joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x11], 0x6e
mov rbx, rcx
mov rdi, rdx
je 0x401b20
lea rdx, [0x00410254]
mov rcx, r8
call fcn.00403600
test rax, rax
mov r12, rax
je 0x401c12
lea rdx, [0x0041012c]
mov rcx, rbx
call fcn.00403600
test rax, rax
mov rbp, rax
je 0x401ba2
mov edx, dword [rdi + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rbx + 0x1000]
call fcn.0040df60
test eax, eax
js 0x401bf1
cmp byte [rdi + 0x10], 1
je 0x401b61
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov r13, rax
je 0x401c33
mov ebx, dword [rdi + 0xc]
test rbx, rbx
je 0x401bc0
mov r14d, 0x2000
jmp 0x401aca
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r13
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x401bd0
sub rbx, rsi
je 0x401bc0
cmp rbx, 0x2000
mov rsi, r14
mov r9, rbp
cmovbe rsi, rbx
mov r8d, 1
mov rcx, r13
mov rdx, rsi
call sub.msvcrt.dll_fread
test rax, rax
jne 0x401aa4
lea r8, [rdi + 0x12]
mov ebx, 0xffffffff
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.004021a0
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x401b74
mov qword [rsp + 0x70], r8
call fcn.004018a0
test rax, rax
mov rsi, rax
je 0x401b86
mov r8, qword [rsp + 0x70]
mov rcx, rax
mov rdx, r8
call fcn.004036a0
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_free
test ebx, ebx
js 0x401b90
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call fcn.00401590
mov ebx, eax
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rcx, r12
call sub.msvcrt.dll_fclose
jmp 0x401b50
mov ebx, 0xffffffff
nop dword [rax + rax]
lea rdx, [rdi + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.004020d0
jmp 0x401b50
lea rdx, [rdi + 0x12]
mov ebx, 0xffffffff
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.004020d0
jmp 0x401b7c
xor ebx, ebx
jmp 0x401b0d
lea r8, [rdi + 0x12]
mov ebx, 0xffffffff
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
call fcn.004021a0
jmp 0x401b0d
lea r8, [rdi + 0x12]
mov ebx, 0xffffffff
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.004021a0
jmp 0x401b74
lea r8, [rdi + 0x12]
mov ebx, 0xffffffff
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.004021a0
jmp 0x401b50
lea r8, [rdi + 0x12]
or ebx, 0xffffffff
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.004021a0
jmp 0x401b74
Function at 0x401c60
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
lea rdx, [0x0041012c]
mov rbp, rcx
call fcn.00403600
test rax, rax
mov rbx, rax
je 0x401e82
mov rax, qword [0x004157c0]
lea r12, [rsp + 0x20]
mov r8d, 8
xor esi, esi
mov rdx, r12
mov rcx, rbx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
shr rax, 0x18
add eax, 0xc
mov byte [rsp + 0x23], al
call fcn.00407030
test rax, rax
mov rdi, rax
jne 0x401cd5
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rax, rsi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.0040df60
test eax, eax
js 0x401e92
mov r9, rbx
mov r8d, 1
mov edx, 0x58
mov rcx, r12
call sub.msvcrt.dll_fread
test rax, rax
je 0x401eb0
mov edx, 0x1060
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov rsi, rax
je 0x401ed0
mov r9, rbp
mov edx, 0x1000
mov rcx, rax
lea r8, [0x00410129]
call fcn.00401860
mov eax, dword [rsp + 0x28]
lea r9, [r12 + 0x18]
mov edx, 0x40
lea rcx, [rsi + 0x1020]
lea r8, [0x00410129]
bswap eax
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2c]
bswap eax
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
bswap eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x34]
bswap eax
mov dword [rsi + 0x101c], eax
mov dword [rsp + 0x34], eax
call fcn.00401860
mov eax, dword [rsp + 0x28]
xor r8d, r8d
mov rcx, rbx
sub rdi, rax
lea rdx, [rdi + 0x58]
mov qword [rsi + 0x1000], rdx
add edx, dword [rsp + 0x2c]
call fcn.0040df60
mov edi, dword [rsp + 0x30]
mov rcx, rdi
call sub.msvcrt.dll_malloc
test rax, rax
mov qword [rsi + 0x1008], rax
je 0x401f10
mov r9, rbx
mov r8d, 1
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_fread
test rax, rax
je 0x401ef0
mov eax, dword [rsp + 0x30]
mov rcx, rbx
add rax, qword [rsi + 0x1008]
mov qword [rsi + 0x1010], rax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x401f30
mov rax, qword [rsi + 0x1008]
mov r8, qword [rsi + 0x1010]
cmp rax, r8
jae 0x401cbf
movzx r9d, byte [rsi + 0x1018]
mov r10d, 1
nop word [rax + rax]
mov ecx, dword [rax + 4]
movzx edi, byte [rax + 0x11]
mov edx, dword [rax]
bswap ecx
mov dword [rax + 4], ecx
mov ecx, dword [rax + 8]
bswap edx
mov dword [rax], edx
bswap ecx
mov dword [rax + 8], ecx
mov ecx, dword [rax + 0xc]
bswap ecx
mov dword [rax + 0xc], ecx
lea ecx, [rdi - 0x5a]
cmp cl, 0x1e
ja 0x401e6c
mov rdi, r10
shl rdi, cl
test edi, 0x40100501
setne cl
or r9d, ecx
mov edx, edx
add rax, rdx
cmp rax, r8
jb 0x401e30
mov byte [rsi + 0x1018], r9b
jmp 0x401cbf
xor esi, esi
mov rax, rsi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.Failed_to_seek_to_cookie_position__n
lea rcx, str.fseek
call fcn.004021a0
jmp 0x401cbf
lea rdx, str.Failed_to_read_cookie__n
lea rcx, str.fread
call fcn.004021a0
jmp 0x401cbf
lea rdx, str.Could_not_allocate_memory_for_archive_structure__n
lea rcx, [0x0041038a]
call fcn.004021a0
jmp 0x401cbf
lea rdx, str.Could_not_read_full_TOC__n
lea rcx, str.fread
call fcn.004021a0
jmp 0x401cbf
lea rdx, str.Could_not_allocate_buffer_for_TOC__n
lea rcx, str.malloc
call fcn.004021a0
jmp 0x401cbf
lea rcx, str.Error_on_file._n
call fcn.004020d0
jmp 0x401cbf
Function at 0x406df0
Capabilities:
Create directory

Disassembly:
push r15
mov eax, 0x3038
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0040d6b0
sub rsp, rax
mov rbx, r8
mov r14, rcx
mov rcx, rdx
mov rdi, rdx
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rsi, rax
call sub.msvcrt.dll_strlen
lea rax, [rsi + rax + 1]
cmp rax, 0xfff
ja 0x406ef2
lea rsi, [rsp + 0x30]
mov r9, rdi
mov edx, 0x1000
mov dword [rsp + 0x20], 0x5c
lea r8, str._s_c
mov rcx, rsi
mov ebp, 0x1000
call fcn.00406dd0
mov edx, 0x5c
mov rcx, rbx
movsxd rdi, eax
call sub.msvcrt.dll_strchr
sub rbp, rdi
add rdi, rsi
test rax, rax
mov r15, rax
je 0x406f00
lea r12, [0x00411bd5]
lea r13, [rsp + 0x1030]
jmp 0x406ea8
lea rcx, [r15 + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
mov r15, rax
je 0x406f00
mov r9d, r15d
mov r8, r12
mov rdx, rbp
mov qword [rsp + 0x20], rbx
sub r9d, ebx
mov rcx, rdi
call fcn.00406dd0
mov rcx, rsi
call fcn.004035c0
test eax, eax
jne 0x406e92
mov r8d, 0x1000
mov rdx, r13
mov rcx, rsi
call fcn.00407f30
mov rdx, qword [r14 + 0x3038]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406e92
mov eax, 0xffffffff
jmp 0x406f02
xor eax, eax
add rsp, 0x3038
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x406f20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rdi
mov eax, 0x1020
push rsi
push rbx
call fcn.0040d6b0
sub rsp, rax
mov rsi, rdx
lea rdx, [0x00411bda]
call fcn.00403600
test rax, rax
mov rbx, rax
je 0x40700b
lea rdx, [0x00411bdd]
mov rcx, rsi
call fcn.00403600
test rax, rax
mov rsi, rax
je 0x407012
lea rdi, [rsp + 0x20]
jmp 0x406faf
mov r8d, 0x1000
mov r9, rbx
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fread
test rax, rax
mov r8, rax
je 0x406ff0
mov r9, rsi
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x406fe0
mov rcx, rsi
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x406fe0
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
je 0x406f70
xor edi, edi
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov eax, edi
add rsp, 0x1020
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
mov edi, 0xffffffff
call sub.msvcrt.dll_clearerr
jmp 0x406fbd
mov rcx, rbx
call sub.msvcrt.dll_ferror
test eax, eax
je 0x406fbb
mov rcx, rbx
mov edi, 0xffffffff
call sub.msvcrt.dll_clearerr
jmp 0x406fbd
mov edi, 0xffffffff
jmp 0x406fcd
mov rcx, rbx
mov edi, 0xffffffff
call sub.msvcrt.dll_fclose
jmp 0x406fcd
Function at 0x407030
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rcx
mov ecx, 0x2000
mov rbp, rdx
mov rsi, r8
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x407132
xor edx, edx
mov r8d, 2
mov rcx, r12
call fcn.0040df60
test eax, eax
js 0x407132
mov rcx, r12
call fcn.0040e450
movsxd rdi, eax
cmp rdi, rsi
jb 0x407132
lea rax, [rsi - 1]
mov qword [rsp + 0x28], rax
cmp rdi, 0x2000
mov r14d, 0x2000
cmovae r14, rdi
lea r13, [r14 - 0x2000]
sub rdi, r13
cmp rsi, rdi
ja 0x407132
xor r8d, r8d
mov edx, r13d
mov rcx, r12
call fcn.0040df60
test eax, eax
js 0x407132
mov r9, r12
mov r8, rdi
mov edx, 1
mov rcx, rbx
call sub.msvcrt.dll_fread
cmp rax, rdi
jne 0x407132
sub rax, rsi
add rax, 1
mov rdi, rax
jne 0x4070f8
jmp 0x407120
test r15, r15
mov rdi, r15
je 0x407120
lea r15, [rdi - 1]
mov r8, rsi
mov rdx, rbp
lea rcx, [rbx + r15]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4070f0
lea rsi, [r14 + rdi - 0x2001]
jmp 0x407134
mov rax, qword [rsp + 0x28]
test r13, r13
lea rdi, [rax + r13]
jne 0x407094
xor esi, esi
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, rsi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x407150
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
mov eax, 0x2288
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0040d6b0
sub rsp, rax
lea r8, str._s
mov edx, 0x1000
mov r14, qword [sym.imp.msvcrt.dll__snwprintf]
lea r13, [rsp + 0x280]
mov r9, rcx
mov r15, rcx
mov rcx, r13
call r14
cmp eax, 0xfff
jg 0x4072b8
lea rdi, [rsp + 0x30]
mov r12d, 0x1000
mov rcx, r13
lea ebx, [rax - 1]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub r12d, ebx
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x4072b8
movsxd rax, ebx
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rax, [r13 + rax*2]
mov qword [rsp + 0x20], rax
lea rbx, [rdi + 0x2c]
movsxd rax, r12d
mov qword [rsp + 0x28], rax
lea rdx, [0x00411bfa]
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x407250
lea rdx, [0x00411bfe]
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x407250
lea r8, [0x00411c04]
mov r9, rbx
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call r14
cmp eax, r12d
jge 0x407250
mov eax, dword [rsp + 0x30]
mov rcx, r13
test al, 0x10
je 0x407290
test ah, 4
je 0x407241
cmp dword [rsp + 0x54], 0xa000000c
je 0x4072b0
call fcn.00407150
nop word cs:[rax + rax]
mov rdx, rdi
mov rcx, rsi
call rbp
test eax, eax
jne 0x4071e5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
setne al
movzx eax, al
neg eax
add rsp, 0x2288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, rdi
mov rcx, rsi
call rbp
test eax, eax
jne 0x4071e5
jmp 0x40725c
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x407250
mov eax, 0xffffffff
jmp 0x407279
Function at 0x4074a0
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x4028
push rbx
call fcn.0040d6b0
sub rsp, rax
xor r8d, r8d
xor edx, edx
call fcn.00407f30
lea rbx, [rsp + 0x20]
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0xffe
ja 0x407515
lea rsi, [rsp + 0x2020]
mov r8d, 0x1000
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub eax, 1
cmp eax, 0xffe
ja 0x407515
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.00407e40
add rsp, 0x4028
pop rbx
pop rsi
ret
xor eax, eax
add rsp, 0x4028
pop rbx
pop rsi
ret
Function at 0x4079b0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push rdi
mov eax, 0x2110
push rsi
push rbx
call fcn.0040d6b0
sub rsp, rax
mov r8d, 0x1000
lea rsi, [rsp + 0x110]
add rcx, 0x10
lea rdi, [rsp + 0xa0]
mov rdx, rsi
call fcn.00407f30
mov edx, 1
lea rcx, [0x004072c0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rcx, rdi
mov dword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 1
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
xor ecx, ecx
mov rbx, qword [fcn.0040e6e0]
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0xdc], 0x101
mov word [rsp + 0xe0], ax
call rbx
mov rcx, rax
call fcn.004072e0
mov ecx, 1
mov qword [rsp + 0xf0], rax
call rbx
mov rcx, rax
call fcn.004072e0
mov ecx, 2
mov qword [rsp + 0xf8], rax
call rbx
mov rcx, rax
call fcn.004072e0
mov qword [rsp + 0x100], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
mov qword [rsp + 0x40], rdi
mov rcx, rsi
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x48], rdx
lea r8, [rsp + 0x60]
mov rdx, rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407b22
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x5c]
add rsp, 0x2110
pop rbx
pop rsi
pop rdi
ret
lea rdx, str.Failed_to_create_child_process__n
lea rcx, str.CreateProcessW
call fcn.00402230
mov eax, 0xffffffff
jmp 0x407b17
Function at 0x407c90
Capabilities:
Enumerate process modules

Disassembly:
push r15
mov eax, 0x4048
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0040d6b0
sub rsp, rax
mov dword [rsp + 0x3c], 0
lea rbx, [rsp + 0x3c]
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov r9, rbx
mov rcx, rax
mov rsi, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x407cde
mov edi, dword [rsp + 0x3c]
test edi, edi
jne 0x407cf2
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, edi
mov edx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov rbp, rax
je 0x407cde
mov r9, rbx
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
jne 0x407d40
mov rcx, rbp
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msvcrt.dll_free
lea r14, [rsp + 0x2040]
mov r8d, 0x1000
lea rcx, [r12 + 0x2022]
mov rdx, r14
call fcn.00407f30
test rax, rax
je 0x407d1b
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x3c]
shr eax, 3
test eax, eax
je 0x407d1b
sub eax, 1
mov rbx, rbp
mov r15, rbp
lea r12, [rbp + rax*8 + 8]
xor r13d, r13d
lea rdi, [rsp + 0x40]
mov rdx, qword [r15]
mov r9d, 0x1000
mov r8, rdi
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x407dcd
mov r8, qword [rsp + 0x28]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x407dcd
mov rdx, qword [r15]
movsxd rax, r13d
add r13d, 1
mov qword [rbp + rax*8], rdx
add r15, 8
cmp r15, r12
jne 0x407d91
test r13d, r13d
je 0x407d1b
lea eax, [r13 - 1]
mov r13, qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r14, [rbp + rax*8 + 8]
jmp 0x407dfe
add rbx, 8
cmp rbx, r14
je 0x407d1b
mov rdx, qword [rbx]
mov r9d, 0x1000
mov r8, rdi
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x407df1
xor r12d, r12d
jmp 0x407e24
test eax, eax
je 0x407df1
add r12d, 1
mov rcx, qword [rbx]
call r13
cmp r12d, 0x20
jne 0x407e20
jmp 0x407df1
Function at 0x408600
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
mov eax, 0x80000000
test ecx, ecx
je 0x408675
lea rsi, [0x00412120]
mov ebx, 3
jmp 0x408627
add ebx, 1
sar ecx, 1
je 0x408675
test cl, 1
je 0x408620
mov edx, ebx
mov r8d, 0x80000000
and edx, 0x1f
mov r11d, dword [rsi + rdx*4]
mov edx, eax
xor eax, eax
jmp 0x40865e
mov r10d, edx
shr edx, 1
mov r9d, edx
and r10d, 1
shr r8d, 1
xor r9d, 0xedb88320
test r10d, r10d
cmovne edx, r9d
test r11d, r8d
je 0x408641
lea r9d, [r8 - 1]
xor eax, edx
test r9d, r11d
jne 0x408641
add ebx, 1
sar ecx, 1
jne 0x408627
pop rbx
pop rsi
ret
Function at 0x40c750
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0041e904]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x40c8d8
mov rax, qword [0x0041e908]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40c79c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x40c825
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x40c780
mov rcx, rbx
call fcn.0040d3f0
test rax, rax
mov r12, rax
je 0x40c90d
mov rax, qword [0x0041e908]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0040d520
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0041e908]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40c8f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40c81e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x40c880
add dword [0x0041e904], 1
cmp edi, 8
jae 0x40c853
test dil, 4
jne 0x40c8c4
test edi, edi
je 0x40c848
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40c8df
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x40c848
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40c86c
jmp 0x40c848
add rsi, qword [0x0041e908]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40c81e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040e7e0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x40c848
xor esi, esi
jmp 0x40c7a7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x40c848
mov rax, qword [0x0041e908]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0040e7e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0040e7e0
nop
nop dword [rax]

Function at 0x40d060
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0041ebe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0041ebc0]
test rbx, rbx
je 0x40d0b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40d0ab
test rsi, rsi
je 0x40d0ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40d090
lea rcx, [0x0041ebe0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x40d3f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00415be0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40d45d
mov rcx, r8
call fcn.0040d2d0
test eax, eax
je 0x40d45d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40d45d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x40d454
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40d45f
add rax, 0x28
cmp rax, r9
jne 0x40d440
xor eax, eax
add rsp, 0x28
ret

Function at 0x40e7e0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401560]
jmp 0x401530
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0040e6e0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0040e6e0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401550
Function at 0x14002924c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c844
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c844
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002939c
cmp rax, 0xffffffffffffffff
je 0x14002939c
xor edi, edi
test rbp, rbp
jle 0x140029347
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f158
mov rbx, rax
test rax, rax
jne 0x1400292d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002933d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a178
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d520
cmp eax, 0xffffffff
je 0x14002931d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400292e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a178
jmp 0x14002933d
cmp byte [rsi + 0x38], dil
je 0x140029334
cmp dword [rsi + 0x34], 5
jne 0x140029334
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002933d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001af0c
jmp 0x1400293b0
jns 0x1400293b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c844
cmp rax, 0xffffffffffffffff
jne 0x140029368
cmp byte [rsi + 0x30], dil
je 0x1400293b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400293b0
mov ecx, r14d
call fcn.140018630
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400293b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400293b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400293a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400293ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c844
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001c4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c96
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c98
xor al, al
add rsp, 0x28
ret