joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7210
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x20]
mov rcx, qword [rdx + 0x30]
mov rdx, qword [rdx + 0x38]
lea r9, [0x00536200]
call fcn.004a639b
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x60]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x4a72e4
test eax, eax
je 0x4a7300
cmp eax, 0x90317
je 0x4a736b
cmp eax, 0x90321
jne 0x4a7373
mov dword [rdi + 0x208], 0x10000
xor ebx, ebx
mov byte [rdi + 0x20c], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.004a757b
and qword [rdi + 0x1d8], 0
mov byte [rsi + 1], bl
jmp 0x4a7381
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x4a736f
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x38]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 8]
and qword [rdi + 0x18], 0
call fcn.004a63ac
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.0043238e
and qword [rdi], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.004a757b
xor eax, eax
cmp qword [rdi + 0x20], rbx
sete al
mov qword [rdi + 0x1d8], rax
mov byte [rsi + 1], 0
jmp 0x4a7381
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x4a7381
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x4ad500
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
sub r8, rdx
cmp r8, 0x20
jae 0x4ad521
cmp rcx, rdx
je 0x4ad52c
cmp r8, 4
jae 0x4ad52f
xor eax, eax
mov rcx, rdx
jmp 0x4ad5bc
mov rcx, rdx
mov rdx, r8
jmp fcn.0042d710
xor eax, eax
ret
mov rcx, r8
and rcx, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x005036c0]
movdqa xmm3, xmmword [0x005036d0]
pxor xmm1, xmm1
movzx r9d, word [rdx + rax]
movd xmm4, r9d
movzx r9d, word [rdx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp rcx, rax
jne 0x4ad550
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp rcx, r8
je 0x4ad5d9
add rcx, rdx
add rdx, r8
nop
xor r8d, r8d
cmp byte [rcx], 0xc0
lea r9, [rcx + 1]
setge r8b
add rax, r8
mov rcx, r9
cmp r9, rdx
jne 0x4ad5c0
ret
Function at 0x4ad800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x4ad85b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x4ad85b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x4ad876
cmp eax, 0x42
jne 0x4ad85b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x4ad926
cmp byte [r9 + r11], 0x5f
jne 0x4ad926
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x4ad98e
mov rcx, rsi
xor edx, edx
call fcn.004a8a70
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.004a8a70
test al, al
jne 0x4ada28
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4ad8b2
lea rdx, [0x00536a22]
mov r8d, 1
call fcn.0042ac60
test al, al
jne 0x4ada28
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x4ad86a
xor r14d, r14d
lea rbx, [0x0053c509]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x4ad8e4
cmp byte [rax + rcx], 0x45
je 0x4ada51
sub r14, 1
jb 0x4ad909
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4ad909
mov r8d, 2
mov rdx, rbx
call fcn.0042ac60
test al, al
jne 0x4ada28
mov rcx, rsi
call fcn.004ada60
test al, al
jne 0x4ada28
mov rax, qword [rsi]
test rax, rax
jne 0x4ad8d0
jmp 0x4ad86a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x4ad9ef
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x4ad982
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x4ad96c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x4ad95b
add dl, 0xa9
jmp 0x4ad96a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x4ad9ef
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x4ad9ef
movzx edx, bl
add rax, rdx
jae 0x4ad930
jmp 0x4ad9ef
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x4ad9ef
cmp rax, rcx
jae 0x4ad9ec
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x4ada30
cmp qword [rsi + 0x20], 0
je 0x4ada4a
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.004ad800
mov edi, eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
cmp al, 2
jne 0x4ad86a
jmp 0x4ada28
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x4ada3f
lea rax, [0x005369e9]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.0042ac60
test al, al
je 0x4ada3f
mov dil, 2
jmp 0x4ad86a
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x4ad9fa
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x4ad86a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x4ad86a
Function at 0x4b0ab3
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0xa8], 0x400010
mov rax, qword [rcx + 8]
test rax, rax
je 0x4b0b1c
mov edx, dword [rcx + 0x10]
mov dword [rsp + 0x88], edx
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x4b0b51
mov rdx, qword [rcx + 0x28]
xor r8d, r8d
lea r9, [0x00563920]
xor r10d, r10d
cmp rdx, r8
je 0x4b0b49
movzx r11d, byte [rax + r8]
or r10d, dword [r9 + r11*4]
inc r8
jmp 0x4b0b36
mov dword [rsp + 0x98], r10d
mov r14, qword [rcx + 0x38]
mov r15, qword [rcx + 0x40]
lea rsi, [r15*8]
test r15, r15
je 0x4b0b9c
xor ebx, ebx
mov rax, r15
shr rax, 0x3c
sete al
jne 0x4b0c74
mov bl, al
shl rbx, 3
mov rcx, rsi
mov rdx, rbx
call fcn.00455ede
mov rdi, rax
test rax, rax
jne 0x4b0ba1
mov rcx, rsi
mov rdx, rbx
jmp 0x4b0c85
mov edi, 8
xor eax, eax
mov rcx, rsi
test rcx, rcx
je 0x4b0bbc
mov rdx, qword [r14 + rax*8]
mov qword [rdi + rax*8], rdx
inc rax
add rcx, 0xfffffffffffffff8
jmp 0x4b0ba6
lea rcx, [rsp + 0x60]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, [0x00536e16]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x4b0c12
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x4b0c41
movaps xmm6, xmmword [rsp + 0x50]
mov ecx, 0x20
mov edx, 8
call fcn.00403370
test rax, rax
je 0x4b0c7b
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
movups xmmword [rbx + 0x10], xmm6
xor r14d, r14d
test r15, r15
je 0x4b0c57
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call fcn.004342d3
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.00403940
ud2
mov ecx, 0x20
mov edx, 8
call fcn.004043b0
ud2

Function at 0x4b0e9b
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x4b0ec4
mov rdx, qword [rsp + 0x20]
jmp 0x4b0ecc
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret

Function at 0x4b1bbb
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg1 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x4b1bd7
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg2 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret
Function at 0x4b3fa3
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x4b3fcf
xor eax, eax
jmp 0x4b3fd4
call fcn.004562dd
nop
add rsp, 0x38
ret

Function at 0x4b3ffe
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov r8d, dword [rdx + 0x80]
call sub.ws2_32.dll_connect
test eax, eax
je 0x4b401b
add rsp, 0x28
jmp fcn.004562dd
xor eax, eax
add rsp, 0x28
ret
Function at 0x4b71b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x60
mov byte [rsp + 0x37], 0
mov rax, qword [0x005760b0]
cmp rax, 3
jne 0x4b71d4
cmp byte [rsp + 0x37], 0
je 0x4b71e5
add rsp, 0x60
pop rsi
ret
lea rcx, [rsp + 0x37]
call fcn.004eab70
cmp byte [rsp + 0x37], 0
jne 0x4b71ce
mov ecx, dword [0x00502128]
test ecx, ecx
je 0x4b7241
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x4b725a
mov rsi, rax
cmp byte [rax + 8], 0
je 0x4b725a
add rsi, 9
mov rax, qword [0x00576078]
cmp rax, rsi
jne 0x4b733d
mov eax, dword [0x005760a8]
inc eax
jne 0x4b735d
lea rcx, [0x00537522]
lea r8, [0x00537568]
mov edx, 0x26
call fcn.0042c3b0
ud2
lea rcx, [0x00502110]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x4b71fc
mov ecx, dword [0x00502128]
test ecx, ecx
je 0x4b72a8
dec ecx
call sub.kernel32.dll_TlsGetValue
test rax, rax
je 0x4b72c0
mov rsi, rax
cmp rax, 1
jne 0x4b7323
lea rax, [0x0053add8]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_repos_rust_1.70.0_library_std_src_thread_local.rs
lea r9, [0x0053adb8]
lea r8, [rsp + 0x38]
mov edx, 0x46
call fcn.0042c510
ud2
lea rcx, [0x00502110]
call fcn.004dae70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4b7270
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x4b72e4
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x4b7458
mov rcx, rax
mov qword [0x00576170], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x4b7458
mov rsi, rax
lea rax, [0x00502110]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x00502128]
test ecx, ecx
je 0x4b741a
dec ecx
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
mov word [rsi + 8], 1
add rsi, 9
mov rax, qword [0x00576078]
cmp rax, rsi
je 0x4b7219
lea rcx, [0x00576070]
call sub.kernel32.dll_TryAcquireSRWLockExclusive
test al, al
je 0x4b71ce
mov qword [0x00576078], rsi
mov eax, 1
mov dword [0x005760a8], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov word [rsp + 0x5c], 0
cmp qword [0x00576080], 0
jne 0x4b742d
mov qword [0x00576080], 0xffffffffffffffff
lea rcx, [0x00576088]
call fcn.004d9e10
cmp qword [0x00576088], 0
je 0x4b73d1
mov r8, qword [0x00576090]
mov rcx, qword [0x00576170]
xor edx, edx
call sub.kernel32.dll_HeapFree
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [0x00576098], xmm1
movups xmmword [0x00576088], xmm0
inc qword [0x00576080]
dec dword [0x005760a8]
jne 0x4b71ce
mov qword [0x00576078], 0
lea rcx, [0x00576070]
call sub.kernel32.dll_ReleaseSRWLockExclusive
nop
add rsp, 0x60
pop rsi
ret
lea rcx, [0x00502110]
call fcn.004dae70
mov ecx, eax
jmp 0x4b731b
lea rax, [0x00537508]
mov qword [rsp + 0x20], rax
lea rcx, str.already_borrowed
lea r9, [0x0053ac80]
lea r8, [rsp + 0x38]
mov edx, 0x10
call fcn.0042c510
ud2
mov ecx, 0x10
mov edx, 8
call fcn.004043b0
ud2
Function at 0x4b8720
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1088
call fcn.004ff140
sub rsp, rax
movaps xmmword [rsp + 0x1070], xmm6
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
lea rbx, [rsp + 0x70]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x30]
mov qword [rsp + 0x58], r13
lea rbp, [0x004e97d0]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x4b88bb
mov r14d, 0xffffffff
lea rbx, [rsp + 0x40]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4b87be
cmp dword [rsp + 0x34], 0
jne 0x4b88c0
mov r15d, dword [rsp + 0x38]
test r15, r15
je 0x4b88c0
cmp r15d, 0x1000
ja 0x4b8900
xor r12d, r12d
nop dword [rax]
mov r8, r15
sub r8, r12
lea rdx, [rsp + r12]
add rdx, 0x70
cmp r8, r14
cmovae r8, r14
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov r9, rbx
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x4b88bb
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.kernel32.dll_SleepEx
cmp dword [rsp + 0x30], 0
je 0x4b8850
cmp dword [rsp + 0x34], 0
jne 0x4b88c0
mov eax, dword [rsp + 0x38]
add r12, rax
cmp r12, r15
je 0x4b887d
jbe 0x4b8800
jmp 0x4b88ec
mov dword [rsp + 0x30], 0
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea rdx, [rsp + 0x70]
mov r8d, 0x1000
mov r9, rbx
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x4b87be
call sub.kernel32.dll_GetLastError
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x1070]
add rsp, 0x1088
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.library_std_src_sys_windows_pipe.rs
mov rcx, r12
mov rdx, r15
call fcn.00431150
jmp 0x4b8914
lea r8, str.library_std_src_sys_windows_pipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.00430740
ud2
Function at 0x4b9360
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rsi, rcx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
movaps xmm0, xmmword [0x005037f0]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.004c67b0
mov rdi, rdx
test rax, rax
je 0x4b941d
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x4b9411
mov rbx, rdi
dec rbx
mov rcx, qword [rdi - 1]
mov rax, qword [rdi + 7]
call qword [rax]
mov rax, qword [rdi + 7]
cmp qword [rax + 8], 0
je 0x4b9400
mov r8, qword [rbx]
cmp qword [rax + 0x10], 0x11
jb 0x4b93f2
mov r8, qword [r8 - 8]
mov rcx, qword [0x00576170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov qword [rsi], 0
jmp 0x4b9588
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.004c69c0
cmp dword [rsp + 0x40], 2
jne 0x4b94a6
mov r14, qword [rsp + 0x48]
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x4b9487
lea rbx, [r14 - 1]
mov rcx, qword [r14 - 1]
mov rax, qword [r14 + 7]
call qword [rax]
mov rax, qword [r14 + 7]
cmp qword [rax + 8], 0
je 0x4b9476
mov r8, qword [rbx]
cmp qword [rax + 0x10], 0x11
jb 0x4b9468
mov r8, qword [r8 - 8]
mov rcx, qword [0x00576170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov qword [rsi], 0
mov rcx, rdi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.kernel32.dll_CloseHandle
mov r12, qword [rsp + 0x68]
test rdi, rdi
je 0x4b94f8
mov qword [rsp + 0x40], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x4b9574
mov rbx, qword [rsp + 0x40]
jmp 0x4b94fa
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x4b9563
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x4b9563
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x4b9580
mov qword [rsi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x4b9580
call sub.kernel32.dll_GetLastError
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x4c0330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x4c0360
test ecx, ecx
jne 0x4c03b0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x4c036c
test ecx, ecx
jne 0x4c03b0
mov rcx, rdi
call fcn.004c0210
movzx eax, al
test bpl, bpl
jne 0x4c03b7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x4c03a3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x004c0528]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x4c03a3.2
xor eax, eax
test bpl, bpl
je 0x4c037c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x4c0509
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x4c03ea
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x4c0469
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x4c0430
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x4c044b
inc rax
dec rdi
cmp rax, 1
jne 0x4c0410
jmp 0x4c0469
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x4c044b
cmp ebx, 0x5c
je 0x4c044b
inc rax
dec rdi
cmp rax, 1
jne 0x4c0430
jmp 0x4c0469
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x4c0517
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x4c0493
mov al, 9
cmp rdx, 2
je 0x4c0497
cmp rdx, 1
jne 0x4c04a7
cmp byte [r8], 0x2e
jne 0x4c04a7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x4c04a7
mov al, 0xa
jmp 0x4c04a7
cmp byte [r8], 0x2e
jne 0x4c04a7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x4c03a3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x4c03a3.2
mov ecx, 2
jmp case.0x4c03a3.2
lea r8, str.library_std_src_path.rs
call fcn.004307d0
ud2
lea r8, str.library_std_src_path.rs
call fcn.004307d0
ud2
Function at 0x4c6020
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x005761b8]
cmp rax, 3
jne 0x4c6147
cmp rbx, 0x17f
ja 0x4c6159
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea r8, [rbx + 1]
cmp rbx, 0xe
ja 0x4c6099
lea rcx, [rbx + 1]
xor eax, eax
xor edx, edx
nop
cmp byte [rsp + rdx + 0x68], 0
je 0x4c60ac
inc rdx
cmp rcx, rdx
jne 0x4c6080
mov rdx, r8
test rax, rax
jne 0x4c60b6
jmp 0x4c6110
lea rdx, [rsp + 0x68]
xor ecx, ecx
call fcn.00430270
test rax, rax
jne 0x4c60b6
jmp 0x4c6110
mov eax, 1
test rax, rax
je 0x4c6110
cmp rdx, rbx
jne 0x4c6110
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4c6124
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x4c6137
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x4c613a
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.004eab00
cmp rbx, 0x17f
jbe 0x4c6058
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x4e8a90
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.00403bc0
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x4e8aee
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x4e8b65
mov rcx, qword [0x00576170]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.kernel32.dll_HeapFree
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x4e8b73
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x4e8b65
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
jne 0x4e8b54
jmp 0x4e8b65