660
mov rdx, r14
mov rcx, r15
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004156b8
mov dword [rbp], 0
xor r12d, r12d
jmp 0x100415588
lea rcx, [0x100422bb3]
call sub.msys_gpg_error_0.dll_gpgrt_log_printf
jmp 0x100415518
lea rdx, [0x100422be6]
mov rcx, r15
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004156f4
mov r12, 0xffffffffffffffff
jmp 0x100415588
call sub.msys_2.0.dll___errno
cmp dword [rax], 0x22
je 0x10041571b
mov r12d, 0xffffffff
jmp 0x100415514
xor r12d, r12d
jmp 0x1004155e0
lea rcx, str.unknown_debug_flag__s_ignored_n
call sub.msys_intl_8.dll_libintl_gettext
mov rdx, r15
mov rcx, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_info
jmp 0x100415588
call sub.msys_2.0.dll___errno
mov dword [rax], 0x16
or eax, 0xffffffff
jmp 0x10041551a
Function at 0x100028d80
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1000a1140]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, qword [0x1000aca08]
xor edx, edx
mov rcx, rbx
call fcn.100028918
lea rcx, [rsp + 0x42]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bp
call sub.msvcrt.dll_memset
mov esi, 0x104
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov edi, ebp
call fcn.1000646a8
lea rcx, [rsp + 0x40]
cmp al, bpl
jne 0x100028e05
mov r8, qword [0x1000ad708]
mov rdx, rsi
call sub.msvcrt.dll_wcscpy_s
lea edi, [rbp + 0x28]
jmp 0x100028e48
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbp
jne 0x100028e48
lea rcx, [rsp + 0x40]
mov edx, 0x2f
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbp
jne 0x100028e48
lea rcx, [rsp + 0x40]
mov dx, 0x3a
call qword [sym.imp.msvcrt.dll_wcschr]
mov edi, 0x28
mov ecx, ebp
cmp rax, rbp
cmove ecx, edi
mov edi, ecx
mov rcx, qword [rbx + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, edi
add rcx, 8
mov rax, qword [rcx]
call qword [rax + 0x28]
cmp al, bpl
je 0x100028ef1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebp
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8d, 1
cmp dword [rsp + 0x20], r8d
jle 0x100028eb2
lea rdx, [rax + 8]
mov rsi, qword [rdx]
lea rdi, [0x100014ab0]
mov ecx, 9
repe cmpsw word [rsi], word [rdi]
je 0x100028ee8
inc r8d
add rdx, 8
cmp r8d, dword [rsp + 0x20]
jl 0x100028e90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rbx + 0x89], bpl
jne 0x100028f5d
xor edx, edx
xor ecx, ecx
call fcn.1000646a8
cmp al, bpl
jne 0x100028f5d
mov rcx, qword [0x1000acba0]
call fcn.100038e5c
jmp 0x100028f34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
xor ecx, ecx
call fcn.1000646a8
cmp al, bpl
je 0x100028f04
call fcn.100065674
mov rax, qword [0x1000aca08]
cmp byte [rax + 0x8b], bpl
je 0x100028f34
lea rdx, [0x100014ac8]
lea rcx, [rsp + 0x28]
call fcn.10005fa08
mov rcx, qword [0x1000aca08]
mov rdx, rax
call fcn.1000283d0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1000915c0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.100028f8c
cmp al, bpl
je 0x100028f74
mov rcx, rbx
call fcn.100029130
jmp 0x100028f34
call fcn.100065674
xor edx, edx
mov rcx, rbx
call fcn.100028918
jmp 0x100028f34
Function at 0x100041064
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rdx, [0x10001de38]
mov ecx, 8
call fcn.100069df4
cmp dword [0x1000aa588], 0
jne 0x1000410b7
lea rcx, [0x1000aa5a0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1000410b7
lea rdx, [0x10001ddd0]
lea ecx, [rax + 8]
call fcn.100069df4
mov ecx, 0x21
mov dword [0x1000aa588], 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
cmp dword [0x1000aa588], 1
jne 0x1000410cc
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x1000aa5a0], eax
add rsp, 0x28
jmp fcn.100051364

Function at 0x1000410dc
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
cmp byte [0x1000acaca], 0
je 0x1000411a6
lea r9, [0x10001a250]
lea r8, [0x10001a278]
mov edx, 0x244
mov ecx, 0x10
call fcn.100069a3c
cmp byte [0x1000acbbe], 0
jne 0x100041186
mov edx, 0x373
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 0x12]
mov r9d, 0xfffe
mov r8d, 1
call fcn.100065a40
mov rcx, qword [0x1000acba0]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x1000a84a4]
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x1000acba0]
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], eax
mov eax, dword [0x1000a7dbc]
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x100041194
mov rcx, qword [0x1000acb70]
mov byte [rcx + 0xa5], 0
xor ecx, ecx
call fcn.100048a48
test al, al
je 0x1000411a6
mov al, 1
add rsp, 0x58
ret
lea r9, [0x10001a290]
lea r8, [0x10001a278]
mov edx, 0x25d
mov ecx, 0x10
call fcn.100069a3c
mov edx, 0x37d
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea ecx, [rdx + 8]
mov r9d, 0xfffe
mov r8d, 1
call fcn.100065a40
mov cl, byte [0x1000acbbe]
call fcn.100064118
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100048a48
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov dil, cl
cmp cl, byte [0x1000acaca]
je 0x100048be4
mov rcx, qword [0x1000acba8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov cl, 1
call fcn.1000453e8
mov rcx, qword [0x1000acba0]
mov r9d, 0x107
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rbx, qword [0x1000accb8]
mov byte [0x1000acaca], dil
test rbx, rbx
je 0x100048af7
xor esi, esi
cmp dword [rbx + 0x18], esi
jbe 0x100048ad8
xor ebp, ebp
mov rax, qword [rbx + 0x10]
mov dl, dil
mov rcx, qword [rax + rbp]
mov rax, qword [rcx]
call qword [rax + 0x40]
inc esi
add rbp, 8
cmp esi, dword [rbx + 0x18]
jb 0x100048ab5
mov rbx, qword [0x1000accb8]
mov rcx, rbx
call fcn.10004ff04
mov rcx, qword [0x1000accb8]
call fcn.10004fe44
test al, al
jne 0x100048af7
xor al, al
jmp 0x100048be6
mov rbx, qword [0x1000acb70]
test rbx, rbx
je 0x100048b7c
cmp dword [rbx + 0xd4], 0
je 0x100048b7c
lea r9, [0x100018ea8]
lea r8, [0x100018780]
mov edx, 0x201
mov ecx, 2
call fcn.100069a3c
mov rcx, rbx
call fcn.10003c608
mov rcx, rbx
call fcn.10003c484
test al, al
je 0x100048af0
cmp dword [0x1000acc4c], 0
jne 0x100048b6d
cmp byte [0x1000acaca], 0
mov r8d, dword [0x1000a7574]
mov edx, dword [0x1000a7324]
mov rcx, qword [0x1000acb70]
je 0x100048b68
add r8d, r8d
add edx, edx
call fcn.10003dae0
mov rax, qword [0x1000acb70]
mov byte [rax + 0x14], 1
mov byte [rax + 0x58], 1
call fcn.100048c04
mov rcx, qword [0x1000acba8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1000acba0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
cmp qword [0x1000acb70], 0
je 0x100048be4
mov ecx, 0x25
call fcn.10004c4ec
mov rcx, qword [0x1000acb70]
mov rcx, qword [rcx + 0x78]
mov rdx, rax
mov rbx, rax
mov r8, qword [rcx]
call qword [r8 + 0x18]
test rbx, rbx
je 0x100048be4
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10004a4e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r12, qword [rsp + 0xa0]
mov r13, rcx
mov r14d, 0x2028
mov rcx, r14
mov rbp, r9
mov rsi, r8
mov rbx, rdx
call fcn.1000910f4
mov r8, r14
mov rcx, rax
xor edx, edx
mov rdi, rax
call sub.msvcrt.dll_memset
mov dword [rdi], 0x484d4752
mov dword [rdi + 4], 1
mov dword [rdi + 8], r14d
movdqu xmm0, xmmword [rbx]
xor ebx, ebx
movdqu xmmword [rdi + 0x18], xmm0
cmp rsi, rbx
je 0x10004a54b
mov qword [rdi + 0xc], rbx
mov eax, dword [rsi]
mov dword [rdi + 0x14], eax
mov r14d, 0x3ff
cmp rbp, rbx
je 0x10004a565
lea rcx, [rdi + 0x28]
mov r8, rbp
mov rdx, r14
call sub.msvcrt.dll_wcscpy_s
cmp r12, rbx
je 0x10004a57c
lea rcx, [rdi + 0x828]
mov r8, r12
mov rdx, r14
call sub.msvcrt.dll_wcscpy_s
lea r9, [rsp + 0x30]
mov r8d, 0x2028
mov rdx, rdi
mov rcx, r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x10004a5ac
mov rcx, rdi
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x10004a5e2
cmp rsi, rbx
je 0x10004a5d3
mov r8d, dword [rsi]
mov rdx, qword [rsi + 0x10]
lea r9, [rsp + 0x30]
mov rcx, r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x10004a5d8
mov ebx, 1
mov rcx, rdi
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x10004a5f8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov r12, rcx
mov ecx, 0x2028
call fcn.1000910f4
mov rbx, rax
jmp 0x10004a632
xor edi, edi
cmp rbx, rdi
jne 0x10004a640
xor eax, eax
jmp 0x10004a735
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
mov r8d, 0x2028
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x10004a72b
cmp dword [rsp + 0x58], 0x2028
jne 0x10004a72b
cmp dword [rbx], 0x484d4752
jne 0x10004a71f
cmp dword [rbx + 4], 1
jne 0x10004a691
cmp dword [rbx + 8], 0x2028
je 0x10004a6e6
cmp dword [rbx + 8], 0x2030
jne 0x10004a71f
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0xc]
mov r8d, 0x2018
call sub.msvcrt.dll_memmove
mov dword [rbx + 8], 0x2028
mov word [rbx + 0x2024], di
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 7]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10004a6e6
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x10004a735
mov edx, dword [rbx + 0x14]
cmp edx, edi
je 0x10004a710
mov r9d, 1
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10004a710
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x10004a735
mov rcx, rbx
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x10004a735
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x10004a735
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x10004f3f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x20
mov rbx, rcx
mov r13d, 0x40
mov rcx, r13
call fcn.1000910f4
xor edi, edi
lea r12, [0x1000207b8]
cmp rax, rdi
je 0x10004f44c
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], edi
mov qword [rax], r12
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
jmp 0x10004f44f
mov rax, rdi
mov rcx, r13
mov qword [rbx + 0x60], rax
call fcn.1000910f4
cmp rax, rdi
je 0x10004f488
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], edi
mov qword [rax], r12
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
jmp 0x10004f48b
mov rax, rdi
mov rcx, rax
mov qword [rbx + 0x68], rax
call fcn.100063938
mov rcx, r13
call fcn.1000910f4
cmp rax, rdi
je 0x10004f4d3
mov dword [rax + 8], edi
mov dword [rax + 0xc], edi
mov dword [rax + 0x10], 0x10
mov qword [rax + 0x18], rdi
lea rcx, [0x1000207e0]
mov dword [rax + 0x20], edi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov dword [rax + 0x38], 0x3e8
mov qword [rax], rcx
jmp 0x10004f4d6
mov rax, rdi
mov rcx, rax
mov qword [rbx + 0x70], rax
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
add rsp, 0x20
pop r13
jmp fcn.100063938
Function at 0x10004f9d4
Capabilities:
Get common file path
Set current directory
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x20
mov rbx, qword [0x1000accb8]
mov r13d, 4
lea rdx, [0x10001d610]
mov ecx, r13d
call fcn.100069df4
xor esi, esi
cmp dword [rbx + 0x18], esi
jbe 0x10004fa7a
xor ebp, ebp
mov rax, qword [rbx + 0x10]
mov rdi, qword [rax + rbp]
cmp dword [rdi + 0x18], 1
je 0x10004fa26
cmp dword [rdi + 0x18], 3
jne 0x10004fa6f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x10004fa6f
cmp dword [rdi + 0x18], 1
jne 0x10004fa46
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x50]
test al, al
jne 0x10004fa6f
cmp byte [rdi + 0x14], 0
mov r9, qword [rdi + 0x20]
lea rax, [0x10001d690]
lea r8, [0x100014db8]
lea rdx, [0x10001d6a8]
mov ecx, r13d
cmovne r8, rax
call fcn.100069df4
inc esi
add rbp, 8
cmp esi, dword [rbx + 0x18]
jb 0x10004fa12
lea rdx, [0x10001d6c0]
mov ecx, r13d
call fcn.100069df4
xor edi, edi
cmp dword [rbx + 0x18], edi
jbe 0x10004fad2
xor esi, esi
mov rax, qword [rbx + 0x10]
mov rbp, qword [rsi + rax]
cmp dword [rbp + 0x18], 1
je 0x10004faa6
cmp dword [rbp + 0x18], 3
jne 0x10004fac7
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 8]
test al, al
jne 0x10004fac7
mov r8, qword [rbp + 0x20]
lea rdx, [0x1000154ec]
mov ecx, r13d
call fcn.100069df4
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x18]
jb 0x10004fa92
lea rdx, [0x10001d740]
mov ecx, r13d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r13
jmp fcn.100069df4
Function at 0x100053a58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov r12b, r9b
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov dword [rcx + 0x10], edi
mov dword [rcx + 8], 1
mov dword [rcx + 0xc], edi
mov dword [rcx + 0x28], edi
mov qword [rcx + 0x20], rdi
mov byte [rcx + 0x14], dil
mov dword [rcx + 0x18], 3
lea rax, [0x10001e800]
mov qword [rcx], rax
lea eax, [rdi + 2]
mul r13
lea r14, [rdi - 1]
cmovo rax, r14
mov rcx, rax
call fcn.100091194
mov qword [rbx + 0x68], rax
cmp rax, rdi
je 0x100053ae0
mov r8, rbp
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_wcscpy_s
mov dword [rbx + 0x70], r13d
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x88], rdi
mov qword [rbx + 0x80], rdi
mov qword [rbx + 0x98], rdi
mov byte [rbx + 0x34], r12b
mov qword [rbx + 0x78], rdi
mov byte [rbx + 0x90], dil
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x3c], edi
mov dword [rbx + 0x38], edi
mov dword [rbx + 0x40], edi
movzx ecx, r12b
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.100091194
mov qword [rbx + 0x48], rax
cmp rax, rdi
je 0x100053b5c
cmp byte [rbx + 0x34], dil
jbe 0x100053b5c
mov rcx, rdi
mov rax, qword [rbx + 0x48]
mov dword [rcx + rax], 0x64
inc edi
add rcx, 4
movzx eax, byte [rbx + 0x34]
cmp edi, eax
jb 0x100053b43
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret