joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6742
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x848
lea rdx, str.loading
mov r12, rcx
mov rcx, qword [0x0053bb30]
call fcn.004d0399
mov rdx, r12
mov rcx, rax
call fcn.0052ea90
mov rcx, rax
call fcn.004d075f
mov rax, qword [r12]
lea rdx, [0x005370f4]
lea rcx, [rax + 4]
call sub.msvcrt.dll_fopen
mov r13, rax
test rax, rax
jne 0x4b67c5
mov rcx, qword [0x0053bb20]
lea rdx, str.could_not_open
call fcn.004d0399
mov rdx, r12
mov rcx, rax
call fcn.0052ea90
mov rcx, rax
call fcn.004d075f
jmp 0x4b68fe
mov ecx, 0x58
lea r15, [rsp + 0x38]
call sub.msvcrt.dll_malloc
mov r12, rax
mov rcx, rax
call fcn.0047afdc
mov dword [r12 + 0x50], 2
mov rcx, r13
call sub.msvcrt.dll_feof
mov ebx, eax
test eax, eax
jne 0x4b6902
lea rbp, [rsp + 0x40]
mov r9, r13
mov r8d, 0x800
mov edx, 1
mov rcx, rbp
call sub.msvcrt.dll_fread
mov rsi, rax
mov edi, eax
test eax, eax
je 0x4b6902
lea r14, [0x0053724b]
cmp ebx, edi
jge 0x4b67e8
movsxd rdx, ebx
mov r8d, edi
mov rcx, r12
add rdx, rbp
sub r8d, ebx
call fcn.0047b062
test eax, eax
jle 0x4b6858
mov rcx, r12
add ebx, eax
call fcn.0047b130
test rax, rax
jne 0x4b6885
cmp esi, ebx
je 0x4b67e8
mov rcx, qword [0x0053bb20]
lea rdx, str.parse_error
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
mov rcx, r12
call fcn.004b5e90
mov rcx, r12
call fcn.004d4108
jmp 0x4b68fe
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x4b6902
mov eax, dword [rax + 0x10]
sub eax, 2
cmp eax, 1
ja 0x4b68ba
cmp dword [rdx + 0x10], 2
jne 0x4b68b1
mov rcx, r15
mov qword [rsp + 0x28], rdx
call method.CService.CService_JSNode_
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x4b6899
mov rcx, r12
call fcn.004b5e90
mov rcx, r12
call fcn.004d4108
mov ecx, 0x58
call sub.msvcrt.dll_malloc
mov r12, rax
mov rcx, rax
call fcn.0047afdc
mov r8d, 3
mov rdx, r14
mov rcx, r12
call fcn.0047b062
mov dword [r12 + 0x50], 2
jmp 0x4b6829
xor eax, eax
jmp 0x4b691c
mov rcx, r13
call sub.msvcrt.dll_fclose
mov rcx, r12
call fcn.004b5e90
mov rcx, r12
call fcn.004d4108
mov al, 1
add rsp, 0x848
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x4b6930
Capabilities:
Create directory
Get file attributes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
lea r13, [rsp + 0x38]
mov r12, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, r13
call fcn.004adcf9
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0
je 0x4b69ad
mov rdx, qword [rsi]
mov dword [rsp + 0x20], ebx
lea r8, [rax + 4]
lea rcx, [0x005ea4e0]
lea r9, [rdx + 4]
lea rdx, str._s_s__u
call sub.msvcrt.dll_sprintf
lea rcx, [0x005ea4e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
jne 0x4b699c
xor edx, edx
lea rcx, [0x005ea4e0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [0x005ea4e0]
mov rcx, r12
call fcn.004cdfee
jmp 0x4b69b5
mov rcx, r12
call fcn.004cdf4c
mov rcx, r13
call fcn.004cddea
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x4b6a47
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
mov r12, rcx
lea rsi, [rsp + 0x34]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r14, rax
mov r9, rsi
mov r8d, 4
mov rcx, rax
call rbx
test eax, eax
jne 0x4b6abb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x0053bb30]
lea rdx, str.read_len_failed
mov r13d, eax
call fcn.004d0399
mov edx, r13d
mov rcx, rax
call fcn.004d0482
jmp 0x4b6ad5
cmp dword [rsp + 0x34], 3
ja 0x4b6aea
mov rcx, qword [0x0053bb30]
lea rdx, str.bad_read_len
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
mov rcx, r12
call fcn.00429106
jmp 0x4b6bb1
lea r15, [rsp + 0x40]
lea r13, [rsp + 0x38]
mov rcx, r15
call fcn.004cebd6
mov edx, dword [rsp + 0x30]
mov r8, r13
mov rcx, r15
mov byte [rsp + 0x38], 0
call fcn.004cee62
mov r8d, dword [rsp + 0x30]
mov r9, rsi
mov rcx, r14
mov qword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x40]
call rbx
test eax, eax
jne 0x4b6b58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x0053bb30]
lea rdx, str.read_msg_failed
mov r13d, eax
call fcn.004d0399
mov edx, r13d
mov rcx, rax
call fcn.004d0482
jmp 0x4b6b77
mov r8d, dword [rsp + 0x30]
cmp dword [rsp + 0x34], r8d
jae 0x4b6b89
mov rcx, qword [0x0053bb30]
lea rdx, str.read_trimmed_msg
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
mov rcx, r12
call fcn.00429106
jmp 0x4b6ba9
mov rdx, qword [rsp + 0x40]
mov rcx, r13
call fcn.0042aff0
mov rcx, r12
mov rdx, r13
call fcn.0042a5a2
mov rcx, r13
call fcn.00429bd8
mov rcx, r15
call fcn.004cebe6
mov rax, r12
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4beffd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
xor eax, eax
mov r10, rdx
mov r11d, r8d
lea rbx, [rsp + 0x30]
mov edx, dword [rcx + rax*4]
mov dword [rbx + rax*4], edx
inc rax
cmp r9d, eax
ja 0x4bf015
mov r8d, r9d
mov rsi, rbx
lea rdi, [0x0053ac00]
xor ecx, ecx
lea rdx, str.cw
lea eax, [r8 - 1]
mov eax, dword [rsp + rax*4 + 0x30]
mov dword [rsp + 0x2c], eax
test ecx, ecx
jne 0x4bf08d
ror eax, 8
inc rdi
movzx ebp, al
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2c], bpl
movzx ebp, ah
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2d], bpl
mov ebp, eax
shr eax, 0x18
shr ebp, 0x10
mov al, byte [rdx + rax]
movzx ebp, bpl
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2f], al
movzx eax, byte [rdi - 1]
mov byte [rsp + 0x2e], bpl
xor dword [rsp + 0x2c], eax
jmp 0x4bf0cc
cmp ecx, 4
jne 0x4bf0cc
cmp r9d, 8
jne 0x4bf0cc
movzx ebp, al
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2c], bpl
movzx ebp, ah
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2d], bpl
mov ebp, eax
shr eax, 0x18
shr ebp, 0x10
mov al, byte [rdx + rax]
movzx ebp, bpl
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2f], al
mov byte [rsp + 0x2e], bpl
mov eax, dword [rsi]
inc ecx
xor eax, dword [rsp + 0x2c]
mov dword [rbx + r8*4], eax
cmp r9d, ecx
jne 0x4bf0df
xor ecx, ecx
inc r8
add rsi, 4
cmp r11d, r8d
ja 0x4bf039
xor r9d, r9d
mov ecx, r9d
shl rcx, 2
lea rdx, [rbx + rcx]
add rcx, r10
call fcn.004bebc0
add r9d, 4
cmp r11d, r9d
ja 0x4bf0f2
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x00598970]
mov r9d, 4
mov r8d, 0x2c
mov r10, rdx
mov qword [rcx], rax
lea rdx, [rcx + 8]
mov rcx, r10
jmp 0x4beffd
Function at 0x4bf11a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
xor eax, eax
mov r10, rdx
mov r11d, r8d
lea rbx, [rsp + 0x30]
mov edx, dword [rcx + rax*4]
mov dword [rbx + rax*4], edx
inc rax
cmp r9d, eax
ja 0x4bf015
mov r8d, r9d
mov rsi, rbx
lea rdi, [0x0053ac00]
xor ecx, ecx
lea rdx, str.cw
lea eax, [r8 - 1]
mov eax, dword [rsp + rax*4 + 0x30]
mov dword [rsp + 0x2c], eax
test ecx, ecx
jne 0x4bf08d
ror eax, 8
inc rdi
movzx ebp, al
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2c], bpl
movzx ebp, ah
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2d], bpl
mov ebp, eax
shr eax, 0x18
shr ebp, 0x10
mov al, byte [rdx + rax]
movzx ebp, bpl
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2f], al
movzx eax, byte [rdi - 1]
mov byte [rsp + 0x2e], bpl
xor dword [rsp + 0x2c], eax
jmp 0x4bf0cc
cmp ecx, 4
jne 0x4bf0cc
cmp r9d, 8
jne 0x4bf0cc
movzx ebp, al
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2c], bpl
movzx ebp, ah
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2d], bpl
mov ebp, eax
shr eax, 0x18
shr ebp, 0x10
mov al, byte [rdx + rax]
movzx ebp, bpl
mov bpl, byte [rdx + rbp]
mov byte [rsp + 0x2f], al
mov byte [rsp + 0x2e], bpl
mov eax, dword [rsi]
inc ecx
xor eax, dword [rsp + 0x2c]
mov dword [rbx + r8*4], eax
cmp r9d, ecx
jne 0x4bf0df
xor ecx, ecx
inc r8
add rsi, 4
cmp r11d, r8d
ja 0x4bf039
xor r9d, r9d
mov ecx, r9d
shl rcx, 2
lea rdx, [rbx + rcx]
add rcx, r10
call fcn.004bebc0
add r9d, 4
cmp r11d, r9d
ja 0x4bf0f2
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x00598970]
mov r9d, 4
mov r8d, 0x2c
mov r10, rdx
mov qword [rcx], rax
lea rdx, [rcx + 8]
mov rcx, r10
jmp 0x4beffd

Function at 0x4bf1d6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push rbx
mov eax, 0x3020100
mov r9, rcx
mov dword [r9], eax
add eax, 0x4040404
add r9, 4
cmp eax, 0x4030200
jne 0x4bf1e0
xor eax, eax
xor r10d, r10d
xor r9d, r9d
mov r11d, r10d
movzx esi, byte [rcx + rax]
inc r10d
movzx r11d, byte [rdx + r11]
mov ebx, esi
add r11d, esi
add r9d, r11d
movzx r9d, r9b
cmp r10d, r8d
jne 0x4bf21e
xor r10d, r10d
mov r11d, r9d
mov sil, byte [rcx + r11]
mov byte [rcx + rax], sil
inc rax
mov byte [rcx + r11], bl
cmp rax, 0x100
jne 0x4bf1fb
mov qword [rcx + 0x100], 1
pop rbx
pop rsi
ret
Function at 0x4c118c
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x005ea900], 0
mov rsi, rcx
mov r12, rdx
mov rbx, r8
jne 0x4c1279
mov ecx, 0x40
call sub.msvcrt.dll_malloc
xor edx, edx
lea r8, [0x0053b040]
mov qword [0x005ea908], rax
movzx ecx, byte [r8 + rdx]
mov byte [rax + rcx], dl
inc rdx
cmp rdx, 0x40
jne 0x4c11cd
mov ecx, 0x800
lea rbp, [0x0053af20]
lea rdi, [0x0053b040]
call sub.msvcrt.dll_malloc
xor r10d, r10d
mov qword [0x005ea900], rax
mov r11d, r10d
lea r13d, [r10*4]
xor r9d, r9d
shl r11, 3
mov edx, r9d
mov ecx, r9d
lea r14, [0x0053b020]
shr edx, 3
and ecx, 7
add rdx, r11
shl ecx, 2
mov r8d, dword [rbp + rdx*4]
xor edx, edx
shr r8d, cl
mov ecx, r13d
and r8d, 0xf
shl r8d, cl
movzx ecx, byte [r14]
mov r15d, r8d
add edx, edx
inc r14
shr r15d, cl
mov ecx, r15d
and ecx, 1
or edx, ecx
cmp rdi, r14
jne 0x4c123f
rol edx, 1
mov dword [rax + r9*4], edx
inc r9
cmp r9, 0x40
jne 0x4c1212
inc r10d
add rax, 0x100
cmp r10d, 8
jne 0x4c1200
lea r8, [0x0053b040]
mov edx, 0x20
mov rcx, r12
call fcn.004c1155
mov edx, 0x20
lea r8, [0x0053b060]
mov rcx, r12
rol eax, 1
mov ebp, eax
call fcn.004c1155
mov rdi, qword [0x005ea900]
xor r10d, r10d
rol eax, 1
mov edx, eax
mov r11d, r10d
mov r12, rdi
mov r8d, ebp
xor r9d, r9d
add r11, r11
mov eax, r9d
mov ecx, r9d
mov r15d, edx
shr eax, 2
and ecx, 3
imul ecx, ecx, 6
add rax, r11
mov eax, dword [rsi + rax*4 + 8]
shr eax, cl
lea ecx, [r9*4]
inc r9d
ror r15d, cl
xor eax, r15d
and eax, 0x3f
xor r8d, dword [r12 + rax*4]
add r12, 0x100
cmp r9d, 8
jne 0x4c12c2
inc r10d
mov ebp, edx
cmp r10d, 0x10
je 0x4c1312
mov edx, r8d
jmp 0x4c12b3
mov ecx, r8d
lea r13, [rsp + 0x28]
ror ecx, 1
call fcn.004c1150
ror edx, 1
mov dword [rsp + 0x28], eax
mov ecx, edx
call fcn.004c1150
mov r8, qword [0x005ea908]
mov rcx, r13
mov edx, 0x20
mov dword [rsp + 0x2c], eax
call fcn.004c1155
mov edx, 0x20
mov rcx, r13
mov r12d, eax
add r8, 0x20
call fcn.004c1155
mov ecx, r12d
mov r8d, eax
call fcn.004c1150
mov dword [rbx], eax
mov ecx, r8d
call fcn.004c1150
mov dword [rbx + 4], eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x4d0ff4
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx + 0x138]
call sub.msvcrt.dll__read
mov edx, 0
test eax, eax
cmovs eax, edx
add rsp, 0x28
ret

Function at 0x4d1378
Capabilities:
Write file on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov r12b, 1
mov rax, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
mov rsi, rax
sub rsi, rdx
mov rbx, rcx
cmp eax, edx
je 0x4d13d2
mov rcx, qword [rcx + 0x138]
mov dword [rsp + 0x3c], 0
lea r9, [rsp + 0x3c]
mov r8d, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x3c], esi
je 0x4d13c9
xor r12d, r12d
jmp 0x4d13d2
neg esi
movsxd rsi, esi
add qword [rbx + 0x28], rsi
mov eax, r12d
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x4d2770
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004d4200
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.004d4200
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x4d27e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x005eb004]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x4d2988
mov rax, qword [0x005eb008]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x4d282c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x4d28b7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x4d2810
mov rcx, r12
call fcn.004d34e0
mov rbp, rax
test rax, rax
je 0x4d29c2
mov rax, qword [0x005eb008]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.004d3610
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x005eb008]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4d29d1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4d28b0
sub eax, 4
and eax, 0xfffffffb
jne 0x4d2940
add dword [0x005eb004], 1
cmp ebx, 8
jae 0x4d28e8
test bl, 4
jne 0x4d2990
test ebx, ebx
je 0x4d28d9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x4d29b0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x4d28d9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x4d291a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x005eb008]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4d28b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004d2770
nop dword [rax]
xor edi, edi
jmp 0x4d2837
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x4d28d9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x4d28d9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.004d2770
mov rax, qword [0x005eb008]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.004d2770
nop
nop dword [rax]
Function at 0x4d3150
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005eb2e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x005eb2c0]
test rbx, rbx
je 0x4d31a4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4d319b
test r12, r12
je 0x4d319b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4d3180
lea rcx, [0x005eb2e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4d34e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0053b9c0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x4d3559
mov rcx, r10
call fcn.004d33b0
test eax, eax
je 0x4d3559
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x4d3556
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x4d354d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x4d3559
add r8, 0x28
cmp r8, r9
jne 0x4d3538
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x4e6100
Capabilities:
Delete file
Move file

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x170
xor r12d, r12d
lea r13, [rsp + 0x28]
mov rbx, rcx
mov rbp, rdx
mov rsi, r8
mov rcx, r13
call fcn.004adf47
mov rax, qword [rsp + 0x28]
lea rdx, [0x00535ddb]
mov qword [rsp + 0x40], 0
lea rcx, [rax + 4]
call sub.msvcrt.dll_fopen
mov qword [rsp + 0x38], rax
test rax, rax
je 0x4e632b
mov rax, qword [rsi]
lea rsi, [rsp + 0x38]
cmp dword [rax], 0
je 0x4e61f7
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rsi
xor edi, edi
mov dword [rsp + 0x30], 0x4011f00d
call fcn.00517380
lea rdx, str.ERROR:_could_not_write_magic
test al, al
je 0x4e61c2
call sub.msvcrt.dll_rand
lea r12, [rsp + 0x48]
mov dword [r12 + rdi*4], eax
inc rdi
cmp rdi, 4
jne 0x4e618f
mov r8d, 0x20
mov rdx, r12
mov rcx, rsi
call fcn.00517380
test al, al
jne 0x4e61db
lea rdx, str.ERROR:_could_not_write_nonce
mov rcx, qword [0x0053bb30]
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
jmp 0x4e62f0
lea rdi, [rsp + 0x68]
lea r8, [rbx + 0xa0]
mov rdx, r12
mov rcx, rdi
call fcn.00515830
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, rsi
mov dword [rsp + 0x20], 0xc01df00d
call fcn.00517380
mov r12d, eax
test al, al
jne 0x4e6239
mov rcx, qword [0x0053bb30]
lea rdx, str.ERROR:_could_not_write_magic
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
jmp 0x4e632b
mov rax, qword [rbx + 0x28]
lea r12, [rsp + 0x48]
add rbx, 0x20
lea r14, [rsp + 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x30]
cmp rdi, rbx
je 0x4e62f5
mov rcx, r12
call fcn.004cebd6
lea rcx, [rdi + 0x20]
mov rdx, r12
call fcn.004299ac
mov rax, qword [rsp + 0x50]
mov rdx, r14
mov rcx, rsi
sub rax, qword [rsp + 0x48]
mov r8d, 4
mov dword [rsp + 0x24], eax
call fcn.00517380
test al, al
jne 0x4e629e
lea rdx, str.ERROR:_could_not_write_size
jmp 0x4e62bb
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.00517380
test al, al
jne 0x4e62d9
lea rdx, str.ERROR:_could_not_write_msg
mov rcx, qword [0x0053bb30]
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
mov rcx, r12
call fcn.004cebe6
jmp 0x4e62f0
mov rcx, r12
call fcn.004cebe6
lea rcx, [rsp + 0x30]
call fcn.004cf0aa
jmp 0x4e6250
xor r12d, r12d
jmp 0x4e632b
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], 0
mov r8d, 3
add rdx, 4
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
setne r12b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x4e633a
call sub.msvcrt.dll_fclose
mov rcx, r13
call fcn.004cddea
mov eax, r12d
add rsp, 0x170
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4f50a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
mov rbx, qword [0x0053bba0]
lea r8, [0x00537366]
mov edx, 0x66
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rbx]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, r12
mov rcx, qword [rbx]
mov r13, rax
lea r12, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r13
lea r13, [rsp + 0x38]
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, dword [rsp + 0x2c]
mov rcx, r12
mov rdx, rax
call fcn.004cdfe2
lea rdx, str.RouterOS_Credits
mov rcx, r13
call fcn.004cdfee
mov rdx, r12
mov rcx, r13
call sym.winbox.exe_createBigMessageBox_string_const__string_const_
mov rbx, rax
test rax, rax
je 0x4f5139
mov rax, qword [rax]
mov rdx, qword [rax - 0x18]
add rdx, rbx
inc dword [rdx + 8]
mov rcx, r13
call fcn.004cddea
mov rcx, r12
call fcn.004cddea
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov rax, qword [rbx]
add rbx, qword [rax - 0x18]
mov rcx, rbx
call fcn.00514360
nop
add rsp, 0x40
pop rbx
pop r12
pop r13
ret

Function at 0x4f5360
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r12, rcx
lea r13, [rsp + 0x60]
lea rdi, [rsp + 0x50]
mov rsi, rdx
mov rcx, r13
lea rbp, [r12 + 0x1c0]
lea r14, [rsp + 0x58]
call fcn.004ceac0
mov rdx, r13
mov rcx, rbp
call fcn.004ade13
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp rbx, qword [rsp + 0x28]
je 0x4f5490
lea rdx, str..viw
mov rcx, rbx
call fcn.004b6701
test al, al
je 0x4f5487
lea rdx, str.settings.cfg.viw
mov rcx, rbx
call fcn.004b5ace
test al, al
jne 0x4f5487
lea r8, [0x005370a0]
mov rdx, rsi
lea r15, [rsp + 0x40]
mov rcx, rdi
call fcn.004b59fc
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call fcn.004b5ae1
mov rax, qword [rsp + 0x58]
mov rdx, rbp
mov rcx, r15
lea r8, [0x005370a0]
lea r10, [rax + 4]
mov qword [rsp + 0x38], r10
call fcn.004b59fc
lea r11, [rsp + 0x48]
mov r8, rbx
mov rdx, r15
mov rcx, r11
mov qword [rsp + 0x30], r11
call fcn.004b5ae1
mov r10, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov r8d, 3
mov rdx, r10
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r11, qword [rsp + 0x30]
mov rcx, r11
call fcn.004cddea
mov rcx, r15
call fcn.004cddea
mov rcx, r14
call fcn.004cddea
mov rcx, rdi
call fcn.004cddea
add rbx, 8
jmp 0x4f53af
lea r15, [rsp + 0x58]
mov rcx, r15
call fcn.004b6a09
mov rax, qword [rsp + 0x58]
lea rdx, [0x00537480]
lea rcx, [rax + 4]
call sub.msvcrt.dll_fopen
mov rcx, r15
mov r14, rax
call fcn.004cddea
test r14, r14
je 0x4f54e4
mov rdx, rsi
mov rcx, r12
call fcn.004f6ef0
mov rcx, qword [rsi]
mov rdx, r14
add rcx, 4
call sub.msvcrt.dll_fputs
mov rcx, r14
call sub.msvcrt.dll_fclose
mov rcx, r13
call fcn.004b6ef2
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4f8500
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x78
lea r12, [rsp + 0x68]
lea r15, [rcx + 0x190]
mov r13, rcx
lea r14, [rsp + 0x48]
mov rcx, r12
lea rbx, [rsp + 0x50]
call fcn.004cdf4c
mov r9, r12
mov rdx, r15
mov rcx, r14
mov r8d, 0x200003f0
call fcn.00428d90
mov rcx, r12
call fcn.004cddea
mov rcx, r12
call fcn.004cdf4c
mov r9, r12
mov rdx, r15
mov rcx, rbx
mov r8d, 0x200003ef
call fcn.00428d90
mov rcx, r12
call fcn.004cddea
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0
je 0x4f858c
mov r8, r14
mov rdx, rbx
mov rcx, r13
call fcn.004f7b70
jmp 0x4f868c
mov rcx, r12
lea r15, [rsp + 0x58]
call fcn.004b69cb
mov rdx, r12
mov rcx, r15
call fcn.004b5ec6
mov rcx, r12
call fcn.004cddea
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0
jne 0x4f85f0
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.004adcf9
lea r8, str.Addresses.cdb
mov rdx, rsi
mov rcx, r12
call fcn.004b59fc
mov rdx, r12
mov rcx, r15
call fcn.004ce2ae
mov rcx, r12
call fcn.004cddea
mov rcx, rsi
call fcn.004cddea
mov r8, r14
mov rdx, r15
mov rcx, r13
call fcn.004f7b70
mov rax, qword [rsp + 0x58]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 1
lea rcx, [rax + 4]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x4f867e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4f8684
lea r13, [rsp + 0x60]
mov rcx, r13
call fcn.004adcf9
lea r8, str.winbox.cfg
mov rdx, r13
mov rcx, r12
call fcn.004b59fc
mov rcx, r12
call fcn.004b5e14
mov rcx, r12
call fcn.004cddea
mov rcx, r13
call fcn.004cddea
jmp 0x4f8684
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.004cddea
mov rcx, rbx
call fcn.004cddea
mov rcx, r14
call fcn.004cddea
nop
add rsp, 0x78
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret