joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5670
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rsi, rcx
lea rdi, [rsp + 0x80]
call fcn.0042f9e0
mov rbp, rax
movabs rax, 0x74696e6f4d6b7454
xor ecx, ecx
mov qword [rsp + 0x60], rax
movabs rax, 0x776f646e6957726f
mov rbx, qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rsp + 0x68], rax
movabs rax, 0x74696e6f4d6b7454
mov edx, 0x7f00
mov qword [rsp + 0x80], rax
movabs rax, 0x7373616c43726f
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x88], rax
lea rax, [0x004a5560]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 0x50
mov dword [rsp + 0xa4], 3
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb0], 0
mov dword [rsp + 0xb4], 0
mov qword [rsp + 0xb8], rbp
call rbx
xor ecx, ecx
mov edx, 0x7f00
mov qword [rsp + 0xc0], rax
call rbx
xor ecx, ecx
mov edx, 0x7f00
mov qword [rsp + 0xe8], rax
xor ebx, ebx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0xd0], 5
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe0], rdi
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x4a582a
mov r9d, 0xcf0000
lea r8, [rsp + 0x60]
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
mov r8, rsi
mov edx, 0xffffffeb
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rcx, rbx
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
lea r8, [0x004a5550]
mov rdx, rbx
mov rcx, rsi
call fcn.00414d30
mov rdx, rbx
mov rcx, rsi
call fcn.004a64c0
mov rdx, rbx
mov rcx, rsi
call fcn.004a7550
xor eax, eax
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4a7550
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov r13, rdx
mov rbp, rcx
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.uxtheme.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x4a77ea
mov r12, qword [0x00670bd0]
mov ecx, 0x50
mov rax, qword [r12]
call qword [rax + 0x28]
lea rdx, str.OpenThemeData
mov rdi, rax
mov rcx, rbx
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
test rax, rax
mov qword [rdi], rax
je 0x4a77e0
lea rdx, str.CloseThemeData
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 8], rax
je 0x4a77e0
lea rdx, str.GetThemePartSize
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 0x10], rax
je 0x4a77e0
lea rdx, str.GetThemeSysSize
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 0x18], rax
je 0x4a77e0
lea rdx, str.DrawThemeBackground
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 0x20], rax
je 0x4a77e0
lea rdx, str.GetThemeTextExtent
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 0x30], rax
je 0x4a77e0
lea rdx, str.DrawThemeText
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 0x28], rax
je 0x4a77e0
lea rdx, str.IsThemeActive
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 0x38], rax
je 0x4a77e0
lea rdx, str.IsAppThemed
mov rcx, rbx
call rsi
test rax, rax
mov qword [rdi + 0x40], rax
je 0x4a77e0
lea rdx, str.winnative
mov qword [rdi + 0x48], r13
mov rcx, rbp
call fcn.00415090
lea rdx, str.xpnative
mov r8, rax
mov rcx, rbp
call fcn.00414d90
mov r13, rax
mov eax, 1
test r13, r13
je 0x4a77cc
mov rax, qword [r12]
mov ecx, 0x10
call qword [rax + 0x28]
lea rdx, [0x004a66b0]
mov r8, rax
mov qword [rax + 8], rdi
mov qword [rax], rbx
mov rcx, r13
mov rsi, rax
call fcn.00415080
lea r8, [0x004a6f70]
mov rdx, rsi
mov rcx, rbp
call fcn.00414d30
lea r8, [0x004a6780]
lea rdx, str.vsapi
mov r9, rsi
mov rcx, rbp
call fcn.00415bb0
cmp dword [rsp + 0x30], 2
je 0x4a7800
cmp qword [0x00603500], 0
lea rsi, [0x00603500]
je 0x4a7787
mov rdx, qword [r12]
mov ecx, 0x40
call qword [rdx + 0x28]
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov r9, rax
mov qword [rax + 0x18], 0
mov qword [rax + 0x10], 0
mov rcx, r13
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
mov rbx, rax
add rsi, 0x38
call fcn.00415f50
lea r8, [0x004a66e0]
mov rdx, rbx
mov rcx, rbp
call fcn.00414d30
cmp qword [rsi], 0
jne 0x4a7733
mov r8, qword [0x00670e90]
lea rdx, str.Scale.trough
xor r9d, r9d
mov rcx, r13
call fcn.00415f50
lea rdx, [0x00603dc0]
mov rcx, r13
call fcn.0040e7a0
mov rax, qword [r12]
lea r8, [0x0064703e]
lea rdx, str.ttk::theme::xpnative
mov rcx, rbp
call qword [rax + 0x898]
xor eax, eax
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [r12]
mov rcx, rdi
call qword [rax + 0x30]
mov eax, 1
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp dword [rsp + 0x24], 5
jbe 0x4a7722
lea rdx, str.vista
mov r8, r13
mov rcx, rbp
call fcn.00414d90
test rax, rax
je 0x4a7722
lea rdx, [0x004a66b0]
mov r8, rsi
mov rcx, rax
call fcn.00415080
jmp 0x4a7722
Function at 0x4b8fb0
Capabilities:
Print debug messages

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor ecx, ecx
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
movzx eax, byte [rbx + 5]
mov byte [rsp + 0x23], 0
mov edx, 0x26
mov rcx, rsi
mov rbp, qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov byte [rsp + 0x20], al
movzx eax, byte [rbx + 7]
mov byte [rsp + 0x21], al
movzx eax, byte [rbx + 9]
mov byte [rsp + 0x22], al
call rbp
test ah, 1
je 0x4b9120
mov edx, 0x68
mov rcx, rsi
call rbp
movzx ebp, byte [rsp + 0x21]
mov r12d, eax
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rdi]
shl ebp, 8
or ebp, eax
movzx eax, byte [rsp + 0x22]
shl eax, 0x10
or ebp, eax
mov edx, ebp
call qword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov r8d, 1
mov r13d, eax
mov edx, eax
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
call qword [sym.imp.GDI32.dll_GetPaletteEntries]
mov ecx, dword [rdi + 8]
movzx edx, byte [rsp + 0x30]
movzx eax, byte [rsp + 0x31]
movzx r8d, byte [rsp + 0x32]
cmp r13d, ecx
jae 0x4b9085
movzx r9d, al
movzx r10d, dl
shl r9d, 8
or r9d, r10d
movzx r10d, r8b
shl r10d, 0x10
or r9d, r10d
cmp ebp, r9d
je 0x4b90c3
cmp r12d, ecx
jne 0x4b91a0
mov ecx, edx
shl ecx, 8
add edx, ecx
mov word [rbx + 4], dx
mov edx, eax
shl edx, 8
add eax, edx
mov word [rbx + 6], ax
mov eax, r8d
shl eax, 8
add r8d, eax
mov eax, dword [rsp + 0x30]
cmp r12d, r13d
mov word [rbx + 8], r8w
mov dword [rsp + 0x20], eax
jbe 0x4b91d0
movzx r8d, byte [rsp + 0x22]
movzx eax, byte [rsp + 0x20]
lea rcx, [rdi + 0x10]
shl r8d, 0x10
mov edx, r8d
movzx r8d, byte [rsp + 0x21]
or edx, 0x2000000
shl r8d, 8
or r8d, eax
or r8d, edx
mov edx, r8d
mov dword [rbx], r8d
lea r8, [rsp + 0x3c]
call qword [rdi + 0x58]
mov ecx, dword [rsp + 0x3c]
mov edx, 1
test ecx, ecx
jne 0x4b9113
mov edi, dword [rax + 0x18]
lea edx, [rdi + 1]
movsxd rdx, edx
mov qword [rax + 0x18], rdx
jmp 0x4b917d
movzx edx, byte [rsp + 0x21]
movzx eax, byte [rsp + 0x20]
mov rcx, rsi
shl edx, 8
or edx, eax
movzx eax, byte [rsp + 0x22]
shl eax, 0x10
or edx, eax
call qword [sym.imp.GDI32.dll_GetNearestColor]
mov r8d, eax
mov dword [rbx], eax
movzx eax, al
mov edx, eax
shl edx, 8
add eax, edx
mov word [rbx + 4], ax
mov eax, r8d
shr r8d, 0x10
shr ax, 8
movzx r8d, r8b
mov edx, eax
shl edx, 8
add eax, edx
mov word [rbx + 6], ax
mov eax, r8d
shl eax, 8
add r8d, eax
mov word [rbx + 8], r8w
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea edx, [rcx + 1]
mov rcx, qword [rdi]
mov dword [rdi + 8], edx
call qword [sym.imp.GDI32.dll_ResizePalette]
mov eax, dword [rdi + 8]
lea r9, [rsp + 0x20]
mov r8d, 1
mov rcx, qword [rdi]
lea edx, [rax - 1]
call qword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x4b90c3
lea rcx, str.XAllocColor:_Colormap_is_bigger_than_we_thought
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4b90c3
Function at 0x4bd290
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
mov rsi, qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edi, r8d
mov ebx, ecx
mov ebp, edx
mov ecx, ebx
xor edx, edx
call rsi
test edi, edi
mov r12d, eax
jne 0x4bd3a4
cmp ebx, 0x14
je 0x4bd3a4
lea eax, [rbx - 0x90]
cmp eax, 1
jbe 0x4bd3a4
mov ecx, ebx
mov edx, 2
call rsi
cmp eax, 0x7fff
mov ecx, 0xff20
jbe 0x4bd302
mov rax, rcx
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r13, [rsp + 0x40]
xor eax, eax
mov cx, 0x20
test bpl, 1
mov rdi, r13
rep stosq qword [rdi], rax
je 0x4bd31e
mov byte [rsp + 0x50], pe_nt_image_headers64
test bpl, 4
je 0x4bd329
mov byte [rsp + 0x51], pe_nt_image_headers64
test bpl, 0x10
je 0x4bd334
mov byte [rsp + 0x52], pe_nt_image_headers64
test bpl, 2
je 0x4bd33f
mov byte [rsp + 0x54], 1
test bpl, 0x20
je 0x4bd34d
mov byte [rsp + 0xd1], 1
and ebp, 8
je 0x4bd35a
mov byte [rsp + 0xd0], 1
lea r14, [rsp + 0x30]
mov dword [rsp + 0x20], 0
mov r8, r13
mov edx, r12d
mov ecx, ebx
mov rbp, qword [sym.imp.USER32.dll_ToAscii]
mov r9, r14
call rbp
test eax, eax
js 0x4bd430
cmp eax, 2
je 0x4bd44f
cmp eax, 1
jne 0x4bd3a4
movzx ecx, byte [rsp + 0x30]
cmp cl, 0x1f
jbe 0x4bd3a4
cmp cl, 0x7f
jne 0x4bd2ed
xor ecx, ecx
cmp ebx, 0x91
ja 0x4bd2ed
cmp ebx, 0x11
je 0x4bd410
cmp ebx, 0x12
je 0x4bd3f0
cmp ebx, 0x10
je 0x4bd3d1
lea rax, [0x0064c080]
mov rcx, qword [rax + rbx*8]
jmp 0x4bd2ed
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
mov ecx, 0xffe2
jne 0x4bd2ed
jmp 0x4bd3c1
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
mov ecx, 0xffea
jne 0x4bd2ed
jmp 0x4bd3c1
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
mov ecx, 0xffe4
jne 0x4bd2ed
jmp 0x4bd3c1
mov ecx, ebx
mov dword [rsp + 0x20], 0
mov r9, r14
mov r8, r13
mov edx, r12d
call rbp
mov ecx, 0xff20
jmp 0x4bd2ed
movsx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_VkKeyScanA]
movsx edi, ah
movzx ebx, al
xor edx, edx
mov r12d, edi
mov ecx, ebx
mov rdi, r13
call rsi
mov ecx, 0x20
mov edx, eax
xor eax, eax
test r12b, 1
rep stosq qword [rdi], rax
je 0x4bd483
mov byte [rsp + 0x50], pe_nt_image_headers64
test r12b, 2
je 0x4bd48e
mov byte [rsp + 0x51], pe_nt_image_headers64
and r12d, 4
je 0x4bd499
mov byte [rsp + 0x52], pe_nt_image_headers64
mov ecx, ebx
mov dword [rsp + 0x20], 0
mov r9, r14
mov r8, r13
call rbp
mov ecx, 0xff20
jmp 0x4bd2ed

Function at 0x4bd610
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
xor eax, eax
lea rcx, [0x0064c080]
test rdx, rdx
mov dword [r8 + 0x48], 0
jne 0x4bd63c
jmp 0x4bd646
add rax, 1
cmp rax, 0x92
je 0x4bd650
cmp qword [rcx + rax*8], rdx
jne 0x4bd630
mov dword [r8 + 0x48], eax
add rsp, 0x38
ret
cmp rdx, 0x1f
jle 0x4bd646
mov qword [rsp + 0x28], r8
movsx ecx, dl
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x4bd646
mov edx, eax
mov r8, qword [rsp + 0x28]
sar dx, 8
test dl, 1
je 0x4bd67f
or dword [r8 + 0x44], 1
test dl, 2
je 0x4bd689
or dword [r8 + 0x44], 4
and edx, 4
je 0x4bd693
or dword [r8 + 0x44], 0x10
movzx eax, al
jmp 0x4bd642
Function at 0x4bd6a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
xor eax, eax
lea rcx, [0x0064c080]
test rdx, rdx
jne 0x4bd6c0
jmp 0x4bd6e0
add rax, 1
cmp rax, 0x92
je 0x4bd6d0
cmp qword [rcx + rax*8], rdx
jne 0x4bd6b4
add rsp, 0x28
ret
cmp rdx, 0x1f
jg 0x4bd6e7
nop word cs:[rax + rax]
xor eax, eax
add rsp, 0x28
ret
movsx ecx, dl
call qword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x4bd6e0
movzx eax, al
jmp 0x4bd6c6

Function at 0x4bdad0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x130]
mov ebx, dword [rdx + 0x44]
mov rsi, rdx
test eax, eax
mov ebp, ebx
jne 0x4bdb40
mov ecx, dword [rsi + 0x48]
xor r8d, r8d
mov edx, ebx
call fcn.004bd290
test rax, rax
mov rdi, rax
jne 0x4bdb0a
test bl, 0x14
jne 0x4bdb50
test bpl, 1
jne 0x4bdb20
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, dword [rsi + 0x48]
mov edx, ebp
xor r8d, r8d
and edx, 0xfffffffe
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.004bd290
call fcn.004bd780
jmp 0x4bdaea
mov ecx, dword [rsi + 0x48]
and ebx, 0xffffffeb
xor r8d, r8d
mov edx, ebx
mov ebp, ebx
call fcn.004bd290
test rax, rax
je 0x4bdb04
mov rdi, rax
jmp 0x4bdb0a
Function at 0x4bf160
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rdi, qword [0x00670bd0]
mov rax, qword [rdx]
mov rbx, rdx
mov r12d, r8d
mov r13d, r9d
mov r15, qword [rdx + 0x130]
mov rbp, qword [rax + 0x40]
mov rax, qword [rdi]
call qword [rax + 0x568]
mov r14d, eax
mov rax, qword [rdi]
mov edx, 0xd8
lea rcx, [0x0069fb20]
call qword [rax + 0x998]
add dword [rax], 1
test byte [rbx + 0xff], 0x20
mov rsi, rax
jne 0x4bf2c5
mov rcx, rbx
call fcn.004d5fa0
test eax, eax
jne 0x4bf2c0
cmp qword [rbx], 0
je 0x4bf330
test rbp, rbp
je 0x4bf303
lea rbx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
mov rcx, rbp
mov r8, rbx
call fcn.0042b400
mov eax, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], edx
add eax, dword [rbp + 0x78]
add edx, dword [rbp + 0x7c]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], edx
mov rax, qword [rdi]
xor ecx, ecx
call qword [rax + 0x758]
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4bf2e5
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4bf2f9
xor edx, edx
lea rax, [rsp + 0x60]
mov r9d, r13d
mov r8d, r12d
mov rcx, r15
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 8]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rax, qword [rdi]
mov ecx, r14d
call qword [rax + 0x758]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
xor ecx, ecx
call fcn.00424d10
mov eax, dword [rsi]
test eax, eax
je 0x4bf2a9
mov dword [rsi], 0
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub dword [rsi], 1
jmp 0x4bf2a9
mov rax, qword [rdi]
mov rdx, rbx
lea rcx, [fcn.004bdbc0]
call qword [rax + 0x290]
mov rcx, rbx
call fcn.004bdbc0
jmp 0x4bf1c2
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4bf24a
mov edx, 2
jmp 0x4bf24c
lea eax, [r13 - 0x32]
lea rbx, [rsp + 0x50]
mov dword [rsp + 0x64], eax
lea eax, [r13 + 0x32]
mov dword [rsp + 0x6c], eax
lea eax, [r12 - 0x32]
mov dword [rsp + 0x60], eax
lea eax, [r12 + 0x32]
mov dword [rsp + 0x68], eax
jmp 0x4bf218
sub dword [rsi], 1
xor eax, eax
jmp 0x4bf2a9
Function at 0x4dffd0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x0069fbc8]
call fcn.00590ee0
lea rcx, [0x00651020]
call sub.msvcrt.dll_getenv
test rax, rax
mov rbx, rax
je 0x4e0060
mov rdx, qword [0x0069fbc0]
test rdx, rdx
je 0x4e000d
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4e0045
call sub.msvcrt.dll__tzset
mov rcx, qword [0x0069fbc0]
test rcx, rcx
je 0x4e0023
call fcn.004df2d0
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea ecx, [rax + 1]
call fcn.004df170
mov rdx, rbx
mov rcx, rax
mov qword [0x0069fbc0], rax
call sub.msvcrt.dll_strcpy
lea rcx, [0x0069fbc8]
add rsp, 0x20
pop rbx
jmp fcn.00590f50
cmp qword [0x0069fbc0], 0
je 0x4e0045
call sub.msvcrt.dll__tzset
mov rcx, qword [0x0069fbc0]
call fcn.004df2d0
mov qword [0x0069fbc0], 0
jmp 0x4e0045

Function at 0x55a6f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
movzx edi, byte [rcx]
movzx eax, byte [rdx]
mov r12d, 1
mov rbp, r8
nop dword [rax]
cmp dil, 0x30
jne 0x55a727
jmp 0x55a7d6
add rdx, 1
movzx eax, byte [rdx]
cmp al, 0x30
je 0x55a720
cmp dil, 0x2d
je 0x55a830
cmp al, 0x2d
je 0x55a884
xor r13d, r13d
test dil, 0xdf
je 0x55a850
mov rax, rcx
nop dword [rax]
add rax, 1
movzx edi, byte [rax]
test dil, 0xdf
jne 0x55a750
mov r8, rax
mov rsi, rax
sub r8, rcx
test byte [rdx], 0xdf
je 0x55a870
mov rax, rdx
add rax, 1
test byte [rax], 0xdf
jne 0x55a772
mov rbx, rax
sub rax, rdx
cmp r8, rax
jl 0x55a7e3
jg 0x55a87a
mov byte [rsi], 0
movzx r14d, byte [rbx]
mov byte [rbx], 0
call sub.msvcrt.dll_strcmp
test eax, eax
mov byte [rsi], dil
mov byte [rbx], r14b
js 0x55a7e3
jne 0x55a87a
movzx edi, byte [rsi]
test dil, dil
je 0x55a810
test r14b, r14b
lea rcx, [rsi + 1]
movzx edi, byte [rsi + 1]
jne 0x55a898
xor eax, eax
xor r12d, r12d
cmp dil, 0x30
mov rdx, rbx
jne 0x55a727
movzx edi, byte [rcx + 1]
add rcx, 1
jmp 0x55a710
mov eax, 0xffffffff
mov edx, r13d
neg edx
xor eax, edx
add eax, r13d
test rbp, rbp
je 0x55a7fb
mov dword [rbp], r12d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test r14b, r14b
je 0x55a7f2
lea rdx, [rbx + 1]
movzx eax, byte [rbx + 1]
mov rcx, rsi
xor r12d, r12d
jmp 0x55a710
cmp al, 0x2d
jne 0x55a88e
movzx edi, byte [rcx + 1]
add rdx, 1
add rcx, 1
mov r13d, 1
test dil, 0xdf
jne 0x55a74a
xor r8d, r8d
test byte [rdx], 0xdf
mov rsi, rcx
mov rbx, rdx
jne 0x55a76f
jmp 0x55a78c
mov rbx, rdx
xor eax, eax
jmp 0x55a781
mov eax, 1
jmp 0x55a7e8
mov eax, 1
jmp 0x55a7f2
mov eax, 0xffffffff
jmp 0x55a7f2
mov rsi, rcx
jmp 0x55a815
Function at 0x56cf30
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rbx, [0x006a0750]
lea rsi, [0x006a0840]
mov rcx, qword [rbx]
add rbx, 0x18
call fcn.005912c0
mov qword [rbx - 0x18], 0
cmp rbx, rsi
jne 0x56cf44
mov rcx, qword [0x006a0720]
call fcn.005912c0
mov rcx, qword [0x006a0728]
mov qword [0x006a0720], 0
call fcn.005912c0
xor ecx, ecx
mov qword [0x006a0728], 0
add rsp, 0x28
pop rbx
pop rsi
jmp 0x5913a0
sub rsp, 0x28
test rcx, rcx
je 0x5913d5
call fcn.0056c620
xor edx, edx
mov ecx, dword [0x006a1100]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x5913c5
add rsp, 0x28
ret
lea rcx, str.TlsSetValue_failed_from_TclpFreeAllocCache
add rsp, 0x28
jmp fcn.00552d60
mov eax, dword [0x006a1104]
test eax, eax
je 0x5913c0
mov ecx, dword [0x006a1100]
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
je 0x591400
mov dword [0x006a1104], 0
add rsp, 0x28
ret
lea rcx, str.TlsFree_failed_from_TclpFreeAllocCache
call fcn.00552d60
jmp 0x5913ef

Function at 0x580e60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rdx]
cmp dword [rcx], eax
mov rbp, rcx
mov rbx, rdx
mov rdi, r8
lea rsi, [rsp + 0x20]
jle 0x580e90
mov rdx, rcx
mov rcx, rsi
call fcn.0057e800
test eax, eax
jne 0x580ee1
mov r11d, dword [rbx]
jmp 0x580ea3
mov rcx, rsi
call fcn.0057e800
test eax, eax
jne 0x580ee1
mov r11d, dword [rbp]
mov rbx, rbp
test r11d, r11d
jle 0x580ec4
mov r9, qword [rsp + 0x30]
mov rbx, qword [rbx + 0x10]
xor eax, eax
mov r10d, dword [rbx + rax*4]
xor dword [r9 + rax*4], r10d
add rax, 1
cmp r11d, eax
jg 0x580eb3
mov rcx, rsi
call fcn.0057d850
mov rdx, rsi
mov rcx, rdi
call fcn.0057e640
mov rcx, rsi
call fcn.0057d8a0
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x581500
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x98
mov edx, 8
mov rsi, rcx
lea rcx, [0x006a0fa8]
lea rbx, [rsp + 0x28]
call fcn.0056c0c0
mov qword [rsp + 0x28], rax
mov rax, qword [rax]
test rax, rax
je 0x581534
cmp rax, rbx
jbe 0x581565
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rsp + 0x60]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x581580
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx]
test rax, rax
je 0x5815a1
mov qword [rsi], rax
mov eax, 1
add rsp, 0x98
pop rbx
pop rsi
ret
mov eax, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x28]
add rax, qword [rsp + 0x68]
add rax, 0x8000
mov qword [rdx], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x581565
mov eax, dword [rsp + 0x34]
sub eax, 1
not rax
and rbx, rax
mov qword [rdx], rbx
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x581565
Function at 0x5815c0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
mov rcx, qword [0x006a0f90]
call fcn.00517640
test ebx, ebx
jne 0x581610
cmp qword [0x00610ad0], 0
lea rax, [0x00610a00]
mov qword [0x006a0f90], 0
mov qword [0x006a2d80], rax
je 0x5817b0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x006108c0]
lea rdx, [0x006643f3]
xor ecx, ecx
mov qword [0x006a2d80], rax
call fcn.00518260
mov qword [0x006a0f90], rax
mov rax, qword [0x006a2d80]
cmp qword [rax + 0xd0], 0
jne 0x581601
lea rcx, str.kernel32
mov rdi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rdi
test rax, rax
mov rbx, rax
je 0x5816f2
mov rbp, qword [0x006a2d80]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rax
call rsi
mov qword [rbp + 0xd0], rax
mov rbp, qword [0x006a2d80]
lea rdx, str.CreateHardLinkW
mov rcx, rbx
call rsi
mov qword [rbp + 0xd8], rax
mov rbp, qword [0x006a2d80]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
call rsi
mov qword [rbp + 0xe0], rax
mov rbp, qword [0x006a2d80]
lea rdx, str.GetVolumeNameForVolumeMountPointW
mov rcx, rbx
call rsi
mov qword [rbp + 0xe8], rax
mov rbp, qword [0x006a2d80]
mov rcx, rbx
lea rdx, str.GetLongPathNameW
call rsi
mov rcx, rbx
mov qword [rbp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.advapi32
call rdi
test rax, rax
mov rbx, rax
je 0x581601
mov rdi, qword [0x006a2d80]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityW
mov rcx, rax
call rsi
mov qword [rdi + 0xf8], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.ImpersonateSelf
mov rcx, rbx
call rsi
mov qword [rdi + 0x100], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.OpenThreadToken
mov rcx, rbx
call rsi
mov qword [rdi + 0x108], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.RevertToSelf
mov rcx, rbx
call rsi
mov qword [rdi + 0x110], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.MapGenericMask
mov rcx, rbx
call rsi
mov qword [rdi + 0x118], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.AccessCheck
mov rcx, rbx
call rsi
mov qword [rdi + 0x120], rax
jmp 0x581834
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x581601
mov rsi, qword [0x006a2d80]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov rcx, rax
call rdi
mov qword [rsi + 0xd0], rax
mov rsi, qword [0x006a2d80]
lea rdx, str.CreateHardLinkA
mov rcx, rbx
call rdi
mov qword [rsi + 0xd8], rax
mov rsi, qword [0x006a2d80]
lea rdx, str.GetVolumeNameForVolumeMountPointA
mov rcx, rbx
mov qword [rsi + 0xe0], 0
mov qword [rsi + 0xf0], 0
call rdi
mov qword [rsi + 0xe8], rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
sub rsp, 0x28
call fcn.005814b0
sub eax, 2
xor ecx, ecx
cmp eax, 1
setbe cl
add rsp, 0x28
jmp 0x5815c0