joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6daa5b60
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6daa5b70
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6daa5b80
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6daa5bc1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6daa5bb8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6daa5bc3
add rax, 0x28
cmp rax, r9
jne 0x6daa5ba4
xor eax, eax
ret

Function at 0x6daa5c60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6dac31f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6daa5ccd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daa5ccd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6daa5ccd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6daa5cc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6daa5ccf
add rax, 0x28
cmp rax, r9
jne 0x6daa5cb0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6daa5dd0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6dac31f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6daa5df0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daa5de8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6daa5e4d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6daa5e44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6daa5e54
add rax, 0x28
cmp rax, r9
jne 0x6daa5e30
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6daa5e70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6dac31f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6daa5ede
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6daa5ede
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6daa5ede
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6daa5ede
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6daa5ed5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6daa5ee5
add rcx, 0x28
cmp rcx, rax
jne 0x6daa5ec0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6daa5ef8
jmp 0x6daa5ede
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6daa5f06
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6daa5ede
test r9d, r9d
jg 0x6daa5ef0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6daa6240
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x402600
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rdx, rdx
jle 0x402764
mov r12, qword [fcn.0041cee0]
lea r14, [rcx + rdx*8]
mov rdi, rcx
lea r13, [0x0041f138]
lea rbp, [0x0041f139]
mov rbx, qword [rdi]
mov ecx, 1
call r12
mov rsi, rax
test rbx, rbx
je 0x402700
cmp qword [rbx], 0
lea r8, [rbx + 0x10]
mov rdx, rbp
mov rcx, rax
cmove r8, r13
call sub.msvcrt.dll_fprintf
mov r15d, eax
movsxd rax, r15d
cmp rax, qword [rbx]
jge 0x40268f
cmp byte [rbx + rax + 0x10], 0
jne 0x4026e0
xor ecx, ecx
mov rdx, rsi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x40268f
add r15d, 1
movsxd rax, r15d
cmp rax, qword [rbx]
jl 0x40266e
add rdi, 8
cmp rdi, r14
jne 0x402635
mov ecx, 1
call r12
mov r8d, 1
mov edx, 1
lea rcx, [0x0041f13c]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call r12
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msvcrt.dll_fflush
lea r8, [rbx + rax + 0x10]
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_fprintf
test eax, eax
jle 0x40268f
add r15d, eax
jmp 0x402666
mov r8, r13
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov ebx, eax
test ebx, ebx
jns 0x40268f
movsxd r8, ebx
cmp byte [r8 + 0x10], 0
jne 0x402749
xor ecx, ecx
mov rdx, rsi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x40268f
add ebx, 1
test ebx, ebx
jns 0x40268f
movsxd r8, ebx
cmp byte [r8 + 0x10], 0
je 0x402722
add r8, 0x10
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_fprintf
test eax, eax
jle 0x40268f
add ebx, eax
jmp 0x402710
mov r12, qword [fcn.0041cee0]
jmp 0x402698

Function at 0x402ae0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x402aff
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x402d10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.0041cee0]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
ret
Function at 0x4118a0
Capabilities:
Parse credit card information

Disassembly:
cmp cx, 0x16
je 0x411b24
jbe 0x411900
cmp cx, 0x25
je 0x411d10
jbe 0x411a30
cmp cx, 0x44
je 0x411d00
ja 0x411a03
cmp cx, 0x41
je 0x411cf0
jbe 0x411950
cmp cx, 0x42
je 0x411ce0
cmp cx, 0x43
jne 0x411cd0
lea rcx, [0x00420340]
jmp fcn.0040b8b0
cmp cx, 0xa
je 0x411cc0
ja 0x4119c3
cmp cx, 4
je 0x411cb0
jbe 0x411990
cmp cx, 7
je 0x411ca0
jbe 0x411970
cmp cx, 8
je 0x411c90
cmp cx, 9
jne 0x411cd0
lea rcx, [0x004206c0]
jmp fcn.0040b8b0
cmp cx, 0x26
je 0x411c80
cmp cx, 0x40
jne 0x411cd0
lea rcx, [0x004203a0]
jmp fcn.0040b8b0
cmp cx, 5
je 0x411c70
cmp cx, 6
jne 0x411cd0
lea rcx, [0x00420720]
jmp fcn.0040b8b0
cmp cx, 1
je 0x411c60
test cx, cx
je 0x411c50
cmp cx, 2
je 0x411c40
cmp cx, 3
jne 0x411cd0
lea rcx, [0x00420780]
jmp fcn.0040b8b0
cmp cx, 0x10
je 0x411c30
jbe 0x411b00
cmp cx, 0x13
je 0x411c20
jbe 0x411ae0
cmp cx, 0x14
je 0x411c10
cmp cx, 0x15
jne 0x411cd0
lea rcx, [0x00420560]
jmp fcn.0040b8b0
cmp cx, 0x47
je 0x411c00
jbe 0x411a70
cmp cx, 0x48
je 0x411bf0
cmp cx, 0xfff
jne 0x411cd0
lea rcx, [0x00420240]
jmp fcn.0040b8b0
cmp cx, 0x1b
je 0x411be0
jbe 0x411ab0
cmp cx, 0x1e
je 0x411bd0
jbe 0x411a90
cmp cx, 0x1f
je 0x411bc0
cmp cx, 0x24
jne 0x411cd0
lea rcx, [0x00420400]
jmp fcn.0040b8b0
cmp cx, 0x45
je 0x411bb0
cmp cx, 0x46
jne 0x411cd0
lea rcx, [0x004202a0]
jmp fcn.0040b8b0
cmp cx, 0x1c
je 0x411ba0
cmp cx, 0x1d
jne 0x411cd0
lea rcx, [0x00420460]
jmp fcn.0040b8b0
cmp cx, 0x18
je 0x411b90
jb 0x411b80
cmp cx, 0x19
je 0x411b70
cmp cx, 0x1a
jne 0x411cd0
lea rcx, [0x004204c0]
jmp fcn.0040b8b0
cmp cx, 0x11
je 0x411b60
cmp cx, 0x12
jne 0x411cd0
lea rcx, [0x004205c0]
jmp fcn.0040b8b0
cmp cx, 0xc
je 0x411b50
jb 0x411b40
cmp cx, 0xd
je 0x411b30
cmp cx, 0xe
jne 0x411cd0
lea rcx, [0x00420620]
jmp fcn.0040b8b0
lea rcx, [0x00420540]
jmp fcn.0040b8b0
lea rcx, [0x00420640]
jmp fcn.0040b8b0
lea rcx, [0x00420680]
jmp fcn.0040b8b0
lea rcx, [0x00420660]
jmp fcn.0040b8b0
lea rcx, [0x004205e0]
jmp fcn.0040b8b0
lea rcx, [0x004204e0]
jmp fcn.0040b8b0
lea rcx, [0x00420520]
jmp fcn.0040b8b0
lea rcx, [0x00420500]
jmp fcn.0040b8b0
lea rcx, [0x00420480]
jmp fcn.0040b8b0
lea rcx, [0x004202c0]
jmp fcn.0040b8b0
lea rcx, [0x00420420]
jmp fcn.0040b8b0
lea rcx, [0x00420440]
jmp fcn.0040b8b0
lea rcx, [0x004204a0]
jmp fcn.0040b8b0
lea rcx, [0x00420260]
jmp fcn.0040b8b0
lea rcx, [0x00420280]
jmp fcn.0040b8b0
lea rcx, [0x00420580]
jmp fcn.0040b8b0
lea rcx, [0x004205a0]
jmp fcn.0040b8b0
lea rcx, [0x00420600]
jmp fcn.0040b8b0
lea rcx, [0x004207a0]
jmp fcn.0040b8b0
lea rcx, [0x004207e0]
jmp fcn.0040b8b0
lea rcx, [0x004207c0]
jmp fcn.0040b8b0
lea rcx, [0x00420740]
jmp fcn.0040b8b0
lea rcx, [0x004203c0]
jmp fcn.0040b8b0
lea rcx, [0x004206e0]
jmp fcn.0040b8b0
lea rcx, [0x00420700]
jmp fcn.0040b8b0
lea rcx, [0x00420760]
jmp fcn.0040b8b0
lea rcx, [0x004206a0]
jmp fcn.0040b8b0
lea rcx, [0x004208a0]
jmp fcn.0040b8b0
lea rcx, [0x00420360]
jmp fcn.0040b8b0
lea rcx, [0x00420380]
jmp fcn.0040b8b0
lea rcx, [0x00420300]
jmp fcn.0040b8b0
lea rcx, [0x004203e0]
jmp fcn.0040b8b0
Function at 0x413340
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test rcx, rcx
je 0x4133b5
cmp rcx, 0xffffffffffffffff
mov r8, qword [0x0043ca60]
mov r9, qword [0x0043ca68]
je 0x4133c0
mov rax, 0xffffffffffffffff
xor edx, edx
div rcx
not rdx
mov r10, rdx
nop dword [rax]
lea rax, [r9 + r8]
mov rdx, r9
xor rdx, r8
ror r8, 9
mov r9, rdx
xor r8, rdx
ror rdx, 0x1c
shl r9, 0xe
xor r8, r9
cmp rax, r10
mov r9, rdx
ja 0x413370
movq xmm1, rdx
movq xmm0, r8
add rcx, 1
punpcklqdq xmm0, xmm1
xor edx, edx
movups xmmword [0x0043ca60], xmm0
div rcx
mov rax, rdx
ret
mov rax, r8
mov rdx, r8
xor rax, r9
ror rdx, 9
mov rcx, rax
xor rdx, rax
ror rax, 0x1c
shl rcx, 0xe
mov qword [0x0043ca68], rax
xor rdx, rcx
mov qword [0x0043ca60], rdx
lea rdx, [r8 + r9]
mov rax, rdx
ret

Function at 0x413410
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.0040b8b0
test rax, rax
je 0x41346a
mov r9, qword [rax]
test r9, r9
jle 0x41346a
mov r8, rax
add r9, rbx
sub r8, rbx
mov rcx, rbx
mov rdx, rbx
sar rcx, 8
sar rdx, 0x10
xor ecx, ebx
and edx, 0xffffffee
and ecx, 0xffffffee
xor cl, byte [r8 + rbx + 0x10]
xor ecx, edx
mov rdx, rbx
sar rdx, 0x18
and edx, 0xffffffee
xor ecx, edx
mov byte [r8 + rbx + 0x10], cl
add rbx, 1
cmp rbx, r9
jne 0x413433
add rsp, 0x20
pop rbx
ret
Function at 0x4154a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rsi, [0x004222c0]
mov edx, 0x3e2a1280
mov r13, rcx
lea rcx, [0x00422300]
call fcn.00413410
lea rdi, [r13 + 2]
mov edx, 0x6a15ea80
mov rcx, rax
call fcn.00415320
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea rbp, [rax + 0x20]
nop
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x415520
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x415690
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x415500
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
je 0x4156b1
mov rax, rcx
lea edx, [rbx - 0x41]
cmp dx, 0x19
ja 0x4156c0
add ebx, 0x20
add rax, 2
mov word [rax - 2], bx
movzx ebx, word [rax]
test bx, bx
jne 0x415534
movzx r14d, word [r13]
movzx ebx, word [rcx]
test r14w, r14w
je 0x4155c5
test bx, bx
je 0x4156d5
mov r10, rdi
mov eax, r14d
sub r10, rcx
jmp 0x415586
cmp word [rcx], 0
je 0x4155c5
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x4156d5
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x415580
mov edx, 0x22c9e280
mov rcx, rsi
call fcn.00413410
mov edx, 0x2958ba80
mov rcx, rax
call fcn.00415320
cmp r14w, bx
je 0x4156f4
mov r12, qword [r12]
cmp rbp, r12
jne 0x4154f0
lea rcx, [0x00422200]
mov edx, 0x3fbee680
call fcn.00413410
lea rbx, [rsp + 0x30]
mov edx, 0x33457e80
mov rcx, rax
call fcn.00415320
mov rcx, rbx
mov rdx, r13
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x0043d030]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x0043d0a0]
mov edx, 0x5984db80
lea rcx, [0x004221c0]
mov ebx, eax
call fcn.00413410
mov edx, 0x36662380
mov rcx, rax
call fcn.00415320
xor eax, eax
test ebx, ebx
jne 0x4156f9
mov rax, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x415500
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
jne 0x415531
movzx r14d, word [r13]
jmp 0x4155c5
add rax, 2
movzx ebx, word [rax]
test bx, bx
jne 0x415534
jmp 0x415554
mov rcx, rsi
mov edx, 0x22c9e280
call fcn.00413410
mov edx, 0x2958ba80
mov rcx, rax
call fcn.00415320
jmp 0x4155e9
mov rax, qword [r12 + 0x20]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x415ff0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbx, [0x004222c0]
mov r14, rcx
mov ebp, edx
mov edx, 0x3e2a1280
lea rcx, [0x00422300]
call fcn.00413410
lea rsi, [r14 + 2]
mov edx, 0x6a15ea80
mov rcx, rax
call fcn.00415320
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
lea rdi, [rax + 0x20]
movzx eax, word [r14]
mov rdx, r14
test ax, ax
je 0x416070
nop
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x4161e0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x416050
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
je 0x416202
mov rax, rcx
lea edx, [r12 - 0x41]
cmp dx, 0x19
ja 0x416210
add r12d, 0x20
add rax, 2
mov word [rax - 2], r12w
movzx r12d, word [rax]
test r12w, r12w
jne 0x416085
movzx r15d, word [r14]
movzx r12d, word [rcx]
test r15w, r15w
je 0x416115
test r12w, r12w
je 0x416230
mov r10, rsi
mov eax, r15d
sub r10, rcx
jmp 0x4160d6
cmp word [rcx], 0
je 0x416115
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x416230
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x4160d0
mov edx, 0x22c9e280
mov rcx, rbx
call fcn.00413410
mov edx, 0x2958ba80
mov rcx, rax
call fcn.00415320
cmp r15w, r12w
je 0x41624f
mov r13, qword [r13]
cmp rdi, r13
jne 0x416043
test ebp, ebp
je 0x416264
lea rcx, [0x00422200]
mov edx, 0x3fbee680
call fcn.00413410
lea rbx, [rsp + 0x30]
mov edx, 0x33457e80
mov rcx, rax
call fcn.00415320
mov rcx, rbx
mov rdx, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x0043d030]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x0043d0a0]
mov edx, 0x5984db80
lea rcx, [0x004221c0]
mov ebx, eax
call fcn.00413410
mov edx, 0x36662380
mov rcx, rax
call fcn.00415320
test ebx, ebx
jne 0x416282
mov rax, qword [rsp + 0x28]
jmp 0x416253
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x416050
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
jne 0x416082
movzx r15d, word [r14]
jmp 0x416115
add rax, 2
movzx r12d, word [rax]
test r12w, r12w
jne 0x416085
jmp 0x4160ab
mov rcx, rbx
mov edx, 0x22c9e280
call fcn.00413410
mov edx, 0x2958ba80
mov rcx, rax
call fcn.00415320
jmp 0x416139
mov rax, qword [r13 + 0x20]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x00422280]
mov edx, 0x43cf8f80
call fcn.00413410
mov edx, 0x16ad9780
mov rcx, rax
call fcn.00415320
xor eax, eax
jmp 0x416253
Function at 0x417580
Capabilities:
Parse pe header

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [0x00423500]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x20]
mov r13, rdx
mov rdi, qword [rax]
lea rbp, [rdi - 0x10]
mov rbx, rbp
mov rsi, qword [rbx + 0x50]
mov rcx, rsi
call qword [r12]
mov rcx, rsi
movsxd rdx, eax
call fcn.0040ca80
test rax, rax
mov rsi, rax
je 0x417625
cmp qword [rax], 0
je 0x417625
xor ecx, ecx
call fcn.0040e090
mov rdx, rsi
mov rcx, rax
call fcn.0040c960
test al, al
jne 0x417625
mov rcx, qword [rbx + 0x30]
cmp word [rcx], 0x5a4d
je 0x417600
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x4175ed
movsxd rdx, dword [rax + 0x88]
mov r8, r13
add rdx, rcx
call fcn.004173a0
test al, al
jne 0x4175ef
mov rdi, qword [rdi]
lea rbx, [rdi - 0x10]
cmp rbp, rbx
jne 0x4175a8
jmp 0x4175ed
Function at 0x41be20
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00429e84]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x41bfa8
mov rax, qword [0x00429e88]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x41be6c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x41bef5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x41be50
mov rcx, rbx
call fcn.0041cac0
test rax, rax
mov r12, rax
je 0x41bfdd
mov rax, qword [0x00429e88]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0041cbf0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00429e88]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x41bfc0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x41beee
sub eax, 0x40
and eax, 0xffffffbf
jne 0x41bf50
add dword [0x00429e84], 1
cmp edi, 8
jae 0x41bf23
test dil, 4
jne 0x41bf94
test edi, edi
je 0x41bf18
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x41bfaf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x41bf18
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x41bf3c
jmp 0x41bf18
add rsi, qword [0x00429e88]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41beee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0041d080
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x41bf18
xor esi, esi
jmp 0x41be77
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x41bf18
mov rax, qword [0x00429e88]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0041d080
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0041d080
nop
nop dword [rax]

Function at 0x41c730
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0042a160]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0042a140]
test rbx, rbx
je 0x41c784
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x41c77b
test rsi, rsi
je 0x41c77b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x41c760
lea rcx, [0x0042a160]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x41cac0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004238e0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x41cb2d
mov rcx, r8
call fcn.0041c9a0
test eax, eax
je 0x41cb2d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x41cb2d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x41cb24
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x41cb2f
add rax, 0x28
cmp rax, r9
jne 0x41cb10
xor eax, eax
add rsp, 0x28
ret

Function at 0x41d080
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0041cee0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0041cee0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x92d1b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x92d33f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x92d1e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x92d1cf
add dl, dl
jne 0x92d1f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x92d256
xor eax, eax
add dl, dl
jne 0x92d205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x92d30d
add dl, dl
jne 0x92d216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92d223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92d230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92d23d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x92d24a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x92d1de
mov eax, 1
add dl, dl
jne 0x92d266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x92d273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x92d25b
sub eax, ebx
mov ebx, 1
jne 0x92d2ac
mov ecx, 1
add dl, dl
jne 0x92d28e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92d29b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x92d283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x92d1de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x92d2c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x92d2d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x92d2bd
cmp eax, 0x7d00
jae 0x92d2fb
cmp eax, 0x500
jb 0x92d2f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x92d1de
cmp eax, 0x7f
ja 0x92d2fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x92d1de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x92d332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x92d1de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20