joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402fd0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x403024
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x40301b
test r12, r12
je 0x40301b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x403000
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x403250
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x403260
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x403270
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4032b5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x4032ac
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x4032b7
add rax, 0x28
cmp rax, r9
jne 0x403298
xor eax, eax
ret

Function at 0x403360
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004055f0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x4033d9
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4033d9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x4033d6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x4033cd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x4033d9
add r8, 0x28
cmp r8, r9
jne 0x4033b8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x4034c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x004055f0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x40352f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40352f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x40352d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x403524
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x403538
add rax, 0x28
cmp rax, r9
jne 0x403510
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x403550
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x004055f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x4035c8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4035c8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x4035c8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4035c8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x4035bc
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x4035d0
add rdx, 0x28
cmp rdx, r10
jne 0x4035a8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x4035e0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x4035ee
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4035c5
test r8d, r8d
jg 0x4035d8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ec0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014210
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014230
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014243
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001426d
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014281
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014293
xor al, al
jmp 0x1400142b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142af
xor al, al
jmp 0x1400142b1
mov al, 1
add rsp, 0x38
ret
Function at 0x401560
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
xor eax, eax
mov byte [0x00409ae0], 0
mov rbp, rcx
mov ecx, 0x1f
mov r12, rdx
mov qword [rsp + 0x150], 0
lea rdi, [rsp + 0x158]
cmp dword [rbp], 1
mov r14, r8
rep stosq qword [rdi], rax
mov dword [rdi], 0
jle 0x401627
lea rdi, str._p2x_debug
mov esi, 1
lea r15, [rsp + 0x150]
lea r13, [0x00409ae0]
jmp 0x4015e4
lea rdx, [rbx + 0xb]
mov rcx, r13
call sub.msvcrt.dll_strcpy
add esi, 1
cmp dword [rbp], esi
jle 0x401627
mov rdx, qword [r12]
movsxd rax, esi
mov rbx, qword [rdx + rax*8]
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x4015d0
lea rdx, str._p2x_exe
mov rcx, rbx
call sub.msvcrt.dll_strstr
test rax, rax
je 0x4015dc
lea rdx, [rbx + 9]
mov rcx, r15
add esi, 1
call sub.msvcrt.dll_strcpy
cmp dword [rbp], esi
jg 0x4015e4
lea rbx, [rsp + 0x40]
xor ecx, ecx
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [rsp + 0x150], 0
jne 0x4016d0
mov rcx, rbx
call fcn.00402a30
mov rsi, rax
xor eax, eax
test rsi, rsi
je 0x4016b3
lea r12, [rsp + 0x34]
mov rcx, rsi
call fcn.00401ad0
lea rbp, [rsp + 0x3c]
lea rdi, [rsp + 0x38]
lea r13, str.P2XDLL_
jmp 0x401690
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_strstr
cmp rax, rbx
je 0x4016e5
mov r9, r12
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.00402060
test rax, rax
mov rbx, rax
jne 0x401680
mov rcx, rsi
call fcn.004018c0
xor eax, eax
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x150]
mov rcx, rbx
call sub.msvcrt.dll_strcpy
jmp 0x40164b
lea rbx, [rax + 7]
call fcn.00401b80
mov rcx, rax
call sub.msvcrt.dll__mkdir
mov r12d, dword [rsp + 0x34]
mov ebp, dword [rsp + 0x3c]
mov edi, dword [rsp + 0x38]
call fcn.00401b80
mov r8, rbx
mov rcx, rsi
mov rdx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
mov r9d, edi
call fcn.00402790
call fcn.00401b80
mov rcx, r14
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r14
call sub.msvcrt.dll_strlen
cmp byte [r14 + rax - 1], 0x5c
je 0x40174c
mov edx, 0x5c
mov word [r14 + rax], dx
mov rdx, rbx
mov rcx, r14
call sub.msvcrt.dll_strcat
mov rcx, rsi
call fcn.004018c0
mov eax, 1
jmp 0x4016b3
Function at 0x401b80
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00409068]
test rbx, rbx
je 0x401ba0
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.P2XDIR
call sub.msvcrt.dll_getenv
test rax, rax
mov qword [0x00409068], rax
je 0x401c40
call fcn.00401b10
mov rdi, qword [0x00409068]
mov ebp, eax
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rcx, [rax + 0x63]
mov rsi, rax
call sub.msvcrt.dll_malloc
mov r8, rsi
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
mov eax, 0x5c
mov r8d, ebp
lea rdx, str.p2xtmp__d
mov word [rbx + rsi], ax
lea rcx, [rbx + rsi + 1]
call sub.msvcrt.dll_sprintf
mov rax, qword [0x00406890]
mov qword [0x00409068], rbx
mov edx, dword [rax]
test edx, edx
je 0x401b94
lea rcx, str.GetTempDir:_returning__s_n
mov rdx, rbx
call sub.msvcrt.dll_printf
mov rbx, qword [0x00409068]
jmp 0x401b94
lea rcx, str.TEMP
call sub.msvcrt.dll_getenv
test rax, rax
mov qword [0x00409068], rax
jne 0x401bbc
lea rcx, [0x00406101]
call sub.msvcrt.dll_getenv
test rax, rax
mov qword [0x00409068], rax
jne 0x401bbc
lea rcx, str.WINDIR
call sub.msvcrt.dll_getenv
test rax, rax
mov qword [0x00409068], rax
jne 0x401bbc
lea rax, [0x0040610c]
mov qword [0x00409068], rax
jmp 0x401bbc

Function at 0x401cb0
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x1130
call fcn.00404310
sub rsp, rax
lea rax, [rsp + 0x1148]
mov qword [rsp + 0x1148], rdx
lea rbx, [rsp + 0x130]
mov qword [rsp + 0x1150], r8
mov qword [rsp + 0x1158], r9
mov rdx, rbx
mov byte [rsp + 0x130], 0
mov qword [rsp + 0x28], rax
mov r8d, dword [rdx]
add rdx, 4
lea eax, [r8 - 0x1010101]
not r8d
and eax, r8d
and eax, 0x80808080
je 0x401cf6
mov r8d, eax
shr r8d, 0x10
test eax, 0x8080
cmove eax, r8d
lea r8, [rdx + 2]
mov r10d, eax
cmove rdx, r8
add r10b, al
mov r8, qword [rsp + 0x28]
sbb rdx, 3
mov rax, rdx
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_vsprintf
mov eax, dword [0x00405020]
test eax, eax
jne 0x401db0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.SERVER_SOFTWARE
call sub.msvcrt.dll_getenv
test rax, rax
je 0x401df0
mov rcx, rbx
call sub.msvcrt.dll_printf
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
call sub.msvcrt.dll_fflush
lea rcx, str.SERVER_SOFTWARE
call sub.msvcrt.dll_getenv
test rax, rax
je 0x401da2
lea rcx, str._br_
call fcn.004045e8
nop
add rsp, 0x1130
pop rbx
ret
cmp byte [rsp + 0x130], 0
mov dword [0x00405020], 0
je 0x401d50
lea rcx, str.SERVER_SOFTWARE
call sub.msvcrt.dll_getenv
test rax, rax
je 0x401d50
lea rcx, str.Content_type:_text_html_n_n
call fcn.00401cb0
jmp 0x401d50
lea rcx, [rsp + 0x30]
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
jne 0x401d6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401d6d
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
lea r8, str.Perl2Exe
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d84
Function at 0x401e30
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movsxd rbp, r8d
mov r12, rdx
mov r8d, 1
mov dword [rsp + 0x80], ecx
xor edx, edx
mov r14, rbp
call sub.msvcrt.dll__lseek
mov ecx, 0xc800
mov dword [rsp + 0x2c], eax
call sub.msvcrt.dll_malloc
mov rbx, rax
lea rax, [rax + 1]
mov qword [rsp + 0x20], rax
mov ecx, dword [rsp + 0x80]
mov r8d, 0xc800
mov rdx, rbx
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov r13d, eax
je 0x401f41
cmp eax, r14d
jle 0x401f41
sub eax, r14d
test eax, eax
jle 0x401f10
lea esi, [rax - 1]
mov r15, rbx
add rsi, qword [rsp + 0x20]
jmp 0x401ebe
add r15, 1
cmp r15, rsi
je 0x401f10
mov r8, rbp
mov rdx, r12
mov rcx, r15
call sub.msvcrt.dll_memcmp
mov edi, r15d
sub edi, ebx
test eax, eax
jne 0x401eb5
add edi, dword [rsp + 0x2c]
xor r8d, r8d
mov ecx, dword [rsp + 0x80]
lea edx, [r14 + rdi]
call sub.msvcrt.dll__lseek
mov rcx, rbx
call sub.msvcrt.dll_free
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r13d, 0xc800
jne 0x401e77
mov ecx, dword [rsp + 0x80]
mov r8d, 1
mov edx, 0xfffffc18
call sub.msvcrt.dll__lseek
add dword [rsp + 0x2c], 0xc418
jmp 0x401e77
mov rcx, rbx
mov edi, 0xffffffff
call sub.msvcrt.dll_free
jmp 0x401ef4

Function at 0x401f50
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, r8d
mov edi, ecx
mov rbx, rdx
mov r8d, 1
xor edx, edx
call sub.msvcrt.dll__lseek
mov r8d, esi
mov rdx, rbx
mov ecx, edi
mov r12d, eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov esi, eax
je 0x401fca
lea rdx, [0x0040616a]
mov rcx, rbx
call sub.msvcrt.dll_strstr
test rax, rax
mov rbp, rax
jne 0x401fe0
mov edx, 0xa
mov rcx, rbx
call sub.msvcrt.dll_strchr
test rax, rax
mov rbp, rax
je 0x402005
sub rax, rbx
xor r8d, r8d
mov ecx, edi
lea edx, [r12 + rax + 1]
mov esi, eax
call sub.msvcrt.dll__lseek
mov byte [rbp], 0
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
sub rax, rbx
xor r8d, r8d
mov ecx, edi
lea edx, [r12 + rax + 2]
mov esi, eax
call sub.msvcrt.dll__lseek
mov eax, esi
mov byte [rbp], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r8d, r8d
mov edx, r12d
mov ecx, edi
call sub.msvcrt.dll__lseek
xor esi, esi
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x402580
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rdi
push rsi
push rbx
xor eax, eax
mov ebx, edx
nop word [rax + rax]
mov byte [r8 + rax], al
add rax, 1
cmp rax, 0x100
jne 0x402590
xor eax, eax
mov r10, r8
xor r11d, r11d
mov word [r8 + 0x100], ax
lea rsi, [r8 + 0x100]
xor eax, eax
nop dword [rax]
movzx edi, byte [r10]
movzx edx, al
add eax, 1
add r10, 1
movzx r9d, byte [rcx + rdx]
movzx edx, dil
add r11d, edx
add r9d, r11d
movzx r11d, r9b
movzx r9d, r9b
add r9, r8
movzx edx, byte [r9]
mov byte [r10 - 1], dl
cdq
idiv ebx
cmp rsi, r10
mov byte [r9], dil
movzx eax, dl
jne 0x4025c0
pop rbx
pop rsi
pop rdi
ret

Function at 0x402610
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r14
push rdi
push rsi
push rbx
movzx edi, byte [r8 + 0x100]
movzx r11d, byte [r8 + 0x101]
test edx, edx
jle 0x402680
lea eax, [rdx - 1]
mov edx, edi
lea rbx, [rcx + rax + 1]
mov rsi, rax
nop word cs:[rax + rax]
lea r9d, [rdx + 1]
mov edx, r9d
movzx r9d, r9b
add r9, r8
movzx eax, byte [r9]
add r11d, eax
movzx r10d, r11b
add r10, r8
movzx r14d, byte [r10]
mov byte [r9], r14b
mov byte [r10], al
add al, byte [r9]
movzx eax, al
movzx eax, byte [r8 + rax]
xor byte [rcx], al
add rcx, 1
cmp rbx, rcx
jne 0x402640
lea edi, [rdi + rsi + 1]
mov byte [r8 + 0x100], dil
mov byte [r8 + 0x101], r11b
pop rbx
pop rsi
pop rdi
pop r14
ret
Function at 0x402790
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
mov ebx, dword [rsp + 0x1e0]
mov r14d, dword [rsp + 0x1e8]
lea rsi, [rsp + 0x60]
mov r12, rcx
mov rdi, r8
mov rcx, rsi
mov r13d, r9d
call sub.msvcrt.dll_strcpy
mov rdx, rsi
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4027cb
lea r15, [rsp + 0x30]
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
cmove rdx, rcx
mov ecx, eax
add cl, al
sbb rdx, 3
sub rdx, rsi
lea rcx, [rsi + rdx + 1]
mov byte [rsi + rdx], 0x2f
mov rdx, rdi
call sub.msvcrt.dll_strcpy
mov rdx, r15
mov rcx, rsi
call fcn.00404350
test eax, eax
jne 0x402840
xor eax, eax
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp ebx, 0xfa000
mov edi, 0xfa000
cmovle edi, ebx
mov ecx, edi
call sub.msvcrt.dll_malloc
mov ecx, dword [r12]
xor r8d, r8d
mov edx, r13d
mov rbp, rax
call sub.msvcrt.dll__lseek
mov r8d, 0x1ff
mov edx, 0x8302
mov rcx, rsi
mov dword [rsp + 0x2c], eax
call sub.msvcrt.dll__open
cmp eax, 0xffffffff
mov r13d, eax
je 0x402911
test ebx, ebx
jne 0x4028ab
jmp 0x402934
mov r8d, r15d
mov rdx, rbp
mov ecx, r13d
call sub.msvcrt.dll__write
cmp eax, 0xffffffff
je 0x4028e0
sub ebx, r15d
je 0x4028ef
mov ecx, dword [r12]
cmp edi, ebx
mov r8d, ebx
mov rdx, rbp
cmovle r8d, edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov r15d, eax
je 0x4028ef
test r14d, r14d
je 0x402893
mov edx, eax
mov rcx, rbp
call fcn.004026a0
jmp 0x402893
lea rcx, str.ERROR:_Cant_write_to__s_n
mov rdx, rsi
call fcn.00401cb0
mov ecx, r13d
call sub.msvcrt.dll__close
mov rcx, rbp
call sub.msvcrt.dll_free
test ebx, ebx
je 0x402827
mov eax, 0xfffffffe
jmp 0x402829
mov rdx, r15
mov rcx, rsi
call fcn.00404350
test eax, eax
jne 0x402948
mov edx, dword [rsp + 0x2c]
xor r8d, r8d
mov ecx, dword [r12]
add edx, ebx
call sub.msvcrt.dll__lseek
jmp 0x4028f7
mov ecx, eax
call sub.msvcrt.dll__close
mov rcx, rbp
call sub.msvcrt.dll_free
jmp 0x402827
lea rcx, str.ERROR:_Cant_create__s_n
mov rdx, rsi
call fcn.00401cb0
cmp dword [0x00405024], 0
jne 0x40296a
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, str.SERVER_SOFTWARE
call sub.msvcrt.dll_getenv
test rax, rax
je 0x402960
lea rcx, str._br_Try_building_your_application_with_a__tiny_option_n
mov dword [0x00405024], 0
call fcn.00401cb0
jmp 0x402960
Function at 0x4029a0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov ebp, edx
mov ebx, r8d
lea ecx, [r8 + 1]
mov r12d, r9d
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x4029fc
mov ecx, dword [rdi]
xor r8d, r8d
movsxd rax, ebx
mov edx, ebp
mov byte [rsi + rax], 0
call sub.msvcrt.dll__lseek
mov ecx, dword [rdi]
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
cmp ebx, eax
jne 0x402a10
test r12d, r12d
je 0x4029fc
mov edx, ebx
mov rcx, rsi
call fcn.004026a0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, ebx
mov r8d, ebp
mov edx, ebp
lea rcx, str.P2X:_IO_error_1_pos_ld__08lx___size_ld_n
call sub.msvcrt.dll_printf
jmp 0x4029ed
Function at 0x4033b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00409784]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4034c8
mov rax, qword [0x00409788]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x4033fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4034ae
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x4033e0
mov rcx, rsi
call fcn.00404010
test rax, rax
mov r12, rax
je 0x403500
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00409788]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00404160
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov qword [r13 + 8], rax
mov rax, qword [0x00409788]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4034e3
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4034a7
sub eax, 4
and eax, 0xfffffffb
je 0x4034a7
add rbx, qword [0x00409788]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4034cf
add dword [0x00409784], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x403407
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00403340
mov rax, qword [0x00409788]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rbx + 8]
call fcn.00403340
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00403340
nop

Function at 0x403c80
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00409a60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00409a40]
test rbx, rbx
je 0x403cd4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x403ccb
test rsi, rsi
je 0x403ccb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x403cb0
lea rcx, [0x00409a60]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x404010
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00406710]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
je 0x404030
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.00403ef0
test eax, eax
je 0x404028
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40408d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x404084
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x404028
add rdx, 0x28
cmp rdx, r9
jne 0x404070
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x1800038b0
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x180003b00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
movabs rax, 0x100000001b3
mov qword [rsp + 0x10], rax
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
mov qword [rsp], 0
jmp 0x180003b4b
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp], rax
jae 0x180003b7d
mov rax, qword [rsp + 0x10]
imul rax, qword [rsp + 8]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x18]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
xor rax, rcx
mov qword [rsp + 8], rax
jmp 0x180003b40
mov rax, qword [rsp + 8]
add rsp, 0x28
ret