joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402248
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
lea rdx, [rsp + 0x30]
mov ecx, 8
call fcn.00402e64
lea rdx, [rsp + 0x60]
mov ecx, 0xc
call fcn.00402e14
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x4023e0
and dword [rbp + 0x210], 0
and qword [rsp + 0x20], 0
mov esi, 4
or rdi, 0xffffffffffffffff
lea edx, [rsi + 3]
lea r8, [rbp + 0x210]
mov r9d, esi
mov rcx, rdi
call rbx
test eax, eax
jne 0x4022e0
cmp dword [rbp + 0x210], eax
je 0x4022e0
mov eax, 1
jmp 0x4023e2
and qword [rbp + 0x220], 0
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x16]
lea r8, [rbp + 0x220]
mov rcx, rdi
call rbx
test eax, eax
jne 0x402312
cmp qword [rbp + 0x220], 0
jne 0x4022d6
and dword [rbp + 0x218], 0
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x218]
mov r9d, esi
mov edx, 0x1f
mov rcx, rdi
call rbx
test eax, eax
jne 0x40233f
cmp dword [rbp + 0x218], eax
je 0x4022d6
mov ecx, 0x30
mov eax, ecx
dec rax
mov byte [rbp + rax - 0x80], 0
jne 0x402346
and qword [rsp + 0x20], 0
mov r9d, ecx
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, rdi
call rbx
lea rdx, [rsp + 0x48]
mov ecx, 0x50
call fcn.00402e64
mov rsi, qword [rbp - 0x58]
test rsi, rsi
je 0x4023e0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4023cf
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x4023cf
cmp dword [rbp - 0x48], esi
jne 0x4023a4
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x48]
call fcn.00402c4c
test eax, eax
jne 0x4023a4
lea edi, [rax + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x4022d6
xor eax, eax
mov rbx, qword [rsp + 0x328]
add rsp, 0x2f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x4023f8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
lea rdx, [rsp + 0x20]
mov ecx, 0x51
call fcn.00402e64
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40246b
jmp 0x402453
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.00402c4c
test eax, eax
je 0x402467
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402440
jmp 0x40246b
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x402497
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret
Function at 0x402e14
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
movzx r8d, cx
lea rax, [0x00407660]
shl r8, 4
mov r10, rdx
movzx r9d, r11w
add r8, rax
cmp r11w, word [r8 + 2]
jae 0x402e57
mov rax, qword [r8 + 8]
movzx edx, r9w
mov cl, byte [rax + rdx]
xor cl, byte [r8]
xor cl, r9b
inc r9w
mov byte [rdx + r10], cl
cmp r9w, word [r8 + 2]
jb 0x402e37
movzx eax, word [r8 + 2]
mov byte [rax + r10], r11b
ret

Function at 0x402e64
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
movzx r8d, cx
lea rax, [0x00407660]
shl r8, 4
mov r10, rdx
movzx r9d, r11w
add r8, rax
cmp r11w, word [r8 + 2]
jae 0x402eb6
mov rax, qword [r8 + 8]
movzx edx, r9w
movsx ecx, byte [rax + rdx]
mov eax, 0xff
xor cx, r9w
inc r9w
and cx, ax
movzx eax, byte [r8]
xor cx, ax
mov word [r10 + rdx*2], cx
cmp r9w, word [r8 + 2]
jb 0x402e87
movzx eax, word [r8 + 2]
mov word [r10 + rax*2], r11w
ret
Function at 0x140d14e60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140d14e6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140d14e7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140d14e65
lea eax, [rcx + 1]
jmp 0x140d14e8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140d14e9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140d14e84
sub eax, 3
jb 0x140d14ebe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140d14f0d
sar eax, 1
movsxd rbp, eax
jb 0x140d14ef4
jmp 0x140d14ecc
add ebx, ebx
jne 0x140d14eca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140d14ef4
inc ecx
add ebx, ebx
jne 0x140d14eda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140d14ef4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140d14eed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140d14edc
add ecx, 2
jmp 0x140d14ef9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140d14e22
jmp 0x140d14e6d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xcf3000]
mov eax, dword [rdi]
or eax, eax
je 0x140d14f6d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd70114]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140d14f1d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140d14f67
mov qword [rbx], rax
add rbx, 8
jmp 0x140d14f3d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140d14fb1
cmp al, 0xef
ja 0x140d14f99
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140d14f79
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140d14f88
mov eax, dword [rdi]
add rdi, 4
jmp 0x140d14f88
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140d15030], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140d15030
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140d15020
sub rsp, 0xffffffffffffff80
jmp 0x1400013c9
Function at 0x14000b4c0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140019060]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14000b500
mov eax, 0xff
jmp 0x14000b6ab
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x14000b51c
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x14001acc8], r9d
mov dword [0x14001acd0], ecx
mov dword [0x14001acd4], edx
mov dword [0x14001acd8], eax
mov dword [0x14001accc], r8d
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000b593
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000b593
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x14000b593
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x14000b595
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x14000b595
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.14000d244
test eax, eax
jne 0x14000b5cb
cmp dword [0x14001a71c], 2
je 0x14000b5b7
call fcn.14000d028
mov ecx, 0x1c
call fcn.14000d074
mov ecx, 0xff
call fcn.14000cc40
call fcn.14000cb0c
test eax, eax
jne 0x14000b5f7
cmp dword [0x14001a71c], 2
je 0x14000b5e2
call fcn.14000d028
mov ecx, 0x10
call fcn.14000d074
mov ecx, 0xff
call fcn.14000cc40
nop
call fcn.14000d2b8
test eax, eax
jns 0x14000b60a
mov ecx, 0x1b
call fcn.14000cc5c
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x14001c8d0], rax
call fcn.14000da58
mov qword [0x14001a720], rax
call fcn.14000d554
test eax, eax
jns 0x14000b635
mov ecx, 8
call fcn.14000cc5c
call fcn.14000d834
test eax, eax
jns 0x14000b648
mov ecx, 9
call fcn.14000cc5c
mov ecx, edi
call fcn.14000cccc
test eax, eax
je 0x14000b65a
mov ecx, eax
call fcn.14000cc5c
mov r8, qword [0x14001acb8]
mov qword [0x14001ace8], r8
mov rdx, qword [0x14001acb0]
mov ecx, dword [0x14001acac]
call fcn.1400070f4
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x14000b68b
mov ecx, eax
call fcn.14000d018
call fcn.14000ccb8
jmp 0x14000b6a9
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000b710
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.140180000
add rsp, 0x28
jmp 0x14000b4c0

Function at 0x14000c1ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x40181f
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rdx
lea rdx, [0x004c5038]
mov rdi, rcx
mov rcx, rsi
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
jne 0x401880
mov rcx, qword [0x004ca800]
lea rdx, str.error:_failed_to_open
call fcn.004bc420
mov rdx, rsi
mov rcx, rax
call fcn.004bc420
lea rdx, str._for_reading
mov rcx, rax
call fcn.004bc420
mov rcx, rax
call fcn.004b9b00
jmp 0x401a12
lea rcx, [0x004f40c0]
xor r9d, r9d
mov rdx, rdi
mov r8d, 0x1e
call fcn.00406e46
xor edx, edx
mov r8d, 2
mov rcx, rbx
movsx edi, ax
call sub.msvcrt.dll_fseek
mov rcx, rbx
call sub.msvcrt.dll_ftell
xor r8d, r8d
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
call sub.msvcrt.dll_fseek
cmp dword [0x004f4044], 0
jle 0x4018f2
mov rcx, qword [0x004ca820]
lea rdx, str.file_size:
call fcn.004bc420
mov rdx, rsi
mov rcx, rax
call fcn.004772a0
mov rcx, rax
call fcn.004b9b00
lea rbp, [rsp + 0x2f]
lea r12, [0x004f40c0]
test rsi, rsi
je 0x401a21
mov r9, rbx
mov r8d, 1
mov edx, 1
mov rcx, rbp
call sub.msvcrt.dll_fread
dec rax
je 0x40193a
mov rcx, qword [0x004ca800]
lea rdx, str.fread_error_
call fcn.004bc420
jmp 0x4019f4
mov r9d, 1
mov r8, rbp
mov edx, edi
mov rcx, r12
call fcn.0040734a
test eax, eax
jns 0x401a19
mov rcx, qword [0x004ca800]
lea rdx, str.SPIFFS_write_error_
call fcn.004bc420
mov edx, dword [0x004f4124]
mov rcx, rax
call fcn.00477be0
lea rdx, [0x004c508c]
mov rcx, rax
call fcn.004bc420
cmp dword [0x004f4124], 0xffffd8ef
jne 0x4019ae
mov rcx, qword [0x004ca800]
lea rdx, str.File_system_is_full.
call fcn.004bc420
mov rcx, rax
call fcn.004b9b00
jmp 0x4019c1
mov rcx, qword [0x004ca800]
lea rdx, str.unknown
call fcn.004bc420
mov rcx, qword [0x004ca800]
call fcn.004b9b00
cmp dword [0x004f4044], 0
jle 0x4019fc
mov rcx, qword [0x004ca820]
lea rdx, str.data_left:
call fcn.004bc420
mov rdx, rsi
mov rcx, rax
call fcn.004772a0
mov rcx, rax
call fcn.004b9b00
mov rcx, rbx
call sub.msvcrt.dll_fclose
lea rcx, [0x004f40c0]
mov edx, edi
call fcn.00407a20
mov eax, 1
jmp 0x401a39
dec rsi
jmp 0x4018fe
lea rcx, [0x004f40c0]
mov edx, edi
call fcn.00407a20
mov rcx, rbx
call sub.msvcrt.dll_fclose
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x401dda
Capabilities:
Create directory

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.00401db9
test al, al
mov bl, al
jne 0x401e17
mov rcx, rsi
call sub.msvcrt.dll__mkdir
test eax, eax
je 0x401e1b
mov rcx, qword [0x004ca800]
lea rdx, str.Can_not_create_directory___
call fcn.004bc420
mov rcx, rax
call fcn.004b9b00
jmp 0x401e1d
xor ebx, ebx
jmp 0x401e1d
mov bl, 1
mov al, bl
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x401e26
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x40
mov esi, dword [rcx + 0x24]
mov rbx, rcx
mov rdi, rdx
lea rax, [rsi + 0xf]
shr rax, 4
shl rax, 4
call fcn.00417340
lea r13, [rbp - 0x20]
lea rdx, [rcx + 2]
sub rsp, rax
lea r14, [rsp + 0x20]
mov rcx, r13
call fcn.00401644
mov rdx, qword [rbp - 0x20]
lea rcx, [0x004f40c0]
xor r9d, r9d
mov r8d, 8
call fcn.00406e46
mov r9d, dword [rbx + 0x24]
movsx r12d, ax
lea rcx, [0x004f40c0]
mov r8, r14
mov edx, r12d
call fcn.00407238
lea rcx, [0x004f40c0]
mov edx, r12d
call fcn.00407a20
lea rdx, [0x004c513f]
mov rcx, rdi
call sub.msvcrt.dll_fopen
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, r14
mov rbx, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, r13
call fcn.0049f4f0
mov al, 1
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret

Function at 0x402535
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
movsxd rdx, dword [0x004f417c]
lea rcx, [0x004f41c0]
lea r8, [rsp + 0x2f]
mov byte [rsp + 0x2f], 0xff
call fcn.0049e530
mov rcx, qword [0x004f4180]
lea rdx, [0x004c513f]
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
jne 0x402595
mov rcx, qword [0x004ca800]
lea rdx, str.error:_failed_to_open_image_file
mov esi, 1
call fcn.004bc420
mov rcx, rax
call fcn.004b9b00
jmp 0x4025de
call fcn.004024fd
mov rcx, qword [0x004f41a0]
lea rdx, [0x004c50c8]
call fcn.00401a44
mov esi, eax
call fcn.004017f6
mov rcx, qword [0x004f41c0]
mov r8, qword [0x004f41c8]
mov r9, rbx
mov edx, 4
sub r8, rcx
shr r8, 2
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x4025e7
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x48
movsxd rdx, dword [0x004f417c]
lea rcx, [0x004f41c0]
lea rsi, [rsp + 0x20]
mov byte [rsp + 0x20], 0xff
mov r8, rsi
call fcn.0049e530
mov rcx, qword [0x004f4180]
lea rdx, [0x004c5038]
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
jne 0x40264a
mov rcx, qword [0x004ca800]
lea rdx, str.error:_failed_to_open_image_file
mov ebx, 1
call fcn.004bc420
mov rcx, rax
call fcn.004b9b00
jmp 0x4026ba
mov rcx, qword [0x004f41c0]
mov r8, qword [0x004f41c8]
mov r9, rax
mov edx, 4
sub r8, rcx
shr r8, 2
call sub.msvcrt.dll_fread
mov rcx, rbx
call sub.msvcrt.dll_fclose
call fcn.004024d6
lea rdx, [0x004f41a0]
mov rcx, rsi
call fcn.004a1780
mov rcx, rsi
call fcn.0040206b
mov bl, al
mov rcx, rsi
xor ebx, 1
call fcn.0049f4f0
movzx ebx, bl
call fcn.004017f6
jmp 0x4026ba
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x4026c3
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
movsxd rdx, dword [0x004f417c]
lea rcx, [0x004f41c0]
lea r8, [rsp + 0x2f]
mov byte [rsp + 0x2f], 0xff
call fcn.0049e530
mov rcx, qword [0x004f4180]
lea rdx, [0x004c5038]
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
jne 0x402722
mov rcx, qword [0x004ca800]
lea rdx, str.error:_failed_to_open_image_file
call fcn.004bc420
mov rcx, rax
call fcn.004b9b00
mov eax, 1
jmp 0x40275d
mov rcx, qword [0x004f41c0]
mov r8, qword [0x004f41c8]
mov r9, rax
mov edx, 4
sub r8, rcx
shr r8, 2
call sub.msvcrt.dll_fread
mov rcx, rbx
call sub.msvcrt.dll_fclose
call fcn.004024d6
call fcn.00401d41
call fcn.004017f6
xor eax, eax
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x30
mov dword [rsp + 0x2c], ecx
mov qword [rsp + 0x20], rdx
call fcn.00415f40
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x2c]
call fcn.00402870
mov eax, dword [0x004f4170]
cmp eax, 2
je 0x4c0400
ja 0x4c03ec
dec eax
jne 0x4c044e
add rsp, 0x30
pop rbx
jmp fcn.00402535
cmp eax, 3
je 0x4c040a
cmp eax, 4
jne 0x4c044e
add rsp, 0x30
pop rbx
jmp fcn.00402763
add rsp, 0x30
pop rbx
jmp fcn.004025e7
add rsp, 0x30
pop rbx
jmp 0x4026c3
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x402763
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
movsxd rdx, dword [0x004f417c]
lea rcx, [0x004f41c0]
lea rsi, [rsp + 0x2c]
mov byte [rsp + 0x2c], 0xff
mov r8, rsi
call fcn.0049e530
mov rcx, qword [0x004f4180]
lea rdx, [0x004c5038]
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
jne 0x4027c9
mov rcx, qword [0x004ca800]
lea rdx, str.error:_failed_to_open_image_file
call fcn.004bc420
mov rcx, rax
call fcn.004b9b00
mov eax, 1
jmp 0x402869
mov rcx, qword [0x004f41c0]
mov r8, qword [0x004f41c8]
mov r9, rax
mov edx, 4
sub r8, rcx
shr r8, 2
call sub.msvcrt.dll_fread
mov rcx, rbx
call sub.msvcrt.dll_fclose
call fcn.004024d6
lea rcx, [0x004f40c0]
call fcn.004082f3
lea rdx, [rsp + 0x28]
lea rcx, [0x004f40c0]
mov r8, rsi
call fcn.00407d8e
mov rcx, qword [0x004ca820]
lea rdx, str.total:
call fcn.004bc420
mov edx, dword [rsp + 0x28]
mov rcx, rax
call fcn.00476e60
mov rcx, rax
call fcn.004b9b00
lea rdx, str.used:
mov rcx, rax
call fcn.004bc420
mov edx, dword [rsp + 0x2c]
mov rcx, rax
call fcn.00476e60
mov rcx, rax
call fcn.004b9b00
call fcn.004017f6
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x408cb8
Capabilities:
Hash data using djb2

Disassembly:
mov edx, 1
mov eax, 0x1505
movzx r8d, byte [rcx + rdx - 1]
cmp edx, 0x20
setne r10b
test r8b, r8b
setne r9b
inc rdx
test r10b, r9b
je 0x408ce6
imul eax, eax, 0x21
xor eax, r8d
jmp 0x408cc2
ret
Function at 0x4092a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
or r13d, 0xffffffff
xor r12d, r12d
lea rdi, [rsp + 0x5a]
lea rbp, [rsp + 0x5c]
mov rbx, rcx
mov word [rsp + 0x58], 0
mov esi, r13d
movzx r9d, word [rsp + 0x58]
cmp r9d, dword [rbx + 0x30]
jae 0x4093ed
mov r11d, dword [rbx + 0x28]
mov r8d, dword [rbx + 0x24]
xor edx, edx
mov r10d, dword [rbx + 0x1c]
mov eax, r8d
div r11d
xor edx, edx
mov rcx, r11
mov eax, eax
add rax, rax
div r11
test rax, rax
jne 0x40930d
mov eax, 1
imul r8d, r9d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
imul eax, ecx
mov rcx, rbx
lea edx, [r10 + r8 - 4]
xor r8d, r8d
lea r9d, [rdx + rax]
mov edx, 0x15
call fcn.004039c0
test eax, eax
js 0x409483
mov ecx, dword [rbx + 0x28]
mov eax, ecx
xor ax, 0x529
cmp ax, word [rsp + 0x5a]
je 0x40935f
inc si
jne 0x4093e3
mov esi, dword [rsp + 0x58]
mov r9d, dword [rbx + 0x24]
xor edx, edx
mov r10d, ecx
mov r8d, dword [rbx + 0x1c]
mov eax, r9d
div ecx
xor edx, edx
mov eax, eax
add rax, rax
div r10
test rax, rax
jne 0x409385
mov eax, 1
movzx edx, word [rsp + 0x58]
mov qword [rsp + 0x28], rbp
imul eax, ecx
mov dword [rsp + 0x20], 2
mov rcx, rbx
imul edx, r9d
lea edx, [r8 + rdx - 2]
xor r8d, r8d
lea r9d, [rdx + rax]
mov edx, 0x15
call fcn.004039c0
test eax, eax
js 0x409483
mov eax, dword [rsp + 0x5c]
cmp ax, 0xffff
je 0x4093d9
cmp r13w, ax
cmova r13d, eax
cmp r12w, ax
cmovb r12d, eax
inc word [rsp + 0x58]
jmp 0x4092d2
mov eax, 0xffffd8d7
jmp 0x409483
movzx eax, r12w
movzx edx, r13w
inc r12d
sub eax, edx
cmp eax, 0x7fff
jle 0x409405
lea r12d, [r13 + 1]
cmp si, 0xffff
mov word [rbx + 0x76], r12w
jne 0x409474
lea rax, [rsp + 0x5c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx + 0x68], 0
mov dword [rbx + 0x70], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov qword [rsp + 0x40], rax
lea rax, [0x00408c95]
mov qword [rsp + 0x28], rax
call fcn.00408e77
cmp eax, 0xffffd8a8
jne 0x409483
xor eax, eax
jmp 0x409483
movzx edx, si
mov rcx, rbx
call fcn.0040919d
test eax, eax
jns 0x409410
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x416400
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x004f47e4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x416520
mov rax, qword [0x004f47e8]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x41644c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x416506
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x416430
mov rcx, rsi
call fcn.00417040
test rax, rax
mov r12, rax
je 0x416558
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x004f47e8]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.00417190
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x004f47e8]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x41653b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4164ff
sub eax, 0x40
and eax, 0xffffffbf
je 0x4164ff
add rbx, qword [0x004f47e8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x416527
add dword [0x004f47e4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x416457
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00416390
mov rax, qword [0x004f47e8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00416390
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00416390
nop
nop dword [rax + rax]

Function at 0x416cb0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004f4ac0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004f4aa0]
test rbx, rbx
je 0x416d04
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x416cfb
test rsi, rsi
je 0x416cfb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x416ce0
lea rcx, [0x004f4ac0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]