joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fc5a
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
mov eax, 0x9050
push rdi
push rsi
push rbx
call fcn.0046ba70
sub rsp, rax
cmp dword [rcx + 0x140], edx
mov rbx, rcx
mov rdi, r8
jne 0x45fd14
cmp dword [r8 + 8], 1
jne 0x45fcea
lea r9, [rsp + 0x1050]
mov rcx, qword [r8 + 0x10]
mov r8d, 0x7fff
mov rdx, r9
mov qword [rsp + 0x48], r9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
mov r9, qword [rsp + 0x48]
jne 0x45fccf
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
mov edx, eax
xor eax, eax
cmp edx, 0xcb
je 0x45fdd2
call rbx
jmp 0x45fdd2
cmp eax, 0x7fff
ja 0x45fd23
mov rdx, qword [rdi + 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdi + 0x18]
mov rcx, qword [rdi]
call qword [rdi + 0x20]
jmp 0x45fd0d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov r8d, 1
mov rbx, rax
mov rcx, rax
mov rdx, rdi
call sym.sigar_proc_env_parse
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x45fdd2
mov ecx, edx
call sym.open_process
test rax, rax
mov rbp, rax
jne 0x45fd2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45fdd2
lea rsi, [rsp + 0x1050]
mov rcx, rbx
mov r9d, 0x2000
mov rdx, rax
mov r8, rsi
call sym.sigar_proc_env_peb_get
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov eax, ebx
jne 0x45fdd2
lea r12, [rsp + 0x50]
mov ebp, 0x2000
mov rbx, rsi
cmp byte [rbx], 0
je 0x45fd0d
mov rcx, rbx
call sym.wcslen
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov r8, rbx
lea esi, [rax + rax + 2]
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call sym.sigar_proc_env_parse
test eax, eax
jne 0x45fd0d
mov eax, esi
add rbx, rax
sub ebp, esi
jne 0x45fd68
jmp 0x45fd0d
add rsp, 0x9050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x46004d
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x558
lea rbx, [rsp + 0x50]
mov rbp, rcx
mov rsi, rdx
mov ecx, 0x100
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea rdx, [rbp + 0x548]
mov edi, eax
mov r8d, 1
mov rcx, rbp
call sym.sigar_dllmod_init
test edi, edi
jne 0x46009f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46027a
lea r12, [rsp + 0x48]
mov rcx, rsi
call sym.sigar_file_system_list_create
cmp byte [rbx], 0
je 0x460278
mov dword [rsp + 0x48], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
lea eax, [rax - 2]
cmp eax, 4
ja case.default.0x4600e0
mov edx, eax
lea rax, [0x004894c4]
movsxd rdx, dword [rax + rdx*4]
add rax, rdx
jmp rax
mov r15d, 3
jmp 0x460108
mov r15d, 5
jmp 0x460108
mov r15d, 4
jmp 0x460108
mov r15d, 1
jmp 0x460108
mov r15d, 2
lea rax, [rsp + 0x44]
lea r13, [rsp + 0x150]
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x150], 0
mov dword [rsp + 0x38], 0x400
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov r9, r12
mov qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [rsp + 0x48], 0
jne 0x460159
cmp edi, 3
je case.0x4600e0.2
mov eax, dword [rsi + 4]
cmp dword [rsi], eax
jb 0x460168
mov rcx, rsi
call sym.sigar_file_system_list_grow
mov r14d, dword [rsi]
mov r8d, 0x104
mov rdx, rbx
lea eax, [r14 + 1]
imul r14, r14, 0x510
add r14, qword [rsi + 8]
mov dword [rsi], eax
mov dword [r14 + 0x508], r15d
lea r15, [r14 + 0x104]
mov rcx, r14
call sym.strncpy
mov byte [r14 + 0x103], 0
mov r8d, 0x104
mov rdx, rbx
mov rcx, r15
call sym.strncpy
cmp edi, 4
mov byte [r14 + 0x207], 0
jne 0x4601f5
mov rax, qword [rbp + 0x560]
test rax, rax
je 0x4601f5
mov dword [rsp + 0x4c], 0x104
mov byte [rsp + 0x42], 0x3a
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x43], 0
mov dl, byte [r14]
lea r8, [rsp + 0x4c]
mov byte [rsp + 0x41], dl
mov rdx, r15
call rax
mov rcx, r14
call sym.sigar_fs_type_get
cmp byte [rsp + 0x150], 0
lea rcx, [r14 + 0x308]
jne 0x46021d
lea rdx, [r14 + 0x208]
mov r8d, 0x100
jmp 0x460226
mov r8d, 0x100
mov rdx, r13
call sym.strncpy
test dword [rsp + 0x44], 0x80000
mov byte [r14 + 0x407], 0
lea rcx, [r14 + 0x408]
mov byte [r14 + 0x408], 0
lea rdx, [0x004894bc]
jne 0x46025a
lea rdx, [0x004894bf]
call sym.strcat
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rdx, rcx
not rdx
add rbx, rdx
jmp 0x4600ac
xor eax, eax
add rsp, 0x558
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4606bb
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rdi, rdx
mov rbx, r8
mov rsi, rcx
mov ecx, 1
call rbp
lea rdx, [rsp + 0x28]
mov r13d, eax
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov r12d, eax
mov ecx, r13d
call rbp
test r12d, r12d
jne 0x46070e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x460773
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
shr rdx, 0xa
shr rax, 0xa
mov qword [rbx + 0x68], rax
shr rcx, 0xa
sub rax, rdx
mov qword [rbx + 0x70], rdx
mov qword [rbx + 0x80], rcx
mov rdx, rbx
mov rcx, rsi
mov qword [rbx + 0x78], rax
call sym.sigar_file_system_usage_calc_used
movsd qword [rbx + 0x60], xmm0
mov qword [rbx + 0x88], 0xffffffffffffffff
mov qword [rbx + 0x90], 0xffffffffffffffff
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sym.mettle.exe_sigar_disk_usage_get
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x461768
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov r12d, dword [rcx + 8]
mov rbp, rcx
test r12b, 0x10
jne 0x46179b
mov eax, dword [rbp + 8]
mov edx, 0x4e21
and eax, 0x20
cmovne eax, edx
jmp 0x461981
mov rbx, qword [rcx]
xor r8d, r8d
mov dword [rsp + 0x30], 0
lea rdx, [rbx + 0x318]
mov rcx, rbx
call sym.sigar_dllmod_init
mov r9, qword [rbx + 0x380]
mov eax, 0x4e21
test r9, r9
je 0x461981
lea rdi, [rsp + 0x30]
xor r8d, r8d
xor ecx, ecx
mov rdx, rdi
call r9
cmp eax, 0x7a
jne 0x46180e
mov edx, dword [rsp + 0x30]
mov ecx, 1
call sym.calloc
xor r8d, r8d
mov rsi, rax
mov rdx, rdi
mov rcx, rax
call qword [rbx + 0x380]
test eax, eax
je 0x461821
mov rcx, rsi
call sym.free
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x461788
jmp 0x461981
mov eax, dword [rsi]
mov r13d, r12d
shr r13d, 1
xor r13d, 1
lea edi, [rax - 1]
mov al, r13b
and eax, 1
mov byte [rsp + 0x2f], al
test edi, edi
js 0x461974
movsxd r15, edi
imul r14, r15, 0x14
add r14, rsi
cmp byte [rsp + 0x2f], 0
mov ebx, dword [r14 + 4]
jne 0x46185c
cmp ebx, 2
je 0x46186f
test r12b, 1
je 0x46196d
cmp ebx, 2
je 0x46196d
imul r15, r15, 0x14
movzx ecx, word [r14 + 0xc]
mov r13, qword [sym.imp.WS2_32.dll_htons]
call r13
movzx eax, ax
dec ebx
mov dword [rsp + 0x34], eax
movzx ecx, word [rsi + r15 + 0x14]
call r13
movzx eax, ax
cmp ebx, 0xa
mov dword [rsp + 0x6c], 0x10
mov dword [rsp + 0x4c], eax
mov eax, dword [r14 + 8]
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x78], 0xffffffff
mov dword [rsp + 0x74], 0xffffffff
mov dword [rsp + 0x3c], eax
mov eax, dword [r14 + 0x10]
mov dword [rsp + 0x54], eax
ja case.default.0x4618e6
lea rax, [0x004896b0]
movsxd rdx, dword [rax + rbx*4]
add rax, rdx
jmp rax
mov dword [rsp + 0x70], 7
jmp 0x46195e
mov dword [rsp + 0x70], 0xa
jmp 0x46195e
mov dword [rsp + 0x70], 2
jmp 0x46195e
mov dword [rsp + 0x70], 3
jmp 0x46195e
mov dword [rsp + 0x70], 1
jmp 0x46195e
mov dword [rsp + 0x70], 4
jmp 0x46195e
mov dword [rsp + 0x70], 5
jmp 0x46195e
mov dword [rsp + 0x70], 8
jmp 0x46195e
mov dword [rsp + 0x70], 0xb
jmp 0x46195e
mov dword [rsp + 0x70], 9
jmp 0x46195e
mov dword [rsp + 0x70], 6
jmp 0x46195e
mov dword [rsp + 0x70], 0xe
lea rdx, [rsp + 0x34]
mov rcx, rbp
call qword [rbp + 0x18]
test eax, eax
jne 0x461974
dec edi
jmp 0x46183a
mov rcx, rsi
call sym.free
jmp 0x461788
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4623f0
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x34]
mov rbx, rdx
mov dword [rsp + 0x34], 0x9c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r12d, dword [rsp + 0x38]
cmp r12d, 4
je 0x462516
cmp r12d, 5
jne 0x462492
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x462478
jb 0x462528
lea rsi, str.Whistler_Server
cmp eax, 2
mov edx, 0
lea r15, str.2003
lea rdi, str.Windows_Unknown
lea rax, str.Windows_2003
cmovne rsi, rdx
lea rdx, str.Unknown
cmovne r15, rdx
jmp 0x462510
lea rsi, str.Whistler
lea r15, [0x00489707]
lea rdi, str.Windows_XP
jmp 0x462561
cmp r12d, 6
jne 0x46253a
cmp byte [rsp + 0xce], 1
jne 0x4624df
cmp dword [rsp + 0x3c], 0
lea rax, str.Vienna
lea rsi, str.Longhorn
lea r15, str.Vista
lea rdi, str.Windows_7
cmovne rsi, rax
lea rax, [0x00489734]
cmovne r15, rax
lea rax, str.Windows_Vista
jmp 0x462510
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jbe 0x46254c
lea rsi, str.Windows_Server_8
cmp eax, 2
mov edx, 0
lea r15, str.2012
lea rdi, str.Windows_Unknown
lea rax, str.Windows_2012
cmovne rsi, rdx
cmove rdi, rax
jmp 0x462561
xor esi, esi
lea r15, [0x004896f0]
lea rdi, str.Windows_NT
jmp 0x462561
xor esi, esi
lea r15, str.2000
lea rdi, str.Windows_2000
jmp 0x462561
xor esi, esi
lea r15, str.Unknown
lea rdi, str.Windows_Unknown
jmp 0x462561
lea rsi, str.Longhorn_Server
lea r15, str.2008
lea rdi, str.Windows_2008
lea rdx, str.Win32
mov r8d, 0x100
mov rcx, rbx
lea r13, [rbx + 0x700]
lea r14, [rbx + 0x900]
call sym.strncpy
lea rdx, str.Microsoft
mov r8d, 0x100
mov rcx, r13
mov byte [rbx + 0xff], 0
call sym.strncpy
mov r8d, 0x100
mov rdx, rdi
mov rcx, r14
mov byte [rbx + 0x7ff], 0
call sym.strncpy
lea rcx, [rbx + 0x800]
mov byte [rbx + 0x9ff], 0
mov r8d, 0x100
mov rdx, r15
call sym.strncpy
test rsi, rsi
mov byte [rbx + 0x8ff], 0
je 0x4625fc
lea rcx, [rbx + 0xa00]
mov r8d, 0x100
mov rdx, rsi
call sym.strncpy
mov byte [rbx + 0xaff], 0
lea rcx, [rbx + 0x200]
lea rdx, [0x004897e6]
mov r8d, 0x100
call sym.strncpy
mov r9d, dword [rsp + 0x3c]
lea rcx, [rbx + 0x100]
lea rdx, str._ld._ld
mov r8d, r12d
mov byte [rbx + 0x2ff], 0
call sym.sprintf
lea rdx, [rbp + 0x14]
lea rcx, [rbx + 0x600]
mov r8d, 0x100
call sym.strncpy
lea rcx, [rbx + 0x400]
lea r8, str._s__s
mov byte [rbx + 0x6ff], 0
mov qword [rsp + 0x20], r14
mov r9, r13
mov edx, 0x100
call sym.snprintf_5
xor eax, eax
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x462750
Capabilities:
Enumerate services

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x10], 0
mov rbx, rcx
mov ebp, edx
mov dword [rsp + 0x4c], 0
jne 0x462796
xor edx, edx
xor ecx, ecx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov qword [rbx + 0x10], rax
jne 0x462796
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46282b
mov eax, dword [rbx]
lea r13, [rbx + 4]
lea r14, [rsp + 0x4c]
lea r12, [rsp + 0x48]
mov rcx, qword [rbx + 0x10]
mov r9, qword [rbx + 8]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r13
mov r8d, ebp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], eax
mov edx, 0x30
mov rdi, qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
call rdi
test eax, eax
je 0x4627da
xor eax, eax
jmp 0x46282b
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0xea
jne 0x46282b
mov edx, dword [rsp + 0x48]
mov rcx, qword [rbx + 8]
call sym.realloc
mov r9, rax
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], r14
mov r8d, ebp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov edx, 0x30
mov dword [rbx], eax
mov dword [rsp + 0x20], eax
call rdi
test eax, eax
jne 0x4627d6
call rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x46290a
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbp, rdx
lea rdx, [rsp + 0x40]
mov rbx, rcx
mov rcx, rbp
mov r12, r8
call sym.GetFileVersionInfoSizeA
test eax, eax
mov dword [rsp + 0x44], eax
jne 0x462946
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x462aaa
mov edx, eax
mov ecx, 1
mov dword [rsp + 0x38], eax
call sym.calloc
mov r8d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x40]
mov r9, rax
mov rcx, rbp
mov rsi, rax
call sym.GetFileVersionInfoA
test eax, eax
je 0x4629d6
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x48]
lea rdx, [0x0048980c]
mov rcx, rsi
call sym.VerQueryValueA
test eax, eax
je 0x4629d6
mov rax, qword [rsp + 0x48]
mov edx, dword [rax + 0x10]
mov ecx, edx
mov word [rbx + 2], dx
mov edx, dword [rax + 0x14]
shr ecx, 0x10
mov word [rbx], cx
mov word [rbx + 6], dx
mov ecx, edx
mov edx, dword [rax + 8]
mov eax, dword [rax + 0xc]
shr ecx, 0x10
mov word [rbx + 4], cx
mov word [rbx + 0xa], dx
mov ecx, edx
mov edx, eax
shr ecx, 0x10
mov word [rbx + 0xe], ax
shr edx, 0x10
mov word [rbx + 8], cx
mov word [rbx + 0xc], dx
xor ebx, ebx
jmp 0x4629de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r12, r12
je 0x462aa0
test ebx, ebx
jne 0x462aa0
lea r13, [rsp + 0x44]
lea r8, [rsp + 0x50]
lea rdx, str.VarFileInfoTranslation
mov rcx, rsi
mov r9, r13
call sym.VerQueryValueA
test eax, eax
je 0x462aa0
lea rax, [rsp + 0x58]
lea rbp, str.Comments
lea r14, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov r15, qword [rbp]
test r15, r15
je 0x462aa0
mov rax, qword [rsp + 0x50]
lea rdx, str.StringFileInfo_04x_04x_s
mov rcx, r14
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
mov qword [rsp + 0x20], r15
call sym.sprintf
mov r8, qword [rsp + 0x38]
mov r9, r13
mov rdx, r14
mov rcx, rsi
call sym.VerQueryValueA
test eax, eax
je 0x462a9a
mov edx, dword [rsp + 0x44]
test edx, edx
je 0x462a9a
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasb al, byte [rdi]
mov r9, qword [rsp + 0x58]
mov dword [rsp + 0x20], edx
mov rdx, r15
not rcx
lea r8d, [rcx - 1]
mov rcx, qword [r12]
call qword [r12 + 0x20]
add rbp, 8
jmp 0x462a29
mov rcx, rsi
call sym.free
mov eax, ebx
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x462b60
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rsi
push rbx
sub rsp, 0x88
mov edx, 0x18
mov dword [rcx], 0
mov rsi, rcx
mov ecx, 1
call sym.calloc
mov rbx, rax
mov rax, qword [str.rootCIMV2]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov rax, qword [0x00489be8]
mov qword [rsp + 0x68], rax
mov eax, dword [0x00489bf0]
mov dword [rsp + 0x70], eax
movzx eax, word [0x00489bf4]
mov word [rsp + 0x74], ax
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x462c90
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, eax
shr edx, 0x1f
test dl, dl
je 0x462c11
cmp eax, 0x80010119
jne 0x462c90
lea rax, [rbx + 8]
xor edx, edx
lea r9, [0x0048f9e0]
mov r8d, 0x17
lea rcx, [0x0048ea40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x462c90
mov rcx, qword [rbx + 8]
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rax, qword [rcx]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], 0
call qword [rax + 0x18]
test eax, eax
mov rdx, rbx
js 0x462c90
mov rax, rdx
add rsp, 0x88
pop rbx
pop rsi
ret
mov rcx, rbx
mov dword [rsp + 0x5c], eax
call dbg.wmi_handle_close
mov eax, dword [rsp + 0x5c]
mov edx, 5
cmp eax, 0x80041003
je 0x462cca
cmp eax, 0x8004100c
mov edx, 0x4e21
je 0x462cca
cmp eax, 0x80041002
mov edx, 1
mov eax, 0x490
cmove edx, eax
mov dword [rsi], edx
xor edx, edx
mov rax, rdx
add rsp, 0x88
pop rbx
pop rsi
ret

Function at 0x4636a3
Capabilities:
Accept command line arguments

Disassembly:
push r12
push rbp
mov eax, 0x4050
push rdi
push rsi
push rbx
call fcn.0046ba70
sub rsp, rax
test rdx, rdx
mov rcx, rdx
mov rbx, r8
jne 0x4636ca
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test rax, rax
mov rdi, rax
je 0x463759
lea rbp, [rsp + 0x50]
xor esi, esi
cmp dword [rsp + 0x4c], esi
jle 0x463750
mov byte [rsp + 0x50], 0
or r9d, 0xffffffff
mov r8, qword [rdi + rsi*8]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [rbx + 4]
cmp dword [rbx], eax
jb 0x46372f
mov rcx, rbx
call sym.sigar_proc_args_grow
mov eax, dword [rbx]
mov rdx, qword [rbx + 8]
inc rsi
lea ecx, [rax + 1]
lea r12, [rdx + rax*8]
mov dword [rbx], ecx
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__strdup]
mov qword [r12], rax
jmp 0x4636e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
add rsp, 0x4050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x464b32
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, 0xfffffffe
test rcx, rcx
mov rsi, rcx
mov r14, rdx
mov r13d, r8d
je 0x464d05
mov rbx, qword [rcx + 0x28]
test rbx, rbx
je 0x464d00
test rdx, rdx
je 0x464d00
mov ebp, dword [rbx + 0x2c]
cmp ebp, 2
je 0x464d05
cmp ebp, 1
jne 0x464b8a
cmp dword [rbx + 8], 0x2a
jne 0x464d05
cmp dword [rbx + 0x9c], 0
mov eax, 0xfffffffe
jne 0x464d05
cmp ebp, 1
jne 0x464bb2
mov ecx, dword [rsi + 0x4c]
mov r8d, r13d
mov rdx, r14
call sym.adler32
mov dword [rsi + 0x4c], eax
cmp r13d, dword [rbx + 0x44]
mov dword [rbx + 0x2c], 0
jb 0x464c07
test ebp, ebp
jne 0x464bfb
mov eax, dword [rbx + 0x74]
mov rdx, qword [rbx + 0x68]
lea ecx, [rax - 1]
mov rdi, rdx
xor eax, eax
add rcx, rcx
mov word [rdx + rcx], 0
rep stosb byte [rdi], al
mov dword [rbx + 0x94], 0
mov dword [rbx + 0x84], 0
mov dword [rbx + 0x170c], 0
mov eax, dword [rbx + 0x44]
sub r13d, eax
add r14, r13
mov r13d, eax
mov edi, dword [rsi + 8]
mov r12, qword [rsi]
mov dword [rsi + 8], r13d
mov qword [rsi], r14
mov rcx, rbx
call sym.fill_window
mov r8d, dword [rbx + 0x9c]
mov edx, dword [rbx + 0x94]
cmp r8d, 2
jbe 0x464cb5
mov eax, dword [rbx + 0x80]
mov r15, qword [rbx + 0x50]
lea r10d, [r8 - 2]
mov r11, qword [rbx + 0x60]
mov r13, qword [rbx + 0x68]
mov r9d, edx
mov dword [rsp + 0x24], eax
mov eax, dword [rbx + 0x7c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x2c], eax
lea eax, [r9 + 2]
mov cl, byte [rsp + 0x24]
movzx r14d, byte [r15 + rax]
mov eax, dword [rbx + 0x70]
shl eax, cl
xor eax, r14d
and eax, dword [rsp + 0x28]
mov r14d, dword [rsp + 0x2c]
and r14d, r9d
mov dword [rbx + 0x70], eax
lea rax, [r13 + rax*2]
mov cx, word [rax]
mov word [r11 + r14*2], cx
mov word [rax], r9w
inc r9d
dec r10d
jne 0x464c5e
lea eax, [r8 + rdx - 2]
mov dword [rbx + 0x9c], 2
mov dword [rbx + 0x94], eax
jmp 0x464c14
add edx, r8d
mov dword [rbx + 0x170c], r8d
mov dword [rbx + 0x9c], 0
mov dword [rbx + 0x94], edx
mov dword [rbx + 0x84], edx
xor eax, eax
mov dword [rbx + 0xa0], 2
mov dword [rbx + 0x88], 2
mov dword [rbx + 0x90], 0
mov qword [rsi], r12
mov dword [rsi + 8], edi
mov dword [rbx + 0x2c], ebp
jmp 0x464d05
mov eax, 0xfffffffe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x469f26
Capabilities:
Hash data with crc32

Disassembly:
xor eax, eax
test rdx, rdx
je 0x46a00d
not ecx
mov r11d, r8d
mov r9, rdx
cmp r11d, 7
jbe 0x469fd6
mov al, cl
xor al, byte [r9]
lea r10, [0x0048b600]
shr ecx, 8
add r9, 8
sub r11d, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
mov al, cl
xor al, byte [r9 - 7]
shr ecx, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
mov al, cl
xor al, byte [r9 - 6]
shr ecx, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
mov al, cl
xor al, byte [r9 - 5]
shr ecx, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
mov al, cl
xor al, byte [r9 - 4]
shr ecx, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
mov al, cl
xor al, byte [r9 - 3]
shr ecx, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
mov al, cl
xor al, byte [r9 - 2]
shr ecx, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
mov al, cl
xor al, byte [r9 - 1]
shr ecx, 8
movzx eax, al
xor ecx, dword [r10 + rax*4]
jmp 0x469f39
mov eax, r8d
shr eax, 3
mov r9d, eax
imul eax, eax, 0xfffffff8
lea rdx, [rdx + r9*8]
add r8d, eax
je 0x46a009
inc rdx
mov al, cl
lea r9, [0x0048b600]
xor al, byte [rdx - 1]
shr ecx, 8
movzx eax, al
xor ecx, dword [r9 + rax*4]
dec r8d
jmp 0x469fe9
mov eax, ecx
not eax
ret

Function at 0x46ab00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x004ab304]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x46ac17
mov rax, qword [0x004ab308]
xor edx, edx
add rax, 8
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x46ab4d
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rcx, r8
cmp rbx, rcx
jb 0x46abfd
add edx, 1
add rax, 0x18
cmp edx, ebp
jne 0x46ab31
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x46ac4f
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x004ab308]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004ab308]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x46ac32
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x46abf6
sub eax, 4
and eax, 0xfffffffb
je 0x46abf6
mov r9, rbp
add r9, qword [0x004ab308]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x46ac1e
add dword [0x004ab304], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x46ab58
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x004ab308]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop