joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed970
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dword [rcx + 0xa4], 1
mov dword [rcx + 0x2cc], 1
mov rbx, rcx
jne 0x4ed997
mov dword [rcx + 0x2cc], 0
lea rcx, str.HWLOC_GROUPING
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x4ed9d0
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x4ed9d0
mov dword [rbx + 0x2cc], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x2cc]
test eax, eax
je 0x4ed9be
movabs rax, 0x3c23d70a00000000
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2d4], 5
mov qword [rbx + 0x2d8], rax
movabs rax, 0x3d4ccccd3ca3d70a
mov qword [rbx + 0x2e0], rax
mov qword [rbx + 0x2e8], 0x3dcccccd
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4edaa0
mov ecx, 4
lea rdi, [0x00721118]
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
seta dl
sbb dl, 0
test dl, dl
jne 0x4eda78
mov dword [rbx + 0x2d0], 0
lea rcx, str.HWLOC_GROUPING_VERBOSE
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x4ed9be
call sub.msvcrt.dll_atoi
mov dword [rbx + 0x2d0], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rbx + 0x2d4], 1
mov rcx, rax
call sub.msvcrt.dll_atof
cvtsd2ss xmm0, xmm0
movss dword [rbx + 0x2d8], xmm0
jmp 0x4eda3d
mov dword [rbx + 0x2d4], 1
jmp 0x4eda3d
Function at 0x4f0250
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x2f0]
mov dword [rcx + 0xc4], 1
mov rsi, rcx
test rbx, rbx
je 0x4f0310
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
nop dword [rax + rax]
mov eax, dword [rbx + 0x10]
test eax, eax
jne 0x4f02a9
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x4f02a9
test eax, eax
jne 0x4f0340
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x4f0288
mov rbx, qword [rsi + 0x2f0]
test byte [rsi + 0x20], 2
jne 0x4f0378
test rbx, rbx
je 0x4f0310
lea rbp, str.components.c
lea rdi, str.backend__is_thissystem__0
jmp 0x4f02e9
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x4f0310
cmp dword [rbx + 0x10], 1
jne 0x4f02e0
mov eax, dword [rbx + 0x28]
cmp eax, 0xffffffff
je 0x4f02e0
test eax, eax
jne 0x4f0360
mov dword [rsi + 0xc4], 0
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x4f02e9
nop
lea rcx, str.HWLOC_THISSYSTEM
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x4f032f
call sub.msvcrt.dll_atoi
mov dword [rsi + 0xc4], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x381
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x4f029f
mov r8d, 0x38f
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x4f02fb
mov dword [rsi + 0xc4], 1
jmp 0x4f02c3

Function at 0x4f0480
Capabilities:
Query environment variable

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov edi, edx
mov rcx, r8
mov r12, r9
mov eax, dword [rsi + 0xc8]
test eax, eax
jne 0x4f0550
xor edx, edx
call fcn.004eef60
mov rbx, rax
test rax, rax
je 0x4f056c
mov r9, r12
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x10]
mov r12, rax
test rax, rax
je 0x4f0564
cmp qword [rsi + 0x2f0], 0
mov dword [rax + 0x10], edi
je 0x4f04fb
mov rcx, rsi
call fcn.004f03d0
mov rcx, r12
call fcn.004efb60
cmp dword [rbx + 8], 1
mov r12d, eax
je 0x4f0520
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str.HWLOC_ANNOTATE_GLOBAL_COMPONENTS
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x4f050c
call sub.msvcrt.dll_atoi
test eax, eax
je 0x4f050c
and dword [rsi + 0x304], 0xffffffbf
jmp 0x4f050c
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x10
jmp 0x4f050c
mov r12d, 0xffffffff
jmp 0x4f050c
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x28
jmp 0x4f050c
Function at 0x4f4f70
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x68
mov r14, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call sub.msvcrt.dll_getenv
mov r12, rax
test rax, rax
je 0x4f500a
mov dword [r14 + 0x328], 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open]
mov r13d, eax
test eax, eax
js 0x4f5020
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__fstat64]
cmp eax, 0xffffffff
je 0x4f5000
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x4f5000
cmp ebx, 0x10000
jg 0x4f5040
lea ecx, [rbx + 1]
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x4f4ff8
mov r8d, ebx
mov rdx, rax
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__read_1]
cmp eax, ebx
je 0x4f5068
mov rcx, r12
call fcn.0052ed18
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__close]
nop
add rsp, 0x68
pop rbx
pop r12
pop r13
pop r14
ret
mov rdx, r12
mov rcx, r14
call fcn.004f47b0
nop
add rsp, 0x68
pop rbx
pop r12
pop r13
pop r14
ret
mov ecx, 2
call qword [fcn.0052ef40]
mov r9d, ebx
mov r8, r12
lea rdx, str.Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x4f5000
cdqe
mov rdx, r12
mov rcx, r14
mov byte [r12 + rax], 0
call fcn.004f47b0
jmp 0x4f4ff8
Function at 0x4f7be0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x88], rdx
mov edx, 0x29
mov ebp, r8d
mov r12, r9
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x20], rcx
call sub.msvcrt.dll_strchr
mov r8, qword [rsp + 0x20]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x4f7e5d
cmp byte [r8], 0x29
je 0x4f7e50
sub ebp, 4
xor r15d, r15d
xor r14d, r14d
xor ebx, ebx
lea r13, [0x00722c6e]
cmp ebp, 7
jbe 0x4f7d6f
nop dword [rax]
mov ecx, 7
lea rsi, str.memory
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x4f7db0
mov ecx, 8
mov rsi, r13
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x4f7dd8
lea r14, [r8 + 8]
lea rdx, [0x00722c77]
mov rcx, r14
mov qword [rsp + 0x80], r14
call sub.msvcrt.dll_strcspn
lea rsi, [r14 + rax]
mov r15, rax
mov qword [rsp + 0x80], rsi
movzx eax, byte [rsi]
cmp al, 0x20
je 0x4f7d50
cmp al, 0x29
jne 0x4f7e00
mov qword [r12], rbx
test r14, r14
je 0x4f7d28
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
je 0x4f7d0c
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x4f7d0c
mov ecx, 2
call qword [fcn.0052ef40]
mov r8d, 0x3c
mov edx, 1
lea rcx, str.Overwriting_duplicate_indexes_attribute_with_last_occurence_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rsp + 0xa0]
mov qword [rax], r14
mov rax, qword [rsp + 0xa8]
mov dword [rax], r15d
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
add rax, 1
mov qword [rbx], rax
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [rsi + 1]
mov qword [rsp + 0x80], r8
cmp byte [rsi + 1], 0x29
je 0x4f7cc5
cmp ebp, 7
ja 0x4f7c50
mov ecx, 5
lea rsi, [0x00722c60]
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x4f7c6e
lea rcx, [r8 + 5]
lea rdx, [rsp + 0x80]
call fcn.004f6340
mov rsi, qword [rsp + 0x80]
mov rbx, rax
jmp 0x4f7cb2
lea rcx, [r8 + 7]
lea rdx, [rsp + 0x80]
call fcn.004f6340
mov rsi, qword [rsp + 0x80]
mov rbx, rax
jmp 0x4f7cb2
mov ecx, dword [rsp + 0xb0]
test ecx, ecx
jne 0x4f7e2a
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x4f7d3e
mov edx, dword [rsp + 0xb0]
test edx, edx
je 0x4f7de3
mov ecx, 2
call qword [fcn.0052ef40]
mov r8, rsi
lea rdx, str.Missing_parameter_separator_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x4f7de3
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.0052ef40]
mov r8, qword [rsp + 0x20]
lea rdx, str.Unknown_attribute_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x4f7de3
mov qword [r12], 0
jmp 0x4f7d28
mov r9d, dword [rsp + 0xb0]
test r9d, r9d
je 0x4f7de3
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.0052ef40]
mov r8, qword [rsp + 0x20]
lea rdx, str.Missing_attribute_closing_bracket_in_synthetic_string_doesnt_have_a_number_of_objects_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x4f7de3
Function at 0x4f8cc0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rbx, rax
mov qword [rsp + 0x80], rcx
mov rdi, r9
mov dword [rsp + 0x88], edx
test r9, r9
je 0x4f8eb4
and edx, 4
jne 0x4f8e48
mov r14, qword [sym.imp.msvcrt.dll__assert]
xor r12d, r12d
lea r13, str.topology_synthetic.c
nop dword [rax + rax]
mov r15, rdi
lea rbp, str.numanode__arity__1
nop word [rax + rax]
cmp dword [r15], 0xd
je 0x4f8d6e
cmp dword [r15 + 0x68], 1
je 0x4f8d4c
mov r8d, 0x559
mov rdx, r13
mov rcx, rbp
call r14
mov r15, qword [r15 + 0x90]
test r15, r15
jne 0x4f8d30
mov r8d, 0x55c
mov rdx, r13
lea rcx, str.numanode
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, dword [rsp + 0xb0]
test r8d, r8d
je 0x4f8d96
cmp rbx, 1
jle 0x4f8d92
mov ecx, 0x20
add rsi, 1
sub rbx, 1
mov word [rsi - 1], cx
add r12d, 1
cmp rbx, 1
jle 0x4f8dad
mov edx, 0x5b
add rsi, 1
sub rbx, 1
mov word [rsi - 1], dx
mov qword [rsp + 0x28], rbx
mov r8, r15
add r12d, 1
mov edx, dword [rsp + 0x88]
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x80]
mov r9d, 0xffffffff
call fcn.004f7470
test eax, eax
js 0x4f8ebc
add r12d, eax
cdqe
cmp rbx, rax
jg 0x4f8df4
test rbx, rbx
jle 0x4f8dfa
lea eax, [rbx - 1]
cdqe
add rsi, rax
sub rbx, rax
cmp rbx, 1
jle 0x4f8e11
mov eax, 0x5d
add rsi, 1
sub rbx, 1
mov word [rsi - 1], ax
mov rdi, qword [rdi + 0x58]
add r12d, 1
mov dword [rsp + 0xb0], 1
test rdi, rdi
jne 0x4f8d20
mov eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r8d, 1
ja 0x4f8ec7
cmp dword [r9], 0xd
jne 0x4f8ec7
mov r10d, dword [rsp + 0xb0]
test r10d, r10d
je 0x4f8e7a
cmp rax, 1
jle 0x4f8e7a
mov r9d, 0x20
add rsi, 1
sub rax, 1
mov word [rsi - 1], r9w
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x88]
mov r8, rdi
mov r9d, 1
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x80]
call fcn.004f7470
test eax, eax
js 0x4f8ebc
add eax, dword [rsp + 0xb0]
mov r12d, eax
jmp 0x4f8e2d
xor r12d, r12d
jmp 0x4f8e2d
mov r12d, 0xffffffff
jmp 0x4f8e2d
mov r11d, dword [rsp + 0xb8]
test r11d, r11d
jne 0x4f8eeb
call qword [sym.imp.msvcrt.dll__errno]
mov r12d, 0xffffffff
mov dword [rax], 0x16
jmp 0x4f8e2d
mov ecx, 2
call qword [fcn.0052ef40]
mov r8d, 0x5d
mov edx, 1
lea rcx, str.Cannot_export_to_synthetic_v1_if_multiple_memory_children_are_attached_to_the_same_location._n
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x4f8ed4

Function at 0x4f94e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00a0a160]
test eax, eax
je 0x4f9500
mov eax, dword [0x00a0a15c]
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x4f9540
call sub.msvcrt.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x00a0a15c], eax
mov dword [0x00a0a160], 1
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_IMPORT
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x00a0a15c]
test rcx, rcx
jne 0x4f9514
jmp 0x4f9527
Function at 0x4f9560
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00a0a158]
test eax, eax
je 0x4f9580
mov eax, dword [0x00a0a154]
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x4f95c0
call sub.msvcrt.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x00a0a154], eax
mov dword [0x00a0a158], 1
add rsp, 0x28
ret
lea rcx, str.HWLOC_LIBXML_EXPORT
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x00a0a154]
test rcx, rcx
jne 0x4f9594
jmp 0x4f95a7
Function at 0x4fb5a0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x00a0a168]
test eax, eax
je 0x4fb5c0
mov eax, dword [0x00a0a164]
add rsp, 0x28
ret
lea rcx, str.HWLOC_XML_VERBOSE
call sub.msvcrt.dll_getenv
mov rcx, rax
mov eax, dword [0x00a0a164]
test rcx, rcx
je 0x4fb5e5
call sub.msvcrt.dll_atoi
mov dword [0x00a0a164], eax
mov dword [0x00a0a168], 1
add rsp, 0x28
ret
Function at 0x5016a0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp byte [rcx], 0x2d
mov qword [rsp + 0xb0], r8
mov r14, rcx
mov r13, rdx
jne 0x5016d2
cmp byte [rcx + 1], 0
lea rax, str._dev_stdin
cmove r14, rax
lea rdx, [0x00724d8a]
mov rcx, r14
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x5017da
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.00525d30
test eax, eax
je 0x5017a8
mov ecx, 0x1001
mov r15d, 0x1000
call sub.msvcrt.dll_malloc
mov r14, rax
test rax, rax
je 0x5017e9
movabs rdi, 0x7fffffffffffffff
mov rsi, r15
xor ebx, ebx
jmp 0x501755
lea rbp, [rsi + rsi]
mov rcx, r14
lea rdx, [rbp + 1]
call sub.msvcrt.dll_realloc
test rax, rax
je 0x5017e1
and rsi, rdi
mov r14, rax
mov r15, rsi
mov rsi, rbp
lea rcx, [r14 + rbx]
mov r9, r12
mov r8, r15
mov edx, 1
call sub.msvcrt.dll_fread
add rbx, rax
mov byte [r14 + rbx], 0
cmp r15, rax
je 0x501730
mov rcx, r12
add rbx, 1
call sub.msvcrt.dll_fclose
mov rax, qword [rsp + 0xb0]
mov qword [r13], r14
mov qword [rax], rbx
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, word [rsp + 0x26]
mov ecx, 0x1001
mov r15d, 0x1000
and ax, 0xf000
cmp ax, 0x8000
jne 0x50170d
mov eax, dword [rsp + 0x34]
lea r15d, [rax + 1]
movsxd r15, r15d
lea rcx, [r15 + 1]
jmp 0x50170d
mov eax, 0xffffffff
jmp 0x501793
mov rcx, r14
call fcn.0052ed18
mov rcx, r12
call sub.msvcrt.dll_fclose
mov eax, 0xffffffff
jmp 0x501793

Function at 0x5042f0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x00701968]
mov eax, dword [rsp + 0x40]
cmp ebx, 1
jbe 0x504333
mov rdx, qword [0x00a0a1d8]
mov eax, ebx
shl eax, 6
test rdx, rdx
je 0x504333
lea ecx, [rbx - 1]
sub ebx, 1
movzx ecx, cx
shl ebx, 6
call rdx
movzx eax, ax
add eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x507630
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rdi
push rsi
push rbx
cmp rdx, 2
jbe 0x5077da
movzx r10d, byte [rcx]
movzx eax, byte [rcx + 1]
lea r11, [rcx + 3]
sub rdx, 3
movzx esi, byte [rcx + 2]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov edi, r10d
mov ecx, eax
shl r10d, 4
shr cl, 4
and r10d, 0x30
shl eax, 2
add r10d, ecx
mov ecx, esi
and eax, 0x3c
shr dil, 2
shr cl, 6
and esi, 0x3f
add ecx, eax
mov eax, 4
cmp r9, 3
ja 0x5076dc
jmp 0x5077c0
movzx r10d, byte [r11]
add r11, 3
add rax, 4
sub rdx, 3
movzx ecx, byte [r11 - 2]
movzx esi, byte [r11 - 1]
mov edi, r10d
shl r10d, 4
mov ebp, ecx
and r10d, 0x30
shl ecx, 2
shr bpl, 4
and ecx, 0x3c
shr dil, 2
add r10d, ebp
mov ebp, esi
and esi, 0x3f
shr bpl, 6
add ecx, ebp
cmp r9, rax
jb 0x5077c0
and r10d, 0x7f
and ecx, 0x7f
and edi, 0x3f
movzx r10d, byte [rbx + r10]
movzx edi, byte [rbx + rdi]
mov byte [r8 + rax - 3], r10b
movzx r10d, byte [rbx + rcx]
mov rcx, rsi
and ecx, 0x3f
mov byte [r8 + rax - 4], dil
movzx ecx, byte [rbx + rcx]
mov byte [r8 + rax - 2], r10b
mov byte [r8 + rax - 1], cl
cmp rdx, 2
ja 0x507690
test rdx, rdx
jne 0x507738
cmp rax, r9
jae 0x5077c0
mov byte [r8 + rax], 0
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx ecx, byte [r11]
cmp rdx, 2
jne 0x5077ca
movzx r10d, byte [r11 + 1]
mov ebx, r10d
shl r10d, 2
shr bl, 4
and r10d, 0x3c
mov r11d, ecx
shl ecx, 4
lea rsi, [rax + 4]
and ecx, 0x30
shr r11b, 2
add ecx, ebx
cmp rsi, r9
ja 0x5077c0
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
and r11d, 0x3f
and ecx, 0x7f
movzx r11d, byte [rbx + r11]
movzx ecx, byte [rbx + rcx]
mov byte [r8 + rax], r11b
lea r11, [r8 + rax + 2]
mov byte [r8 + rax + 1], cl
lea rcx, [rax + 3]
cmp rdx, 1
je 0x5077d1
movzx r10d, r10b
movzx eax, byte [rbx + r10]
mov byte [r11], al
mov rax, rsi
mov byte [r8 + rcx], 0x3d
jmp 0x507721
mov eax, 0xffffffff
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r10d, r10d
xor ebx, ebx
jmp 0x507759
mov byte [r11], 0x3d
mov rax, rsi
jmp 0x5077af
mov r11, rcx
xor eax, eax
jmp 0x50771c
Function at 0x50a8f0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x828
mov r12, rcx
mov rbx, rdx
test rcx, rcx
je 0x50a910
test rdx, rdx
jne 0x50a921
add rsp, 0x828
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov r9d, dword [rdx + 0x18]
mov r10, qword [rdx]
lea r13, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov r11d, dword [rdx + 0x1c]
mov rdi, r13
mov eax, r9d
shl rax, 0xa
lea rsi, [r10 + rax - 0x400]
rep movsq qword [rdi], qword [rsi]
cmp r11d, 1
jbe 0x50aa36
cmp r11d, 3
jbe 0x50a9ea
lea eax, [r11 - 4]
lea edi, [r9 + r9 - 1]
mov esi, 3
and eax, 0xfffffffe
lea r14d, [rax + 5]
mov r8d, edi
add edi, r9d
mov rax, r13
xor edx, edx
mov ecx, edi
shl r8, 0xa
shl rcx, 0xa
add r8, r10
add rcx, r10
nop
movdqu xmm0, xmmword [r8 + rdx]
movdqu xmm1, xmmword [r8 + rdx + 0x10]
add rax, 0x20
pxor xmm0, xmmword [rax - 0x20]
pxor xmm1, xmmword [rax - 0x10]
movaps xmmword [rax - 0x20], xmm0
movaps xmmword [rax - 0x10], xmm1
movdqu xmm2, xmmword [rcx + rdx + 0x10]
movdqu xmm3, xmmword [rcx + rdx]
add rdx, 0x20
pxor xmm1, xmm2
pxor xmm0, xmm3
movaps xmmword [rax - 0x20], xmm0
movaps xmmword [rax - 0x10], xmm1
cmp rdx, 0x400
jne 0x50a990
lea eax, [rsi + 2]
add edi, r9d
cmp eax, r14d
je 0x50a9ef
mov esi, eax
jmp 0x50a974
mov esi, 1
add esi, 1
lea r8, [rsp + 0x420]
mov ecx, esi
imul ecx, r9d
sub ecx, 1
mov edx, ecx
mov rax, r13
shl rdx, 0xa
add rdx, r10
nop
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmmword [rax]
add rax, 0x10
add rdx, 0x10
movaps xmmword [rax - 0x10], xmm0
cmp r8, rax
jne 0x50aa10
add ecx, r9d
cmp r11d, esi
jbe 0x50aa3e
add esi, 1
jmp 0x50aa03
lea r8, [rsp + 0x420]
mov rdi, r8
mov ecx, pe_nt_image_headers64
mov rsi, r13
mov edx, dword [r12 + 8]
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [r12]
lea r14, [rsp + 0x420]
mov r9d, 0x400
mov r8, r14
call fcn.0050e180
mov r9d, dword [0x00a0a1f0]
test r9d, r9d
je 0x50aa9d
mov edx, 0x400
mov rcx, r13
call fcn.0050a8a0
mov r8d, dword [0x00a0a1f0]
test r8d, r8d
je 0x50aa9d
mov edx, 0x400
mov rcx, r14
call fcn.0050a8a0
mov ecx, dword [rbx + 0x28]
test ecx, ecx
jne 0x50aaeb
mov r13d, dword [rbx + 0x10]
mov edx, dword [0x00a0a1f0]
mov rcx, qword [rbx]
shl r13d, 0xa
mov r13d, r13d
test edx, edx
je 0x50aac9
test rcx, rcx
je 0x50aac9
mov rdx, r13
call fcn.0050a8a0
mov eax, dword [rbx + 0x2c]
test eax, eax
jne 0x50a910
mov rax, qword [r12 + 0x68]
mov rcx, qword [rbx]
test rax, rax
je 0x50aafb
mov rdx, r13
call rax
jmp 0x50a910
mov edx, dword [r12 + 8]
mov rcx, qword [r12]
call fcn.0050c560
jmp 0x50aaa4
call fcn.0052ed18
jmp 0x50a910

Function at 0x50b460
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm1, xmmword [rdx + rax]
pxor xmm0, xmm1
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x400
jne 0x50b468
ret
Function at 0x521c50
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0052ef40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.0052ef40
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x521cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00a8a7f4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x521e55
mov rax, qword [0x00a8a7f8]
xor ecx, ecx
add rax, 0x18
mov rdx, qword [rax]
cmp r12, rdx
jb 0x521d0b
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x521d96
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x521cef
mov rcx, r12
call fcn.00522930
mov rbp, rax
test rax, rax
je 0x521e84
mov rax, qword [0x00a8a7f8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00522a50
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00a8a7f8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x521e93
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x521d8f
sub eax, 4
and eax, 0xfffffffb
jne 0x521e11
add dword [0x00a8a7f4], 1
cmp ebx, 8
jae 0x521dc3
test bl, 4
jne 0x521e5c
test ebx, ebx
je 0x521db8
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x521e72
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x521db8
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x521df5
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00a8a7f8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x521d8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00521c50
xor edi, edi
jmp 0x521d16
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x521db8
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x521db8
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00521c50
mov rax, qword [0x00a8a7f8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00521c50
nop
nop
Function at 0x5225e0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00a8aae0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00a8aac0]
test rbx, rbx
je 0x522634
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x52262b
test r12, r12
je 0x52262b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x522610
lea rcx, [0x00a8aae0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x522930
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0072c290]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x5229a2
mov rcx, r10
call fcn.00522820
test eax, eax
je 0x5229a2
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x52299f
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x522996
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x5229a2
add r8, 0x28
cmp r8, r9
jne 0x522981
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret