joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e7970
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x1400e798e
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x1400e7bcf
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x140136d60]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x140136d40]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x140136d20]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x1400e7b1f
cmp r9, 0x20
jb 0x1400e7af3
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x1400e7a6a
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x1400e7a4a
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x1400e7a30
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x1400e7a00
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x1400e79e6
jmp 0x1400e7bad
test ecx, ecx
mov ecx, eax
je 0x1400e7b0c
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.1400e76e0
jmp 0x1400e7bad
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.1400e6c00
jmp 0x1400e7bad
test ecx, ecx
je 0x1400e7b5e
test r9, r9
je 0x1400e7b48
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x1400e7b30
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x1400e7b98
test r9, r9
je 0x1400e7b84
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x1400e7b70
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret
Function at 0x1400eb140
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400eb17a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400eb17f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400eb1c8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140144e90]
cmp byte [rcx + rax], 0
je 0x1400eb1c8
dec r8
sub rdx, 1
jne 0x1400eb1ae
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400eb8b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400eb1e0
mov ebx, eax
test eax, eax
jne 0x1400eb8e0
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400eb93c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb933
test al, 0x10
je 0x1400eb933
bt eax, 0xa
jae 0x1400eb92c
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400eb954
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400eb928
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400eb94c
test edi, edi
jne 0x1400eb933
and dword [rsp + 0x3c], 0
jmp 0x1400eb938
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1400a0b70
int3
Function at 0x1400f26c4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400a6ec0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400a6ec0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400f2814
cmp rax, 0xffffffffffffffff
je 0x1400f2814
xor edi, edi
test rbp, rbp
jle 0x1400f27bf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400a4dc8
mov rbx, rax
test rax, rax
jne 0x1400f274c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400f27b5
mov edx, 0x8000
mov ecx, r14d
call fcn.1400ee240
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400a4458
cmp eax, 0xffffffff
je 0x1400f2795
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400f275c
mov edx, r15d
mov ecx, r14d
call fcn.1400ee240
jmp 0x1400f27b5
cmp byte [rsi + 0x38], dil
je 0x1400f27ac
cmp dword [rsi + 0x34], 5
jne 0x1400f27ac
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x1400f27b5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400a4760
jmp 0x1400f2828
jns 0x1400f2828
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400a6ec0
cmp rax, 0xffffffffffffffff
jne 0x1400f27e0
cmp byte [rsi + 0x30], dil
je 0x1400f2828
mov edi, dword [rsi + 0x2c]
jmp 0x1400f2828
mov ecx, r14d
call fcn.1400acf54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400f2828
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x1400f2828
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400f2821
mov eax, dword [rsi + 0x2c]
jmp 0x1400f2826
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400a6ec0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400f2900
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f2928
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400f2928
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800222d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
cmp dword [rcx + 0x28], 8
mov r13d, r9d
mov esi, dword [rcx]
mov ebp, r8d
mov r14d, edx
mov rdi, rcx
lea rbx, [rsi + 0x10]
je 0x18002230d
mov eax, dword [rcx + 0x10]
cmp rbx, rax
jbe 0x18002230d
mov edx, ebx
call fcn.180021f40
cmp dword [rdi + 0x34], 1
mov dword [rdi], ebx
jge 0x18002231c
mov dword [rdi + 0x34], 1
add rsi, qword [rdi + 8]
xor ebx, ebx
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x180022341
cmp byte [rdx], bl
je 0x180022341
mov rcx, qword [rdi + 0x50]
call fcn.1800220f0
mov r12d, eax
jmp 0x180022344
mov r12d, ebx
movzx eax, byte [rsp + 0x70]
mov byte [rsi + 0xd], al
movzx eax, word [rsp + 0x78]
mov word [rsi + 0xe], ax
mov dword [rsi], r12d
mov dword [rsi + 4], r14d
mov dword [rsi + 8], ebp
mov byte [rsi + 0xc], r13b
sub rsi, qword [rdi + 8]
mov r14, qword [rdi + 0x60]
sar rsi, 4
test r14, r14
je 0x180022439
cmp dword [r14 + 0x28], 8
mov qword [rsp + 0x50], r15
mov r15d, dword [r14]
lea rbp, [r15 + 4]
je 0x18002239e
mov eax, dword [r14 + 0x10]
cmp rbp, rax
jbe 0x18002239e
mov edx, ebp
mov rcx, r14
call fcn.180021f40
cmp dword [r14 + 0x34], 1
mov dword [r14], ebp
jge 0x1800223b0
mov dword [r14 + 0x34], 1
mov r8, qword [r14 + 8]
test r13b, 0xf0
je 0x18002242c
mov rax, qword [rdi + 0x50]
mov r9d, dword [r8]
movsxd rdx, r12d
add rdx, qword [rax + 8]
movzx eax, byte [rdx]
test al, al
je 0x1800223f8
nop
shl ebx, 4
lea rdx, [rdx + 1]
movzx eax, al
add ebx, eax
mov ecx, ebx
and ecx, 0xf0000000
je 0x1800223ed
mov eax, ecx
shr eax, 0x18
xor ebx, eax
movzx eax, byte [rdx]
not ecx
and ebx, ecx
test al, al
jne 0x1800223d0
xor edx, edx
mov eax, ebx
div r9d
movsxd rax, edx
lea edx, [r9 + r9]
mov ecx, dword [r8 + rax*4 + 8]
mov dword [r8 + r15], ecx
mov dword [r8 + rax*4 + 8], esi
inc dword [r8 + 4]
inc dword [r14 + 0x48]
cmp dword [r14 + 0x48], edx
jle 0x180022434
mov rcx, rdi
call fcn.180022180
jmp 0x180022434
mov dword [r8 + r15], ebx
inc dword [r8 + 4]
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180022460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword [rcx + 0x60]
mov rbx, rdx
mov r10, rcx
test rax, rax
je 0x18002252b
mov r11, qword [rax + 8]
xor r8d, r8d
movzx eax, byte [rdx]
mov r9, rdx
mov esi, dword [r11]
test al, al
je 0x1800224cd
nop word [rax + rax]
movzx eax, al
lea r9, [r9 + 1]
shl r8d, 4
add r8d, eax
mov eax, r8d
and eax, 0xf0000000
je 0x1800224c0
mov ecx, eax
shr ecx, 0x18
xor r8d, ecx
not eax
and r8d, eax
movzx eax, byte [r9]
test al, al
jne 0x1800224a0
xor edx, edx
mov eax, r8d
div esi
movsxd rax, edx
mov r9d, dword [r11 + rax*4 + 8]
test r9d, r9d
je 0x18002252b
mov rax, qword [r10 + 0x50]
mov r10, qword [r10 + 8]
mov rdi, qword [rax + 8]
nop dword [rax]
movsxd rax, r9d
add rax, rax
mov r8d, dword [r10 + rax*8]
mov rax, rbx
add r8, rdi
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180022516
inc rax
test ecx, ecx
jne 0x180022503
test edx, edx
je 0x18002253d
lea eax, [r9 + rsi]
movsxd rcx, eax
mov r9d, dword [r11 + rcx*4 + 8]
test r9d, r9d
jne 0x1800224f0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180023ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rdi, rcx
mov ecx, 0x89
call fcn.180046850
mov rbx, rax
test rax, rax
je 0x180023cac
xorps xmm0, xmm0
mov qword [rsp + 0x60], rbp
movups xmmword [rbx], xmm0
xor eax, eax
mov qword [rsp + 0x40], rsi
movups xmmword [rbx + 0x10], xmm0
lea rcx, str..shstrtab
mov rdx, rbx
movups xmmword [rbx + 0x20], xmm0
mov qword [rsp + 0x28], r14
sub rdx, rcx
movups xmmword [rbx + 0x30], xmm0
mov qword [rsp + 0x20], r15
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm0
mov qword [rbx + 0x80], rax
mov byte [rbx + 0x88], al
mov qword [rbx + 0x18], rdi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx + 0x78], al
lea rcx, [rcx + 1]
test al, al
jne 0x180023b50
lea r14, [rdi + 0x528]
mov qword [rbx + 0x28], 3
lea rbp, [rdi + 0x520]
mov dword [rbx + 0x34], 1
mov eax, dword [r14]
mov rdx, r14
mov rcx, rbp
mov dword [rbx + 0x24], eax
mov r8, rbx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbp
call fcn.1800325e0
cmp dword [rbx + 0x28], 8
mov esi, dword [rbx]
lea rdi, [rsi + 1]
je 0x180023bb8
mov eax, dword [rbx + 0x10]
cmp rdi, rax
jbe 0x180023bb8
mov edx, edi
mov rcx, rbx
call fcn.180021f40
cmp dword [rbx + 0x34], 1
mov dword [rbx], edi
jge 0x180023bc7
mov dword [rbx + 0x34], 1
mov rax, qword [rbx + 8]
mov r15d, 1
mov byte [rsi + rax], 0
cmp dword [r14], r15d
jle 0x180023c8c
mov qword [rsp + 0x38], r12
mov r12d, 8
mov qword [rsp + 0x30], r13
nop
mov rax, qword [rbp]
mov rsi, qword [r12 + rax]
mov eax, dword [rsi]
mov dword [rsi + 0x3c], eax
cmp rsi, rbx
je 0x180023c0c
test eax, eax
jne 0x180023c0c
test byte [rsi + 0x2c], 2
je 0x180023c72
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdi + rsi + 0x78], 0
jne 0x180023c13
mov r13d, dword [rbx]
inc edi
mov r14d, edi
add r14, r13
cmp dword [rbx + 0x28], 8
je 0x180023c41
mov eax, dword [rbx + 0x10]
cmp r14, rax
jbe 0x180023c41
mov edx, r14d
mov rcx, rbx
call fcn.180021f40
cmp dword [rbx + 0x34], 1
mov dword [rbx], r14d
jge 0x180023c51
mov dword [rbx + 0x34], 1
mov rcx, qword [rbx + 8]
lea rdx, [rsi + 0x78]
add rcx, r13
movsxd r8, edi
call fcn.180058aa0
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [rsi + 0x20], r13d
inc r15d
add r12, 8
cmp r15d, dword [r14]
jl 0x180023bf0
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov eax, dword [rbx]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x3c], eax
add rsp, 0x48
pop rdi
pop rbx
ret
lea rcx, str.memory_full__malloc_
call fcn.180032f40
int3
Function at 0x180033d10
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
sub rsp, 0x428
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov dword [rcx + 0x28], edx
mov esi, edx
mov rbx, rcx
cmp edx, 4
jne 0x180033d40
mov dword [rcx + 0x2c], 0
cmp byte [rcx + 1], 0
jne 0x180033d60
lea r8, [rcx + 0x98]
lea rdx, [rcx + 0x90]
lea r9, str.B_include_B_include_winapi
call fcn.180032670
cmp byte [rbx + 0x3d], 0
mov qword [rsp + 0x448], rbp
mov qword [rsp + 0x450], rdi
mov qword [rsp + 0x420], r14
je 0x180033ecb
mov ecx, 0x87
call fcn.180046850
mov rdi, rax
test rax, rax
je 0x180033f82
xorps xmm0, xmm0
lea rcx, str..bounds
movups xmmword [rdi], xmm0
xor eax, eax
mov rdx, rdi
movups xmmword [rdi + 0x10], xmm0
sub rdx, rcx
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov dword [rdi + 0x80], eax
mov word [rdi + 0x84], ax
mov byte [rdi + 0x86], al
mov qword [rdi + 0x18], rbx
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x78], al
lea rcx, [rcx + 1]
test al, al
jne 0x180033de0
mov dword [rdi + 0x28], 1
lea rdx, [rbx + 0x528]
mov dword [rdi + 0x2c], 3
lea rcx, [rbx + 0x520]
mov dword [rdi + 0x34], 4
mov r8, rdi
mov eax, dword [rbx + 0x528]
mov dword [rdi + 0x24], eax
call fcn.1800325e0
mov ecx, 0x88
mov qword [rbx + 0x580], rdi
call fcn.180046850
mov rdi, rax
test rax, rax
je 0x180033f82
xorps xmm0, xmm0
lea rcx, str..lbounds
movups xmmword [rdi], xmm0
xor eax, eax
mov r8, rdi
movups xmmword [rdi + 0x10], xmm0
sub r8, rcx
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x18], rbx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + r8 + 0x78], al
lea rcx, [rcx + 1]
test al, al
jne 0x180033e80
mov dword [rdi + 0x28], 1
lea rdx, [rbx + 0x528]
mov dword [rdi + 0x2c], 3
lea rcx, [rbx + 0x520]
mov dword [rdi + 0x34], 4
mov r8, rdi
mov eax, dword [rbx + 0x528]
mov dword [rdi + 0x24], eax
call fcn.1800325e0
mov qword [rbx + 0x588], rdi
cmp byte [rbx + 0x3b], 0
je 0x180033ed9
mov rcx, rbx
call fcn.180021710
lea r9, str.B_lib
mov rcx, rbx
lea r8, [rbx + 0xa8]
lea rdx, [rbx + 0xa0]
call fcn.180032670
cmp byte [rbx + 2], 0
jne 0x180033f4e
cmp esi, 4
je 0x180033f4e
mov edx, 0x3e8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movzx ecx, byte [rsp + 0x20]
lea rax, [rsp + 0x20]
test cl, cl
je 0x180033f33
nop
cmp cl, 0x5c
jne 0x180033f28
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x180033f20
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rbx + 0xa8]
lea rdx, [rbx + 0xa0]
call fcn.180032670
mov r14, qword [rsp + 0x420]
xor eax, eax
mov rdi, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x448]
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1800368f0
add rsp, 0x428
pop rsi
pop rbx
ret
lea rcx, str.memory_full__malloc_
call fcn.180032f40
int3
Function at 0x18003a2e4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18003a353
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18003a353
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18003a353
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18003a353
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18003a353
cmp dword [rcx + 0x84], 0xe
jbe 0x18003a353
cmp dword [rcx + 0xf8], 0
je 0x18003a353
mov ecx, ebx
call fcn.18003a404
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18003a1e0
nop
cmp dword [rbp + 0x20], 0
je 0x18003a3a1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18003a3ac
int3
xor r8d, r8d
xor edx, edx
jmp 0x18003a2e4
Function at 0x180048944
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x180070850]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18004899b
cmp word [rdx], r13w
jne 0x18004899b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1800489a0
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x180048ac5
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x180048ae6
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1800489d9
mov rdx, r9
mov word [rbx], cx
jmp 0x180048a00
cmp r9, r8
jae 0x180048a10
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1800489ba
jmp 0x180048ac5
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180048aba
cmp dword [rsp + 0x80], esi
je 0x180048aba
lea r8, [0x180070850]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x180048a92
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x180048a62
mov word [rbx], r13w
jmp 0x180048ac2
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x180048a6f
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x180048ac2
cmp word [rsp + 0x70], r13w
jne 0x180048a9f
cmp rbx, r14
je 0x180048a5c
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18004a514
cmp word [rsp + 0x70], r13w
je 0x180048ac5
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x180070850]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x180048abf
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x180048ac5
Function at 0x180049f48
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x180049f92
call fcn.180043218
mov dword [rax], 0xf
call fcn.180043238
mov dword [rax], 0xd
call fcn.18004ae80
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800368f0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x180049f9d
lea eax, [rbx + 1]
jmp 0x180049f7f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x180049f7d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x180049f7f

Function at 0x18004b008
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18004b01e
mov al, 1
jmp 0x18004b07e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18004b02f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18004b07c
mov ecx, dword [rcx + 0x18]
nop
call fcn.180053798
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18004b07c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18004b07c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18004b07c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18004b07e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18004d85c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180058270
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.18004aee8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18004d8ab
mov rax, rbp
jmp 0x18004d9b3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x70850]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18004a50c
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x70850]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18004d9af
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18004d9af
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18004a50c
test rax, rax
js 0x18004d9af
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18004d9af
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18004d9a1
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18004d9a1
cmp byte [rcx], 0xd
jne 0x18004d987
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18004d996
cmp byte [rcx + 1], 0xa
jne 0x18004d996
inc rcx
jmp 0x18004d996
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x6f1a0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18004d969
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18004d9b3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1800368f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret