joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f512c
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2fa0]
mov eax, 0x30a0
call fcn.140101610
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x30e0], rbx
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x2f90], rax
mov rsi, r8
mov rdi, rdx
mov r12, rcx
mov rax, rdx
mov r9, r8
sub r9, rdx
movzx edx, word [rax]
movzx r8d, word [rax + r9]
sub edx, r8d
jne 0x1400f5197
add rax, 2
test r8d, r8d
jne 0x1400f5181
test edx, edx
je 0x1400f539f
xor r14b, r14b
lea rdx, [rbp + 0x1f90]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movzx ecx, word [rbp + 0x1f90]
call fcn.140127fa4
mov r15d, eax
mov r13d, 1
cmp word [rbp + 0x1f90], 0x5c
je 0x1400f520d
cmp word [rsi], 0x5c
je 0x1400f520d
cmp word [rdi], 0x5c
je 0x1400f520d
movzx ecx, word [rsi]
call fcn.140127fa4
mov ebx, eax
movzx ecx, word [rdi]
call fcn.140127fa4
cmp word [rsi + 2], 0x3a
cmovne ebx, r15d
cmp word [rdi + 2], 0x3a
cmovne eax, r15d
movzx r14d, r14b
cmp ebx, eax
cmovne r14d, r13d
mov rcx, rdi
call fcn.140070448
test al, al
je 0x1400f5275
lea rcx, [rsp + 0x30]
call fcn.14006ebf0
nop
mov r8d, 9
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14006f250
test al, al
je 0x1400f5261
lea rcx, [rsp + 0x30]
call fcn.14006ed00
test al, al
je 0x1400f5261
mov rcx, rdi
call fcn.140070160
test al, al
je 0x1400f5261
lea rcx, [rsp + 0x30]
call fcn.14006ec30
jmp 0x1400f5275
lea rcx, [rsp + 0x30]
call fcn.14006ec30
mov eax, 0xf
jmp 0x1400f53a1
test r14b, r14b
jne 0x1400f5292
mov rdx, rdi
mov rcx, rsi
call fcn.140070b5c
test al, al
sete al
test al, al
je 0x1400f539f
lea rcx, [rsp + 0x30]
call fcn.14006ebf0
nop
lea rcx, [rbp + 0xf60]
call fcn.14006ebf0
nop
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14006f250
test al, al
jne 0x1400f52d7
mov rdx, rsi
lea rcx, [0x1401d5778]
call fcn.140069db0
mov ebx, 0xa
jmp 0x1400f5364
mov r8d, 0x12
mov rdx, rdi
lea rcx, [rbp + 0xf60]
call fcn.14006eec0
test al, al
jne 0x1400f52f7
mov ebx, 0xf
jmp 0x1400f5364
xor edx, edx
lea rcx, [0x1401d5778]
call fcn.140069ebc
or r9, 0xffffffffffffffff
lea r8, [rbp + 0xf60]
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1400f4be4
mov r14d, eax
lea rcx, [rsp + 0x30]
call fcn.14006ed00
lea rcx, [rbp + 0xf60]
call fcn.14006ed00
mov dl, r13b
lea rcx, [0x1401d5778]
call fcn.140069ebc
test r14d, r14d
je 0x1400f537f
mov rcx, rdi
call fcn.140070160
mov eax, 0xe
lea ebx, [rax - 4]
cmp r14d, ebx
cmove r14d, eax
mov ebx, r14d
lea rcx, [rbp + 0xf60]
call fcn.14006ec30
nop
lea rcx, [rsp + 0x30]
call fcn.14006ec30
mov eax, ebx
jmp 0x1400f53a1
mov rcx, rsi
call fcn.140070160
nop
lea rcx, [rbp + 0xf60]
call fcn.14006ec30
nop
lea rcx, [rsp + 0x30]
call fcn.14006ec30
xor eax, eax
mov rcx, qword [rbp + 0x2f90]
xor rcx, rsp
call fcn.140101680
mov rbx, qword [rsp + 0x30e0]
add rsp, 0x30a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f5724
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0xd0
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rsp + 0xc0], rax
inc dword [rcx + 0x1f4]
mov r14d, r8d
cmp dword [rcx + 0x1f4], 1
mov rdi, rdx
mov rsi, rcx
jne 0x1400f5779
xor ecx, ecx
call fcn.14012cb90
mov rbx, rax
call sub.KERNEL32.dll_GetCurrentProcessId
xor eax, ebx
mov ecx, eax
call fcn.14012cae0
mov r8d, 0x80
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140094300
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400f58d0
xor ebp, ebp
mov r12d, 0xfffd
call fcn.14012cab4
mov ebx, dword [rsi + 0x1f0]
mov rcx, rsi
sar eax, 7
and ebx, r12d
movzx edi, al
or ebx, 2
mov edx, edi
call fcn.1400f592c
mov eax, ebx
xor eax, 1
imul eax, ebx
shr eax, 8
xor al, dil
mov byte [rsp + rbp + 0x30], al
inc rbp
cmp rbp, 0xa
jl 0x1400f57a1
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400f58d0
xor ebp, ebp
mov edi, dword [rsi + 0x1f0]
mov rcx, rsi
movzx ebx, byte [rsp + rbp + 0x30]
and edi, r12d
mov edx, ebx
or edi, 2
call fcn.1400f592c
mov eax, edi
xor eax, 1
imul eax, edi
shr eax, 8
xor al, bl
mov byte [rsp + rbp + 0x30], al
inc rbp
cmp rbp, 0xa
jl 0x1400f57ec
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.140094598
mov edi, dword [rsi + 0x1f0]
mov ebx, r14d
shr ebx, 0x10
and edi, r12d
movzx edx, bl
mov rcx, rsi
or edi, 2
call fcn.1400f592c
mov eax, edi
shr r14d, 0x18
xor eax, 1
mov edx, r14d
imul eax, edi
mov rcx, rsi
shr eax, 8
xor al, bl
mov ebx, dword [rsi + 0x1f0]
and ebx, r12d
mov byte [rsp + 0x3a], al
or ebx, 2
call fcn.1400f592c
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov eax, ebx
mov r9d, 0xc
xor eax, 1
mov rcx, rsi
imul eax, ebx
lea r8d, [r9 - 0xb]
shr eax, 8
xor al, r14b
mov byte [rsp + 0x3b], al
call fcn.1400f4744
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140101680
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400f592c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, dword [rcx + 0x1e8]
lea rbx, [0x140237610]
mov r10, rcx
mov eax, edx
mov r11d, edx
mov r8d, r9d
xor r8, rax
shr r9d, 8
movzx eax, r8b
mov edx, dword [r10 + 0x1f0]
mov r8d, dword [rbx + rax*4]
xor r8d, r9d
mov dword [rcx + 0x1e8], r8d
movzx eax, r8b
add eax, dword [rcx + 0x1ec]
imul ecx, eax, 0x8088405
inc ecx
mov dword [r10 + 0x1ec], ecx
shr rcx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [rbx + rax*4]
mov rbx, qword [rsp + 8]
xor eax, edx
mov dword [r10 + 0x1f0], eax
mov eax, r11d
ret
Function at 0x1400f59a8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp byte [0x1401ae2e0], 0
mov rbp, r9
mov r14, r8
mov r15, rdx
mov rsi, rcx
je 0x1400f5a37
cmp byte [rcx + 4], 0
je 0x1400f59f4
mov edx, ebp
lea r8, [rcx + 8]
imul edx, r14d
mov rcx, r15
call fcn.1400beda8
jmp 0x1400f5a37
mov rdi, r14
mov r12, r15
imul rdi, rbp
test rdi, rdi
je 0x1400f5a37
mov ebx, dword [rsi + 0x1f0]
mov rcx, rsi
movsx edx, byte [r12]
and ebx, 0xfffd
or ebx, 2
call fcn.1400f592c
mov eax, ebx
xor eax, 1
imul eax, ebx
shr eax, 8
xor byte [r12], al
inc r12
sub rdi, 1
jne 0x1400f5a03
and dword [rsp + 0x20], 0
mov r9, rbp
mov r8, r14
mov rdx, r15
mov rcx, rsi
call fcn.1400f4744
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x1400fe0a8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400fe0e0
test al, 0x10
jne 0x1400fe0dc
and eax, 0xffffffdf
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400fe0e0
mov al, 1
jmp 0x1400fe0f6
mov rdx, qword [rdi + 0x64bad8]
mov r8, rbx
mov ecx, 0x11
call fcn.140004ca4
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140103ab8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140103acb
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140104134
lea rdx, [0x140183c48]
lea rcx, [rsp + 0x20]
call fcn.1401213fc
int3

Function at 0x14010ffcc
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140238660]
xor edx, edx
jmp fcn.140103ab8

Function at 0x1401109ec
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140238660]
jmp fcn.140103ab8
Function at 0x140131fc0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140131e60
call fcn.14012b27c
mov dword [rax], 0x16
call fcn.140126fec
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140131e48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140131e48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140131e92
lock or dword [rax + 0x14], 0x10
jmp 0x140131e48
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140131eaf
mov rcx, qword [rbp + 0x10]
call fcn.140136bcc
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14012be14
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140129f2c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140131f06
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140131e48
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140131f72
mov rcx, qword [rbp + 0x10]
call fcn.14012be14
cmp eax, 0xffffffff
je 0x140131f59
mov rcx, qword [rbp + 0x10]
call fcn.14012be14
cmp eax, 0xfffffffe
je 0x140131f59
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14012be14
movsxd rdi, eax
lea rsi, [0x140238b10]
mov rcx, rbx
sar rdi, 6
call fcn.14012be14
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140131f60
lea rax, [0x140192b30]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140131f72
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140131fa8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140131fa4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140131fa4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140131e4b
jmp 0x140131e18
Function at 0x404ae0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
xor ecx, ecx
mov rsi, rdx
mov edi, r8d
call fcn.00404a10
test eax, eax
mov ebx, eax
je 0x404b2a
mov eax, dword [0x00539290]
test eax, eax
je 0x404b0f
add eax, ebx
cmp eax, 0x45
jg 0x404b50
cmp edi, 0x20
je 0x404b90
mov rdx, rsi
mov rcx, rbp
call fcn.00404a10
add dword [0x00539290], ebx
cmp edi, 0x3a
je 0x404b33
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rbp
mov ecx, 0x3a
call sub.msvcrt.dll_putc
add dword [0x00539290], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.__n
mov r9, rbp
mov r8d, 4
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp edi, 0x20
mov dword [0x00539290], 0
jne 0x404b14
mov rdx, rsi
mov rcx, rbp
call fcn.00404a10
add dword [0x00539290], ebx
jmp 0x404b2a
mov rdx, rbp
mov ecx, 0x20
call sub.msvcrt.dll_putc
mov rdx, rsi
mov rcx, rbp
add dword [0x00539290], 1
call fcn.00404a10
add dword [0x00539290], ebx
jmp 0x404b2a

Function at 0x40caa0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
test r9, r9
mov r14, rdx
mov rsi, r8
mov rbp, r9
je 0x40cb9c
lea rdi, [r8 + r9]
xor eax, eax
nop word cs:[rax + rax]
movsx r11d, byte [r8]
add r8, 1
mov r10d, r11d
shl r10d, 0x11
add r10d, r11d
add eax, r10d
mov r9d, eax
shr r9d, 2
xor eax, r9d
cmp rdi, r8
jne 0x40cae0
mov edi, ebp
shl edi, 0x11
add edi, ebp
add edi, eax
mov eax, edi
shr eax, 2
xor edi, eax
test r12, r12
je 0x40cb1d
mov dword [r12], edi
xor edx, edx
mov eax, edi
div dword [r14]
mov rax, qword [rcx]
test rbx, rbx
mov edx, edx
lea r13, [rax + rdx*8]
je 0x40cb35
mov qword [rbx], r13
mov rbx, qword [r13]
test rbx, rbx
je 0x40cba3
xor r12d, r12d
jmp 0x40cb51
mov rax, qword [rbx]
mov r12, rbx
test rax, rax
je 0x40cb8d
mov rbx, rax
cmp edi, dword [rbx + 0x10]
jne 0x40cb43
mov r14, qword [rbx + 8]
mov r8, rbp
mov rdx, rsi
mov rcx, r14
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x40cb43
cmp byte [r14 + rbp], 0
jne 0x40cb43
test r12, r12
je 0x40cba7
mov rax, qword [rbx]
mov qword [r12], rax
mov rax, qword [r13]
mov qword [rbx], rax
mov qword [r13], rbx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
jmp 0x40cb04
xor eax, eax
jmp 0x40cb8d
mov rax, rbx
jmp 0x40cb8d

Function at 0x40d130
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [0x005393d0]
mov rdi, rdx
call sub.msvcrt.dll_feof
test eax, eax
je 0x40d160
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r9, qword [0x005393d0]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call sub.msvcrt.dll_fread
mov rcx, qword [0x005393d0]
mov rbx, rax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x40d14f
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.004cba30
mov rdx, qword [0x005393c8]
lea rcx, str.cant_read_from__s:__s
mov r8, rax
call fcn.00412a70
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x412640
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [0x00539640]
mov rbx, rcx
test eax, eax
jne 0x41269c
test rcx, rcx
mov dword [0x00539640], 1
mov rsi, qword [sym.imp.msvcrt.dll___iob_func]
je 0x4126a3
call rsi
lea rdx, [0x004e9440]
lea rcx, [rax + 0x60]
mov r8, rbx
call sub.msvcrt.dll_fprintf
call rsi
lea rcx, str.Assembler_messages:_n
lea r9, [rax + 0x60]
mov r8d, 0x14
mov edx, 1
call sub.msvcrt.dll_fwrite
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.0040dde0
test rax, rax
mov rbx, rax
je 0x41267e
jmp 0x412669

Function at 0x412b20
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
call fcn.004126c0
lea rax, [rsp + 0x58]
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
mov qword [rsp + 0x28], rax
call rbx
lea rcx, str.Fatal_error:
lea r9, [rax + 0x60]
mov r8d, 0xd
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdi, qword [rsp + 0x28]
call rbx
lea rcx, [rax + 0x60]
mov rdx, rsi
mov r8, rdi
call sub.msvcrt.dll_vfprintf
call rbx
lea rdx, [rax + 0x60]
mov ecx, 0xa
call sub.msvcrt.dll_putc
mov rax, qword [0x0051f3c0]
mov rcx, qword [rax]
test rcx, rcx
je 0x412ba6
call fcn.004cb770
mov ecx, 1
call fcn.004cb8a0
nop
nop dword [rax + rax]
nop word cs:[rax + rax]

Function at 0x41c020
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, qword [0x0051f490]
mov rdi, rcx
cmp qword [rbx], 0
je 0x41c0e1
mov r9, rcx
lea rcx, str.frag_chains:_n
mov r8d, 0xd
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rax, qword [rbx]
mov rbp, qword [rax + 0x88]
test rbp, rbp
je 0x41c0e1
lea r12, str._t_p___10s_t_10d_frags_n
nop
mov rax, qword [rbp]
cmp byte [rax], 0x2a
je 0x41c0d8
mov rax, qword [rbp + 0xb0]
test rax, rax
je 0x41c0d8
mov rsi, qword [rax]
test rsi, rsi
je 0x41c0d8
nop dword [rax]
mov rax, qword [rsi]
xor ebx, ebx
test rax, rax
je 0x41c0ac
nop word [rax + rax]
mov rax, qword [rax + 0x38]
add ebx, 1
test rax, rax
jne 0x41c0a0
mov rdx, rdi
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov dword [rsp + 0x20], ebx
mov r9, qword [rbp]
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_fprintf
mov rsi, qword [rsi + 0x10]
test rsi, rsi
jne 0x41c090
mov rbp, qword [rbp + 0x18]
test rbp, rbp
jne 0x41c070
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x447df0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, dword [rcx + 0x18]
mov eax, dword [r8 + 0x10]
mov rbx, rdx
xor edx, edx
mov r9, qword [rcx]
div r10d
mov edx, edx
lea rax, [r9 + rdx*8]
mov rdx, qword [rax]
test rdx, rdx
je 0x4438f0
cmp r8, rdx
jne 0x4438e8
jmp 0x443913
cmp r8, rax
je 0x443910
mov rdx, rax
mov rax, qword [rdx]
test rax, rax
jne 0x4438e0
lea r8, str.bfd_hash_rename
lea rcx, str._builds_idf_crosstool_NG_.build_HOST_x86_64_w64_mingw32_xtensa_esp32s2_elf_src_binutils_bfd_hash.c
mov edx, 0x244
call fcn.0043f7f0
nop dword [rax + rax]
mov rax, rdx
mov rdx, qword [r8]
test rbx, rbx
mov qword [rax], rdx
mov qword [r8 + 8], rbx
je 0x443981
movzx ecx, byte [rbx]
xor eax, eax
lea rdx, [rbx + 1]
test ecx, ecx
je 0x44394f
nop
mov r11d, ecx
add rdx, 1
shl r11d, 0x11
add ecx, r11d
add eax, ecx
mov ecx, eax
shr ecx, 2
xor eax, ecx
movzx ecx, byte [rdx - 1]
test ecx, ecx
jne 0x443930
sub rdx, rbx
sub edx, 1
add eax, edx
shl edx, 0x11
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
xor edx, edx
mov dword [r8 + 0x10], eax
div r10d
mov eax, edx
lea rax, [r9 + rax*8]
mov rdx, qword [rax]
mov qword [r8], rdx
mov qword [rax], r8
add rsp, 0x20
pop rbx
ret
lea rcx, str._builds_idf_crosstool_NG_.build_HOST_x86_64_w64_mingw32_xtensa_esp32s2_elf_src_binutils_bfd_hash.c
mov edx, 0x1b6
call fcn.0043f7d0
movzx eax, byte [pe_dos_header]
ud2
mov rax, qword [rcx + 0xf8]
lea r8, [rcx - 0x18]
mov qword [rcx], rdx
add rax, 0x60
mov rcx, rax
jmp 0x4438b0

Function at 0x449560
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rax, rcx
mov rbx, rdx
je 0x4495b0
lea rdi, str.default
mov ecx, 8
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
je 0x4495c1
test rbx, rbx
je 0x4495f0
and byte [rbx + 0x44], 0xbf
mov rcx, rax
call fcn.00449440
test rax, rax
je 0x4495fd
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x449572
mov rax, qword [0x004d5750]
test rax, rax
je 0x4495e2
test rbx, rbx
je 0x44959f
or byte [rbx + 0x44], 0x40
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [0x004d5760]
mov rax, qword [rax]
jmp 0x4495cd
mov rcx, rax
call fcn.00449440
test rax, rax
jne 0x44959f
xor eax, eax
jmp 0x44959f
Function at 0x457a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rcx
mov rcx, r8
mov rbx, rdx
mov rsi, r8
mov edi, r9d
call fcn.00457900
mov ecx, dword [rbp]
mov rdx, qword [rbx]
sub ecx, 1
and eax, ecx
mov rbx, qword [rdx + rax*8]
test rbx, rbx
jne 0x457a4d
jmp 0x457b90
mov rbx, qword [rbx + 0x68]
test rbx, rbx
je 0x457b90
mov rax, qword [rbx]
mov rdx, qword [rsi]
test rax, rax
sete r9b
test rdx, rdx
sete cl
cmp r9b, cl
jne 0x457a40
test rax, rax
je 0x457ba0
mov r8, qword [rbx + 0x10]
mov rcx, qword [rsi + 0x10]
mov r9, r8
xor r9, rcx
test r9b, r9b
jne 0x457a40
mov r10, qword [rsi + 0x20]
cmp qword [rbx + 0x20], r10
jne 0x457a40
mov r11, qword [rsi + 0x28]
cmp qword [rbx + 0x28], r11
jne 0x457a40
mov r11d, dword [rsi + 0x30]
cmp dword [rbx + 0x30], r11d
jne 0x457a40
mov rax, qword [rax + 0xf8]
shr r8, 8
xor ebp, ebp
mov r9d, dword [rax + 0x8c]
cmp r8d, r9d
jb 0x457ae0
mov rax, qword [rax + 0x2f8]
sub r8d, r9d
mov rbp, qword [rax + r8*8]
movzx eax, byte [rbp + 0x18]
sub eax, 6
cmp al, 1
ja 0x457ae0
mov rbp, qword [rbp + 0x28]
movzx eax, byte [rbp + 0x18]
sub eax, 6
cmp al, 1
jbe 0x457ad1
mov rax, qword [rdx + 0xf8]
shr rcx, 8
mov edx, dword [rax + 0x8c]
cmp ecx, edx
jb 0x457bce
mov rax, qword [rax + 0x2f8]
sub ecx, edx
mov r12, qword [rax + rcx*8]
movzx eax, byte [r12 + 0x18]
sub eax, 6
cmp al, 1
ja 0x457b25
mov r12, qword [r12 + 0x28]
movzx eax, byte [r12 + 0x18]
sub eax, 6
cmp al, 1
jbe 0x457b13
test byte [r12 + 0x65], 0x10
jne 0x457a40
mov rcx, rbx
call fcn.004578a0
test eax, eax
je 0x457bae
test edi, edi
jne 0x457b59
test rbp, rbp
je 0x457b4c
cmp byte [rbp + 0x18], 4
je 0x457bae
test r12, r12
je 0x457b59
cmp byte [r12 + 0x18], 4
je 0x457bae
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx]
shr rdx, 8
call fcn.004577d0
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rbp, rax
shr rdx, 8
call fcn.004577d0
cmp rbp, rax
jne 0x457a40
jmp 0x457bc0
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, dword [rsi + 0x30]
cmp dword [rbx + 0x30], eax
jne 0x457a40
jmp 0x457b92
cmp rbp, r12
jne 0x457a40
test rbp, rbp
je 0x457a40
mov eax, dword [rsi + 0x34]
cmp dword [rbx + 0x34], eax
jne 0x457a40
jmp 0x457b92
xor r12d, r12d
jmp 0x457b31
Function at 0x4663f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rbx, rdx
mov rdi, rcx
mov rsi, r8
lea rcx, [rbx + 0x10]
mov rax, qword [rax + 0x370]
movzx ebp, byte [rax + 0x3cd]
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov rax, qword [rdi]
and ebp, 1
call qword [rax + 0x98]
mov word [rsi + 0x30], ax
mov rax, qword [rdi]
lea rcx, [rbx + 0x12]
call qword [rax + 0x98]
mov word [rsi + 0x32], ax
mov rax, qword [rdi]
lea rcx, [rbx + 0x14]
call qword [rax + pe_nt_image_headers64]
test bpl, bpl
mov dword [rsi + 0x28], eax
lea rcx, [rbx + 0x18]
mov rax, qword [rdi]
jne 0x466510
call qword [rax + pe_nt_image_headers64]
mov qword [rsi + 0x10], rax
mov rax, qword [rdi]
lea rcx, [rbx + 0x1c]
call qword [rax + pe_nt_image_headers64]
mov qword [rsi + 0x18], rax
mov rax, qword [rdi]
lea rcx, [rbx + 0x20]
call qword [rax + pe_nt_image_headers64]
mov qword [rsi + 0x20], rax
mov rax, qword [rdi]
lea rcx, [rbx + 0x24]
call qword [rax + pe_nt_image_headers64]
mov dword [rsi + 0x2c], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x28]
call qword [rax + 0x98]
mov dword [rsi + 0x34], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x2a]
call qword [rax + 0x98]
mov dword [rsi + 0x38], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x2c]
call qword [rax + 0x98]
mov dword [rsi + 0x3c], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x2e]
call qword [rax + 0x98]
mov dword [rsi + 0x40], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x30]
call qword [rax + 0x98]
mov dword [rsi + 0x44], eax
mov rax, qword [rdi]
lea rcx, [rbx + 0x32]
call qword [rax + 0x98]
mov dword [rsi + 0x48], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [rax + 0x88]
mov qword [rsi + 0x10], rax
jmp 0x46646f

Function at 0x46a7d0
Capabilities:
Hash data using djb2

Disassembly:
movzx edx, byte [rcx]
mov eax, 0x1505
lea r8, [rcx + 1]
test dl, dl
je 0x46a7f8
mov ecx, eax
add r8, 1
shl ecx, 5
add edx, ecx
add eax, edx
movzx edx, byte [r8 - 1]
test dl, dl
jne 0x46a7e0
repz ret
repz ret
Function at 0x4832e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov rbx, rcx
jne 0x4832f7
jmp 0x483380
mov rbx, qword [rbx + 0x28]
movzx eax, byte [rbx + 0x18]
sub eax, 6
cmp al, 1
jbe 0x4832f3
cmp dword [rbx + 0x3c], 0xffffffff
je 0x483380
movzx ecx, byte [rbx + 0x64]
xor eax, eax
test cl, 8
jne 0x483377
movzx eax, byte [rdx]
mov esi, 1
mov r9d, eax
and r9d, 3
cmp r9b, 1
jbe 0x483335
movzx r9d, byte [rbx + 0x65]
xor esi, esi
test r9b, 4
je 0x483390
movzx ecx, byte [rbx + 0x61]
and ecx, 3
je 0x48335e
xor eax, eax
cmp cl, 2
jbe 0x483377
cmp cl, 3
jne 0x48335e
mov rdx, qword [rdx + 0x28]
cmp dword [rdx + 0x40], 1
jne 0x483377
test r8d, r8d
jne 0x4833cc
mov esi, 1
movzx edx, byte [rbx + 0x63]
test dl, 2
jne 0x4833c0
and edx, 0xa
mov eax, 1
jne 0x483377
cmp byte [rbx + 0x18], 3
je 0x4833c0
add rsp, 0x28
pop rbx
pop rsi
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
test al, 4
mov esi, 1
jne 0x483335
and r9d, 0x10
jne 0x483335
xor esi, esi
test byte [rdx + 6], 2
je 0x483335
shr cl, 4
xor ecx, 1
mov esi, ecx
and esi, 1
jmp 0x483335
mov eax, esi
xor eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [rdx + 0x68]
movzx ecx, byte [rbx + 0x60]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x370]
call qword [rax + 0x2e8]
test eax, eax
jne 0x48335e
jmp 0x483359