joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4978de
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x18]
cmp eax, 0xffffffff
jne 0x497992
lea rax, [0x0051dc35]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 8], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x497b22
mov eax, dword [rbp + 0x20]
add eax, 1
movsxd rax, eax
mov r10, rax
mov rcx, r10
call fcn.00449f3d
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov eax, dword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
cmp eax, 0
jge 0x497a75
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call fcn.0044af6f
lea rax, [0x0051dc36]
mov qword [rbp - 0x60], rax
mov eax, 0
mov dword [rbp - 0x58], eax
mov eax, 1
mov dword [rbp - 0x54], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x60]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x50]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x497b22
mov eax, dword [rbp - 0x34]
movsxd rax, eax
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov eax, 0
mov byte [rcx], al
mov eax, dword [rbp - 0x34]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
lea rax, [rbp - 0x88]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00456eb4
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x68], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x64]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x78]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x497b22
leave
ret
Function at 0x4978e9
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x18]
cmp eax, 0xffffffff
jne 0x497992
lea rax, [0x0051dc35]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 8], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x497b22
mov eax, dword [rbp + 0x20]
add eax, 1
movsxd rax, eax
mov r10, rax
mov rcx, r10
call fcn.00449f3d
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov eax, dword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
cmp eax, 0
jge 0x497a75
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call fcn.0044af6f
lea rax, [0x0051dc36]
mov qword [rbp - 0x60], rax
mov eax, 0
mov dword [rbp - 0x58], eax
mov eax, 1
mov dword [rbp - 0x54], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x60]
mov r11, rax
lea rax, [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x40], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x50]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x497b22
mov eax, dword [rbp - 0x34]
movsxd rax, eax
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov eax, 0
mov byte [rcx], al
mov eax, dword [rbp - 0x34]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
lea rax, [rbp - 0x88]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00456eb4
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
lea rax, [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x68], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x64]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x18
mov r8, rcx
lea rcx, [rbp - 0x78]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x497b22
leave
ret
Function at 0x4a4018
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x0051df79]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0051df7b]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00457a0b
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00466ea0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
jne 0x4a415f
mov eax, 0
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4a4190
mov eax, dword [rbp - 0x44]
and eax, 0x10
cmp eax, 0
je 0x4a417f
mov eax, 1
mov byte [rbp - 0x46], al
movzx eax, byte [rbp - 0x46]
jmp 0x4a4190
mov eax, 0
mov byte [rbp - 0x47], al
movzx eax, byte [rbp - 0x47]
jmp 0x4a4190
leave
ret
Function at 0x4a4023
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x0051df79]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0051df7b]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00457a0b
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00466ea0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
jne 0x4a415f
mov eax, 0
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4a4190
mov eax, dword [rbp - 0x44]
and eax, 0x10
cmp eax, 0
je 0x4a417f
mov eax, 1
mov byte [rbp - 0x46], al
movzx eax, byte [rbp - 0x46]
jmp 0x4a4190
mov eax, 0
mov byte [rbp - 0x47], al
movzx eax, byte [rbp - 0x47]
jmp 0x4a4190
leave
ret
Function at 0x4a4192
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x0051df7d]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0051df7f]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00457a0b
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00466ea0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
je 0x4a42da
mov eax, dword [rbp - 0x44]
and eax, 0x400
cmp eax, 0
jne 0x4a42e1
mov eax, 0
jmp 0x4a42e6
mov eax, 1
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4a42f2
leave
ret
Function at 0x4a419d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x0051df7d]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x0051df7f]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00457a0b
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00466ea0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
je 0x4a42da
mov eax, dword [rbp - 0x44]
and eax, 0x400
cmp eax, 0
jne 0x4a42e1
mov eax, 0
jmp 0x4a42e6
mov eax, 1
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4a42f2
leave
ret

Function at 0x4a42f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 4], al
mov eax, 0
mov byte [rbp - 3], al
mov eax, 2
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00466ea0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, 0xffffffff
je 0x4a43ae
mov eax, dword [rbp - 8]
and eax, 0x10
cmp eax, 0
je 0x4a4394
mov eax, 1
mov byte [rbp - 2], al
mov eax, dword [rbp - 8]
and eax, 0x400
cmp eax, 0
je 0x4a43ae
mov eax, 1
mov byte [rbp - 1], al
movsx eax, word [rbp - 2]
leave
ret
Function at 0x4a42ff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 4], al
mov eax, 0
mov byte [rbp - 3], al
mov eax, 2
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00466ea0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, 0xffffffff
je 0x4a43ae
mov eax, dword [rbp - 8]
and eax, 0x10
cmp eax, 0
je 0x4a4394
mov eax, 1
mov byte [rbp - 2], al
mov eax, dword [rbp - 8]
and eax, 0x400
cmp eax, 0
je 0x4a43ae
mov eax, 1
mov byte [rbp - 1], al
movsx eax, word [rbp - 2]
leave
ret
Function at 0x4b521e
Capabilities:
Get hostname

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rbp + 0x10], rcx
mov eax, 0
mov word [rbp - 0x1fe], ax
movabs rax, 0x1fc
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1fc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0xff
mov dword [rbp - 0x204], eax
lea rax, [rbp - 0x204]
mov r11, rax
lea rax, [rbp - 0x1fe]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetComputerNameW
mov byte [rbp - 0x205], al
movzx eax, byte [rbp - 0x205]
cmp eax, 0
jne 0x4b5310
call sub.kernel32.dll_GetLastError
mov r11, rax
lea rax, [rbp - 0x228]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004b2ef4
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x228]
mov r11, rax
lea rax, [rbp - 0x218]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x218]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b537a
lea rax, [rbp - 0x1fe]
mov r11, rax
lea rax, [rbp - 0x248]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00466fa7
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x248]
mov r11, rax
lea rax, [rbp - 0x238]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x238]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4b8f4c
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x4b8f57
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x4b8f8c
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
add rax, 0x10
mov ecx, dword [rax]
mov r11, rcx
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GenerateConsoleCtrlEvent
mov eax, 0x14
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x4b8f97
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
add rax, 0x10
mov ecx, dword [rax]
mov r11, rcx
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GenerateConsoleCtrlEvent
mov eax, 0x14
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret
Function at 0x4b9842
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10f0
call fcn.005151d8
nop
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x4b98db
lea rax, [0x0051e7db]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9b28
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x4b9907
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x4b9925
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x4b9995
lea rax, [0x0051e7dc]
mov qword [rbp - 0x50], rax
mov eax, 0
mov dword [rbp - 0x48], eax
mov eax, 1
mov dword [rbp - 0x44], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x50]
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9b28
mov eax, 0
mov dword [rbp - 0x54], eax
mov eax, 0
mov byte [rbp - 0x1054], al
movabs rax, 0xfff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1053]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x400
mov r11, rax
lea rax, [rbp - 0x1098]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042e782
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x1098]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov byte [rbp - 0x1099], al
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x54]
mov r9, rax
mov eax, 0x3e8
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
mov byte [rbp - 0x1099], al
mov eax, dword [rbp - 0x54]
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042e882
movzx eax, byte [rbp - 0x1099]
cmp eax, 0
je 0x4b9aa2
mov eax, dword [rbp - 0x54]
cmp eax, 0
jne 0x4b9aa7
jmp 0x4b9aac
jmp 0x4b9a16
lea rax, [rbp - 0x1078]
mov r11, rax
lea rax, [rbp - 0x10c0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042f261
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10c0]
mov r11, rax
lea rax, [rbp - 0x10b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
call fcn.0042f454
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10b0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4b984d
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10f0
call fcn.005151d8
nop
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x4b98db
lea rax, [0x0051e7db]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9b28
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x4b9907
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x4b9925
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x4b9995
lea rax, [0x0051e7dc]
mov qword [rbp - 0x50], rax
mov eax, 0
mov dword [rbp - 0x48], eax
mov eax, 1
mov dword [rbp - 0x44], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x50]
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4b9b28
mov eax, 0
mov dword [rbp - 0x54], eax
mov eax, 0
mov byte [rbp - 0x1054], al
movabs rax, 0xfff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1053]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x400
mov r11, rax
lea rax, [rbp - 0x1098]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042e782
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x1098]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov byte [rbp - 0x1099], al
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x54]
mov r9, rax
mov eax, 0x3e8
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
mov byte [rbp - 0x1099], al
mov eax, dword [rbp - 0x54]
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042e882
movzx eax, byte [rbp - 0x1099]
cmp eax, 0
je 0x4b9aa2
mov eax, dword [rbp - 0x54]
cmp eax, 0
jne 0x4b9aa7
jmp 0x4b9aac
jmp 0x4b9a16
lea rax, [rbp - 0x1078]
mov r11, rax
lea rax, [rbp - 0x10c0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0042f261
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10c0]
mov r11, rax
lea rax, [rbp - 0x10b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
call fcn.0042f454
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10b0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret