joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800fec00
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x1800fed5c
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd rbp, dword [rsp + 0x24]
mov qword [rsp + 0x28], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
test rbp, rbp
je 0x1800fed31
shl rbp, 3
mov esi, 8
xor r15d, r15d
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x78]
xor r12d, r12d
jmp 0x1800fecac
lea rax, [r12 + r12*2]
mov rcx, qword [rsp + 0x70]
mov qword [rsi + rax*8 + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + rax*8], xmm0
inc r12
mov qword [rsp + 0x38], r12
add r15, 8
cmp rbp, r15
je 0x1800fed31
mov r13, qword [rdi + r15]
mov rcx, r13
call fcn.18015ba18
lea rax, [rax*2]
add rax, r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], rax
mov word [rsp + 0x88], 0
mov qword [rsp + 0x48], 1
lea rax, [rsp + 0x50]
movups xmmword [rax], xmm6
mov rcx, rbx
mov rdx, r14
call fcn.1800fd100
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r12, qword [rsp + 0x30]
jne 0x1800fec80
lea rcx, [rsp + 0x28]
mov rdx, r12
call fcn.1800feef0
mov rsi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
jmp 0x1800fec80
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LocalFree]
test rax, rax
jne 0x1800fed44
call fcn.1801572a5
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
jmp 0x1800fed6a
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1800ff840
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx + 0x18]
test rdi, rdi
je 0x1800ff8d9
mov rbx, qword [rsi]
lea r14, [rbx + 0x10]
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
not eax
mov r15, qword [sym.imp.pdh.dll_PdhRemoveCounter]
jmp 0x1800ff8a1
lea ebp, [rax - 1]
and ebp, eax
tzcnt eax, eax
shl rax, 5
mov rcx, rbx
sub rcx, rax
mov rcx, qword [rcx - 8]
call r15
mov eax, ebp
dec rdi
je 0x1800ff8d9
test ax, ax
jne 0x1800ff880
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rbx, 0xfffffffffffffe00
add r14, 0x10
cmp ax, 0xffff
je 0x1800ff8b0
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
jmp 0x1800ff885
mov rcx, qword [rsi + 0x38]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1800ff8f1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x1800ff90c
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x1800ff91f
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1801572a5
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1800ff8ff
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.pdh.dll_PdhCloseQuery]
Function at 0x18010a4d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18010a6dd
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1801fb9d0]
test rcx, rcx
jne 0x18010a540
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18010a6dd
mov rcx, qword [rsp + 0x20]
mov qword [0x1801fb9d0], rcx
test rcx, rcx
je 0x18010a6e2
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x18010a556
mov rax, r14
xor edx, edx
div rcx
jmp 0x18010a55d
mov eax, r14d
xor edx, edx
div ecx
imul r9, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x18010a581
xor edx, edx
div rcx
mov r8, rax
jmp 0x18010a588
xor edx, edx
div ecx
mov r8d, eax
add r8, r9
mov rcx, r8
shr rcx, 9
movabs r14, 0x44b82fa09b5a53
mov rax, rcx
mul r14
mov r9, rdx
shr r9, 0xb
add r9, rbx
jb 0x18010a5da
mov rax, rcx
mul r14
shr rdx, 0xb
imul eax, edx, 0x3b9aca00
sub r8d, eax
add r8d, edi
cmp r8d, 0x3b9aca00
jb 0x18010a6a4
inc r9
jne 0x18010a6d4
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18010a6dd
mov rdi, qword [rsp + 0x20]
mov rcx, qword [0x1801fb9d0]
test rcx, rcx
jne 0x18010a638
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18010a6dd
mov rcx, qword [rsp + 0x20]
mov qword [0x1801fb9d0], rcx
test rcx, rcx
je 0x18010a6e2
mov rax, rdi
or rax, rcx
shr rax, 0x20
je 0x18010a64e
mov rax, rdi
xor edx, edx
div rcx
jmp 0x18010a654
mov eax, edi
xor edx, edx
div ecx
imul r9, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x18010a678
xor edx, edx
div rcx
mov r8, rax
jmp 0x18010a67f
xor edx, edx
div ecx
mov r8d, eax
add r8, r9
mov rax, r8
shr rax, 9
mul r14
mov r9, rdx
shr r9, 0xb
imul eax, r9d, 0x3b9aca00
sub r8d, eax
add r9, 0x38640900
mov eax, r8d
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
imul eax, eax, 0x3b9aca00
sub r8d, eax
mov rcx, rsi
mov rdx, r9
call fcn.180109ce0
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
add r8d, 0xc4653600
jmp 0x18010a6a4
call fcn.1801572a5
ud2
Function at 0x18012ceb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
cmp rbx, 0x20
jb 0x18012cf8d
mov rdx, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r11, r9
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r8, rdi
imul r10, rdi
imul r9, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r8, rsi
imul r10, rsi
sub r11, rax
rol r9, 0x1f
xor r11, r8
imul r11, rsi
imul r9, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
movabs r10, 0x85ebca77c2b2ae63
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r10, r11
jmp 0x18012cf9e
mov r10, qword [rcx + 0x18]
movabs rdx, 0x27d4eb2f165667c5
add r10, rdx
add r10, rbx
lea rdx, [rcx + 0x28]
mov rcx, r10
xor r9d, r9d
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.18012cdb0
Function at 0x18015f470
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18015f4a0
xor eax, eax
jmp 0x18015f563
mov rbp, rbx
cmp word [rax], si
je 0x18015f4c5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18015f4ac
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18015f4a8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18015f3c0
movsxd r14, eax
test eax, eax
jne 0x18015f503
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x18015f499
mov rcx, r14
call fcn.18015cd10
mov rdi, rax
test rax, rax
jne 0x18015f51c
xor ecx, ecx
call fcn.18015ccd4
jmp 0x18015f4f8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18015f3c0
test eax, eax
jne 0x18015f54d
mov rcx, rdi
call fcn.18015ccd4
jmp 0x18015f557
xor ecx, ecx
call fcn.18015ccd4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180164c60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180164c88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180164c88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x401310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rdi, rsp
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
xor eax, eax
mov word [rsp + 0x50], ax
jmp 0x4013d8
movzx eax, word [rsp + 0x50]
inc ax
mov word [rsp + 0x50], ax
movzx eax, word [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp eax, dword [rcx + 0x18]
jae 0x401439
movzx eax, word [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.00401d50
cmp eax, dword [rsp + 0x78]
jne 0x401437
movzx eax, word [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x40143b
jmp 0x4013cb
xor eax, eax
add rsp, 0x60
pop rdi
ret

Function at 0x401450
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x60]
mov rax, qword gs:[0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
sub rax, 0x10
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmp qword [rax], rcx
je 0x401513
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
call fcn.00401cc0
cmp eax, dword [rsp + 0x60]
jne 0x4014f1
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x30]
jmp 0x401515
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
cmp qword [rax], rcx
jne 0x401504
xor eax, eax
jmp 0x401515
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
jmp 0x4014b5
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x401cc0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov dword [rsp], 0x1505
mov dword [rsp + 4], 0
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x20]
add rax, 2
mov qword [rsp + 0x20], rax
cmp dword [rsp + 8], 0
je 0x401d41
cmp dword [rsp + 4], 0x41
jl 0x401d2f
cmp dword [rsp + 4], 0x5a
jg 0x401d2f
mov eax, dword [rsp + 4]
add eax, 0x20
mov dword [rsp + 4], eax
mov eax, dword [rsp]
shl eax, 5
add eax, dword [rsp]
add eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x401ced
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret

Function at 0x401d50
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov dword [rsp], 0x1505
mov dword [rsp + 4], 0
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp dword [rsp + 8], 0
je 0x401dd0
cmp dword [rsp + 4], 0x41
jl 0x401dbe
cmp dword [rsp + 4], 0x5a
jg 0x401dbe
mov eax, dword [rsp + 4]
add eax, 0x20
mov dword [rsp + 4], eax
mov eax, dword [rsp]
shl eax, 5
add eax, dword [rsp]
add eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x401d7d
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret
Function at 0x4781f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x47fc90
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.0047fb20
lea rcx, [rsp + 0x40]
call fcn.0047fc50
movzx eax, al
test eax, eax
jne 0x47fcd8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.0047fb40
mov rax, qword [rsp + 0x70]
jmp 0x47fea9
lea rcx, [rsp + 0x40]
call fcn.0047fc30
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.0047fbe0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.0047fc30
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.0047f9f0
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x47fd7e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.0047fb40
mov rax, qword [rsp + 0x80]
jmp 0x47fea9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.00471b70
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.004058e0
lea rcx, [rsp + 0x48]
call fcn.00405980
movzx eax, al
test eax, eax
jne 0x47fde5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.00405920
lea rcx, [rsp + 0x40]
call fcn.0047fb40
mov rax, qword [rsp + 0x88]
jmp 0x47fea9
lea rcx, [rsp + 0x48]
call fcn.00405a70
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.0047fc30
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.0047f9f0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x47fe7b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.00405920
lea rcx, [rsp + 0x40]
call fcn.0047fb40
mov rax, qword [rsp + 0xa0]
jmp 0x47fea9
lea rcx, [rsp + 0x48]
call fcn.00421b80
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.00405920
lea rcx, [rsp + 0x40]
call fcn.0047fb40
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x48ad00
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.00489fb0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x48ad67
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x004ae308]
jmp 0x48ad89
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.0048b290
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x4970e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.0047cc00
lea rcx, [rsp + 0x48]
call fcn.0047cc00
call fcn.00477ae0
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.0047b480
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x49714f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.0047cd30
lea rcx, [rsp + 0x78]
call fcn.0047cd30
mov eax, dword [rsp + 0x24]
jmp 0x4971e0
call fcn.00477ae0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.0047b480
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x497196
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.0047cd30
lea rcx, [rsp + 0x78]
call fcn.0047cd30
mov eax, dword [rsp + 0x2c]
jmp 0x4971e0
lea rcx, [rsp + 0x48]
call fcn.0047d3f0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.0047d3f0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.0047cd30
lea rcx, [rsp + 0x78]
call fcn.0047cd30
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x4a4220
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.004ac160
sub rsp, rax
mov rax, qword [0x004d8008]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x004da1e0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x4a4412
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x4a4366
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x4a4366
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x4a434b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x4a42e8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a43d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x4a4431
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x4a440d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x4a4431
jmp 0x4a42be
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.004021a0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x4a4450
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.004ac160
sub rsp, rax
mov rax, qword [0x004d8008]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x004da1e0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x4a465d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x4a45a9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x4a45a9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x4a4589
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x4a4518
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a461d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x4a467c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x4a4658
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x4a467c
jmp 0x4a44ee
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.004021a0
add rsp, 0x1498
pop rdi
pop rsi
ret