joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax + 8], rbx
mov rbx, qword [rdx]
mov qword [rax + 0x10], rbp
cmp byte [rbx + 0x6d], 1
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov qword [rax - 8], r13
mov r12, r9
mov rbp, rdx
mov r13, r8
mov rdi, rcx
jne 0x4b34dd
cmp word [rbx + 0x48], 0
jne 0x4b33c0
movsx rax, word [rbx + 0x70]
lea r8, [rbx + 0x30]
mov rcx, qword [rbx + rax*8 + 0xa0]
movzx eax, word [rbx + rax*2 + 0x72]
mov r9, qword [rcx + 0x60]
mov r10, rax
movzx eax, byte [r9 + rax*2]
shl eax, 8
movsxd rdx, eax
movzx eax, byte [r9 + r10*2 + 1]
or rdx, rax
movzx eax, word [rcx + 0x14]
and rdx, rax
add rdx, qword [rcx + 0x50]
call fcn.0042d700
or byte [rbx + 0x6c], 2
mov rbx, qword [rbx + 0x30]
lea rax, [rbx - 1]
cmp rax, 0x7ffffffe
ja 0x4b34dd
mov rbp, qword [rbp]
mov word [rsp + 0x38], 0
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x50], 0
movzx eax, word [rbp + 0x44]
cmp ebx, eax
ja 0x4b340d
mov rdx, qword [rbp + 0x38]
mov word [rsp + 0x38], 0x1010
mov dword [rsp + 0x3c], ebx
mov qword [rsp + 0x40], rdx
jmp 0x4b34ac
lea edx, [rbx + 2]
mov word [rsp + 0x38], 1
test edx, edx
jle 0x4b3472
lea rcx, [rsp + 0x30]
xor r8d, r8d
call fcn.004415f0
test eax, eax
mov edi, eax
jne 0x4b34a3
mov r9, qword [rsp + 0x40]
mov r8d, ebx
xor edx, edx
mov rcx, rbp
mov dword [rsp + 0x20], 0
call fcn.004a3ea0
test eax, eax
mov edi, eax
jne 0x4b3485
mov rax, qword [rsp + 0x40]
mov ecx, ebx
mov byte [rcx + rax], dil
mov rax, qword [rsp + 0x40]
lea ecx, [rbx + 1]
mov byte [rcx + rax], dil
mov word [rsp + 0x38], 0x210
mov dword [rsp + 0x3c], ebx
jmp 0x4b349f
mov r9, qword [rsp + 0x48]
mov word [rsp + 0x38], 1
mov qword [rsp + 0x40], r9
jmp 0x4b3433
test word [rsp + 0x38], 0x2460
jne 0x4b3495
cmp dword [rsp + 0x50], 0
je 0x4b349f
lea rcx, [rsp + 0x30]
call fcn.0042e360
test edi, edi
je 0x4b34a7
mov eax, edi
jmp 0x4b3508
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x3c]
xor r9d, r9d
mov r8, r13
call fcn.0047b2a0
test word [rsp + 0x38], 0x2460
mov dword [r12], eax
jne 0x4b34cf
cmp dword [rsp + 0x50], 0
je 0x4b34d9
lea rcx, [rsp + 0x30]
call fcn.0042e360
xor eax, eax
jmp 0x4b3508
lea r9, [0x006a0b6c]
lea rdx, str.database_corruption_at_line__d_of___.10s_
mov r8d, 0x1065c
mov ecx, reloc.WS2_32.dll_inet_addr
mov dword [r12], 0
call fcn.00461f70
mov eax, reloc.WS2_32.dll_inet_addr
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x4e8fc0
Capabilities:
Hash data using crc32b

Disassembly:
mov qword [rsp + 0x20], rdi
xor eax, eax
mov r9d, 0xffffffff
mov rdi, rcx
xor r8d, r8d
test r9b, 1
je 0x4e8fea
mov ecx, Ordinal_33
mov edx, 1
sub ecx, r8d
shl edx, cl
or eax, edx
inc r8
shr r9d, 1
cmp r8, 0x20
jb 0x4e8fd3
cmp byte [0x00773000], 0
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], eax
lea rsi, [0x00772c00]
jne 0x4e90c0
mov qword [rsp + 0x10], rbx
xor bl, bl
nop
nop
xor r8d, r8d
mov cl, 0x80
test bl, cl
je 0x4e902e
btc r8d, 0x1f
bt r8d, 0x1f
jae 0x4e9041
add r8d, r8d
xor r8d, 0x4c11db7
jmp 0x4e9044
add r8d, r8d
shr cl, 1
jne 0x4e9025
xor r11d, r11d
xor r9d, r9d
nop
test r8b, 1
je 0x4e9068
mov ecx, Ordinal_33
mov edx, 1
sub ecx, r9d
shl edx, cl
or r11d, edx
inc r9
shr r8d, 1
cmp r9, 0x20
jb 0x4e9050
xor r10b, r10b
movzx r9d, bl
xor r8d, r8d
nop
test r9b, 1
je 0x4e9098
mov ecx, 7
mov edx, 1
sub ecx, r8d
shl dl, cl
or r10b, dl
inc r8
shr r9b, 1
cmp r8, 8
jb 0x4e9080
inc bl
movzx ecx, r10b
mov dword [rsi + rcx*4], r11d
jne 0x4e9020
mov rbx, qword [rsp + 0x10]
mov byte [0x00773000], 1
mov r8, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov rdi, qword [rsp + 0x20]
test r8, r8
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea r9, [r8 + rcx]
cmp r8, r9
jae 0x4e9103
movzx ecx, byte [rsp + 8]
movzx edx, byte [r8]
inc r8
xor rdx, rcx
mov ecx, eax
mov eax, dword [rsi + rdx*4]
shr ecx, 8
xor eax, ecx
cmp r8, r9
mov dword [rsp + 8], eax
jb 0x4e90e1
mov rsi, qword [rsp + 0x18]
not eax
ret
Function at 0x4e90e1
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rdi
xor eax, eax
mov r9d, 0xffffffff
mov rdi, rcx
xor r8d, r8d
test r9b, 1
je 0x4e8fea
mov ecx, Ordinal_33
mov edx, 1
sub ecx, r8d
shl edx, cl
or eax, edx
inc r8
shr r9d, 1
cmp r8, 0x20
jb 0x4e8fd3
cmp byte [0x00773000], 0
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], eax
lea rsi, [0x00772c00]
jne 0x4e90c0
mov qword [rsp + 0x10], rbx
xor bl, bl
nop
nop
xor r8d, r8d
mov cl, 0x80
test bl, cl
je 0x4e902e
btc r8d, 0x1f
bt r8d, 0x1f
jae 0x4e9041
add r8d, r8d
xor r8d, 0x4c11db7
jmp 0x4e9044
add r8d, r8d
shr cl, 1
jne 0x4e9025
xor r11d, r11d
xor r9d, r9d
nop
test r8b, 1
je 0x4e9068
mov ecx, Ordinal_33
mov edx, 1
sub ecx, r9d
shl edx, cl
or r11d, edx
inc r9
shr r8d, 1
cmp r9, 0x20
jb 0x4e9050
xor r10b, r10b
movzx r9d, bl
xor r8d, r8d
nop
test r9b, 1
je 0x4e9098
mov ecx, 7
mov edx, 1
sub ecx, r8d
shl dl, cl
or r10b, dl
inc r8
shr r9b, 1
cmp r8, 8
jb 0x4e9080
inc bl
movzx ecx, r10b
mov dword [rsi + rcx*4], r11d
jne 0x4e9020
mov rbx, qword [rsp + 0x10]
mov byte [0x00773000], 1
mov r8, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov rdi, qword [rsp + 0x20]
test r8, r8
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea r9, [r8 + rcx]
cmp r8, r9
jae 0x4e9103
movzx ecx, byte [rsp + 8]
movzx edx, byte [r8]
inc r8
xor rdx, rcx
mov ecx, eax
mov eax, dword [rsi + rdx*4]
shr ecx, 8
xor eax, ecx
cmp r8, r9
mov dword [rsp + 8], eax
jb 0x4e90e1
mov rsi, qword [rsp + 0x18]
not eax
ret
Function at 0x509060
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0xa8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
movzx esi, r8b
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x24], 0
xor eax, eax
mov byte [r11 + 0x10], al
lea rdx, [r11 + 0x10]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const____ptr64____ptr64]
mov dword [rsp + 0x24], 1
cmp qword [rbx + 0x10], 0
jne 0x5090f5
xor eax, eax
mov byte [rsp + 0x20], al
lea r8, [rsp + 0x20]
lea rdx, str.empty_name
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::runtime_error::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rdx, [0x00727f10]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll__CxxThrowException
nop
mov rcx, qword [rbx + 8]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea rax, [0x006a76e8]
lea rdx, [0x00698274]
test sil, sil
cmovne rdx, rax
call qword [sym.imp.msvcrt.dll_fopen]
mov rsi, rax
test rax, rax
je 0x509194
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fseek]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_ftell]
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fseek]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_long_long_unsigned___int64_____ptr64]
mov rbx, qword [rdi + 0x10]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.msvcp60.dll_public:_char____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, 1
call qword [sym.imp.msvcrt.dll_fread]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fclose]
mov rax, rdi
mov rbx, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
add rsp, 0xa8
ret
Function at 0x509210
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov rbx, rcx
xor eax, eax
mov qword [rsp + 0x68], rdi
mov rdi, rdx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x50], al
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const____ptr64____ptr64]
mov rcx, qword [rbx + 8]
lea rdx, [0x006a76fc]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.msvcrt.dll_fopen]
test rax, rax
mov rbx, rax
je 0x509288
mov rcx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov r9, rax
test rcx, rcx
mov edx, 1
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.msvcrt.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret

Function at 0x5092b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
test rcx, rcx
mov rdi, rdx
lea rdx, [0x006a7700]
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.msvcrt.dll_fopen]
test rax, rax
mov rbx, rax
je 0x50930f
mov rcx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov r9, rax
test rcx, rcx
mov edx, 1
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.msvcrt.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x509a80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rdi, rcx
mov dword [rsp + 0x24], 0
xor eax, eax
mov byte [r11 + 0x10], al
lea r9, [r11 + 0x10]
xor r8d, r8d
mov edx, 0x105
lea rcx, [r11 - 0x48]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_unsigned_long_long_unsigned___int64___char__class_std::allocator_char__const____ptr64____ptr64]
nop
mov ebx, dword [rsp + 0x40]
add ebx, 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_char____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x509b32
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
nop
mov rdx, rax
mov rcx, rdi
call fcn.0050edf0
nop
mov dword [rsp + 0x24], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rax, rdi
jmp 0x509b64
xor eax, eax
mov byte [rsp + 0x20], al
lea r8, [rsp + 0x20]
lea rdx, [0x006a7808]
mov rcx, rdi
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
nop
mov dword [rsp + 0x24], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rax, rdi
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
add rsp, 0x78
ret
Function at 0x50a380
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x24], 0
xor eax, eax
mov byte [rsp + 0x20], al
lea r9, [r11 - 0x58]
xor r8d, r8d
mov edx, reloc.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
lea rcx, [r11 - 0x48]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_unsigned_long_long_unsigned___int64___char__class_std::allocator_char__const____ptr64____ptr64]
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_char____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rdx, rax
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x50a442
xor eax, eax
mov byte [rsp + 0x21], al
mov rdx, qword [rsp + 0x38]
test rdx, rdx
cmove rdx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea r8, [rsp + 0x21]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.0050a230
nop
mov dword [rsp + 0x24], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rax, rdi
jmp 0x50a474
xor eax, eax
mov byte [rsp + 0x21], al
lea r8, [rsp + 0x21]
lea rdx, [0x00696800]
mov rcx, rdi
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64__class_std::allocator_char__const____ptr64____ptr64]
nop
mov dword [rsp + 0x24], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov rax, rdi
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
add rsp, 0x78
ret
Function at 0x50acc0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov rbx, rcx
cmp qword [rcx + 0x80], 0
jne 0x50ad7a
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
mov edx, 0x104
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDatabase::GetConnectInfo
mov rcx, rax
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CCmdUI::SetCheck
lea rdx, [0x006a7d10]
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_Ordinal_1287
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x50ad66
mov edx, 0x6a
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadCursorW]
test rax, rax
je 0x50ad66
mov rcx, rax
call qword [sym.imp.USER32.dll_CopyIcon]
mov qword [rbx + 0x80], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x40]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
jmp method..virtual_176
jmp qword [sym.imp.MFC42u.dll_RFX_Long]
Function at 0x50bd70
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x50cbd0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rsp + 0x58], 0
xor eax, eax
mov byte [rsp + 0x48], al
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x400
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_unsigned_long_long_unsigned___int64___char__class_std::allocator_char__const____ptr64____ptr64]
mov dword [rsp + 0x58], 1
mov rcx, qword [rbx + 0x10]
add ecx, 0xffffffff
mov dword [rsp + 0x50], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_char____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rdx, rax
lea r8, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x50cc4b
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_long_long_unsigned___int64_____ptr64]
mov rax, rbx
jmp 0x50cc63
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov r8, qword [r8]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x50cca0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rsp + 0x58], 0
xor eax, eax
mov byte [rsp + 0x48], al
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x400
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_unsigned_long_long_unsigned___int64___char__class_std::allocator_char__const____ptr64____ptr64]
mov dword [rsp + 0x58], 1
mov rcx, qword [rbx + 0x10]
add ecx, 0xffffffff
mov dword [rsp + 0x50], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_char____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x50cd1c
mov edx, dword [rsp + 0x50]
add edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_long_long_unsigned___int64_____ptr64]
mov rax, rbx
jmp 0x50cd34
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov r8, qword [r8]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x50d140
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x40], r13
mov rdi, rdx
mov rsi, rcx
mov ecx, 8
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x50d1ba
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx], rax
mov rcx, rbx
call fcn.0050a5a0
test al, al
jne 0x50d1bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [0x00727f68]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
xor edi, edi
mov rbx, rdi
test rbx, rbx
setne r12b
add rsi, 8
lea rax, [rsp + 0x30]
cmp rsi, rax
je 0x50d20a
mov r13, qword [rsi + 8]
cmp r13, rbx
je 0x50d1fc
cmp byte [rsi], 0
je 0x50d1f7
test r13, r13
je 0x50d1f7
mov rcx, r13
call fcn.0050a5b0
mov rcx, r13
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
mov byte [rsi], r12b
jmp 0x50d204
test r12b, r12b
je 0x50d204
mov byte [rsi], 1
mov qword [rsi + 8], rbx
jmp 0x50d225
test r12b, r12b
je 0x50d225
test rbx, rbx
je 0x50d225
mov rcx, rbx
call fcn.0050a5b0
mov rcx, rbx
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x50d241
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x50d241
xor al, al
jmp 0x50d243
mov al, 1
test al, al
sete al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x40]
add rsp, 0x48
ret