joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400be8a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
mov rbp, rcx
sar rdi, 2
test rdi, rdi
je 0x1400bea7f
mov qword [rsp + 0x60], rbx
mov rbx, qword [rcx + 8]
sub rbx, qword [rcx]
mov qword [rsp + 0x30], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x1400be8f0
mov eax, listen
jmp 0x1400be91e
cmp rdi, 0x44
jb 0x1400be8fd
mov eax, 7
jmp 0x1400be91e
cmp rdi, 0x27
jb 0x1400be90a
mov eax, 5
jmp 0x1400be91e
cmp rdi, 7
jb 0x1400be917
mov eax, 3
jmp 0x1400be91e
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x1400be937
mov r15, rdi
mov r8, rdi
mov edx, 0x8b8b8b8b
shl r8, 2
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
test r15, r15
je 0x1400be9ef
mov qword [rsp + 0x38], r12
nop dword [rax + rax]
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea r12, [rsi + rdx*4]
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [r12]
xor r8d, r11d
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x1400be9ad
mov rax, rbx
jmp 0x1400be9c2
cmp rcx, rbx
ja 0x1400be9bf
mov rax, qword [rbp]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x1400be9c2
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [r12], r8d
cmp rcx, r15
jb 0x1400be960
mov r12, qword [rsp + 0x38]
add r15, rdi
cmp rcx, r15
jae 0x1400bea6b
inc r14
lea rbp, [rcx - 1]
inc r13
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, r10d
add ecx, dword [rsi + r9*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x1400bea01
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c0f10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140157dc0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
lea rax, vtable.httplib::ThreadPool.0
mov qword [rcx], rax
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x28], r15
lea ecx, [r15 + 0x50]
call fcn.1400d347c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x30], r15b
lea rcx, [rsi + 0x38]
call sub.MSVCP140.dll__Cnd_init_in_situ
nop
lea rcx, [rsi + 0x80]
mov dword [rcx], r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r15
lea edx, [r15 + 2]
call sub.MSVCP140.dll__Mtx_init_in_situ
nop
test rbp, rbp
je 0x1400c1033
nop dword [rax]
mov qword [rsp + 0x38], rsi
mov rdi, qword [rsi + 0x10]
cmp rdi, qword [rsi + 0x18]
je 0x1400c101c
mov ecx, 8
call fcn.1400d347c
test rax, rax
je 0x1400c0fe3
mov qword [rax], rsi
jmp 0x1400c0fe6
mov rax, r15
mov qword [rsp + 0x38], rax
lea r14, [rdi + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x1400be4e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400c105d
add qword [rsi + 0x10], 0x10
jmp 0x1400c102d
lea r8, [rsp + 0x38]
mov rdx, rdi
lea rcx, [rsi + 8]
call fcn.1400be0e0
sub rbp, 1
jne 0x1400c0fc0
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d35d0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov dword [r14], r15d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400c8c60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x140157dc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebp, r9d
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x1400c8ddd
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x80], 0
mov rcx, qword [rbx + 0x3b8]
test rcx, rcx
je 0x1400c8ccf
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x90]
call fcn.140041d50
movzx ecx, byte [rbx + 0x37c]
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x38], al
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], cl
mov dword [rsp + 0x20], ebp
mov r9d, dword [rbx + 0x378]
mov r8d, edi
lea rdx, [0x1400f5051]
mov rcx, rsi
call fcn.1400be590
mov rsi, rax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400c8d66
mov r8, qword [rcx]
lea rax, [rsp + 0x48]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov qword [rsp + 0x80], 0
xchg qword [rbx + 0x48], rsi
mov rax, qword [rbx + 0x48]
nop
cmp rax, 0xffffffffffffffff
je 0x1400c8ddd
test edi, edi
jne 0x1400c8dcb
mov dword [rsp + 0xd0], 0x80
mov rcx, qword [rbx + 0x48]
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xe0]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400c8ddd
movzx eax, word [rsp + 0xe0]
cmp ax, 2
je 0x1400c8db8
cmp ax, 0x17
jne 0x1400c8ddd
movzx ecx, word [rsp + 0xe2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx edi, ax
test edi, edi
js 0x1400c8ddd
mov rcx, rbx
call fcn.1400c8e00
test al, al
je 0x1400c8ddd
mov al, 1
jmp 0x1400c8ddf
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400d35d0
add rsp, 0x178
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d2c90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
cmp byte [0x140161170], 0
lea rsi, [0x140156a20]
mov qword [rsp + 0x40], r14
mov edi, edx
mov r14d, ecx
jne 0x1400d2d99
mov byte [0x140161170], 1
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
mov r9, rax
cmp rbx, 0x989680
jne 0x1400d2ce0
imul rax, r9, 0x64
jmp 0x1400d2d5d
cmp rbx, 0x16e3600
jne 0x1400d2d3f
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
mov rax, r10
lea r8, [r9 + rdx]
sar r8, 0x18
mov rcx, r8
shr rcx, 0x3f
add r8, rcx
imul rcx, r8, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, r8, 0x3b9aca00
add rax, rdx
jmp 0x1400d2d5d
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov rcx, rax
mov dword [0x140156a24], eax
mov edx, 1
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [rsi + rdx*4 + 4], ecx
inc rdx
cmp rdx, 0x270
jb 0x1400d2d70
mov dword [0x140156a20], 0x270
mov ebp, 0x80000000
mov qword [rsp + 0x50], rsi
cmp r14d, ebp
lea eax, [r14 - 0x80000000]
lea esi, [r14 + rbp]
mov r14, qword [rsp + 0x40]
cmovae esi, eax
lea ecx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ecx, eax
sub ecx, esi
cmp ecx, 0xffffffff
jne 0x1400d2ddc
lea rcx, [rsp + 0x50]
call fcn.1400401d0
mov ecx, eax
jmp 0x1400d2e1b
lea edi, [rcx + 1]
lea rcx, [rsp + 0x50]
mov ebx, edi
call fcn.1400401d0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1400d2e17
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1400d2e17
lea rcx, [rsp + 0x50]
call fcn.1400401d0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1400d2e03
shr rcx, 0x20
mov rbx, qword [rsp + 0x48]
lea edx, [rsi + rcx]
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d4280
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d42ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d42ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d42ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d42ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d42ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d42cc
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
test rax, rax
je 0x14000109f
movsxd rcx, dword [rax + 0x3c]
xor r9d, r9d
mov r8d, dword [rcx + rax + 0x88]
add r8, rax
mov esi, dword [r8 + 0x1c]
mov edi, dword [r8 + 0x20]
add rsi, rax
mov ebp, dword [r8 + 0x24]
add rdi, rax
mov r11d, dword [r8 + 0x14]
add rbp, rax
test r11, r11
je 0x14000109f
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [rdi + r9*4]
mov eax, 0x1505
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x140001093
nop dword [rax]
nop word [rax + rax]
imul eax, eax, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140001080
cmp eax, ebx
je 0x1400010b6
inc r9
cmp r9, r11
jne 0x140001060
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r10
jmp 0x1400010a1

Function at 0x140001d94
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001dde
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001dde
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001dde
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001dde
cmp dword [rcx + 0x84], 0xe
jbe 0x140001dde
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001de0
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d6a40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d7442
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d74da
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d74be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d74b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d74b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7478
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d74db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d75e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7608
mov eax, 0
jmp 0x2fc4d7656
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7631
mov eax, 0
jmp 0x2fc4d7656
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7651
mov eax, 0
jmp 0x2fc4d7656
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d765c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d76da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d76d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d76d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d76ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d76a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ca7c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4cb1c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ef108]
test eax, eax
je 0x2fc4cb25a
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ef110]
mov qword [rbp - 8], rax
jmp 0x2fc4cb23e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cb232
cmp qword [rbp - 0x10], 0
je 0x2fc4cb232
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4cb1f8
lea rax, [0x2fc4ef0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cb25b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4cb360
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4cb388
mov eax, 0
jmp 0x2fc4cb3d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4cb3b1
mov eax, 0
jmp 0x2fc4cb3d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4cb3d1
mov eax, 0
jmp 0x2fc4cb3d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4cb3dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cb45a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cb451
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cb451
mov rax, qword [rbp - 8]
jmp 0x2fc4cb46f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cb424
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00508660]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00508670]
mov dword [rax], 1
mov rax, qword [0x00508680]
mov dword [rax], 1
mov rax, qword [0x00508650]
mov dword [rax], 1
mov rax, qword [0x00508510]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x00508640]
mov dword [0x0053500c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.unk_4305
call dbg.__p__fmode
mov rdx, qword [0x00508600]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00507930]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.unk_4305
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x4016c3
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
setne al
test al, al
je 0x4016f5
mov ebx, 1
jmp 0x4017ab
mov dword [rbp + 0xf4], 0x60
mov eax, dword [rbp + 0xf4]
mov rax, qword gs:[rax]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
add rax, 0xbc
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0xf8]
mov eax, dword [rax]
and eax, 0x70
test eax, eax
je 0x40173b
mov ebx, 1
jmp 0x4017ab
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x28
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
test eax, eax
setne al
test al, al
je 0x401773
mov ebx, 1
jmp 0x4017ab
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x50]
mov r8d, 2
mov rcx, rax
call method.std::filesystem::__cxx11::path::path_char__260___std::filesystem::__cxx11.path__char_const_____260___std::filesystem::__cxx11::path::format_
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.copyExecutableToDirectory_std::filesystem::__cxx11::path_const_
call sym.IntegratedFunction__
mov ebx, 0
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.004a3b60
mov eax, ebx
jmp 0x4017c9
add rsp, 0x188
pop rbx
pop rbp
ret
Function at 0x402ff0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x403000
jmp sym.unk_3992
xor eax, eax
ret

Function at 0x403010
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403055
dec ecx
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x40304c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x403057
add rax, 0x28
cmp rax, r9
jne 0x403038
xor eax, eax
ret

Function at 0x403100
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00508510]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x403171
mov rcx, r10
call sym.unk_3992
test eax, eax
je 0x403171
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x40316e
dec eax
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x403165
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x403171
add r8, 0x28
cmp r8, r9
jne 0x403150
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x403250
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00508510]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x4032bf
mov rcx, r9
call sym.unk_3992
test eax, eax
je 0x4032bf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x4032bd
dec edx
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4032b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4032c8
add rax, 0x28
cmp rax, r9
jne 0x4032a0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x4032e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00508510]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x403358
mov rcx, r11
call sym.unk_3992
test eax, eax
je 0x403358
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x403358
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403358
dec ecx
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop word [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x40334c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x403360
add rdx, 0x28
cmp rdx, r10
jne 0x403338
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x40336f
dec r8d
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x40337d
mov edx, dword [rax + 0xc]
test edx, edx
je 0x403355
test r8d, r8d
jg 0x403368
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x404aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push r13
push r12
sub rsp, 0x230
mov r12, rcx
call sym._errno
mov dword [rax], 0
test r12, r12
je 0x404c10
cmp word [r12], 0
je 0x404c00
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404c20
test al, 0x10
je 0x404c00
lea r13, [rsp + 0x20]
mov rdx, r12
mov r8d, 0x104
mov rcx, r13
call sym.unk_4358
mov rcx, r13
call sym.wcslen
lea rcx, [0x005070e0]
mov r12, rax
call sym.wcslen
lea rcx, [0x005070e4]
add r12, rax
call sym.wcslen
lea rcx, [r12 + rax + 0x229]
add rcx, rcx
call sym.malloc
mov r12, rax
test rax, rax
je 0x404c33
lea r14, [rax + 0x44c]
mov rdx, r13
mov rcx, r14
call sym.wcscpy
cmp word [r12 + 0x44c], 0
jne 0x404bc0
lea rdx, [0x005070e4]
mov rcx, r14
call sym.wcscat
lea rcx, [r12 + 0x238]
mov r8d, 0x208
xor edx, edx
mov qword [r12 + 0x440], 0xffffffffffffffff
mov dword [r12 + 0x448], 0
mov qword [r12 + 0x230], 0
call sym.memset
mov rax, r12
add rsp, 0x230
pop r12
pop r13
pop r14
ret
mov rcx, r14
call sym.wcslen
cmp word [r12 + rax*2 + 0x44a], 0x2f
je 0x404b60
mov rcx, r14
call sym.wcslen
cmp word [r12 + rax*2 + 0x44a], 0x5c
je 0x404b60
lea rdx, [0x005070e0]
mov rcx, r14
call sym.wcscat
jmp 0x404b60
call sym._errno
xor r12d, r12d
mov dword [rax], 0x14
jmp 0x404ba8
call sym._errno
mov dword [rax], 0xe
jmp 0x404ba8
call sym._errno
xor r12d, r12d
mov dword [rax], 2
jmp 0x404ba8
call sym._errno
mov dword [rax], 0xc
jmp 0x404ba8