joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0000
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4b0017
inc rax
cmp rax, 4
jge 0x4b002f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4b0014
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4b0040
inc rax
cmp rax, 4
jge 0x4b004e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4b0077
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4b005b
jmp 0x4b003d

Function at 0x4be7e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4be92e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x005e3ad0]
call fcn.004b0280
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004be940]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.004038e0
xorps xmm15, xmm15
mov r14, qword [0x0063ee08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4be8f2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4be928
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4be91d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00464f60
call fcn.00464ee0
nop
call fcn.00462c20
jmp fcn.004be7e0
Function at 0x4da0c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4da309
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x4da2f4
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x4da102
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x4da11c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.004ccb00
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4da231
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.0047acc0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0053e3c8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e940
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004038e0
xorps xmm15, xmm15
mov r14, qword [0x0063ee08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4da1fb
xor eax, eax
lea rbx, [0x005117bc]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005117f4]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044ea00
jmp 0x4da228
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0053e3f8]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e940
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.0047acc0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004038e0
xorps xmm15, xmm15
mov r14, qword [0x0063ee08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4da2be
xor eax, eax
lea rbx, [0x005117bc]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005117f4]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044ea00
jmp 0x4da2eb
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0053e3f8]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e940
add rsp, 0xa8
pop rbp
ret
lea rax, [0x00511ab7]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00462c20
mov rax, qword [rsp + 8]
jmp fcn.004da0c0
Function at 0x1400290fc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c6f4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c6f4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002924c
cmp rax, 0xffffffffffffffff
je 0x14002924c
xor edi, edi
test rbp, rbp
jle 0x1400291f7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f008
mov rbx, rax
test rax, rax
jne 0x140029184
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400291ed
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a028
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d3d0
cmp eax, 0xffffffff
je 0x1400291cd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029194
mov edx, r15d
mov ecx, r14d
call fcn.14001a028
jmp 0x1400291ed
cmp byte [rsi + 0x38], dil
je 0x1400291e4
cmp dword [rsi + 0x34], 5
jne 0x1400291e4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400291ed
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001adbc
jmp 0x140029260
jns 0x140029260
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c6f4
cmp rax, 0xffffffffffffffff
jne 0x140029218
cmp byte [rsi + 0x30], dil
je 0x140029260
mov edi, dword [rsi + 0x2c]
jmp 0x140029260
mov ecx, r14d
call fcn.1400184e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029260
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029260
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029259
mov eax, dword [rsi + 0x2c]
jmp 0x14002925e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c6f4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400021e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000222a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000222a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000222a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000222a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000222a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000222c
xor al, al
add rsp, 0x28
ret
Function at 0x401465
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x0040cb90]
mov dword [rax], 1
mov rax, qword [0x0040cba0]
mov dword [rax], 1
mov rax, qword [0x0040cbb0]
mov dword [rax], 1
mov rax, qword [0x0040cb80]
mov dword [rax], 1
mov rax, qword [0x0040ca00]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x4014c3
mov eax, 0
jmp 0x401570
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x4014ef
mov eax, 0
jmp 0x401570
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x401515
cmp eax, 0x20b
je 0x40153c
jmp 0x40156b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x401528
mov eax, 0
jmp 0x401570
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x401570
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x401557
mov eax, 0
jmp 0x401570
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x401570
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x401810
Capabilities:
Delete file

Disassembly:
sub rsp, 0x88
mov rcx, qword [0x004110a0]
test rcx, rcx
je 0x40185a
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor ecx, ecx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
je 0x4018e0
mov rcx, qword [0x004110a0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x004110a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x0041e0c0], 0
jne 0x401870
add rsp, 0x88
ret
lea rax, [0x0040c0a8]
lea rdx, [0x0041e0e0]
mov qword [rsp + 0x40], 0
movq xmm1, rax
movq xmm0, rdx
mov edx, 0x414
mov dword [rsp + 0x48], 3
punpcklqdq xmm0, xmm1
mov word [rsp + 0x60], dx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x50], xmm0
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop
add rsp, 0x88
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x400
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rcx, str.Failed_to_send_CTRL_C_to_child_process.
call sub.msvcrt.dll_puts
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_puts
jmp 0x40183b
Function at 0x401c70
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc38
xor r9d, r9d
mov word [rcx], r9w
movzx eax, word [rdx]
mov rbx, rcx
mov rsi, r8
test ax, ax
je 0x401d68
lea rdi, [rdx + 2]
xor edx, edx
jmp 0x401cc0
test rdx, rdx
je 0x401d48
mov word [rdx], ax
add rdx, 2
movzx eax, word [rdi]
add rdi, 2
test ax, ax
je 0x401d68
cmp ax, 0x25
jne 0x401ca0
test rdx, rdx
je 0x401d80
xor ecx, ecx
lea r12, [rsp + 0x430]
mov word [rdx], cx
lea rdx, str.TEMP
mov rcx, r12
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x401e38
lea rdx, str.PROGRAM
mov rcx, r12
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x401e48
lea rdx, [0x0040c146]
mov rcx, r12
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x401e00
lea rdx, str.TIME
mov rcx, r12
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x401da0
xor eax, eax
add rsp, 0xc38
pop rbx
pop rsi
pop rdi
pop r12
ret
test rsi, rsi
je 0x401d34
mov word [rbx], ax
movzx eax, word [rdi]
sub rsi, 1
add rbx, 2
add rdi, 2
test ax, ax
jne 0x401cc0
xor eax, eax
mov word [rbx], ax
mov eax, 1
add rsp, 0xc38
pop rbx
pop rsi
pop rdi
pop r12
ret
xor r8d, r8d
lea rdx, [rsp + 0x430]
mov word [rsp + 0x430], r8w
jmp 0x401cb0
lea rcx, [rsp + 0x28]
lea r12, [rsp + 0x30]
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r9, qword [rsp + 0x28]
mov rcx, r12
lea r8, str._lld
mov edx, 0x400
call fcn.004017c0
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.00401b70
jmp 0x401df0
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x401de8
xor edx, edx
jmp 0x401cb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r12, [rsp + 0x30]
mov edx, pe_nt_image_headers64
lea r8, [0x0040c14e]
mov rcx, r12
mov r9d, eax
call fcn.004017c0
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.00401b70
jmp 0x401df0
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x401df0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp word [rbx], 0
mov rdx, rsi
mov rcx, qword [rax]
mov rax, rbx
je 0x401e7e
nop dword [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x401e70
movzx r8d, word [rcx]
test r8w, r8w
je 0x401eb3
test rdx, rdx
jne 0x401e99
jmp 0x401ebd
test rdx, rdx
je 0x40a53a
add rcx, 2
mov word [rax], r8w
add rax, 2
sub rdx, 1
movzx r8d, word [rcx]
test r8w, r8w
jne 0x401e90
xor edx, edx
mov word [rax], dx
jmp 0x401df0
jmp 0x40a53a
Function at 0x402fe0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
lea rax, [rbp - 0x28]
mov qword [rbp - 0x58], rax
mov ecx, 2
call fcn.0040a1d0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 0x58]
mov ecx, 2
call fcn.0040a1d0
mov r8, rbx
mov rdx, qword [rbp - 0x30]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x403be6
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x004201c8]
test eax, eax
je 0x403c74
lea rcx, [0x004201a0]
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x004201d0]
mov qword [rbp - 8], rax
jmp 0x403c5b
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x403c4f
cmp qword [rbp - 0x10], 0
je 0x403c4f
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x403c15
lea rcx, [0x004201a0]
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x403c75
nop
add rsp, 0x30
pop rbp
ret

Function at 0x403d80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x403da8
mov eax, 0
jmp 0x403df6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x403dd1
mov eax, 0
jmp 0x403df6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x403df1
mov eax, 0
jmp 0x403df6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x403dfc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x403e7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x403e71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x403e71
mov rax, qword [rbp - 8]
jmp 0x403e8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x403e44
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400180a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400180b0]
mov dword [rax], 1
mov rax, qword [0x1400180c0]
mov dword [rax], 1
mov rax, qword [0x140018090]
mov dword [rax], 1
mov rax, qword [0x140017f10]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x140018080]
mov dword [0x14001d020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140018040]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140018020]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140017ec0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001b93
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword [0x14001d080]
test rax, rax
je 0x140001ba7
call rax
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0xe
mov edx, 1
lea rcx, str.out_of_memory_n
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.fflush
mov ecx, 1
call sym.exit
nop

Function at 0x140004870
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
sub rsp, 0x648
lea rsi, str.upgrader.bin
mov ecx, 0xd
lea rdi, [rsp + 0x2b]
lea r12, [rsp + 0x38]
rep movsb byte [rdi], byte [rsi]
lea r13, [rsp + 0x13c]
mov rdx, r12
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rdx, r12
mov rcx, r13
call sym.strcpy
mov rcx, r13
lea rdx, [rsi - 0xd]
call sym.strcat
lea rcx, [rsp + 0x2b]
lea rdx, [0x1400175cd]
call sym.fopen
mov r12, rax
test rax, rax
je 0x14000493e
mov rcx, r13
lea rdx, [0x1400175d0]
lea rsi, [rsp + 0x240]
call sym.fopen
mov rcx, r12
mov r13, rax
test rax, rax
je 0x140004938
mov r8d, 0x400
mov r9, r12
mov edx, 1
mov rcx, rsi
call sym.fread
mov r8, rax
test rax, rax
je 0x14000492d
mov r9, r13
mov edx, 1
mov rcx, rsi
call sym.fwrite
jmp 0x1400048fd
mov rcx, r12
call sym.fclose
mov rcx, r13
call sym.fclose
nop
add rsp, 0x648
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x14000494c
Capabilities:
Create thread
Get common file path
Read file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x160
lea rsi, str.upgrader.bin
call sym.copyFileToUserTempDirectory
lea r12, [rsp + 0x3e]
mov byte [rsp + 0x5b], 0
movabs rax, 0x3079466e564a3942
mov qword [rsp + 0x4b], rax
lea rdi, [rsp + 0x3e]
mov ecx, 0xd
movabs rdx, 0x34503351384f3438
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x53], rdx
mov rcx, r12
xor edx, edx
mov dword [rsp + 0x38], 0
call qword [sym.imp.msvcrt.dll__access]
lea rdx, [0x1400175cd]
mov rcx, r12
test eax, eax
je 0x1400049e3
lea r13, [rsp + 0x5c]
mov ecx, 0x104
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov rdx, r12
mov rcx, r13
call sym.strcat
lea rdx, [0x1400175cd]
mov rcx, r13
call sym.fopen
xor edx, edx
mov r8d, 2
mov rbx, rax
mov rcx, rax
call sym.fseek
mov rcx, rbx
call sym.ftell
xor r8d, r8d
xor edx, edx
mov rcx, rbx
movsxd r12, eax
call sym.fseek
mov rdx, r12
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, rbx
mov rdx, r12
mov r8d, 1
mov rsi, rax
mov rcx, rax
call sym.fread
mov rcx, rsi
lea r8, [rsp + 0x4b]
mov rdx, r12
mov r9d, 0x11
call sym.XOR
lea r9, [rsp + 0x38]
mov rdx, r12
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add rsp, 0x160
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret

Function at 0x140006130
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x140017fc0]
mov rax, qword [rsi]
test rax, rax
je 0x1400061c0
cmp qword [rax + 0x30], 0
jne 0x1400061e0
lea rbx, [0x140016258]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140006190
cmp qword [rax + 0x30], 0
jne 0x1400061b0
lea rdx, [0x140016258]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140006172
test rax, rax
jne 0x1400061b0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140006180
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140006150
test rax, rax
jne 0x1400061e0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x14000615b
Function at 0x1400061f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140006302
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x1400062da
add rax, 1
cmp rax, 0x6b
je 0x1400062f7
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x1400062d0
cmp edx, 0x6a
je 0x1400062f7
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sym.abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x1400062eb