joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410340
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r10d, dword [rcx + 0x18]
mov rbx, r8
mov rsi, rdx
xor edx, edx
mov r8, qword [rcx]
mov eax, dword [rbx + 0x10]
mov rdi, rcx
div r10d
lea rdx, [r8 + rdx*8]
mov rax, qword [rdx]
test rax, rax
jne 0x40cdff
jmp 0x40ce95
mov rdx, rax
mov rax, qword [rax]
test rax, rax
je 0x40ce95
cmp rbx, rax
jne 0x40cdf0
mov rax, qword [rbx]
test rsi, rsi
mov qword [rdx], rax
mov qword [rbx + 8], rsi
je 0x40ce78
movzx ecx, byte [rsi]
lea r9, [rsi + 1]
test ecx, ecx
je 0x40ce61
xor eax, eax
mov edx, ecx
add r9, 1
shl edx, 0x11
add edx, ecx
movzx ecx, byte [r9 - 1]
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
test ecx, ecx
jne 0x40ce20
sub r9, rsi
sub r9d, 1
mov edx, r9d
shl edx, 0x11
add edx, r9d
add eax, edx
xor edx, edx
mov ecx, eax
shr ecx, 2
xor ecx, eax
mov eax, ecx
div r10d
lea r8, [r8 + rdx*8]
mov rax, qword [r8]
mov dword [rbx + 0x10], ecx
mov qword [rbx], rax
mov qword [r8], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, str..._.._.._src_binutils_2.32_bfd_hash.c
mov edx, 0x1b6
call fcn.00408d80
mov r10d, dword [rdi + 0x18]
mov r8, qword [rdi]
jmp 0x40ce13
lea r8, str.bfd_hash_rename
mov edx, 0x244
lea rcx, str..._.._.._src_binutils_2.32_bfd_hash.c
call fcn.00408da0
nop
nop
mov rax, rdx
add rcx, 0x60
mov rdx, r8
mov qword [rax], r8
lea r8, [rax - 0x18]
jmp 0x40cdc0

Function at 0x411a10
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x411a58
lea rdx, str.default
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x411a70
test rsi, rsi
je 0x411a90
and byte [rsi + 0x43], 0xfb
mov rcx, rbx
call fcn.00411870
test rax, rax
je 0x411a4e
mov qword [rsi + 8], rax
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
test rax, rax
mov rbx, rax
jne 0x411a21
nop dword [rax]
mov rax, qword [0x004c1970]
test rax, rax
je 0x411aa0
test rsi, rsi
je 0x411a4e
or byte [rsi + 0x43], 4
mov qword [rsi + 8], rax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00411870
mov rax, qword [0x004c1980]
mov rax, qword [rax]
jmp 0x411a7c
Function at 0x447b70
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movzx edx, byte [rcx]
lea r8, [rcx + 1]
test dl, dl
je 0x447b96
mov ecx, eax
add r8, 1
shl ecx, 5
add eax, ecx
add eax, edx
movzx edx, byte [r8 - 1]
test dl, dl
jne 0x447b80
ret
Function at 0x46b700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, r8
mov r8, qword [r9 + 8]
mov r11, rcx
mov r10, rdx
mov ecx, dword [r9 + 0x40]
mov rdx, qword [rsp + 0x60]
mov rax, qword [r8 + 8]
shr rax, cl
test eax, eax
je 0x46b810
mov eax, eax
cmp rax, qword [r9 + 0x28]
jb 0x46b7b0
sub rax, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x38]
mov r9, qword [rcx + rax*8]
test r9, r9
jne 0x46b754
jmp 0x46b7fb
mov r9, qword [r9 + 0x28]
movzx eax, byte [r9 + 0x18]
sub eax, 6
cmp al, 1
jbe 0x46b750
movzx ecx, byte [r9 + 0x5d]
or byte [r9 + 0x5c], 0x20
test cl, 0x20
je 0x46b786
mov rax, r9
nop word [rax + rax]
mov rax, qword [rax + 0x68]
test byte [rax + 0x5d], 0x20
jne 0x46b778
or byte [rax + 0x5c], 0x20
test rdx, rdx
je 0x46b7f0
and ecx, 0x10
je 0x46b7f0
mov rcx, qword [r9 + 0x78]
movzx eax, byte [rcx + 0x24]
shr al, 3
xor eax, 1
and eax, 1
mov dword [rdx], eax
mov rax, rcx
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rax
shl rcx, 5
add rcx, qword [r9 + 0x18]
movzx esi, byte [rcx + 0x14]
shr sil, 4
test sil, sil
jne 0x46b733
mov qword [rsp + 0x60], rcx
xor r9d, r9d
mov rdx, r11
mov rcx, r10
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp rax
mov qword [rsp + 0x60], 0
jmp 0x46b7d4
mov rax, qword [r11 + 0x20]
lea rcx, str._F_P:_corrupt_input:__pB_n
mov rdx, qword [r10 + 0xf0]
call qword [rax + 0x58]
xor ecx, ecx
jmp 0x46b7a3
Function at 0x46b820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
or byte [rdx + 0x24], 8
mov rbx, rdx
mov rdx, qword [rdx + 0xe0]
mov rsi, rcx
mov rdi, r8
mov rdx, qword [rdx + 0xc0]
test rdx, rdx
je 0x46b85b
test byte [rdx + 0x24], 8
je 0x46b9d0
mov rax, qword [rbx + 0xf0]
test byte [rbx + 0x20], 4
mov rax, qword [rax + 0xf0]
mov rbp, qword [rax + 0x350]
je 0x46b948
mov eax, dword [rbx + 0x88]
test eax, eax
je 0x46b948
cmp rbx, rbp
je 0x46b9a0
lea r13, [rsp + 0x40]
mov r8, rbx
mov rdx, rsi
mov rcx, r13
call fcn.0045f2c0
test eax, eax
je 0x46b9cb
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
cmp r12, r14
jb 0x46b8d2
jmp 0x46ba90
add r12, 0x18
cmp r12, r14
mov qword [rsp + 0x48], r12
jae 0x46ba90
mov r9, r13
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.0046bab0
test eax, eax
jne 0x46b8c0
xor r13d, r13d
xor r12d, r12d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x46b914
mov rdx, qword [rbx + 0xe0]
cmp rcx, qword [rdx + 0x98]
je 0x46b914
mov dword [rsp + 0x3c], eax
call fcn.004c02e0
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x46b95a
mov rdx, qword [rbx + 0xf0]
mov rdx, qword [rdx + 0xf0]
cmp rcx, qword [rdx + 0xa8]
je 0x46b95a
mov dword [rsp + 0x3c], eax
call fcn.004c02e0
mov eax, dword [rsp + 0x3c]
jmp 0x46b95a
test rbp, rbp
mov r12d, 1
mov eax, 1
setne r13b
mov rdx, qword [rbx + 0xe0]
test r13b, r13b
mov rcx, rdx
jne 0x46b9a7
mov rdx, qword [rcx + 0xd0]
test rdx, rdx
je 0x46b985
test r12b, r12b
je 0x46b985
test byte [rdx + 0x24], 8
mov eax, 1
je 0x46b9f0
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [rbx + 0xe0]
cmp qword [rdx + 0xc8], 0
mov rcx, rdx
je 0x46b9e0
lea r12, [rsp + 0x40]
mov r8, rbp
mov rdx, rsi
mov rcx, r12
call fcn.0045f2c0
test eax, eax
jne 0x46ba08
xor eax, eax
jmp 0x46b985
call fcn.0046b820
test eax, eax
jne 0x46b85b
jmp 0x46b9cb
mov r12d, 1
mov eax, 1
jmp 0x46b969
mov r8, rdi
mov rcx, rsi
call fcn.0046b820
test eax, eax
setne al
movzx eax, al
jmp 0x46b985
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov r9, rdi
mov r8, rbp
mov rdx, rbx
call fcn.00470f80
mov rcx, qword [rsp + 0x40]
test eax, eax
setne al
setne r12b
movzx eax, al
test rcx, rcx
je 0x46ba51
mov rdx, qword [rbp + 0xe0]
cmp rcx, qword [rdx + 0x98]
je 0x46ba51
mov dword [rsp + 0x3c], eax
call fcn.004c02e0
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x46ba7f
mov rdx, qword [rbp + 0xf0]
mov rdx, qword [rdx + 0xf0]
cmp rcx, qword [rdx + 0xa8]
je 0x46ba7f
mov dword [rsp + 0x3c], eax
call fcn.004c02e0
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rbx + 0xe0]
jmp 0x46b969
test rbp, rbp
mov r12d, 1
mov eax, 1
setne r13b
jmp 0x46b8ed
Function at 0x48a080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov rax, qword [rax + 0x368]
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
lea rcx, [rdx + 0x10]
movzx ebp, byte [rax + 0x38d]
mov rax, qword [rdx]
and ebp, 1
mov qword [r8], rax
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
lea rcx, [rbx + 0x12]
mov word [rsi + 0x30], ax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
lea rcx, [rbx + 0x14]
mov word [rsi + 0x32], ax
mov rax, qword [rdi + 8]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x18]
test bpl, bpl
mov dword [rsi + 0x28], eax
mov rax, qword [rdi + 8]
je 0x48a1b0
call qword [rax + 0x88]
mov qword [rsi + 0x10], rax
mov rax, qword [rdi + 8]
lea rcx, [rbx + 0x1c]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x20]
mov qword [rsi + 0x18], rax
mov rax, qword [rdi + 8]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x24]
mov qword [rsi + 0x20], rax
mov rax, qword [rdi + 8]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x28]
mov dword [rsi + 0x2c], eax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
lea rcx, [rbx + 0x2a]
mov dword [rsi + 0x34], eax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
lea rcx, [rbx + 0x2c]
mov dword [rsi + 0x38], eax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
lea rcx, [rbx + 0x2e]
mov dword [rsi + 0x3c], eax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
lea rcx, [rbx + 0x30]
mov dword [rsi + 0x40], eax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
lea rcx, [rbx + 0x32]
mov dword [rsi + 0x44], eax
mov rax, qword [rdi + 8]
call qword [rax + 0x98]
mov dword [rsi + 0x48], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [rax + pe_nt_image_headers64]
jmp 0x48a100

Function at 0x4921e0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8d, 1
mov rdx, rcx
lea rcx, [0x00511880]
jmp fcn.0040cc20
Function at 0x492d50
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov eax, dword [rcx + 0x44]
mov ebp, dword [rcx + 0x40]
test eax, eax
mov rsi, rcx
mov rdi, rdx
movd xmm6, r8d
mov ebx, r9d
jne 0x492e68
xor r13d, r13d
test ebp, ebp
je 0x492db0
mov r9d, ebp
xor r13d, r13d
add r9, rdx
nop
movzx ecx, byte [rdx]
add rdx, 1
mov eax, ecx
shl eax, 0x11
add eax, ecx
add eax, r13d
mov r13d, eax
shr r13d, 2
xor r13d, eax
cmp rdx, r9
jne 0x492d90
xor edx, edx
mov eax, r13d
div dword [rsi + 0x18]
mov rax, qword [rsi]
mov r12, qword [rax + rdx*8]
test r12, r12
je 0x492e20
mov r14d, ebp
jmp 0x492dd9
mov r12, qword [r12]
test r12, r12
je 0x492e20
cmp dword [r12 + 0x10], r13d
jne 0x492dd0
cmp dword [r12 + 0x18], ebp
jne 0x492dd0
mov rcx, qword [r12 + 8]
mov r8, r14
mov rdx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x492dd0
movd eax, xmm6
cmp dword [r12 + 0x1c], eax
jae 0x492e4a
test ebx, ebx
je 0x492f73
mov qword [r12 + 0x18], 0
jmp 0x492e27
xor r12d, r12d
test ebx, ebx
je 0x492e4a
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call fcn.0040ca80
test rax, rax
mov r12, rax
je 0x492e4a
movd xmm0, ebp
punpckldq xmm0, xmm6
movq qword [rax + 0x18], xmm0
movaps xmm6, xmmword [rsp + 0x20]
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp ebp, 1
je 0x492f12
lea r12d, [rbp - 1]
mov r9d, ebp
xor r11d, r11d
add r12, 1
add r9, rdx
xor ecx, ecx
test ebp, ebp
je 0x492ef0
mov r10, rdx
xor r11d, r11d
xor ecx, ecx
mov rdx, r10
xor eax, eax
jmp 0x492eab
add eax, 1
add rdx, 1
cmp eax, ebp
je 0x492ef0
cmp byte [rdx], 0
je 0x492ea0
cmp eax, ebp
je 0x492ef0
mov rdx, r10
nop word [rax + rax]
movzx r13d, byte [rdx]
add rdx, 1
mov eax, r13d
shl eax, 0x11
add eax, r13d
add eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, eax
cmp rdx, r9
jne 0x492ec0
add r10, r12
add r11d, 1
add r9, r12
jmp 0x492e90
mov eax, r11d
shl eax, 0x11
add eax, r11d
add r11d, 1
add eax, ecx
imul ebp, r11d
mov r13d, eax
shr r13d, 2
xor r13d, eax
jmp 0x492db0
movzx r13d, byte [rdx]
lea r8, [rdx + 1]
test r13d, r13d
je 0x492db0
mov rdx, r8
xor eax, eax
nop dword [rax + rax]
mov ecx, r13d
shl ecx, 0x11
add ecx, r13d
add eax, ecx
mov ecx, eax
shr ecx, 2
xor eax, ecx
mov rcx, rdx
movzx r13d, byte [rdx]
add rdx, 1
test r13d, r13d
jne 0x492f30
sub ecx, r8d
lea ebp, [rcx + 1]
mov edx, ebp
shl edx, 0x11
add edx, ebp
add ebp, 1
add eax, edx
mov r13d, eax
shr r13d, 2
xor r13d, eax
jmp 0x492db0
xor r12d, r12d
jmp 0x492e4a
Function at 0x4b01f0
Capabilities:
Query environment variable

Disassembly:
mov r9d, 1
jmp fcn.004afc40

Function at 0x4b0240
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x00511910]
test rax, rax
je 0x4b0260
add rsp, 0x28
pop rbx
pop rsi
ret
xor edx, edx
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rsi
test eax, eax
mov ebx, eax
jne 0x4b0290
mov rax, qword [0x00511910]
test rax, rax
je 0x4b02c0
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, eax
call fcn.004b1090
mov ecx, ebx
mov rdx, rax
mov qword [0x00511910], rax
call rsi
test eax, eax
jne 0x4b0273
mov rcx, qword [0x00511910]
call fcn.004c02e0
mov qword [0x00511910], 0
lea rcx, [0x004ff1f8]
call fcn.004b1160
mov qword [0x00511910], rax
jmp 0x4b0252

Function at 0x4b16f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004bfbf0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.004bfbf0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x4b1760
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00511a04]
test esi, esi
mov rbx, rcx
jle 0x4b1890
mov rax, qword [0x00511a08]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x4b17ab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x4b1835
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x4b1790
mov rcx, rbx
call fcn.004b21e0
test rax, rax
mov rdi, rax
je 0x4b18b2
mov rax, qword [0x00511a08]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.004b2320
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x00511a08]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4b1897
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4b182e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x4b1840
add dword [0x00511a04], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x00511a08]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4b182e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004b16f0
nop dword [rax]
xor esi, esi
jmp 0x4b17b8
mov rax, qword [0x00511a08]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.004b16f0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004b16f0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x4b1e50
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x00511a60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00511a40]
test rbx, rbx
je 0x4b1eac
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x4b1ea3
test eax, eax
jne 0x4b1ea3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4b1e88
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4b21e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00500360]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x4b2200
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x4b2208
ret
cmp word [r8 + 0x18], 0x20b
jne 0x4b2200
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x4b225d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4b2254
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4b2200
add rax, 0x28
cmp rax, r9
jne 0x4b2240
xor eax, eax
ret

Function at 0x4b2260
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00500360]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x4b227f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4b2288
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x4b227f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x4b2320
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00500360]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x4b233f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x4b2348
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x4b2500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x4b2640
cmp byte [rbx], 0
je 0x4b2608
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4b2650
test al, 0x10
je 0x4b2608
lea rdi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
call sub.msvcrt.dll__fullpath
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rcx, [rax + 0x24b]
mov rsi, rax
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x4b265f
lea rbp, [rsi + 1]
mov rdx, rdi
lea rcx, [rax + 0x244]
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov rcx, rax
je 0x4b25b0
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x5c
je 0x4b25b0
cmp al, 0x2f
jne 0x4b2628
lea rdx, [rbx + 0x130]
mov eax, 0x2a
mov word [rcx + rsi], ax
mov rdi, rdx
xor eax, eax
mov ecx, 0x20
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov qword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov rax, rbx
mov dword [rdi], 0
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 0x5c
mov word [rcx + rsi], dx
mov rsi, rbp
jmp 0x4b25b0
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 0xe
jmp 0x4b2615
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x4b2615
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 0xc
jmp 0x4b2615

Function at 0x4b2f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov ebx, edx
je 0x4b2fd0
cmp edx, 7
ja 0x4b2fd0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4b2fdd
xor edx, edx
test al, 0x10
jne 0x4b2fad
test al, 1
je 0x4b2fad
and ebx, 2
mov edx, ebx
jne 0x4b2fba
mov eax, edx
add rsp, 0x20
pop rbx
ret
cmp eax, 5
jne 0x4b2fd0
call sub.msvcrt.dll__errno
mov dword [rax], 0xd
or edx, 0xffffffff
jmp 0x4b2fad
call sub.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x4b2fc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
ja 0x4b2fb5
cmp eax, 1
jbe 0x4b2fd0
call sub.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x4b2fc5
Function at 0x14000b040
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
mov rbx, rdx
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 0x11]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x28]
mov rdx, r9
shr rdx, 0x20
xor rdx, r9
and rdx, rcx
cmp qword [r10 + 0x30], rdx
ja 0x14000b0b8
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
mov rcx, qword [r10 + 0x10]
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x14000b0ec
cmp qword [rcx], r8
jne 0x14000b0e2
mov rax, qword [r10]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x10]
mov rax, qword [r10]
mov qword [rdx + rcx + 8], rax
jmp 0x14000b0f7
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14000b0f7
cmp qword [rcx], r8
jne 0x14000b0fc
mov rax, qword [r8]
mov qword [rcx], rax
mov r8, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, r10
call fcn.14000b530
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b5c0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [rcx + 0x28]
imul r8, r9
xor r8, rax
imul r8, r9
mov rax, r8
shr rax, 0x20
xor rax, r8
and rax, rdx
cmp qword [rcx + 0x30], rax
ja 0x14000b650
shr rdx, 1
or rcx, 0xffffffffffffffff
sub rcx, rdx
add rax, rcx
ret
Function at 0x14000bf70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
mov r11, r8
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 1]
mov rsi, rdx
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x28]
mov r8, r9
shr r8, 0x20
xor r8, r9
and r8, rcx
cmp qword [r10 + 0x30], r8
ja 0x14000bff2
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov rcx, qword [r10 + 0x10]
mov rbx, qword [r10]
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x14000c040
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14000c040
mov ecx, dword [r11]
mov rbx, qword [rbx + 8]
cmp dword [rbx + 0x10], ecx
je 0x14000c026
cmp rbx, rax
jne 0x14000c016
jmp 0x14000c040
mov rdx, rdi
mov rcx, r10
call fcn.14000c530
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14000c0d0
mov rax, qword [rdi]
cmp rbx, rax
je 0x14000c075
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10]
jne 0x14000c092
mov qword [rdx], rdi
mov rax, qword [r10 + 0x10]
mov qword [rax + r8 + 8], rdi
jmp 0x14000c0be
cmp rax, rbx
jne 0x14000c09c
mov qword [rdx], rdi
jmp 0x14000c0be
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14000c0be
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.14000c590
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret