joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404dafec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404db019
mov qword [rsp + 0x18], rbp
movsx rax, r14w
push rsi
jmp 0x1404db028
push rdi
bswap eax
push r14
mov eax, ecx
mov eax, 0x1450
call fcn.1404471fb
sub rsp, rax
test r14w, sp
rol ah, 0x49
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1440], rax
bsf esi, r13d
sar bpl, cl
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
movsx rsi, r10w
bts rdx, rbx
sal sil, 0xff
sar rax, 6
adc dx, si
shld rcx, r10, 4
bt r14, 0x3f
lea rcx, [0x1400ba940]
and r10d, 0x3f
and dl, r11b
add rbp, r8
cqo
btc r14w, 0xa2
shr dl, 0x6b
mov rsi, r8
mov rax, qword [rcx + rax*8]
xadd r14, rdx
movsx dx, dl
clc
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
stc
test r8b, 0xb8
clc
xor eax, eax
mov qword [rdi], rax
test r13d, ebx
cmp r15b, dl
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404db0d7
jae 0x1404db1d6
lea rbx, [rsp + 0x40]
clc
test rsi, 0x1af4622a
cmp rsi, rbp
jmp 0x1404db0f2
jae 0x1404db14b
mov al, byte [rsi]
jmp 0x1404db0ff
inc rsi
test ax, r14w
cmc
cmp sp, 0x5c05
cmp al, 0xa
jmp 0x1404db113
jne 0x1404db12c
inc dword [rdi + 8]
jmp 0x1404db121
mov byte [rbx], 0xd
jmp 0x1404db129
inc rbx
mov byte [rbx], al
inc rbx
btr ax, bp
rcr ax, 0xc3
lea rax, [rsp + 0x143f]
stc
cmp rbx, rax
jb 0x1404db0ea
and qword [rsp + 0x20], 0
xor al, sil
setp r9b
sbb r9b, 0xcd
lea rax, [rsp + 0x40]
sar r9w, 0x7f
sub ebx, eax
lea r9, [rsp + 0x30]
setne r8b
movzx dx, r15b
mov dl, 0x3c
mov r8d, ebx
cqo
lea rdx, [rsp + 0x40]
movsx cx, al
not ch
mov rcx, r14
jmp 0x1404db190
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404db19d
je 0x1404db1ce
mov eax, dword [rsp + 0x30]
test bpl, bpl
add dword [rdi + 4], eax
test dil, 0xa6
cmp bl, ch
cmp eax, ebx
jmp 0x1404db1ba
jb 0x1404db1d6
cmp rsi, rbp
jb 0x1404db0dd
jmp 0x1404db1d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
btc rcx, 0xd3
mov ecx, edi
mov rcx, qword [rsp + 0x1440]
test r8b, bpl
cmp rbp, 0x6d7f206a
xor rcx, rsp
jmp 0x1404db1fa
call fcn.14049e6a7
lea r11, [rsp + 0x1450]
setae sil
mov rbx, qword [r11 + 0x20]
mov sil, cl
movzx edi, dx
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movsx rdi, r15w
xchg edi, r14d
movzx esi, r10w
pop r14
mov dil, 0xd5
pop rdi
movzx rsi, r8w
movsx si, r12b
pop rsi
ret
Function at 0x1404db238
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, dil
mov qword [rsp + 0x18], rbp
movsx eax, r12w
push rsi
movzx eax, r10w
movzx ax, sil
cwde
push rdi
setbe al
push r14
cwde
mov eax, 0x1450
call fcn.1404471fb
sub rsp, rax
or ah, 0xd8
xadd sil, r14b
btr r10d, r9d
mov rax, qword [0x1400b7288]
bsf si, r9w
xor rax, rsp
movzx r10d, r8w
dec sil
bt rbp, 0xee
mov qword [rsp + 0x1440], rax
seta ah
shr ah, cl
sal eax, 0x65
movsxd r10, edx
mov rdi, rcx
and ch, 0xbf
setnp r14b
mov rax, r10
cmc
movsx r14, si
mov ebp, r9d
sar rax, 6
test dil, 0xd9
lea rcx, [0x1400ba940]
and r10d, 0x3f
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
cqo
lea rdx, [r10 + r10*8]
shl r14, cl
mov r14, qword [rax + rdx*8 + 0x28]
clc
sub eax, eax
clc
cmc
jmp 0x1404db2ed
mov qword [rdi], rax
cmp r10w, 0x58f9
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1404db409
lea rbx, [rsp + 0x40]
jmp 0x1404db30d
cmp rsi, rbp
jmp 0x1404db315
jae 0x1404db379
movzx eax, word [rsi]
add rsi, 2
test r15w, bx
stc
cmp ax, 0xa
jmp 0x1404db330
jne 0x1404db350
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
clc
add rbx, 2
cmp cx, 0x1865
cmp rsp, r8
clc
mov word [rbx], ax
movsx rax, di
clc
add rbx, 2
cwde
movsxd rax, eax
add rax, r8
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404db373
jb 0x1404db30d
and qword [rsp + 0x20], 0
neg rax
lea rax, [rsp + 0x40]
add cx, bx
movzx r9w, r15b
bts rdx, rbp
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
shrd r8d, r13d, 0x1a
btr r8w, 0x25
bsr ecx, edi
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
movzx r8d, sp
mov r8d, ebx
jmp 0x1404db3c2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404db3cf
je 0x1404db3fc
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404db3e3
jb 0x1404db409
cmp rsi, rbp
jmp 0x1404db3f1
jb 0x1404db302
jmp 0x1404db409
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bsf ax, r15w
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
cmc
test r8w, 0x4aaf
xor rcx, rsp
jmp 0x1404db423
call fcn.14049e6a7
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
bswap ebp
movzx rbp, bp
mov rbp, qword [r11 + 0x30]
movzx r14, dx
bswap r14d
jmp 0x1404db44a
mov rsp, r11
movsx rdi, si
pop r14
setge dil
pop rdi
xchg esi, esi
mov si, 0x74ae
pop rsi
jmp 0x1404db464
ret
Function at 0x1404db465
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp + 0x18], rbp
movsx rax, r12w
movsxd rax, ebp
not ax
push rsi
cbw
movsx rax, r10w
push rdi
setbe al
mov eax, r9d
push r12
push r14
push r15
mov eax, 0x1470
jmp 0x1404db499
call fcn.1404471fb
sub rsp, rax
not r14b
lahf
mov rax, qword [0x1400b7288]
sub r10d, r15d
sal r15d, cl
movsxd r10, r12d
xor rax, rsp
mov qword [rsp + 0x1460], rax
cbw
movsxd r10, edx
bt r15, 0xa1
mov rbx, rcx
cbw
mov rax, r10
sar dil, cl
mov r14d, r9d
cwd
movzx r15, r9w
add r15, 0x117547c4
sar rax, 6
cmc
lea rcx, [0x1400ba940]
bsr r12w, r9w
not r12
and r10d, 0x3f
rcr dl, 0x1d
cmp r11b, 0x6d
add r14, r8
dec r15b
mov r15, r8
mov rdi, r8
sub dx, 0x4a03
mov rax, qword [rcx + rax*8]
inc dx
or edx, esi
sub r12w, 0x5c3a
lea rdx, [r10 + r10*8]
btc r12w, si
bt r12d, edx
sal r12d, 0x6e
mov r12, qword [rax + rdx*8 + 0x28]
test r9d, esi
test rax, 0x2165394a
sub eax, eax
cmc
clc
mov qword [rbx], rax
cmp r8, r14
jmp 0x1404db552
mov dword [rbx + 8], eax
jmp 0x1404db55a
jae 0x1404db71d
lea rax, [rsp + 0x50]
cmc
cmp rdi, r14
jae 0x1404db5d3
movzx ecx, word [rdi]
test r8d, 0x4a5c652b
add rdi, 2
cmp r12w, cx
test spl, 0x9c
cmp cx, 0xa
jmp 0x1404db58e
jne 0x1404db5a9
mov edx, 0xd
mov word [rax], dx
jmp 0x1404db5a5
add rax, 2
mov word [rax], cx
add rax, 2
shr ch, 0x29
lea rcx, [rsp + 0x6f8]
test r8b, 0xc1
jmp 0x1404db5c5
cmp rax, rcx
jmp 0x1404db5cd
jb 0x1404db566
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
not r8b
and qword [rsp + 0x30], 0
jmp 0x1404db5f4
lea r8, [rsp + 0x50]
btc r9w, 0x18
shrd r9w, bp, 0xb3
sub rax, rcx
stc
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
clc
or r9b, r12b
sar r9w, cl
sar rax, 1
mov qword [rsp + 0x20], rcx
mov r9d, eax
test r15d, 0x6c3f7800
btr ecx, edi
movsx rcx, sp
mov ecx, 0xfde9
test bpl, sil
jmp 0x1404db647
xor edx, edx
jmp 0x1404db64e
call fcn.1404c83b7
mov ebp, eax
cmp edi, 0x74be0c73
cmp r10w, dx
test r13w, si
test eax, eax
jmp 0x1404db66a
je 0x1404db70b
sub esi, esi
test r11b, 0xc0
stc
test eax, eax
jmp 0x1404db67e
je 0x1404db6ea
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
mov rcx, r11
btc r8d, 0xe0
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8b, al
stc
mov r8d, ebp
add rdx, rcx
btc ecx, 0xd4
xor ch, 0xa2
ror ch, cl
mov rcx, r12
cmp sp, dx
cmp si, 0x74bb
sub r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404db6cf
je 0x1404db70b
add esi, dword [rsp + 0x40]
cmp sil, sil
cmc
cmp esi, ebp
jmp 0x1404db6e4
jb 0x1404db684
mov eax, edi
test r14b, dil
cmp rcx, 0x7933493d
sub eax, r15d
clc
cmc
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x1404db706
jmp 0x1404db55a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp spl, r12b
adc rcx, 0x4897309e
mov rax, rbx
btc cx, r10w
cmp r15d, 0xfd74705
mov rcx, qword [rsp + 0x1460]
cmp r13, rsp
jmp 0x1404db73c
xor rcx, rsp
jmp 0x1404db744
call fcn.14049e6a7
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
movzx edi, bx
setl r12b
pop r15
cmovne r14w, r15w
movsx r12, di
pop r14
mov r12w, dx
pop r12
xchg rsi, rsi
movzx si, dil
pop rdi
bswap si
pop rsi
ret
Function at 0x1404dee7a
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sal r8w, cl
add r8, 0x6ca4061f
push rdi
sub rsp, 0x20
not r9b
xchg di, di
mov rbx, rdx
lea r9, [0x1400c8ea8]
movsxd rdi, r11d
jmp 0x1404deeac
mov edi, ecx
lea rdx, [0x1400cf748]
jmp 0x1404deeba
mov ecx, 3
lea r8, [0x1400c8ea0]
jmp 0x1404deecb
call fcn.1404defdc
mov rdx, rbx
add ch, 0x3e
sal ecx, cl
mov ecx, edi
stc
test rax, rax
jmp 0x1404deee3
je 0x1404deef4
call qword [0x1400b8d90]
jmp 0x1404deefa
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rdi, r14
add rsp, 0x20
mov rdi, 0x11c7c12
pop rdi
ret
Function at 0x1404e3011
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
bsf r10w, r12w
movsx r10d, r10w
xor eax, eax
test r13b, r14b
bts r10, r12
mov r10d, ecx
test rcx, 0xd5234d0
test rdx, rdx
jne 0x1404e3067
call fcn.1404b4263
mov ebx, 0x16
jmp 0x1404e304b
mov dword [rax], ebx
jmp 0x1404e3052
call fcn.1404b4f59
mov eax, ebx
add rsp, 0x30
movzx ebx, di
pop rbx
jmp 0x1404e3066
ret
test r8, r8
jmp 0x1404e306f
je 0x1404e303c
movzx ecx, byte [rsp + 0x60]
mov word [rdx], ax
cbw
lea rax, [rcx + 1]
cmp r8, rax
jmp 0x1404e308b
ja 0x1404e30a5
call fcn.1404b4263
mov ebx, 0x22
jmp 0x1404e30a0
jmp 0x1404e304b
lea eax, [r9 - 2]
adc rbx, rdi
add rbx, rbp
mov ebx, 0x22
cmp eax, ebx
jmp 0x1404e30bb
ja 0x1404e303c
mov byte [rsp + 0x60], cl
btr bx, 0x73
mov ecx, r10d
add bl, r10b
rcr bh, cl
add rsp, 0x30
movzx bx, bl
movzx rbx, r9w
pop rbx
jmp 0x1404e30e4
jmp 0x1404e30e9
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
movsx r10, r11w
bswap rbp
mov qword [rsp + 0x18], rsi
mov bpl, bl
push rdi
xadd r10b, bl
jmp 0x1404e310c
push r14
test rax, r10
movsxd r11, eax
sbb di, 0x5678
push r15
sub rsp, 0x20
xor r15d, r15d
mov ebp, r9d
mov rdi, r8
mov r11, rdx
add r10d, 0x682e6f05
rol r10b, cl
mov r10, rdx
mov ebx, r15d
jmp 0x1404e3146
cmp byte [rsp + 0x60], r15b
je 0x1404e316b
lea eax, [r15 + 0x2d]
cmc
neg ecx
movzx r9d, r13w
btr r9w, ax
mov word [rdx], ax
lea ebx, [rax - 0x2c]
lea r10, [rdx + 2]
mov r8, r10
and r14w, bp
bt r9w, 0xe0
sub edx, edx
lea rsi, [r10 + 2]
ror al, cl
mov eax, ecx
mov r9, r10
div ebp
mov ecx, eax
test ebx, edi
rcl r14b, cl
cmp edx, 9
movsx r14, r12w
not al
cdqe
mov eax, 0x57
movzx r14w, spl
not r14w
movsx r14d, r9w
lea r14d, [rax - 0x27]
jmp 0x1404e31b4
cmovbe ax, r14w
jmp 0x1404e31be
inc rbx
cmp si, 0x3f3d
test r12b, 0x6b
add ax, dx
mov word [r10], ax
test ecx, ecx
jmp 0x1404e31d8
je 0x1404e31f1
mov r10, rsi
stc
cmc
cmp rbx, rdi
jmp 0x1404e31eb
jb 0x1404e3178
cmp rbx, rdi
jb 0x1404e3225
mov word [r11], r15w
jmp 0x1404e3203
call fcn.1404b4263
mov ebx, 0x22
jmp 0x1404e3212
mov dword [rax], ebx
call fcn.1404b4f59
mov eax, ebx
jmp 0x1404e3220
jmp 0x1404e3275
mov word [rsi], r15w
btc rcx, 0xbc
xor cl, 0xed
movzx eax, word [r8]
movsx rcx, r8w
sbb ch, 0xc8
movzx ecx, word [r9]
mov word [r9], ax
cmp ebx, eax
clc
stc
sub r9, 2
cmp bp, di
stc
jmp 0x1404e3255
mov word [r8], cx
add r8, 2
cmc
cmp ax, bx
jmp 0x1404e3266
cmp r8, r9
jb 0x1404e3231
xor eax, eax
rol bx, 0x3e
mov rbx, qword [rsp + 0x40]
movsx rdi, bp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sar r14b, cl
setle r14b
xadd rdi, r15
add rsp, 0x20
bswap r15w
mov dil, r15b
movsx di, bpl
pop r15
pop r14
not edi
pop rdi
jmp 0x1404e32af
ret
Function at 0x1401a6000
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
pushfq
push rax
push rdi
push rsi
push rsp
push rdx
push rcx
lea r12, [entry0]
sub r12, qword [0x1401a61c2]
jmp 0x1401a604c
movdqu xmm1, xmmword [0x1401a61a2]
mov rax, qword [0x1401a61b2]
add rax, r12
mov rdx, qword [0x1401a61ba]
movdqu xmm0, xmm1
aeskeygenassist xmm2, xmm1, 1
call fcn.1401a6017
movdqu xmm4, xmm1
aeskeygenassist xmm2, xmm1, 2
call fcn.1401a6017
movdqu xmm5, xmm1
aeskeygenassist xmm2, xmm1, 4
call fcn.1401a6017
movdqu xmm6, xmm1
aeskeygenassist xmm2, xmm1, 8
call fcn.1401a6017
movdqu xmm7, xmm1
aeskeygenassist xmm2, xmm1, 0x10
call fcn.1401a6017
movdqu xmm8, xmm1
aeskeygenassist xmm2, xmm1, 0x20
call fcn.1401a6017
movdqu xmm9, xmm1
aeskeygenassist xmm2, xmm1, 0x40
call fcn.1401a6017
movdqu xmm10, xmm1
aeskeygenassist xmm2, xmm1, 0x80
call fcn.1401a6017
movdqu xmm11, xmm1
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.1401a6017
movdqu xmm12, xmm1
aeskeygenassist xmm2, xmm1, 0x36
call fcn.1401a6017
movdqu xmm13, xmm1
aesimc xmm4, xmm4
aesimc xmm5, xmm5
aesimc xmm6, xmm6
aesimc xmm7, xmm7
aesimc xmm8, xmm8
aesimc xmm9, xmm9
aesimc xmm10, xmm10
aesimc xmm11, xmm11
aesimc xmm12, xmm12
xor r8, r8
sub rdx, 0x10
movdqu xmm15, xmmword [rax + r8]
pxor xmm15, xmm13
aesdec xmm15, xmm12
aesdec xmm15, xmm11
aesdec xmm15, xmm10
aesdec xmm15, xmm9
aesdec xmm15, xmm8
aesdec xmm15, xmm7
aesdec xmm15, xmm6
aesdec xmm15, xmm5
aesdec xmm15, xmm4
aesdeclast xmm15, xmm0
movdqu xmmword [rax + r8], xmm15
add r8, 0x10
cmp rdx, r8
jle 0x1401a6196
jmp 0x1401a613e
pop rcx
pop rdx
pop rsp
pop rsi
pop rdi
pop rax
popfq
jmp 0x1400013d0
Function at 0x402a7d
Capabilities:
Parse pe header

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp word [rdx], 0x5a4d
jne 0x402aa7
movsxd rax, dword [rdx + 0x3c]
lea rcx, [rsi + 8]
cmp dword [rdx + rax], 0x4550
jne 0x402ac4
add rdx, rax
mov qword [rcx], rdx
xor eax, eax
jmp 0x402adf
xor ecx, ecx
call fcn.004384cc
mov qword [rsi + 0x10], rdx
and qword [rsi + 0x18], 0
mov dword [rsi + 0x20], 1
mov qword [rsi + 8], rax
jmp 0x402ada
lea rdx, [0x0043e578]
xor r8d, r8d
call fcn.0040216f
mov dword [rsi + 0x20], 2
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret
Function at 0x4106ac
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x0043b010]
call fcn.004106e3
mov ecx, eax
add rsp, 0x28
jmp fcn.00438948

Function at 0x4106c7
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.004106e3
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.00438950
Function at 0x4193b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rcx, qword [0x0043b040]
test rcx, rcx
jne 0x4193d1
lea rcx, [0x0043b040]
call fcn.00434720
mov rcx, rax
call fcn.00438948
cmp rax, 1
jbe 0x4193ed
mov rdi, rax
cmp dword [rax], 1
jne 0x4193ed
add rdi, 8
jmp 0x419498
mov rcx, qword [0x0043b040]
test rcx, rcx
jne 0x419408
lea rcx, [0x0043b040]
call fcn.00434720
mov rcx, rax
call fcn.00438948
test rax, rax
je 0x41941f
mov rsi, rax
cmp rax, 1
jne 0x41946b
xor edi, edi
jmp 0x419498
mov ecx, 0x20
mov edx, 8
call fcn.0040acb0
test rax, rax
je 0x4194a2
mov rsi, rax
mov qword [rax], 0
lea rax, [0x0043b040]
mov qword [rsi + 0x18], rax
mov rcx, qword [0x0043b040]
test rcx, rcx
jne 0x419463
lea rcx, [0x0043b040]
call fcn.00434720
mov rcx, rax
mov rdx, rsi
call fcn.00438950
lea rdi, [rsi + 8]
cmp qword [rsi], 0
mov rcx, qword [rsi + 0x10]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
je 0x419498
test rcx, rcx
je 0x419498
lock sub qword [rcx], 1
jne 0x419498
call fcn.00419590
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x20
mov edx, 8
call fcn.0040b090
ud2
Function at 0x41a0a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rcx, qword [0x0043b050]
test rcx, rcx
jne 0x41a0c0
lea rcx, [0x0043b050]
call fcn.00434720
mov rcx, rax
call fcn.00438948
cmp rax, 1
jbe 0x41a0d7
mov rsi, rax
cmp dword [rax], 1
je 0x41a164
mov rcx, qword [0x0043b050]
test rcx, rcx
jne 0x41a0f2
lea rcx, [0x0043b050]
call fcn.00434720
mov rcx, rax
call fcn.00438948
test rax, rax
je 0x41a109
mov rsi, rax
cmp rax, 1
jne 0x41a155
xor esi, esi
jmp 0x41a168
mov ecx, 0x18
mov edx, 8
call fcn.0040acb0
test rax, rax
je 0x41a171
mov rsi, rax
mov qword [rax], 0
lea rax, [0x0043b050]
mov qword [rsi + 0x10], rax
mov rcx, qword [0x0043b050]
test rcx, rcx
jne 0x41a14d
lea rcx, [0x0043b050]
call fcn.00434720
mov rcx, rax
mov rdx, rsi
call fcn.00438950
mov qword [rsi], 1
mov qword [rsi + 8], 0
add rsi, 8
mov rax, rsi
add rsp, 0x20
pop rsi
ret
mov ecx, 0x18
mov edx, 8
call fcn.0040b090
ud2
Function at 0x41c260
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x54], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea rcx, [rsp + 0x90]
lea r9, [rsp + 0x40]
call fcn.00431200
cmp dword [rsp + 0x90], 1
mov rdi, qword [rsp + 0x98]
jne 0x41c30f
cmp dil, 3
jne 0x41c303
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
call qword [rax]
mov rax, qword [rdi + 8]
cmp qword [rax + 8], 0
je 0x41c2f2
mov rcx, qword [rdi]
mov rdx, qword [rax + 0x10]
call fcn.0040ad40
mov rcx, qword [0x00446110]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov qword [rsi], 0
jmp 0x41c436
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.004313d0
cmp dword [rsp + 0x40], 1
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
jne 0x41c36d
cmp r12b, 3
jne 0x41c427
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
call qword [rax]
mov rax, qword [rbx + 8]
cmp qword [rax + 8], 0
je 0x41c357
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
call fcn.0040ad40
mov rcx, qword [0x00446110]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
jmp 0x41c427
cmp rbx, 2
je 0x41c427
mov qword [rsp + 0x40], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x41c422
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x41c448
mov rbx, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x41c448
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov qword [rsi], 1
jmp 0x41c42e
call sub.kernel32.dll_GetLastError
mov qword [rsi], 0
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsi], 0
mov rcx, r14
call sub.kernel32.dll_CloseHandle
jmp 0x41c42e
Function at 0x434720
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
lea rcx, [0x004460e8]
call sub.kernel32.dll_AcquireSRWLockExclusive
mov rbx, qword [rsi]
test rbx, rbx
jne 0x4347ab
mov rbx, qword [rsi + 8]
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x4347c5
mov edi, eax
test rbx, rbx
je 0x43479f
mov ecx, 0x18
mov edx, 8
call fcn.0040acb0
test rax, rax
je 0x4347df
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], 0
mov dword [rax + 0x10], edi
mov rax, qword [0x00446128]
nop word cs:[rax + rax]
nop dword [rax]
mov qword [rcx + 8], rax
lock cmpxchg qword [0x00446128], rcx
jne 0x434790
mov ebx, edi
mov rax, rbx
xchg qword [rsi], rax
test edi, edi
je 0x4347f0
lea rcx, [0x004460e8]
call sub.kernel32.dll_ReleaseSRWLockExclusive
mov rax, rbx
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXESlibrary_std_src_syswindows_thread_local_key.rs
lea r8, [0x00440768]
mov edx, 0x2e
call fcn.0040c8f0
ud2
mov ecx, 0x18
mov edx, 8
call fcn.0040b090
ud2
mov byte [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
lea rax, str.assertion_failed:_key___0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 0
lea rax, [0x0043e578]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [0x0040cb20]
mov qword [rsp + 0x48], rax
lea rax, str.fatal_runtime_error:__n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x50]
call fcn.0041a190
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.0041a2a0
mov ecx, 7
int 0x29
ud2

Function at 0x438f10
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00439fe0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00439fe0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x438f80
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x004467f4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x439128
mov rax, qword [0x004467f8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x438fcc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x439057
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x438fb0
mov rcx, r12
call fcn.00439ce0
mov rbp, rax
test rax, rax
je 0x439162
mov rax, qword [0x004467f8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00439e10
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004467f8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x439171
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x439050
sub eax, 4
and eax, 0xfffffffb
jne 0x4390e0
add dword [0x004467f4], 1
cmp ebx, 8
jae 0x439088
test bl, 4
jne 0x439130
test ebx, ebx
je 0x439079
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x439150
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x439079
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x4390ba
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x004467f8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x439050
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00438f10
nop dword [rax]
xor edi, edi
jmp 0x438fd7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x439079
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x439079
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00438f10
mov rax, qword [0x004467f8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00438f10
nop
nop dword [rax]