joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140122a00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140194080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140122a95
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x140122af6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400fcf50
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140136d30
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140122bb1
sub ecx, 1
je 0x140122c24
sub ecx, 1
je 0x140122b60
cmp ecx, 1
je 0x140122b43
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14016bc84]
call fcn.1400fcf50
jmp 0x140122c24
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140122730
test eax, eax
je 0x140122c24
jmp 0x140122aca
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140122c24
sub rax, rsi
cmp rax, rbp
jae 0x140122c24
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400fd0d0
jmp 0x140122c24
cmp r8d, 4
jle 0x140122c24
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140122c24
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400fce70
mov esi, eax
test eax, eax
je 0x140122c03
mov edx, 5
mov rcx, rbx
call fcn.1401236f0
mov eax, esi
jmp 0x140122aca
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14010b950
mov rcx, r14
call fcn.14010bc30
test eax, eax
je 0x140122ac8
mov edx, 5
mov rcx, rbx
call fcn.1401236f0
mov eax, Ordinal_46
jmp 0x140122aca
Function at 0x1401359c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140135a02
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140135a49
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140135aa2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140135a60
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140135ae3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140166422]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140166423]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140135ab0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140135b90
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140135bca
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140135bcf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140135c18
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140135c18
dec r8
sub rdx, 1
jne 0x140135bfe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14013736c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401373b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401373b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401373b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401373b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1401373b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401373b8
xor al, al
add rsp, 0x28
ret
Function at 0x140001670
Capabilities:
Execute command

Disassembly:
sub rsp, 0x48
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x20
call fcn.140002120
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400045e0]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.Opening_CS2_through_Steam...]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140004420]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140004428]
mov dword [rax + 0x18], ecx
mov byte [rax + 0x1c], 0
lea rcx, [rsp + 0x20]
call fcn.1400011c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001711
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000170c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000170c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000215c
lea rcx, str.start_steam:__rungameid_730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov ecx, 0x20
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
test eax, eax
jne 0x1400017c1
call fcn.140002120
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400045d0]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.The_launch_was_a_success]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140004460]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
lea rcx, [rsp + 0x20]
call fcn.1400011c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001860
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000185b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000185b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002120
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x1400045f0]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.Failed_to_launch_Steam_or_game.]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140004480]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140004488]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14000448c]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x14000448e]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
lea rcx, [rsp + 0x20]
call fcn.1400011c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001860
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000185b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000185b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000215c
add rsp, 0x48
ret
Function at 0x140002a80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002aca
mov ecx, __p__commode
cmp word [rax], cx
jne 0x140002aca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002aca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002aca
cmp dword [rcx + 0x84], 0xe
jbe 0x140002aca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002acc
xor al, al
add rsp, 0x28
ret
Function at 0x401bc0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov eax, 1
xchg byte [0x00ef4aa0], al
test al, al
je 0x401bdf
lea rcx, [0x00ef4aa0]
call fcn.00438ce0
movzx eax, byte [0x00ef4aa1]
test al, al
je 0x401c00
mov byte [0x00ef4aa0], 0
add rsp, 0x58
ret
lea rdx, [0x00f75ae8]
lea rcx, [0x00f75b10]
mov rax, rdx
mov byte [rax], 0
add rax, 1
cmp rax, rcx
jne 0x401c11
lea rax, [0x00f75ae8]
xor ecx, ecx
pxor xmm0, xmm0
mov qword [0x00f75ae8], rax
mov qword [0x00f75af0], rax
lea rax, [0x00ef4ae0]
mov r8, rax
add rcx, 1
movaps xmmword [r8], xmm0
add r8, 0x10
cmp rcx, 0x4000
jne 0x401c42
mov byte [0x00f34ae0], 0
xor ecx, ecx
pxor xmm0, xmm0
add rcx, 1
movaps xmmword [rax + 0x40040], xmm0
add rax, 0x10
cmp rcx, 0xd8
jne 0x401c64
lea rax, [0x00f358a0]
mov byte [rax], 0
add rax, 1
cmp rax, rdx
jne 0x401c83
mov rax, qword [0x006bca98]
test rax, rax
jne 0x401cb1
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x006bca98], rax
mov qword [0x00f358a0], rax
lea rax, [0x00f358b0]
mov qword [0x00f358a8], rax
mov byte [0x00ef4aa1], 1
mov byte [0x00ef4aa0], 0
add rsp, 0x58
ret
Function at 0x408630
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
mov rbx, r9
je 0x4086e5
lea rax, [rsp + 0x40]
test rsi, rsi
cmove rsi, rax
test r9, r9
lea rax, [rsp + 0x48]
mov dword [rsi], 0
cmove rbx, rax
lea rax, [rcx - 1]
mov qword [rbx], 0
cmp rax, 1
ja 0x4086a9
cmp rcx, 1
mov qword [rsp + 0x38], r8
sete cl
mov qword [rsp + 0x30], rdx
movzx ecx, cl
sub ecx, 0xc
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov rdx, qword [rsp + 0x30]
test rax, rax
mov rcx, rax
mov r8, qword [rsp + 0x38]
je 0x408710
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x4086d4
mov eax, dword [rsp + 0x44]
mov qword [rbx], rax
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsi], eax
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
ret
lea r8, str.__fd_____fd_t__1_______0_
xor r9d, r9d
mov edx, 0x2586
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406910
nop dword [rax]
mov dword [rsi], 6
xor eax, eax
jmp 0x4086cd

Function at 0x40b380
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, 1
mov rsi, qword [rcx]
mov rbx, rcx
mov rdi, rdx
xchg byte [rsi], al
test al, al
je 0x40b3ad
mov rcx, rsi
mov qword [rsp + 0x38], r8
call fcn.00438ce0
mov r8, qword [rsp + 0x38]
mov rax, qword [rbx]
movzx r9d, byte [rax]
cmp r9, 1
jne 0x40b410
mov rcx, qword [rbx + 8]
lea rax, [rcx - 1]
cmp rax, 1
jbe 0x40b3de
mov rcx, rbx
mov qword [rsp + 0x38], r8
call fcn.0040beb0
mov rcx, qword [rbx + 8]
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rdi
call fcn.00408630
test al, al
jne 0x40b3ff
mov rcx, rdi
call qword [sym.imp.kernel32.dll_OutputDebugStringA]
mov byte [rsi], 0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov qword [rsp + 0x20], 1
lea r8, str.__atomic_load_state___memory_order_relaxed_______1__
mov edx, 0x2b
lea rcx, str....._sanitizer_common_sanitizer_mutex.h
call fcn.00406910
nop
nop word cs:[rax + rax]
Function at 0x40d630
Capabilities:
Get system information on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, qword [0x00659da0]
mov rsi, rcx
lea rcx, [rax - 1]
test rax, rcx
jne 0x40d704
lea rbx, [rdx + rcx]
neg rax
mov rdx, qword [rsi]
and rbx, rax
mov rax, qword [rsi + 8]
sub rdx, rax
cmp rdx, rbx
jge 0x40d6cb
mov rax, qword [0x006bca98]
test rax, rax
je 0x40d710
lea rdi, [rax - 1]
test rdi, rax
jne 0x40d704
lea rdx, str.Allocate
neg rax
add rdi, rbx
and rdi, rax
mov rcx, rdi
call fcn.0040d510
mov r8, qword [0x00ee7270]
lea rdx, [rax + rdi]
mov qword [rsi + 8], rax
mov qword [rsi], rdx
test r8, r8
je 0x40d6c3
mov rdx, rdi
mov rcx, rax
call r8
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rdx, rax
cmp rbx, rdx
jg 0x40d6e0
add rbx, rax
mov qword [rsi + 8], rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea r8, str.__allocated_end____allocated_current_____sptr_size______0_
xor r9d, r9d
mov edx, 0x1b33
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406910
call fcn.0040b440
nop dword [rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov qword [0x006bca98], rax
jmp 0x40d677
Function at 0x40e8b0
Capabilities:
Get system information on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbx, qword [0x006bca98]
mov r12, qword [rsp + 0xf0]
test rbx, rbx
mov qword [rsp + 0xd0], rcx
mov rbp, rdx
mov rsi, r9
mov qword [rsp + 0xe0], r8
je 0x40eab0
mov r13, qword [sym.imp.kernel32.dll_ReadFile]
lea r14, [rsp + 0x50]
cmp r12, rbx
cmovbe rbx, r12
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rbp]
mov rdx, qword [rax]
call fcn.0040e770
xor ecx, ecx
mov r9d, 4
mov rdx, rbx
mov r8d, 0x3000
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x40eb37
mov qword [rbp], rax
mov rax, qword [rsp + 0xe0]
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.kernel32.dll_CreateFileA]
cmp rax, 1
mov rdi, rax
je 0x40ead0
cmp rax, 2
je 0x40eaf4
cmp qword [rsp + 0xf8], 0
setne r15b
cmp rax, 0xffffffffffffffff
sete al
test al, r15b
jne 0x40ea61
cmp rdi, 0xffffffffffffffff
je 0x40ea71
mov qword [rsi], 0
xor ecx, ecx
jmp 0x40e9eb
test eax, eax
mov r8d, dword [rsp + 0x50]
je 0x40ea2c
mov rcx, r8
add rcx, qword [rsi]
cmp r12, rcx
mov qword [rsi], rcx
sete dl
test r8, r8
sete al
or al, dl
jne 0x40eb20
cmp rbx, rcx
jbe 0x40ea90
mov r8d, ebx
mov rdx, rcx
mov r9, r14
add rdx, qword [rbp]
mov qword [rsp + 0x20], 0
sub r8d, ecx
mov rcx, rdi
call r13
test eax, eax
jne 0x40e9c5
test r15b, r15b
je 0x40e9c5
call qword [sym.imp.kernel32.dll_GetLastError]
mov rsi, qword [rsp + 0xf8]
mov dword [rsi], eax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rbp]
mov rdx, qword [rax]
call fcn.0040e770
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
xor edx, edx
mov eax, edx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov rdi, qword [rsp + 0xf8]
mov dword [rdi], eax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rbp]
mov rdx, qword [rax]
call fcn.0040e770
xor edx, edx
jmp 0x40ea4b
add rbx, rbx
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp r12, rbx
cmovbe rbx, r12
jmp 0x40e904
lea rcx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ebx, dword [rsp + 0x54]
mov qword [0x006bca98], rbx
jmp 0x40e8f1
lea r8, str.__res_____fd_t_1_____fd_t_1_____fd_t__1_______0_
xor r9d, r9d
mov edx, 0x2564
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406910
lea r8, str.__res_____fd_t_2_____fd_t_2_____fd_t__1_______0_
xor r9d, r9d
mov edx, 0x2565
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406910
nop dword [rax + rax]
mov byte [rsp + 0x4f], al
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
movzx edx, byte [rsp + 0x4f]
jmp 0x40ea4b
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsp + 0x20], 0
lea r8, str.allocate
mov rcx, rbx
lea rdx, str.ReadFileToBuffer
mov r9d, eax
call fcn.0040d470
nop
nop
Function at 0x40eb60
Capabilities:
Get system information on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rax, qword [0x006bca98]
test rax, rax
mov rbx, rcx
mov rsi, rdx
mov ebp, r8d
lea r9, [rsp + 0x60]
je 0x40ec96
lea rcx, [rsp + 0x4c]
cmp rax, 0x7fff
mov edx, 0x8000
mov qword [rsp + 0x50], 0
cmovbe rax, rdx
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x58], 0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], 0
lea r8, [rsp + 0x58]
call fcn.0040e8b0
test al, al
mov edi, eax
jne 0x40ebf1
test bpl, bpl
je 0x40ecb9
mov edi, 1
jmp 0x40ec84
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x40ec7a
movabs r13, 0x400100100002600
mov r12, qword [rbx + 0x10]
xor eax, eax
mov qword [rbx + 0x10], rcx
mov rbp, qword [rbx + 0x18]
mov qword [rbx + 0x18], 0
nop dword [rax + rax]
movzx edx, byte [rcx + rax]
cmp dl, 0x3a
jbe 0x40ec45
mov rdx, rsi
mov rcx, rbx
call fcn.0040db10
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
movzx edx, byte [rcx + rax]
cmp dl, 0x3a
ja 0x40ec29
bt r13, rdx
jae 0x40ec55
add rax, 1
mov qword [rbx + 0x18], rax
jmp 0x40ec20
test dl, dl
jne 0x40ec29
mov eax, dword [0x006bc9a4]
test eax, eax
jg 0x40ec6d
mov dword [0x006bc9a4], 1
mov rcx, qword [rsp + 0x50]
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], rbp
mov rdx, qword [rsp + 0x58]
call fcn.0040e770
mov eax, edi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, r9
mov qword [rsp + 0x38], r9
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x64]
mov r9, qword [rsp + 0x38]
mov qword [0x006bca98], rax
jmp 0x40eb8d
mov r8d, dword [rsp + 0x4c]
lea rcx, str.Failed_to_read_options_from__s:_error__d_n
mov rdx, rsi
call fcn.0040c3a0
jmp 0x40ec84
Function at 0x452c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x452dab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree_1]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0046dcc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x452c6e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x452c81
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x452ca5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x452cb9
cmp rbx, 0x1000
jae 0x452c78
nop
jmp 0x452d29
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x452ccd
xor edx, edx
jmp 0x452d20
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree_1]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0046dcc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x452caf
jmp 0x452c95
call fcn.0049d640
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004720c0
lea rax, [0x00547734]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.004729c0
mov rax, qword [rsp + 0x38]
call fcn.004726c0
lea rax, [0x005477dc]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004729c0
mov rax, qword [rsp + 0x30]
call fcn.004726c0
call fcn.00472320
call fcn.00472140
lea rax, [0x0054a15e]
mov ebx, 0x21
call fcn.00470920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00499460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00452c00
Function at 0x452de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45300a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc_1]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0046dd40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x452e5b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x452e6e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x452e90
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x452ea4
cmp rbx, 0x1000
jae 0x452e65
jmp 0x452f2e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x452eb6
xor esi, esi
jmp 0x452f20
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc_1]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0046dd40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x452e9a
jmp 0x452e82
call fcn.0049d640
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x452fa9
call fcn.004720c0
lea rax, [0x00547d54]
mov ebx, 0x19
call fcn.004729c0
mov rax, qword [rsp + 0x68]
call fcn.004726c0
lea rax, [0x005477dc]
mov ebx, 0x19
nop
call fcn.004729c0
mov eax, dword [rsp + 0x34]
call fcn.004726c0
call fcn.00472320
call fcn.00472140
lea rax, [0x00543c86]
mov ebx, 0xd
call fcn.00470920
cmp eax, 0x5af
je 0x452f53
call fcn.004720c0
lea rax, [0x00547d54]
mov ebx, 0x19
call fcn.004729c0
mov rax, qword [rsp + 0x38]
call fcn.004726c0
lea rax, [0x005477dc]
mov ebx, 0x19
nop dword [rax]
call fcn.004729c0
mov eax, dword [rsp + 0x34]
call fcn.004726c0
call fcn.00472320
call fcn.00472140
lea rax, [0x005499eb]
mov ebx, 0x1f
call fcn.00470920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00499460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00452de0
Function at 0x45ad00
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x006b6b70], 0
jne 0x45adef
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x45ade5
lea rbx, [0x00688fd0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x45adc7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0049bb80
lea rax, [0x0054bb84]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00470920
nop
int3