joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431142
Capabilities:
Log keystrokes via polling

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, qword [rcx]
mov rdx, qword [rcx + 0x10]
mov rax, qword [rax + 0x100]
mov r12, rcx
test byte [rdx + 1], 1
je 0x431174
cmp word [rdx + 4], 0
js 0x431174
or r8d, 0xffffffff
or edx, 0xffffffff
jmp 0x431179
xor r8d, r8d
xor edx, edx
mov rcx, r12
lea rbx, [rsp + 0x50]
call rax
mov r8d, 0x4000
mov edx, 0x4000
mov rcx, r12
mov rsi, rax
mov rax, qword [r12]
call qword [rax + 0x100]
mov rdx, r12
mov rcx, rbx
mov rdi, rax
call method.IWindow.getBounds__
mov rcx, rbx
call fcn.0052a4b0
mov rcx, rsi
mov rdx, rax
sar rcx, 0x20
sar rdx, 0x20
cmp edx, ecx
cmovle edx, ecx
mov rcx, rdi
sar rcx, 0x20
cmp edx, ecx
cmovg edx, ecx
cmp eax, esi
cmovle eax, esi
lea rsi, [rsp + 0x40]
mov dword [rsp + 0x34], edx
mov rdx, r12
cmp eax, edi
cmovg eax, edi
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x30], eax
call method.IWindow.getBounds__
mov rax, qword [rsp + 0x20]
mov rdx, rbx
mov rcx, rsi
lea r8, [rsp + 0x30]
mov qword [rsp + 0x50], rax
call method.Rect.Rect_Point_const__Point_const_
mov rax, qword [r12 + 0x10]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x431251
mov rcx, rbx
call method.IWindow.getClientAreaBounds__
mov rax, qword [r12]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [rax + 0x100]
lea rdx, [rsp + 0x38]
mov r8, rbx
mov rcx, rsi
mov qword [rsp + 0x38], rax
call sym.winbox.exe_fitWindowInTheRect_Rect__Point_const__Rect_const_
mov rax, qword [r12]
xor r9d, r9d
xor edx, edx
mov r8, rsi
mov rcx, r12
call qword [rax + 0x128]
xor edx, edx
mov rcx, r12
call method.IWindow.invalidate_bool_
cmp qword [0x005eabe8], 0
je 0x4312f2
mov ecx, 1
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
xor r13d, r13d
call rsi
mov ecx, 2
test ax, ax
setne r13b
call rsi
test ax, ax
je 0x4312a2
or r13d, 2
call qword [sym.imp.USER32.dll_GetMessagePos]
mov rcx, rbx
mov edx, eax
call method.Point.Point_long_
mov rcx, qword [0x005eabe8]
mov rdx, rbx
test rcx, rcx
jne 0x4312c4
mov rcx, r12
call method.IWindow.fromScreen_Point_const_
mov r9, rdi
mov r8, rbx
mov edx, r13d
mov rcx, r12
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0x51
mov qword [rsp + 0x28], 0
call method.IWindow.processMouseMsg_int__Point_const__bool__IWindow::__int__Point_const__
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x432e4e
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rax, qword [rdx]
cmp dword [rax], 0
mov rbx, rcx
je 0x432e7a
lea rcx, [rcx + 0x48]
cmp rcx, rdx
je 0x432e7a
call fcn.004ceeb2
mov rax, qword [rbx + 0x48]
cmp dword [rax], 0
je 0x433075
lea r12, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x00533b9b]
mov r9, r12
lea rcx, [0x00533b9f]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x432eba
mov rax, qword [rbx + 0x48]
mov rcx, r12
lea rdx, [rax + 4]
call sub.msvcrt.dll_strcpy
mov rcx, qword [0x0053cb90]
lea rdx, str.saving_settings_to
call fcn.004d0ff9
mov rdx, r12
mov rcx, rax
call fcn.004d0ff9
lea rdx, str...._for
mov rcx, rax
call fcn.004d0ff9
mov rcx, rax
mov rax, qword [rbx + 0x48]
lea rdx, [rax + 4]
mov eax, dword [rax]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call fcn.004d1018
mov rcx, rax
call fcn.004d13bf
lea rdx, [0x00533bbe]
mov rcx, r12
call sub.msvcrt.dll_fopen
mov r13, rax
test rax, rax
je 0x433075
mov rax, qword [rbx + 0x18]
lea rbp, [rbx + 0x10]
lea rsi, [rsp + 0x38]
lea rdi, [rsp + 0x148]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, rbp
je 0x432fa8
mov r14, qword [rax + 0x28]
mov rcx, rsi
mov rdx, qword [r14]
mov r15, qword [rdx + 0x28]
mov edx, dword [rax + 0x18]
call sym.winbox.exe_packData_unsigned_int_
mov rcx, rdi
lea rdx, [0x00533bc1]
call fcn.004cec4e
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call r15
mov rcx, rdi
call fcn.004cea4a
mov rcx, rsi
call fcn.004cea4a
mov rax, qword [r14]
mov rcx, r14
mov rdx, r13
call qword [rax + 0x40]
lea rcx, [rsp + 0x30]
call fcn.004cfd0a
jmp 0x432f45
mov rcx, r13
call sub.msvcrt.dll_fclose
cmp byte [rsp + 0x44], 0x2e
jne 0x433059
mov rax, qword [rbx + 0x48]
lea r13, [rsp + 0x148]
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rax, qword [rbx + 0x48]
lea r9, [rsp + 0x38]
mov r8, r13
mov edx, 0x104
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
call sym.winbox.exe_getMainWindow__
mov rcx, rax
call method.IWindow.getHandle__
xor r8d, r8d
mov rdx, r13
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov rdx, qword [rbx + 0x48]
mov r8d, 3
mov rcx, r12
add rdx, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x433059
mov rcx, qword [0x0053cb90]
lea rdx, str.MoveFileEx_failed_error
call fcn.004d0ff9
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
mov edx, eax
call fcn.004d1044
mov rcx, rax
call fcn.004d13bf
mov rcx, qword [0x0053cb90]
lea rdx, str.settings_saved
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
nop
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
push r12
sub rsp, 0x20
mov r12, rcx
call sym.winbox.exe_storeAllSettings__
call fcn.004335f7
mov rdx, r12
mov rcx, rax
add rsp, 0x20
pop r12
jmp 0x432e4e
Function at 0x4336e3
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rax, qword [rdx]
cmp dword [rax], 0
mov rbx, rcx
je 0x432e7a
lea rcx, [rcx + 0x48]
cmp rcx, rdx
je 0x432e7a
call fcn.004ceeb2
mov rax, qword [rbx + 0x48]
cmp dword [rax], 0
je 0x433075
lea r12, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x00533b9b]
mov r9, r12
lea rcx, [0x00533b9f]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x432eba
mov rax, qword [rbx + 0x48]
mov rcx, r12
lea rdx, [rax + 4]
call sub.msvcrt.dll_strcpy
mov rcx, qword [0x0053cb90]
lea rdx, str.saving_settings_to
call fcn.004d0ff9
mov rdx, r12
mov rcx, rax
call fcn.004d0ff9
lea rdx, str...._for
mov rcx, rax
call fcn.004d0ff9
mov rcx, rax
mov rax, qword [rbx + 0x48]
lea rdx, [rax + 4]
mov eax, dword [rax]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call fcn.004d1018
mov rcx, rax
call fcn.004d13bf
lea rdx, [0x00533bbe]
mov rcx, r12
call sub.msvcrt.dll_fopen
mov r13, rax
test rax, rax
je 0x433075
mov rax, qword [rbx + 0x18]
lea rbp, [rbx + 0x10]
lea rsi, [rsp + 0x38]
lea rdi, [rsp + 0x148]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, rbp
je 0x432fa8
mov r14, qword [rax + 0x28]
mov rcx, rsi
mov rdx, qword [r14]
mov r15, qword [rdx + 0x28]
mov edx, dword [rax + 0x18]
call sym.winbox.exe_packData_unsigned_int_
mov rcx, rdi
lea rdx, [0x00533bc1]
call fcn.004cec4e
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call r15
mov rcx, rdi
call fcn.004cea4a
mov rcx, rsi
call fcn.004cea4a
mov rax, qword [r14]
mov rcx, r14
mov rdx, r13
call qword [rax + 0x40]
lea rcx, [rsp + 0x30]
call fcn.004cfd0a
jmp 0x432f45
mov rcx, r13
call sub.msvcrt.dll_fclose
cmp byte [rsp + 0x44], 0x2e
jne 0x433059
mov rax, qword [rbx + 0x48]
lea r13, [rsp + 0x148]
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rax, qword [rbx + 0x48]
lea r9, [rsp + 0x38]
mov r8, r13
mov edx, 0x104
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
call sym.winbox.exe_getMainWindow__
mov rcx, rax
call method.IWindow.getHandle__
xor r8d, r8d
mov rdx, r13
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov rdx, qword [rbx + 0x48]
mov r8d, 3
mov rcx, r12
add rdx, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x433059
mov rcx, qword [0x0053cb90]
lea rdx, str.MoveFileEx_failed_error
call fcn.004d0ff9
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
mov edx, eax
call fcn.004d1044
mov rcx, rax
call fcn.004d13bf
mov rcx, qword [0x0053cb90]
lea rdx, str.settings_saved
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
nop
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
push r12
sub rsp, 0x20
mov r12, rcx
call sym.winbox.exe_storeAllSettings__
call fcn.004335f7
mov rdx, r12
mov rcx, rax
add rsp, 0x20
pop r12
jmp 0x432e4e
Function at 0x4412f9
Capabilities:
Log keystrokes via polling

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 8]
mov rbx, rcx
mov r12d, edx
cmp eax, 0x200
jne 0x4413c1
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x441409
mov rcx, qword [rbx]
call method.IWindow.findWindow_HWND___
mov r13, rax
test rax, rax
je 0x441409
mov rcx, rax
call method.IWindow.getTopParent__
mov rcx, rax
test rax, rax
je 0x441409
mov rax, qword [rax]
mov edx, 0x68
call qword [rax + 0xb8]
mov r12, rax
test rax, rax
je 0x441409
mov rdx, qword [rbx + 0x18]
lea r14, [rsp + 0x28]
mov rcx, r14
call method.Point.Point_long_
mov rdx, r14
mov rcx, r13
call method.IWindow.toScreen_Point_const_
lea rdx, [rsp + 0x20]
mov rcx, r12
mov qword [rsp + 0x20], rax
call method.IWindow.fromScreen_Point_const_
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x28], rax
call fcn.00440026
mov rdx, rax
shr rdx, 0x20
mov ebx, edx
or ebx, eax
je 0x441409
mov rcx, r12
call method.IWindow.captureCursor__
jmp 0x44144c
and eax, 0xfffffffb
cmp eax, 0x100
jne 0x441409
cmp qword [0x005eae30], 0
je 0x441409
mov r13, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
call r13
test ax, ax
js 0x441409
mov rax, qword [rbx + 0x10]
cmp rax, 0x73
je 0x44143b
ja 0x441403
cmp rax, 2
je 0x44143b
cmp rax, 9
je 0x44140d
jmp 0x441409
cmp rax, 0x75
je 0x44141a
xor eax, eax
jmp 0x44144e
mov ecx, 0x11
call r13
test ax, ax
jns 0x441409
mov r12, qword [0x005eae30]
mov ecx, 0x10
call r13
movsx edx, ax
mov rcx, r12
not edx
shr edx, 0x1f
call fcn.00441200
jmp 0x44144c
test r12b, r12b
jne 0x441409
mov rcx, qword [0x005eae30]
call fcn.0043f2e4
mov al, 1
add rsp, 0x38
pop rbx
pop r12
pop r13
pop r14
ret

Function at 0x447174
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, rcx
call method.IWindow.getHandle__
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44726c
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x447265
mov r9d, dword [rsi + 0x4c]
mov ebx, dword [rsi + 0x48]
lea r13, [rsp + 0x30]
lea r12, [rsp + 0x38]
mov rcx, r13
cmp r9d, ebx
mov r8d, ebx
cmovbe r8d, r9d
cmovae ebx, r9d
mov dword [rsp + 0x2c], r8d
call fcn.004cebac
mov rax, qword [rsi + 0x38]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x2c]
lea rdx, [rsi + 0x30]
cmp ebx, dword [rax]
je 0x4471ed
sub ebx, r8d
mov r9d, ebx
mov rcx, r12
call fcn.004cf482
mov rdx, r12
mov rcx, r13
call fcn.004cef0e
mov rcx, r12
call fcn.004cea4a
mov rax, qword [rsp + 0x30]
mov ecx, 0x2000
mov eax, dword [rax]
lea edx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x44725d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x44725d
mov rsi, qword [rsp + 0x30]
mov rdi, rax
mov edx, dword [rsi]
add rsi, 4
lea ecx, [rdx + 1]
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, r12
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, r13
call fcn.004cea4a
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x45b62e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
mov r12, rcx
cmp dword [rcx + 0x1b0], eax
jne 0x45b660
mov ebx, dword [rdx + 4]
cmp dword [rcx + 0x1b4], ebx
jne 0x45b660
mov eax, dword [rcx + 0x190]
sub ebx, dword [rcx + 0x198]
cmp ebx, eax
jge 0x45b66d
jmp 0x45b690
mov rax, qword [rdx]
mov qword [r12 + 0x1b0], rax
jmp 0x45b6e1
add eax, 0x1d
cmp ebx, eax
jg 0x45b690
mov rcx, qword [rcx + 0x1c8]
or ebx, 0xffffffff
mov rax, qword [rcx]
call qword [rax + 0x190]
test eax, eax
jne 0x45b6f2
jmp 0x45b799
lea rcx, [rsp + 0x20]
mov rdx, r12
call fcn.004574ce
movsxd rax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
sub eax, 0x1e
cmp ebx, eax
jl 0x45b6e1
mov rcx, qword [r12 + 0x1c8]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov ebx, dword [r12 + 0x170]
mov rcx, r12
mov esi, eax
call fcn.004578a8
sub ebx, eax
cmp esi, ebx
je 0x45b799
mov ebx, 1
jmp 0x45b6f2
mov dword [r12 + 0x1b8], 0
jmp 0x45b799
cmp dword [r12 + 0x1b8], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x45b71c
call rax
mov dword [r12 + 0x1bc], 0
mov dword [r12 + 0x1b8], eax
jmp 0x45b799
call rax
mov edx, eax
sub edx, dword [r12 + 0x1b8]
cmp edx, 0x12b
jbe 0x45b799
mov dword [r12 + 0x1b8], eax
mov eax, dword [r12 + 0x1bc]
cmp eax, 7
ja 0x45b758
cmp eax, 3
ja 0x45b753
cmp eax, 1
jbe 0x45b75b
add ebx, ebx
jmp 0x45b75b
shl ebx, 2
jmp 0x45b75b
shl ebx, 3
inc eax
or r8d, 0xffffffff
or edx, 0xffffffff
mov rcx, r12
mov dword [r12 + 0x1bc], eax
call fcn.0045a760
test al, al
je 0x45b780
mov rcx, r12
call method.IWindow.update__
xor r9d, r9d
mov r8d, ebx
or edx, 0xffffffff
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop r12
jmp fcn.0045a8b2
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret

Function at 0x4678ed
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx]
mov ebx, r8d
mov rdi, rcx
mov rsi, rdx
mov r8d, 0xa
lea rdx, [rsp + 0x28]
lea rcx, [rax + 4]
call sub.msvcrt.dll_strtol
imul eax, ebx
mov r9d, eax
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
test al, al
jne 0x46792d
mov dword [rsi], r9d
mov r8b, 1
jmp 0x467996
cmp ebx, 1
seta r8b
cmp al, 0x2e
sete al
and r8b, al
jne 0x467943
xor r8d, r8d
jmp 0x467996
xor ecx, ecx
mov r10d, 0xa
mov rax, qword [rsp + 0x28]
lea rdx, [rax + 1]
mov qword [rsp + 0x28], rdx
movsx eax, byte [rax + 1]
test al, al
je 0x46797e
cmp ebx, 1
jbe 0x46797e
sub eax, 0x30
cmp eax, 9
ja 0x46793e
imul ecx, ecx, 0xa
xor edx, edx
add ecx, eax
mov eax, ebx
div r10d
mov ebx, eax
jmp 0x46794b
mov rax, qword [rdi]
imul ecx, ebx
cmp dword [rax], 0
je 0x467991
cmp byte [rax + 4], 0x2d
jne 0x467991
neg ecx
add ecx, r9d
mov dword [rsi], ecx
mov eax, r8d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x4a7d5e
Capabilities:
Read data from internet
Receive data

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
mov r12, rcx
mov rbp, rdx
mov r13d, r8d
cmp eax, 1
je 0x4a7d88
sub eax, 2
cmp eax, 1
jbe 0x4a7dbb
jmp 0x4a7e94
lea r14, [rsp + 0x28]
lea rdx, str.receiving_data...
mov rcx, r14
call fcn.004cec4e
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.004a7ae4
mov rcx, r14
call fcn.004cea4a
mov dword [r12 + 0x10], 2
test ebp, ebp
je 0x4a7dd5
mov r14, qword [sym.imp.WININET.dll_InternetReadFileExA]
lea r13, [r12 + 0x80]
lea rbp, [r12 + 0x18]
jmp 0x4a7de3
mov edx, r13d
jmp 0x4a7e35
mov dword [r12 + 0x10], 2
cmp dword [r12 + 0x10], 2
jne 0x4a7e4a
xor eax, eax
mov ecx, 0xe
mov rdi, rbp
mov r9, r12
rep stosd dword [rdi], eax
mov r8d, 1
mov qword [r12 + 0x38], r13
mov rdx, rbp
mov dword [r12 + 0x18], 0x38
mov dword [r12 + 0x40], 0x1000
mov rcx, qword [r12 + 0x60]
call r14
test eax, eax
jne 0x4a7e4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
cmp eax, 0x3e5
je 0x4a7e3f
mov rcx, r12
call fcn.004a7cec
jmp 0x4a7ebd
mov dword [r12 + 0x10], 3
jmp 0x4a7ebd
mov rax, qword [r12]
mov r8d, dword [r12 + 0x40]
mov rdx, r13
mov rcx, r12
call qword [rax + 8]
cmp dword [r12 + 0x40], 0
jne 0x4a7dda
lea r13, [rsp + 0x28]
lea rdx, [0x00536551]
mov rcx, r13
call fcn.004cec4e
mov rcx, r12
xor r8d, r8d
mov rdx, r13
call fcn.004a7ae4
mov rcx, r13
call fcn.004cea4a
jmp 0x4a7ebd
mov rcx, qword [0x0053cb90]
lea rdx, str.onCompletion_in_wrong_state
call fcn.004d0ff9
mov edx, dword [r12 + 0x10]
mov rcx, rax
call fcn.004d10e2
mov rcx, rax
call fcn.004d13bf
nop
add rsp, 0x30
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x4a7f06
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x48
mov r12, rcx
test r8d, r8d
je 0x4a7f91
mov rcx, qword [rcx + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x4a7f75
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a7fbf
lea r13, [rsp + 0x38]
lea rdx, str.failed:_couldnt_write_file_to_disk
mov rcx, r13
call fcn.004cec4e
or r8d, 0xffffffff
mov rdx, r13
mov rcx, r12
call fcn.004a7ae4
mov rcx, r13
call fcn.004cea4a
mov rcx, r12
call fcn.004a7cb0
jmp 0x4a7fbf
lea r13, [rsp + 0x38]
mov rcx, r13
call fcn.004cec42
lea rcx, [r12 + 0x70]
mov rdx, r13
call fcn.004cedc2
jmp 0x4a7fb6
lea r13, [rsp + 0x38]
lea rdx, [rcx + 0x70]
mov rcx, r13
call fcn.004cebf6
mov rcx, r12
call fcn.004a7cb0
mov rax, qword [r12]
mov rdx, r13
mov rcx, r12
call qword [rax]
mov rcx, r13
call fcn.004cea4a
nop
add rsp, 0x48
pop r12
pop r13
ret
Function at 0x4a8354
Capabilities:
Get http content length

Disassembly:
sub rsp, 0x48
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x38], 0
test rcx, rcx
je 0x4a838f
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x38]
mov edx, 0x20000005
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [rsp + 0x38]
add rsp, 0x48
ret

Function at 0x4a8752
Capabilities:
Read file on windows

Disassembly:
push r14
mov eax, 0x1030
push r13
push r12
call fcn.004d43f0
sub rsp, rax
lea rdx, [0x005367b9]
mov rcx, qword [rcx]
add rcx, 4
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x4a87cd
lea r14, [rsp + 0x30]
mov r9, rax
mov r8d, 0x1000
mov edx, 1
mov rcx, r14
lea r13, [rsp + 0x28]
call sub.msvcrt.dll_fread
mov rdx, r14
mov rcx, r13
mov eax, eax
lea r8, [r14 + rax]
call fcn.004cec6e
mov rcx, r13
call fcn.004a86c1
mov rcx, r13
call fcn.004cea4a
mov rcx, r12
call sub.msvcrt.dll_fclose
mov al, 1
jmp 0x4a87ea
mov rcx, qword [0x0053cb90]
lea rdx, str.file_does_not_exist
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
xor eax, eax
add rsp, 0x1030
pop r12
pop r13
pop r14
ret
Function at 0x4a9f1c
Capabilities:
Delete directory
Delete file

Disassembly:
push r14
mov eax, 0x4030
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.004d43f0
sub rsp, rax
xor esi, esi
movabs rdi, 0xaaaaaaaaaaaaaaab
mov rbx, rcx
call fcn.004a9e7a
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r13, qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov rdx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x38]
sub rax, rdx
sar rax, 3
imul rax, rdi
cmp esi, eax
jae 0x4a9fbe
mov ebp, esi
lea r14, [rsp + 0x2f]
imul rbp, rbp, 0x18
mov rcx, qword [rdx + rbp + 8]
add rcx, 4
call r12
mov rax, qword [rbx + 0x30]
lea r9, [rsp + 0x20]
mov r8, r14
mov edx, 0x4000
mov rcx, qword [rax + rbp + 8]
add rcx, 4
call r13
test eax, eax
je 0x4a9fba
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4a9fb1
mov byte [rax], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc esi
jmp 0x4a9f55
lea rcx, [rbx + 0x40]
lea rdx, [0x004d7310]
call fcn.004d078c
mov r13, qword [rbx + 0x30]
mov rsi, qword [rbx + 0x38]
lea r12, [rbx + 0x30]
mov rdi, r13
cmp rsi, rdi
je 0x4a9ff9
lea rcx, [rdi + 8]
call fcn.004cea4a
mov rcx, rdi
add rdi, 0x18
call fcn.004cea4a
jmp 0x4a9fdd
sub rsi, r13
mov rdx, r13
mov rcx, r12
mov r8, rsi
movabs rsi, 0xaaaaaaaaaaaaaab
shr r8, 3
imul r8, rsi
movabs rsi, 0x1fffffffffffffff
and r8, rsi
imul r8, r8, 0x18
add r8, r13
call fcn.004cf806
mov rcx, r12
call fcn.004cf730
lea rcx, [rbx + 0x20]
call fcn.004a8f6e
lea rcx, [rbx + 0x18]
call fcn.004a8f84
nop
add rsp, 0x4030
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4ade60
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
mov eax, 0x8048
push rdi
push rsi
push rbx
call fcn.004d43f0
sub rsp, rax
xor r8d, r8d
mov edx, 0x10
lea rax, [rsp + 0x38]
lea rbx, [rsp + 0x40]
mov r12, rcx
mov ecx, 2
mov qword [rsp + 0x20], rax
mov r9, rbx
mov dword [rsp + 0x38], 0x8000
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4adef6
lea rsi, [rsp + 0x3c]
mov rax, qword [rbx + 0xb0]
test rax, rax
je 0x4adeed
mov rdx, qword [rax + 0x10]
xor ecx, ecx
mov edi, dword [rdx + 4]
mov edx, dword [rax + 0x20]
xor eax, eax
cmp eax, edx
je 0x4aded4
shr ecx, 1
inc eax
or ecx, 0x80000000
jmp 0x4adec4
call qword [sym.imp.WS2_32.dll_htonl]
mov rdx, rsi
mov rcx, r12
not eax
or eax, edi
mov dword [rsp + 0x3c], eax
call fcn.005185d0
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x4adeaa
mov rax, qword [r12 + 8]
cmp qword [r12], rax
jne 0x4adf17
lea rdx, [rsp + 0x3c]
mov rcx, r12
mov dword [rsp + 0x3c], 0xffffffff
call fcn.005185d0
nop
add rsp, 0x8048
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x4ae0f6
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f0
mov edx, 6
lea r12, [rsp + 0x78]
mov rbx, rcx
mov dword [rcx + 0xa8], 0xffffffff
mov rcx, r12
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x478], 4
call fcn.004ad880
mov ecx, 0x162e
mov word [rsp + 0x4c], 2
mov rdi, qword [sym.imp.WS2_32.dll_htons]
call rdi
xor r9d, r9d
mov dword [rsp + 0x50], 0xffffffff
mov rdx, r12
mov rcx, qword [rbx + 0x78]
mov word [rsp + 0x4e], ax
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x28], 0x10
mov r8d, dword [rsp + 0x478]
mov qword [rsp + 0x20], rax
mov rbp, qword [sym.imp.WS2_32.dll_sendto]
call rbp
test eax, eax
jg 0x4ae198
lea rcx, str.sendto_old
call sub.msvcrt.dll_perror
mov r13, qword [rbx + 0x90]
mov rsi, qword [rbx + 0x88]
lea r14, str.sendto
cmp r13, rsi
je 0x4ae1db
xor r9d, r9d
mov r8d, dword [rsp + 0x478]
mov rcx, qword [rsi]
mov rdx, r12
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x4ae1d5
mov rcx, r14
call fcn.004ad780
add rsi, 8
jmp 0x4ae1ad
cmp qword [rbx + 0x80], 0xffffffffffffffff
je 0x4ae256
mov ecx, 0x162e
mov word [rsp + 0x5c], 0x17
call rdi
lea rdx, [rsp + 0x64]
mov ecx, 0xf
xor r9d, r9d
mov rdi, rdx
mov word [rsp + 0x5e], ax
xor eax, eax
lea r8, [rsp + 0x5c]
rep stosb byte [rdi], al
mov byte [rsp + 0x73], 1
mov rcx, qword [rbx + 0x80]
mov rdx, r12
mov qword [rsp + 0x20], r8
mov r8d, dword [rsp + 0x478]
mov word [rsp + 0x64], 0x2ff
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x28], 0x1c
call rbp
test eax, eax
jg 0x4ae256
lea rcx, str.sendto6
call fcn.004ad780
inc dword [rbx + 0xb4]
jne 0x4ae299
lea rax, [0x00521280]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
call fcn.004d6830
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x64
mov rdx, rax
call sym.winbox.exe_addTimer_unsigned_int__EventListener__void__bool_
mov dword [rbx + 0xa8], eax
add rsp, 0x4f0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret