joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417a60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rdi
push rsi
push rbx
cmp r8d, 0x1f
mov r14, rcx
jle 0x417c7e
sub r8d, 0x20
mov ebx, dword [rcx]
mov r10d, r8d
mov rax, qword [0x0042cb70]
shr r10d, 5
mov r9d, r10d
add r9, 1
shl r9, 5
add r9, rdx
nop
nop word cs:[rax + rax]
mov esi, dword [rdx + 4]
xor ebx, dword [rdx]
mov r11d, esi
movzx edi, sil
mov ecx, esi
shr r11d, 0x18
mov r11d, dword [rax + r11*4]
xor r11d, dword [rax + rdi*4 + 0xc00]
mov edi, esi
movzx esi, ch
shr edi, 0x10
movzx edi, dil
xor r11d, dword [rax + rdi*4 + 0x400]
xor r11d, dword [rax + rsi*4 + 0x800]
mov esi, ebx
shr esi, 0x18
xor r11d, dword [rax + rsi*4 + 0x1000]
movzx esi, bl
xor r11d, dword [rax + rsi*4 + 0x1c00]
mov esi, ebx
movzx ebx, bh
shr esi, 0x10
movzx esi, sil
xor r11d, dword [rax + rsi*4 + 0x1400]
xor r11d, dword [rax + rbx*4 + 0x1800]
mov dword [r14], r11d
mov esi, dword [rdx + 0xc]
mov ebx, r11d
xor ebx, dword [rdx + 8]
mov r11d, esi
movzx edi, sil
mov ecx, esi
shr r11d, 0x18
mov r11d, dword [rax + r11*4]
xor r11d, dword [rax + rdi*4 + 0xc00]
mov edi, esi
movzx esi, ch
shr edi, 0x10
movzx edi, dil
xor r11d, dword [rax + rdi*4 + 0x400]
xor r11d, dword [rax + rsi*4 + 0x800]
mov esi, ebx
shr esi, 0x18
xor r11d, dword [rax + rsi*4 + 0x1000]
movzx esi, bl
xor r11d, dword [rax + rsi*4 + 0x1c00]
mov esi, ebx
movzx ebx, bh
shr esi, 0x10
movzx esi, sil
xor r11d, dword [rax + rsi*4 + 0x1400]
xor r11d, dword [rax + rbx*4 + 0x1800]
mov dword [r14], r11d
mov esi, dword [rdx + 0x14]
mov ebx, r11d
xor ebx, dword [rdx + 0x10]
mov r11d, esi
movzx edi, sil
mov ecx, esi
shr r11d, 0x18
mov r11d, dword [rax + r11*4]
xor r11d, dword [rax + rdi*4 + 0xc00]
mov edi, esi
movzx esi, ch
shr edi, 0x10
movzx edi, dil
xor r11d, dword [rax + rdi*4 + 0x400]
xor r11d, dword [rax + rsi*4 + 0x800]
mov esi, ebx
shr esi, 0x18
xor r11d, dword [rax + rsi*4 + 0x1000]
movzx esi, bl
xor r11d, dword [rax + rsi*4 + 0x1c00]
mov esi, ebx
movzx ebx, bh
shr esi, 0x10
add rdx, 0x20
movzx esi, sil
xor r11d, dword [rax + rsi*4 + 0x1400]
xor r11d, dword [rax + rbx*4 + 0x1800]
mov dword [r14], r11d
mov esi, dword [rdx - 4]
xor r11d, dword [rdx - 8]
mov ebx, esi
movzx edi, sil
mov ecx, esi
shr ebx, 0x18
mov ebx, dword [rax + rbx*4]
xor ebx, dword [rax + rdi*4 + 0xc00]
mov edi, esi
movzx esi, ch
mov ecx, r11d
shr edi, 0x10
movzx edi, dil
xor ebx, dword [rax + rdi*4 + 0x400]
xor ebx, dword [rax + rsi*4 + 0x800]
mov esi, r11d
shr esi, 0x18
xor ebx, dword [rax + rsi*4 + 0x1000]
movzx esi, r11b
xor ebx, dword [rax + rsi*4 + 0x1c00]
mov esi, r11d
shr esi, 0x10
movzx esi, sil
xor ebx, dword [rax + rsi*4 + 0x1400]
movzx esi, ch
xor ebx, dword [rax + rsi*4 + 0x1800]
cmp rdx, r9
mov dword [r14], ebx
jne 0x417aa0
shl r10d, 5
sub r8d, r10d
test r8d, r8d
jle 0x417cc0
lea eax, [r8 - 1]
mov r9d, dword [r14]
lea r10, [rdx + rax + 1]
mov rax, qword [0x0042cb70]
nop word cs:[rax + rax]
add rdx, 1
movzx r8d, byte [rdx - 1]
xor r8d, r9d
shr r9d, 8
movzx r8d, r8b
xor r9d, dword [rax + r8*4]
cmp rdx, r10
mov dword [r14], r9d
jne 0x417ca0
pop rbx
pop rsi
pop rdi
pop r14
ret
Function at 0x4180e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x0042cb60]
cmp byte [rax], 0
mov rbx, rcx
mov rbp, rdx
mov dword [rsp + 0x90], r8d
jne 0x41810a
mov byte [rax], 1
call fcn.0041b2b0
lea rdi, [rsp + 0x40]
mov r8d, 3
mov dword [rsp + 0x40], 0xffffffff
lea rsi, [rsp + 0x90]
mov rcx, rdi
mov rdx, rsi
call fcn.00417a60
mov r8d, dword [rsp + 0x90]
mov rcx, rdi
mov rdx, rbp
call fcn.00417a60
mov eax, dword [rsp + 0x40]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
mov rcx, qword [rbx + 8]
mov r8d, 3
mov rdx, rsi
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
not eax
mov dword [rsp + 0x3c], eax
call rdi
test eax, eax
je 0x4181f2
cmp dword [rsp + 0x4c], 3
jne 0x4181f2
add qword [rbx + 0x10], 3
lea rdx, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
mov r8d, 4
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
call rdi
test eax, eax
je 0x4181f2
cmp dword [rsp + 0x48], 4
jne 0x4181f2
mov esi, dword [rsp + 0x90]
lea r9, [rsp + 0x44]
mov rdx, rbp
mov qword [rsp + 0x20], 0
add qword [rbx + 0x10], 4
mov rcx, qword [rbx + 8]
mov r8d, esi
call rdi
test eax, eax
je 0x4181f2
cmp esi, dword [rsp + 0x44]
jne 0x4181f2
mov eax, dword [rsp + 0x90]
add qword [rbx + 0x10], rsi
add eax, 7
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [0x0042b297]
call sub.msvcrt.dll_puts
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop word [rax + rax]
Function at 0x41a390
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rcx + 0x1020]
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
lea rdi, [rsp + 0x3c]
jmp 0x41a3d6
movsxd rdx, eax
cmp byte [rbx + rdx], 0
jne 0x41a4b0
add eax, 1
mov dword [rbx + 0x1020], eax
cmp dword [rbx + 0x1024], eax
jg 0x41a3c0
mov rcx, qword [rbx + 0x1010]
mov r9, rdi
mov r8d, 0x1000
mov rdx, rbx
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
je 0x41a5b4
mov eax, dword [rsp + 0x3c]
add qword [rbx + 0x1018], rax
test eax, eax
mov rcx, rax
mov dword [rbx + 0x1024], eax
je 0x41a480
mov dword [rbx + 0x1020], 0
cdqe
cmp ecx, 3
mov byte [rbx + rax], 0
jle 0x41a490
mov edx, dword [rbx]
xor eax, eax
shl edx, 8
cmp edx, 0xbfbbef00
jne 0x41a44f
mov dword [rbx + 0x1020], 3
mov eax, 3
sub ecx, 1
mov rdx, rbx
lea r8, [rbx + rcx + 1]
jmp 0x41a472
cmp cl, 0x22
je 0x41a47a
add rdx, 1
cmp rdx, r8
je 0x41a3c0
movzx ecx, byte [rdx]
cmp cl, 0x1f
ja 0x41a460
mov byte [rdx], 0
jmp 0x41a465
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
test ecx, ecx
jg 0x41a44f
movsxd rdx, eax
cmp byte [rbx + rdx], 0
je 0x41a3cd
nop dword [rax]
nop word cs:[rax + rax]
lea rsi, [rbx + rdx]
mov rcx, rsi
call sub.msvcrt.dll_strlen
cmp eax, r12d
mov rdi, rax
jae 0x41a5ca
lea r8d, [rax + 1]
mov rdx, rsi
mov rcx, rbp
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx + 0x1020]
add eax, edi
cmp eax, dword [rbx + 0x1024]
mov dword [rbx + 0x1020], eax
je 0x41a500
mov eax, 1
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r9d, r9d
mov r8d, 0x1000
mov rdx, rbx
lea rcx, [rbx + 0x1008]
call fcn.00415af0
test eax, eax
mov dword [rbx + 0x1024], eax
je 0x41a569
mov dword [rbx + 0x1020], 0
movsxd rdx, eax
cmp eax, 3
mov byte [rbx + rdx], 0
jg 0x41a594
xor ecx, ecx
test eax, eax
jle 0x41a56f
sub eax, 1
mov rdx, rbx
lea r8, [rbx + rax + 1]
jmp 0x41a55d
cmp al, 0x22
je 0x41a564
add rdx, 1
cmp r8, rdx
je 0x41a56f
movzx eax, byte [rdx]
cmp al, 0x1f
ja 0x41a550
mov byte [rdx], 0
jmp 0x41a554
mov ecx, dword [rbx + 0x1020]
movsxd rax, ecx
cmp byte [rbx + rax], 0
je 0x41a4ed
mov edx, edi
mov r8d, r12d
mov rcx, rbx
add rdx, rbp
sub r8d, edi
call fcn.0041a390
jmp 0x41a4ed
mov edx, dword [rbx]
xor ecx, ecx
shl edx, 8
cmp edx, 0xbfbbef00
jne 0x41a53e
mov dword [rbx + 0x1020], 3
mov ecx, 3
jmp 0x41a53e
lea rcx, str._n__ERROR__Read_failed_
call sub.msvcrt.dll_puts
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, str._n__ERROR__Line_too_long_
call sub.msvcrt.dll_puts
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x41a9e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
mov eax, 0x4048
push rdi
push rsi
push rbx
call fcn.004282b0
sub rsp, rax
mov rbp, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41aa09
test al, 0x10
jne 0x41aa56
lea rsi, [rsp + 0x2040]
mov rdx, rbx
lea rdi, [rsp + 0x40]
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
lea rdx, [0x0042b4cc]
mov rcx, rsi
call fcn.0041a980
mov rdx, rsi
mov rcx, rdi
call fcn.0041a930
mov rcx, rax
call fcn.0041a8a0
test al, al
jne 0x41aa70
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41aa7d
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rdi
mov rcx, rbp
call fcn.0041a9e0
jmp 0x41aa47
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, dword [0x00434680]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, str._n__ERROR__Cant_create_directory__s__n
mov rdx, rsi
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop dword [rax]

Function at 0x41ac80
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp rbx, qword [rsp + 0x30]
ja 0x41acdb
lea rcx, [rbx + 8]
call sub.msvcrt.dll_malloc
test rax, rax
je 0x41acf1
mov qword [rax], rbx
add rbx, qword [0x00436a98]
cmp rbx, qword [0x004347a8]
mov qword [0x00436a98], rbx
jbe 0x41acd1
mov qword [0x004347a8], rbx
add rax, 8
add rsp, 0x60
pop rbx
ret
lea rcx, str._n__ERROR__Not_enough_memory_
call sub.msvcrt.dll_puts
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, str._n__ERROR__alloc0_failed_
call sub.msvcrt.dll_puts
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop dword [rax + rax]
push rbx
sub rsp, 0x20
lea rax, [0x0042c5b0]
mov rbx, rcx
mov qword [rcx], rax
lea rcx, [rcx + 0x18]
call fcn.00421fd0
mov edx, 0x38
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x428740
test rcx, rcx
je 0x41da7e
mov rcx, qword [rcx - 8]
test rcx, rcx
jne 0x41da80
ret
mov rax, qword [rcx - 8]
sub rcx, 8
sub qword [0x00436a98], rax
jmp fcn.00428390
jmp 0x41da70
Function at 0x41b2b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
lea r9, [0x00432680]
xor r8d, r8d
nop dword [rax + rax]
mov edx, r8d
mov ecx, 8
nop dword [rax + rax]
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub ecx, 1
jne 0x41b2d0
mov dword [r9 + r8*4], edx
add r8, 1
cmp r8, 0x100
jne 0x41b2c0
mov r11d, 0x400
xor r10d, r10d
lea rbx, [r9 + r11]
mov rdx, r9
sub rdx, r10
nop dword [rax]
mov eax, dword [rdx]
lea rcx, [r10 + rdx]
add rdx, 4
movzx r8d, al
shr eax, 8
xor eax, dword [r9 + r8*4]
cmp rdx, rbx
mov dword [rcx + r11], eax
jne 0x41b310
sub r10, 0x400
add r11, 0x400
cmp r10, 0xffffffffffffe400
jne 0x41b2ff
pop rbx
ret

Function at 0x41c7a0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push r13
mov eax, 0x1078
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.004282b0
sub rsp, rax
test edx, edx
mov r12, rcx
mov esi, edx
mov ebp, r8d
js 0x41c89f
lea rdi, [rcx + 0xa0]
jmp 0x41c7de
mov esi, dword [rbx + 0x224]
test esi, esi
js 0x41c89f
mov edx, esi
mov rcx, rdi
call fcn.0041bae0
test byte [rax + 0x220], 0x10
mov rbx, rax
je 0x41c7d0
cmp byte [rax + 0x230], 0
je 0x41c7d0
mov eax, dword [0x00436a94]
mov r8d, esi
mov r9d, 1
mov rcx, rdi
add eax, 1
mov dword [0x00436a94], eax
and eax, 1
shl rax, 0xd
lea rdx, [rdi + rax + 0x20]
call fcn.0041c510
mov rcx, rax
call fcn.0041abc0
test bpl, bpl
mov qword [rsp + 0x58], 0xffffffffffffffff
mov qword [rsp + 0x50], 0
mov rsi, rax
je 0x41c8b0
lea r13, [rsp + 0x50]
mov edx, dword [rbx + 0x220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r9d, r9d
mov rdx, rsi
mov rcx, r13
mov dword [rsp + 0x20], 0
mov r8d, 4
call fcn.00417780
test al, al
jne 0x41c8f0
mov edx, dword [rbx + 0x228]
test edx, edx
jns 0x41c8e0
mov rcx, r13
call fcn.00417730
mov esi, dword [rbx + 0x224]
test esi, esi
jns 0x41c7de
add rsp, 0x1078
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c8c2
test al, 0x10
jne 0x41c8d1
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41c92a
mov edx, dword [rbx + 0x228]
lea r13, [rsp + 0x50]
test edx, edx
js 0x41c889
movzx r8d, bpl
mov rcx, r12
call fcn.0041c7a0
jmp 0x41c889
mov rax, qword [rbx + 0x210]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
imul edx, eax, 0x989680
imul rax, rax, 0x989680
mov dword [rsp + 0x48], edx
xor edx, edx
sar rax, 0x20
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x41c87f
lea rbx, [rsp + 0x70]
mov r8, rsi
xor edx, edx
mov ecx, dword [0x00434680]
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, str._n__ERROR__Cant_create_directory__s__n
mov rdx, rbx
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop
Function at 0x422200
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x0042a038], eax
je 0x42221a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x422720
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x422743
call fcn.00426cf0
cmp eax, 1
je 0x42274e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x4227c5
mov eax, 0x28
jmp 0x4227aa
add rax, 1
cmp rax, 0x6b
je 0x4227b7
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x4227a0
cmp eax, 0x6a
jne 0x4227ca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
jmp 0x4227b7

Function at 0x422870
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x00436b00], 1
je 0x422886
call fcn.004227e0
mov ecx, dword [0x0042a038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x4228b0
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00422660
cmp qword [0x0043a050], 0
mov rsi, rax
je 0x42289a
test rax, rax
je 0x42289a
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x30], rax
call fcn.00422720
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4229a0
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rdx, rsi
mov ecx, dword [0x0042a038]
mov dword [rsi + 0xbc], 0
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4229a0
mov rbx, rsi
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
Function at 0x423f40
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, rcx
mov r13, rdx
mov rsi, r8
mov rdi, r9
call fcn.00422660
test rax, rax
mov rbx, rax
je 0x4240c8
test rbp, rbp
je 0x423f7b
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x423ff0
test rsi, rsi
je 0x423fe0
mov ecx, 0x14
call r14
cmp esi, 4
je 0x423ff0
add rsi, 1
jmp 0x423faf
xor ecx, ecx
call r12
jmp 0x423fd9
lea rsi, [rbx + 0x68]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov rcx, rsi
call fcn.00422720
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x4240ad
xor edx, edx
test r13, r13
je 0x42404d
mov eax, dword [r13]
mov edx, dword [r13 + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x424180
mov eax, dword [r13 + 0x18]
mov dword [rbx + 0xc0], eax
xor ecx, ecx
mov dword [rsp + 0x20], 4
mov r9, rbx
mov qword [rsp + 0x28], 0
lea r8, [0x00422d20]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x4240e0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x42408c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.00421fd0
mov rcx, rsi
call fcn.00422720
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test rbp, rbp
je 0x4240ba
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x424170
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x424110
add edx, 0xd
cmp eax, 0xffffffff
jl 0x424110
cmp eax, 0xe
mov edx, 0xf
jle 0x4241a0
nop word cs:[rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
jne 0x424150
mov qword [rbx + 0x28], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rdi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x424136
mov rcx, rbx
call fcn.00422420
jmp 0x4240c8
mov dword [rsp + 0x3c], edx
call fcn.00422870
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
jmp 0x42404d
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x424110
Function at 0x427350
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00437124]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4274d8
mov rax, qword [0x00437128]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x42739c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x427425
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x427380
mov rcx, rbx
call fcn.00427ff0
test rax, rax
mov r12, rax
je 0x42750d
mov rax, qword [0x00437128]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00428120
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00437128]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4274f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x42741e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x427480
add dword [0x00437124], 1
cmp edi, 8
jae 0x427453
test dil, 4
jne 0x4274c4
test edi, edi
je 0x427448
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4274df
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x427448
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x42746c
jmp 0x427448
add rsi, qword [0x00437128]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x42741e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00429100
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x427448
xor esi, esi
jmp 0x4273a7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x427448
mov rax, qword [0x00437128]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00429100
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00429100
nop
nop dword [rax]

Function at 0x427c60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00437400]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004373e0]
test rbx, rbx
je 0x427cb4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x427cab
test rsi, rsi
je 0x427cab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x427c90
lea rcx, [0x00437400]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x427ff0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0042cc10]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x42805d
mov rcx, r8
call fcn.00427ed0
test eax, eax
je 0x42805d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x42805d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x428054
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x42805f
add rax, 0x28
cmp rax, r9
jne 0x428040
xor eax, eax
add rsp, 0x28
ret

Function at 0x428fa0
Capabilities:
Accept command line arguments

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov ebx, ecx
mov rdi, rdx
call fcn.00426ef0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp ebx, 1
mov r12, rax
jle 0x429030
lea eax, [rbx - 2]
mov ebx, 8
lea rbp, [rax*8 + 0x10]
jmp 0x428ff9
add rbx, 8
cmp rbp, rbx
je 0x429030
mov rsi, qword [rdi + rbx]
cmp byte [rsi], 0x3a
jne 0x428ff0
mov ecx, 0x2000
call fcn.00428750
lea rdx, [rsi + 1]
mov r8d, 0x1000
mov qword [r12 + rbx], rax
mov rcx, rax
add rbx, 8
call fcn.0041a8d0
cmp rbp, rbx
jne 0x428ff9
nop dword [rax + rax]
mov eax, dword [rsp + 0x2c]
lea rdx, [r12 + 8]
lea ecx, [rax - 1]
call fcn.00420650
mov rax, qword [0x00436a98]
cmp rax, 0x8000
ja 0x42906c
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
call sub.msvcrt.dll_fflush
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, str._n__ERROR__Memory_leak__iK__n
mov edx, eax
sar edx, 0xa
call sub.msvcrt.dll_printf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400051c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x1400051e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x2c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x1400051d0
mov byte [rcx + 0x19], 0
mov rax, rcx
ret