joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4de56c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4de5ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4de5e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4de5e1
mov rax, qword [rbp - 8]
jmp 0x2fc4de5ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4de5b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x401550
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, dword [0x0040e014]
cmp ebx, 0xffffffff
je 0x401583
mov dword [0x0040e014], 0xffffffff
cmp ebx, 0xd
je 0x4015c9
cmp ebx, 0xa
jne 0x40157b
add dword [0x0040e010], 1
mov eax, ebx
add rsp, 0x30
pop rbx
ret
mov eax, dword [0x00414058]
test eax, eax
jne 0x40157b
mov rcx, qword [0x00414060]
call sub.msvcrt.dll_feof
test eax, eax
jne 0x40157b
lea rcx, [rsp + 0x2f]
mov r8d, 1
mov edx, 1
mov r9, qword [0x00414060]
call sub.msvcrt.dll_fread
cmp rax, 1
jne 0x40157b
movzx ebx, byte [rsp + 0x2f]
cmp ebx, 0xd
jne 0x40156f
call fcn.00401550
mov ebx, eax
jmp 0x40156f

Function at 0x401820
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [fcn.0040d0c0]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], rdx
mov rdi, rcx
mov ecx, 2
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x28], rax
call rbx
mov r8d, 0xe
mov edx, 1
lea rcx, str.configfile_at
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [0x00414050]
cmp byte [rsi], 0
je 0x4018e0
mov ebp, dword [0x0040e010]
mov ecx, 2
call rbx
lea rdx, str.line__d_near___s
mov r9, rsi
mov rcx, rax
mov r8d, ebp
call sub.msvcrt.dll_fprintf
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x0040f03b]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call rbx
mov rdx, rdi
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [0x00414058]
mov ecx, 2
test eax, eax
jne 0x401910
call rbx
mov r8d, 0xd
mov edx, 1
lea rcx, str.start_of_file
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x40189a
call rbx
mov r8d, 0xb
mov edx, 1
lea rcx, str.end_of_file
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x40189a
Function at 0x402150
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, 1
test rcx, rcx
mov rdi, rcx
je 0x4022d2
mov rbp, qword [0x00414038]
mov r9, rcx
mov r8d, 0x25
mov edx, 1
lea rcx, str.__Configuration_of_genidl_tool.____n
call sub.msvcrt.dll_fwrite
lea r14, [0x0040f16b]
lea r13, [0x0040f16d]
lea r12, str.______s__s_n
test rbp, rbp
jne 0x4021e0
jmp 0x4022d0
test rbx, rbx
jne 0x402265
mov r9, rdi
mov r8d, 4
mov edx, 1
lea rcx, [0x0040f1df]
call sub.msvcrt.dll_fwrite
mov rbp, qword [rbp]
test rbp, rbp
je 0x4022d0
mov rsi, qword [rbp + 8]
lea r8, [rbp + 0x18]
mov rcx, rdi
lea rdx, str.__s____n
mov rbx, qword [rbp + 0x10]
call sub.msvcrt.dll_fprintf
test rsi, rsi
je 0x4021b0
mov r9, rdi
mov r8d, 0xc
mov edx, 1
lea rcx, str.__alias___n
call sub.msvcrt.dll_fwrite
nop word [rax + rax]
cmp qword [rsi], 0
mov r9, r13
mov rdx, r12
mov rcx, rdi
lea r8, [rsi + 8]
cmovne r9, r14
call sub.msvcrt.dll_fprintf
mov rsi, qword [rsi]
test rsi, rsi
jne 0x402220
mov r9, rdi
mov r8d, 5
mov edx, 1
lea rcx, str.____n
call sub.msvcrt.dll_fwrite
test rbx, rbx
je 0x4021b9
mov r9, rdi
mov r8d, 0xd
mov edx, 1
lea rcx, str.__export___n
call sub.msvcrt.dll_fwrite
lea rsi, str.______s_____s___n
nop word cs:[rax + rax]
mov r9, qword [rbx + 8]
lea r8, [rbx + 0x10]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_fprintf
mov rbx, qword [rbx]
test rbx, rbx
jne 0x402290
mov r9, rdi
mov r8d, 5
mov edx, 1
lea rcx, str.____n
call sub.msvcrt.dll_fwrite
jmp 0x4021b9
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x404a40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test dl, 1
mov rsi, rcx
mov ebx, edx
jne 0x404ad3
test bl, 2
jne 0x404af6
test bl, 4
jne 0x404b19
test bl, 8
jne 0x404b3c
test bl, 0x10
jne 0x404b5f
test bl, 0x20
jne 0x404b82
test bl, 0x40
jne 0x404ba5
test bl, 0x80
jne 0x404bc8
test bh, 1
jne 0x404beb
test bh, 2
jne 0x404c0e
test bh, 4
jne 0x404c31
test bh, 8
jne 0x404c54
test bh, 0x10
jne 0x404c77
and ebx, 0xffffe000
jne 0x404c9d
add rsp, 0x28
pop rbx
pop rsi
ret
mov r9, rcx
mov r8d, 9
mov edx, 1
lea rcx, str._readonly
call sub.msvcrt.dll_fwrite
test bl, 2
je 0x404a5d
mov r9, rsi
mov r8d, 7
mov edx, 1
lea rcx, str._source
call sub.msvcrt.dll_fwrite
test bl, 4
je 0x404a66
mov r9, rsi
mov r8d, 9
mov edx, 1
lea rcx, str._bindable
call sub.msvcrt.dll_fwrite
test bl, 8
je 0x404a6f
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._requestedit
call sub.msvcrt.dll_fwrite
test bl, 0x10
je 0x404a78
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._displaybind
call sub.msvcrt.dll_fwrite
test bl, 0x20
je 0x404a81
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._defaultbind
call sub.msvcrt.dll_fwrite
test bl, 0x40
je 0x404a8a
mov r9, rsi
mov r8d, 7
mov edx, 1
lea rcx, str._hidden
call sub.msvcrt.dll_fwrite
test bl, 0x80
je 0x404a93
mov r9, rsi
mov r8d, 0xb
mov edx, 1
lea rcx, str._restricted
call sub.msvcrt.dll_fwrite
test bh, 1
je 0x404a9c
mov r9, rsi
mov r8d, 0x10
mov edx, 1
lea rcx, str._defaultcollelem
call sub.msvcrt.dll_fwrite
test bh, 2
je 0x404aa5
mov r9, rsi
mov r8d, 0xa
mov edx, 1
lea rcx, str._uidefault
call sub.msvcrt.dll_fwrite
test bh, 4
je 0x404aae
mov r9, rsi
mov r8d, 0xd
mov edx, 1
lea rcx, str._nonbrowsable
call sub.msvcrt.dll_fwrite
test bh, 8
je 0x404ab7
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._replaceable
call sub.msvcrt.dll_fwrite
test bh, 0x10
je 0x404ac0
mov r9, rsi
mov r8d, 0xd
mov edx, 1
lea rcx, [0x0040f82a]
call sub.msvcrt.dll_fwrite
and ebx, 0xffffe000
je 0x404acc
lea rdx, str.___flags:0x_x__
mov r8d, ebx
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fprintf
Function at 0x404d20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test r8b, 3
mov rsi, rcx
mov r12, rdx
mov rdi, r8
mov rbp, r9
jne 0x404e09
and rdi, 0xfffffffffffffffc
je 0x404df8
lea rdx, str.0x_x:
xor r8d, r8d
mov rcx, rsi
call sub.msvcrt.dll_fprintf
test rbp, rbp
lea rax, [0x0040f878]
cmove rbp, rax
xor ebx, ebx
xor r14d, r14d
lea rcx, [0x0040f853]
lea r13, [0x0040f876]
lea r15, str.0x_x:
nop word [rax + rax]
mov r9, rsi
mov r8d, 1
mov edx, 1
call sub.msvcrt.dll_fwrite
mov r8d, dword [r12 + rbx]
mov rcx, rsi
mov rdx, rbp
add r14, 1
add rbx, 4
call fcn.00404ce0
cmp r14, 3
mov rcx, r13
ja 0x404dc8
cmp rdi, rbx
ja 0x404d90
mov rdx, rsi
mov ecx, 0xa
call sub.msvcrt.dll_fputc
cmp rdi, rbx
jbe 0x404df8
mov r8, rbx
mov rcx, rsi
mov rdx, r15
shr r8, 2
xor r14d, r14d
call sub.msvcrt.dll_fprintf
lea rcx, [0x0040f853]
jmp 0x404d90
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9, rcx
mov r8d, 0x1a
mov edx, 1
lea rcx, str.Has_not_4_byte_alignment__n
call sub.msvcrt.dll_fwrite
jmp 0x404d46
Function at 0x406100
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test dl, 1
mov rsi, rcx
mov ebx, edx
jne 0x406193
test bl, 2
jne 0x4061b6
test bl, 4
jne 0x4061d9
test bl, 8
jne 0x4061fc
test bl, 0x10
jne 0x40621f
test bl, 0x20
jne 0x406242
test bl, 0x40
jne 0x406265
test bl, 0x80
jne 0x406288
test bh, 1
jne 0x4062ab
test bh, 2
jne 0x4062ce
test bh, 4
jne 0x4062f1
test bh, 8
jne 0x406314
test bh, 0x10
jne 0x406337
and ebx, 0xffffe000
jne 0x40635d
add rsp, 0x28
pop rbx
pop rsi
ret
mov r9, rcx
mov r8d, 0xb
mov edx, 1
lea rcx, str._restricted
call sub.msvcrt.dll_fwrite
test bl, 2
je 0x40611d
mov r9, rsi
mov r8d, 7
mov edx, 1
lea rcx, str._source
call sub.msvcrt.dll_fwrite
test bl, 4
je 0x406126
mov r9, rsi
mov r8d, 9
mov edx, 1
lea rcx, str._bindable
call sub.msvcrt.dll_fwrite
test bl, 8
je 0x40612f
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._requestedit
call sub.msvcrt.dll_fwrite
test bl, 0x10
je 0x406138
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._displaybind
call sub.msvcrt.dll_fwrite
test bl, 0x20
je 0x406141
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._defaultbind
call sub.msvcrt.dll_fwrite
test bl, 0x40
je 0x40614a
mov r9, rsi
mov r8d, 7
mov edx, 1
lea rcx, str._hidden
call sub.msvcrt.dll_fwrite
test bl, 0x80
je 0x406153
mov r9, rsi
mov r8d, 0x10
mov edx, 1
lea rcx, str._usegetlasterror
call sub.msvcrt.dll_fwrite
test bh, 1
je 0x40615c
mov r9, rsi
mov r8d, 0x10
mov edx, 1
lea rcx, str._defaultcollelem
call sub.msvcrt.dll_fwrite
test bh, 2
je 0x406165
mov r9, rsi
mov r8d, 0xa
mov edx, 1
lea rcx, str._uidefault
call sub.msvcrt.dll_fwrite
test bh, 4
je 0x40616e
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._nobrowsable
call sub.msvcrt.dll_fwrite
test bh, 8
je 0x406177
mov r9, rsi
mov r8d, 0xc
mov edx, 1
lea rcx, str._replaceable
call sub.msvcrt.dll_fwrite
test bh, 0x10
je 0x406180
mov r9, rsi
mov r8d, 0xe
mov edx, 1
lea rcx, str._immediatebind
call sub.msvcrt.dll_fwrite
and ebx, 0xffffe000
je 0x40618c
lea rdx, str.___flags:0x_x__
mov r8d, ebx
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fprintf
Function at 0x406380
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r8, [0x0040f84a]
test edx, edx
mov rsi, rcx
mov ebx, edx
jne 0x406420
test bl, 0x10
jne 0x4064b0
test bl, 0x20
jne 0x4064cf
test bl, 0x40
jne 0x4064ee
test bl, 0x80
jne 0x40650d
test bh, 1
jne 0x40652c
test bh, 2
jne 0x40654b
test bh, 4
jne 0x40656a
test bh, 8
jne 0x406589
test bh, 0x10
jne 0x4065a8
test bh, 0x20
jne 0x4065c7
mov edi, ebx
and edi, 0xffff8000
test bh, 0x40
jne 0x4065ee
test edi, edi
jne 0x406601
test ebx, ebx
jne 0x406613
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rdx, rcx
mov ecx, 0x5b
mov qword [rsp + 0x28], r8
call sub.msvcrt.dll_fputc
test bl, 1
mov r8, qword [rsp + 0x28]
je 0x406452
lea rdx, str._sappobject
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bl, 2
je 0x40646d
lea rdx, str._scancreate
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bl, 4
je 0x406488
lea rdx, str._slicensed
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bl, 8
je 0x40639b
lea rdx, str._spredclid
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bl, 0x10
je 0x4063a4
lea rdx, str._shidden
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bl, 0x20
je 0x4063ad
lea rdx, str._scontrol
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bl, 0x40
je 0x4063b6
lea rdx, str._sdual
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bl, 0x80
je 0x4063bf
lea rdx, str._snonextensible
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bh, 1
je 0x4063c8
lea rdx, str._soleautomation
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bh, 2
je 0x4063d1
lea rdx, str._srestricted
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bh, 4
je 0x4063da
lea rdx, str._saggregatable
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bh, 8
je 0x4063e3
lea rdx, str._sreplaceable
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bh, 0x10
je 0x4063ec
lea rdx, str._sdispatchable
mov rcx, rsi
call sub.msvcrt.dll_fprintf
lea r8, [0x0040f853]
test bh, 0x20
je 0x4063f5
lea rdx, str._sreversbind
mov rcx, rsi
mov edi, ebx
call sub.msvcrt.dll_fprintf
and edi, 0xffff8000
test bh, 0x40
lea r8, [0x0040f853]
je 0x406406
lea rdx, str._sproxy
mov rcx, rsi
call sub.msvcrt.dll_fprintf
test edi, edi
je 0x406613
lea rdx, str.___TYPFLAG:0x_x__
mov r8d, edi
mov rcx, rsi
call sub.msvcrt.dll_fprintf
mov r9, rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x0040fe5f]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sub.msvcrt.dll_fwrite
Function at 0x408790
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x178
xor r8d, r8d
mov rbx, rcx
mov dword [rdx], 0
mov rsi, rdx
xor edx, edx
call sub.msvcrt.dll_fseek
lea rcx, [rsp + 0x20]
mov r9, rbx
mov r8d, 0x40
mov edx, 1
call sub.msvcrt.dll_fread
cmp rax, 0x40
jne 0x4087d6
cmp word [rsp + 0x20], 0x5a4d
je 0x4087e2
xor eax, eax
add rsp, 0x178
pop rbx
pop rsi
ret
mov edx, dword [rsp + 0x5c]
test edx, edx
je 0x4087d6
xor r8d, r8d
mov rcx, rbx
call sub.msvcrt.dll_fseek
lea rcx, [rsp + 0x60]
mov r9, rbx
mov r8d, 0x108
mov edx, 1
call sub.msvcrt.dll_fread
cmp rax, 0x108
jne 0x4087d6
cmp dword [rsp + 0x60], 0x4550
jne 0x4087d6
movzx eax, word [rsp + 0x74]
cmp ax, 0xe0
je 0x408840
cmp ax, 0xf0
jne 0x4087d6
mov dword [rsi], 1
mov eax, dword [rsp + 0x5c]
jmp 0x4087d8
mov dword [rsi], 0
jmp 0x408836

Function at 0x408850
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
mov r14, rdx
mov rbp, rcx
mov r13, r8
mov qword [rsp + 0x1e8], r9
lea rdx, [rsp + 0x3c]
call fcn.00408790
xor ecx, ecx
mov qword [r14], 0
test eax, eax
mov qword [r13], 0
jne 0x4088b0
mov eax, ecx
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r8d, r8d
mov edx, eax
mov rcx, rbp
call sub.msvcrt.dll_fseek
mov edx, dword [rsp + 0x3c]
lea rcx, [rsp + 0x70]
mov r9, rbp
test edx, edx
je 0x408992
mov r8d, 0x108
mov edx, 1
call sub.msvcrt.dll_fread
mov eax, dword [rsp + 0x10c]
movzx ebx, word [rsp + 0x76]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x408988
test ebx, ebx
je 0x408988
lea r12, [rsp + 0x40]
lea r15, str..rsrc
jmp 0x408918
sub ebx, 1
je 0x408988
mov rcx, r12
mov r9, rbp
mov r8d, 0x28
mov edx, 1
mov rsi, r12
mov rdi, r15
call sub.msvcrt.dll_fread
mov ecx, 6
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x408913
mov edx, dword [rsp + 0x54]
xor r8d, r8d
mov rcx, rbp
call sub.msvcrt.dll_fseek
mov ebx, dword [rsp + 0x4c]
mov rax, qword [rsp + 0x1e8]
mov qword [rax], rbx
mov ebx, dword [rsp + 0x2c]
mov rcx, rbx
call sub.msvcrt.dll_malloc
mov r9, rbp
mov r8, rbx
mov edx, 1
mov qword [r14], rax
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [r13], rbx
mov ecx, 1
jmp 0x408893
mov r8d, 0xf8
mov edx, 1
call sub.msvcrt.dll_fread
mov eax, dword [rsp + 0xfc]
movzx ebx, word [rsp + 0x76]
mov dword [rsp + 0x2c], eax
jmp 0x4088f1
Function at 0x409ea0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
lea rdx, str._s
call sub.msvcrt.dll_fprintf
test rdi, rdi
je 0x409f43
cmp byte [rdi], 0x22
je 0x409ee3
lea rdx, str.uuid__s_
mov r8, rdi
mov rcx, rsi
call sub.msvcrt.dll_fprintf
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp byte [rdi + 1], 0x22
je 0x409f43
lea rcx, str.uuid_
mov r9, rsi
mov r8d, 5
lea rbx, [rdi + 1]
mov edx, 1
call sub.msvcrt.dll_fwrite
movsx ecx, byte [rdi + 1]
cmp cl, 0x22
je 0x409f2c
test cl, cl
je 0x409f2c
add rbx, 1
mov rdx, rsi
call sub.msvcrt.dll_fputc
movsx ecx, byte [rbx]
test cl, cl
je 0x409f2c
cmp cl, 0x22
jne 0x409f14
mov rdx, rsi
mov ecx, 0x29
call sub.msvcrt.dll_fputc
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r9, rsi
mov r8d, 0x2a
mov edx, 1
lea rcx, str.uuid_00000000_0000_0000_0000_000000000000_
call sub.msvcrt.dll_fwrite
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x409f70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test r8d, r8d
mov rsi, rcx
mov ebx, edx
je 0x409fc0
cmp r8d, 0xffffffff
je 0x409fd1
lea rdx, str._s
mov r8, r9
call sub.msvcrt.dll_fprintf
mov r9d, ebx
movzx r8d, bx
mov rcx, rsi
lea rdx, str.version__d._d_
shr r9d, 0x10
call sub.msvcrt.dll_fprintf
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
lea rdx, str.__n_s
mov r8, r9
call sub.msvcrt.dll_fprintf
jmp 0x409f95
mov r9, rcx
mov r8d, 2
mov edx, 1
lea rcx, [0x00410783]
call sub.msvcrt.dll_fwrite
jmp 0x409f95

Function at 0x409ff0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test r9d, r9d
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
je 0x40a064
cmp r9d, 0xffffffff
je 0x40a083
mov r8, qword [rsp + 0x60]
lea rdx, str._s
call sub.msvcrt.dll_fprintf
test rbx, rbx
je 0x40a07a
cmp byte [rbx], 0x22
je 0x40a045
mov r9, rbx
mov r8, rdi
mov rcx, rsi
lea rdx, str._s___s__
call sub.msvcrt.dll_fprintf
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r9, rbx
mov r8, rdi
mov rcx, rsi
lea rdx, str._s__s_
call sub.msvcrt.dll_fprintf
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8, qword [rsp + 0x60]
lea rdx, str.__n_s
call sub.msvcrt.dll_fprintf
test rbx, rbx
jne 0x40a021
lea rbx, [0x00410712]
jmp 0x40a026
mov r9, rcx
mov r8d, 2
mov edx, 1
lea rcx, [0x00410783]
call sub.msvcrt.dll_fwrite
jmp 0x40a01c
Function at 0x40a0b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov edi, dword [rdx + 0x10]
test edi, edi
mov rbp, rcx
mov rsi, rdx
mov r12, r8
mov r14, r9
mov ebx, edi
jne 0x40a0e0
cmp qword [rdx + 0x28], 0
je 0x40a1f3
lea rdx, [0x00410878]
mov r8, r12
mov rcx, rbp
call sub.msvcrt.dll_fprintf
mov rdx, qword [rsi + 0x20]
mov eax, 1
test rdx, rdx
je 0x40a10b
mov r8, r12
mov rcx, rbp
call fcn.00409ea0
mov edx, dword [rsi + 0x38]
test edx, edx
jne 0x40a240
mov r8, qword [rsi + 0x28]
test r8, r8
je 0x40a136
mov qword [rsp + 0x20], r12
lea rdx, str.helpstring
mov r9d, eax
mov rcx, rbp
call fcn.00409ff0
test edi, edi
je 0x40a1a0
lea r13, str.appobject
xor esi, esi
lea r15, str._s
jmp 0x40a15c
add esi, 1
shr ebx, 1
je 0x40a1a0
cmp esi, 0x20
je 0x40a1a0
test bl, 1
je 0x40a150
mov edx, esi
mov rdi, qword [r13 + rdx*8]
cmp byte [rdi], 0
je 0x40a150
test eax, eax
je 0x40a223
cmp eax, 0xffffffff
je 0x40a253
mov r8, r12
mov rdx, r15
mov rcx, rbp
call sub.msvcrt.dll_fprintf
mov rdx, rbp
mov rcx, rdi
add esi, 1
call sub.msvcrt.dll_fputs
xor eax, eax
shr ebx, 1
jne 0x40a157
test r14, r14
je 0x40a1bf
mov qword [rsp + 0x20], r12
mov r9d, eax
mov r8, r14
mov rcx, rbp
lea rdx, str.dllname
call fcn.00409ff0
cmp eax, 1
je 0x40a1d1
mov rdx, rbp
mov ecx, 0xa
call sub.msvcrt.dll_fputc
lea rdx, [0x00410890]
mov r8, r12
mov rcx, rbp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msvcrt.dll_fprintf
cmp qword [rdx + 0x20], 0
jne 0x40a0e0
mov eax, dword [rdx + 0x38]
test eax, eax
jne 0x40a0e0
test r9, r9
jne 0x40a0e0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.__n_s
mov r8, r12
mov rcx, rbp
call sub.msvcrt.dll_fprintf
jmp 0x40a18c
mov r9, r12
mov r8d, eax
mov rcx, rbp
call fcn.00409f70
jmp 0x40a116
mov r9, rbp
mov r8d, 2
mov edx, 1
lea rcx, [0x00410783]
call sub.msvcrt.dll_fwrite
jmp 0x40a18c
Function at 0x40b950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
test ecx, ecx
jne 0x40b960
add rsp, 0x20
pop rbx
ret
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
mov qword [0x00414730], rax
je 0x40ba50
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, qword [0x00414730]
mov qword [0x00414728], rax
call rbx
mov rdx, qword [0x00414728]
mov qword [0x00414720], rax
test rdx, rdx
je 0x40b9e0
test rax, rax
je 0x40b9e0
lea rcx, [0x00414738]
call rdx
test eax, eax
je 0x40ba20
lea rcx, [0x0040b940]
add rsp, 0x20
pop rbx
jmp fcn.00401510
mov rcx, qword [0x00414730]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 2
call qword [fcn.0040d0c0]
mov r8d, 0x53
mov edx, 1
lea rcx, str.Wow64DisableWow64FsRedirection_or_Wow64RevertWow64FsRedirection_functions_missing._n
mov r9, rax
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_fwrite
mov ecx, 2
call qword [fcn.0040d0c0]
mov r8d, 0x27
mov edx, 1
lea rcx, str.Wow64DisableWow64FsRedirection_failed._n
mov r9, rax
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_fwrite
mov ecx, 2
call qword [fcn.0040d0c0]
mov r8d, 0x3f
mov edx, 1
lea rcx, str.kernel32.dll_failed_to_load__failed_to_disable_FS_redirection._n
mov r9, rax
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_fwrite
Function at 0x40bff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00414d44]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x40c178
mov rax, qword [0x00414d48]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40c03c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x40c0c5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x40c020
mov rcx, rbx
call fcn.0040cc90
test rax, rax
mov r12, rax
je 0x40c1ad
mov rax, qword [0x00414d48]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0040cdc0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00414d48]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40c190
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40c0be
sub eax, 0x40
and eax, 0xffffffbf
jne 0x40c120
add dword [0x00414d44], 1
cmp edi, 8
jae 0x40c0f3
test dil, 4
jne 0x40c164
test edi, edi
je 0x40c0e8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40c17f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x40c0e8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40c10c
jmp 0x40c0e8
add rsi, qword [0x00414d48]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40c0be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040da10
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x40c0e8
xor esi, esi
jmp 0x40c047
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x40c0e8
mov rax, qword [0x00414d48]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0040da10
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0040da10
nop
nop dword [rax]

Function at 0x40c900
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00415020]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00415000]
test rbx, rbx
je 0x40c954
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40c94b
test rsi, rsi
je 0x40c94b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40c930
lea rcx, [0x00415020]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x40cc90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00411e60]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40ccfd
mov rcx, r8
call fcn.0040cb70
test eax, eax
je 0x40ccfd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40ccfd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x40ccf4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40ccff
add rax, 0x28
cmp rax, r9
jne 0x40cce0
xor eax, eax
add rsp, 0x28
ret