joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f8c8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400454b0], eax
call fcn.1400300e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x1400454b0], 0
jne case.default.0x14002f91e
mov ecx, 1
call fcn.1400300e0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
sub eax, 0x3f12ce82
invalid
Function at 0x401ac0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rdi, rdx
call fcn.0041f950
test rax, rax
mov rbp, rax
jne 0x401b00
mov dword [0x0052f164], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rax + 2]
call fcn.004d1690
lea rdx, [0x004e36b5]
mov rcx, rsi
mov rbx, rax
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
je 0x401d07
mov r9, rax
mov r8, rbp
mov edx, 1
mov rcx, rbx
call sub.msvcrt.dll_fread
test rax, rax
je 0x401cf8
mov rcx, r12
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x401cf8
mov rcx, r12
mov r15d, 1
call sub.msvcrt.dll_fclose
mov byte [rbx + rbp], 0xa
lea r12, str._s:_d:_Ignoring_rubbish_found_on_this_line
mov byte [rbx + rbp + 1], 0
movzx eax, byte [rbx]
mov ebp, 0x2401
test al, al
je 0x401aed
cmp al, 0xa
mov r13, rbx
je 0x401bac
jle 0x401c60
cmp al, 0xd
je 0x401c71
cmp al, 0x23
jne 0x401b9f
mov byte [r13], 0
add r13, 1
movzx eax, byte [r13]
cmp al, 0xa
jne 0x401b88
cmp byte [r13 + 1], 0xd
mov byte [r13], 0
lea r14, [r13 + 1]
je 0x401c85
movzx eax, byte [rbx]
cmp al, 9
je 0x401bd0
cmp al, 0x20
jne 0x401bdf
nop dword [rax + rax]
add rbx, 1
movzx eax, byte [rbx]
cmp al, 0x20
je 0x401bd0
cmp al, 9
je 0x401bd0
cmp al, 0xa
je 0x401cf0
cmp al, 0xd
je 0x401cf0
test al, al
je 0x401cf0
mov rcx, rbx
jmp 0x401c07
test al, al
mov rcx, r9
je 0x401c29
movzx eax, byte [rcx + 1]
lea r9, [rcx + 1]
cmp al, 0xa
setne dl
cmp al, 0xd
setne r8b
and edx, r8d
cmp al, 0x20
je 0x401c94
cmp al, 9
je 0x401c94
test dl, dl
jne 0x401c00
cmp r9, rbx
mov byte [r9], 0
jbe 0x401c46
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call fcn.004cfaa0
mov qword [rax], rbx
movzx eax, byte [r13 + 1]
add r15d, 1
mov rbx, r14
test al, al
jne 0x401b81
jmp 0x401aed
test al, al
jne 0x401b9f
lea r14, [r13 + 1]
jmp 0x401bc0
cmp byte [r13 + 1], 0xa
mov byte [r13], 0
lea r14, [r13 + 1]
jne 0x401bc0
lea rax, [r13 + 2]
mov r13, r14
mov r14, rax
jmp 0x401bc0
test dl, dl
je 0x401c29
test al, al
je 0x401c29
movzx eax, byte [r9 + 1]
add rcx, 2
cmp al, 0x20
jne 0x401cbb
nop dword [rax]
add rcx, 1
movzx eax, byte [rcx]
cmp al, 0x20
je 0x401cb0
cmp al, 9
je 0x401cb0
cmp al, 0xd
ja 0x401cd0
bt rbp, rax
jb 0x401c29
nop dword [rax]
mov r8d, r15d
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x28], r9
call fcn.0041f240
mov r9, qword [rsp + 0x28]
jmp 0x401c29
mov byte [rbx], 0
jmp 0x401c46
lea rcx, str._s:_fread_failed
mov rdx, rsi
call fcn.0041f210
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sub.msvcrt.dll_strerror
lea rcx, str.cannot_open__s:__s
mov rdx, rsi
mov r8, rax
call fcn.0041f210
nop
nop word [rax + rax]
Function at 0x401d30
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdx, [0x004e370b]
mov rbp, rcx
mov rcx, qword [rcx + 0x10]
call sub.msvcrt.dll_fopen
test rax, rax
mov rsi, rax
je 0x401de8
mov ecx, 0x1000
mov edi, 0x1000
xor ebx, ebx
call fcn.004d1690
mov qword [rbp + 0x20], rax
jmp 0x401d98
mov r8, rdi
add rcx, rbx
mov r9, rsi
sub r8, rbx
mov edx, 1
call sub.msvcrt.dll_fread
mov rcx, rsi
mov r12, rax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x401dd8
add rbx, r12
mov rcx, rsi
call sub.msvcrt.dll_feof
test eax, eax
jne 0x401dc2
cmp rbx, rdi
mov rcx, qword [rbp + 0x20]
jne 0x401d70
lea rdi, [rbx + rbx]
mov rdx, rdi
call fcn.004d1710
mov rcx, rax
mov qword [rbp + 0x20], rax
jmp 0x401d70
mov rcx, rsi
mov qword [rbp + 0x18], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x10]
lea rcx, str._s:_fread_failed
call fcn.0041f210
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sub.msvcrt.dll_strerror
mov rdx, qword [rbp + 0x10]
lea rcx, str.cannot_open:__s:__s
mov r8, rax
call fcn.0041f210
nop
nop dword [rax]
Function at 0x4061d0
Capabilities:
Delete file
Move file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__stat64]
test eax, eax
je 0x406231
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_rename
test eax, eax
mov esi, eax
je 0x406227
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call sub.msvcrt.dll_strerror
lea rcx, str.unable_to_rename__s__reason:__s
mov rdx, rbx
mov r8, rax
call fcn.0041f240
mov rcx, rdi
call sub.msvcrt.dll__unlink
mov eax, esi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call sub.msvcrt.dll_remove
jmp 0x4061ef

Function at 0x406310
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ecx, 2
mov rsi, qword [fcn.004d5190]
lea rdi, [0x0052f1c0]
call rsi
mov r8d, 0x21
mov edx, 1
lea rcx, str.Last_stabs_entries_before_error:_n
mov r9, rax
lea r12, str.___6d
lea rbp, [0x004e5a3f]
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rsi
mov r8d, 0x1e
mov edx, 1
lea rcx, str.n_type_n_desc_n_value__string_n
mov r9, rax
call sub.msvcrt.dll_fwrite
lea r13, [0x004e5a48]
mov ebx, dword [0x0052f1a0]
jmp 0x406414
mov ecx, 2
call rsi
lea rdx, str.__6s
mov r8, r15
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov r15d, dword [r14 + 4]
mov ecx, 2
call rsi
mov rdx, r12
mov rcx, rax
mov r8d, r15d
call sub.msvcrt.dll_fprintf
mov r15, qword [r14 + 8]
mov ecx, 2
call rsi
mov rdx, rbp
mov rcx, rax
mov r8, r15
call sub.msvcrt.dll_fprintf
mov eax, dword [r14]
test eax, eax
jne 0x406470
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
add ebx, 1
mov eax, ebx
sar eax, 0x1f
shr eax, 0x1c
add ebx, eax
and ebx, 0xf
sub ebx, eax
cmp dword [0x0052f1a0], ebx
je 0x406490
movsxd rax, ebx
lea rax, [rax + rax*2]
lea r14, [rdi + rax*8]
cmp qword [r14 + 0x10], 0
je 0x4063fa
mov ecx, dword [r14]
call fcn.0042ae50
test rax, rax
mov r15, rax
jne 0x406390
mov r15d, dword [r14]
mov ecx, 2
test r15d, r15d
jne 0x4064a1
call rsi
mov r8d, 6
mov edx, 1
lea rcx, str.HdrSym
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x4063a9
mov r14, qword [r14 + 0x10]
mov ecx, 2
call rsi
mov rdx, r13
mov rcx, rax
mov r8, r14
call sub.msvcrt.dll_fprintf
jmp 0x4063e6
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call rsi
lea rdx, str.__6d
mov r8d, r15d
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x4063a9
Function at 0x40b1f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, r8
mov r12, rcx
mov ecx, 0x50
mov r15, r9
mov r13, rdx
call fcn.004d1690
test rbx, rbx
mov dword [r15], 0
mov rdi, rax
je 0x40b340
cmp dword [rbx], 0x2e
jne 0x40b300
mov r8, qword [rbx + 8]
xor esi, esi
test r8, r8
je 0x40b2b6
lea r14, [rsp + 0x4c]
mov ebp, 0xa
jmp 0x40b27b
lea r9d, [rsi + 1]
cmp r9d, ebp
jae 0x40b2d2
mov rbx, qword [rbx + 0x10]
mov qword [rdi + rsi*8], r8
mov esi, r9d
test rbx, rbx
je 0x40b2b2
cmp dword [rbx], 0x2e
jne 0x40b300
mov r8, qword [rbx + 8]
test r8, r8
je 0x40b2b2
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rdx, r13
mov rcx, r12
call fcn.0040aa80
test rax, rax
mov r8, rax
jne 0x40b250
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x40b331
mov dword [r15], 1
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40b269
shl rsi, 3
mov qword [rdi + rsi], 0
mov rax, rdi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea edx, [rbp + 0xa]
mov rcx, rdi
mov dword [rsp + 0x34], r9d
mov rbp, rdx
shl rdx, 3
mov qword [rsp + 0x38], rax
call fcn.004d1710
mov r8, qword [rsp + 0x38]
mov rdi, rax
mov r9d, dword [rsp + 0x34]
jmp 0x40b259
mov ecx, 2
call qword [fcn.004d5190]
mov r8d, 0x29
mov edx, 1
lea rcx, str.Unexpected_type_in_v3_arglist_demangling_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rdi
xor edi, edi
call fcn.004d4f88
jmp 0x40b2be
mov rcx, rdi
xor edi, edi
call fcn.004d4f88
jmp 0x40b2be
xor esi, esi
jmp 0x40b2b6
Function at 0x411aa0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp rdx, 0x7f
mov rdi, rcx
mov rbp, rdx
jbe 0x411b80
lea r13, [rsp + 0x20]
mov rax, rdx
lea rsi, [r13 + 0x14]
jmp 0x411ad3
mov rsi, rbx
mov byte [rsi - 1], al
lea rbx, [rsi - 1]
shr rax, 8
test rax, rax
jne 0x411ad0
add r13, 0x14
sub r13, rbx
cmp r13d, 8
ja 0x411bd0
mov rdx, qword [rdi + 0x18]
mov eax, dword [rdx + 8]
cmp eax, 0x1e9
ja 0x411c34
lea ecx, [rax + 1]
mov dword [rdx + 8], ecx
lea ecx, [r13 - 0x80]
mov byte [rdx + rax + 0xc], cl
lea eax, [r13 - 1]
lea r12, [rdi + 0x18]
add rsi, rax
test r13d, r13d
lea rbp, [rdi + 0x10]
jne 0x411b46
jmp 0x411b99
lea ecx, [rax + 1]
mov dword [rdx + 8], ecx
movzx ecx, byte [rbx]
mov byte [rdx + rax + 0xc], cl
add rbx, 1
cmp rbx, rsi
je 0x411b99
mov rdx, qword [rdi + 0x18]
mov eax, dword [rdx + 8]
cmp eax, 0x1e9
jbe 0x411b30
movzx r8d, byte [rbx]
mov rdx, r12
mov rcx, rbp
call fcn.00410b00
test eax, eax
jne 0x411b3d
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rcx + 0x18]
mov eax, dword [rdx + 8]
cmp eax, 0x1e9
ja 0x411bb0
lea ecx, [rax + 1]
mov dword [rdx + 8], ecx
mov byte [rdx + rax + 0xc], bpl
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [rcx + 0x18]
mov r8d, ebp
lea rcx, [rcx + 0x10]
call fcn.00410b00
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rbx, qword [fcn.004d5190]
mov ecx, 2
call rbx
mov r8d, 0x19
mov edx, 1
lea rcx, str.IEEE_numeric_overflow:_0x
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rbx
lea rdx, [0x004e7391]
mov r8, rbp
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [rdi + 0x18]
lea rcx, [rdi + 0x10]
lea r8d, [r13 + 0x80]
call fcn.00410b00
test eax, eax
jne 0x411b14
xor eax, eax
jmp 0x411b69

Function at 0x41f340
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov rsi, rdx
je 0x41f3b5
lea rdx, str._s:_supported_targets:
mov r8, rcx
mov rcx, rsi
call sub.msvcrt.dll_fprintf
call fcn.0042c650
mov r8, qword [rax]
mov rbp, rax
test r8, r8
je 0x41f398
lea rbx, [rax + 8]
lea rdi, [0x004e8a97]
nop dword [rax]
add rbx, 8
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_fprintf
mov r8, qword [rbx - 8]
test r8, r8
jne 0x41f380
mov rdx, rsi
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.004d4f88
lea rcx, str.Supported_targets:
mov r9, rdx
mov r8d, 0x12
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x41f362
Function at 0x41f8d0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
call fcn.0041ee20
mov rcx, rax
call sub.msvcrt.dll__mktemp
test rax, rax
mov rbx, rax
je 0x41f900
mov rcx, rax
call sub.msvcrt.dll__mkdir
test eax, eax
jne 0x41f900
mov rax, rbx
add rsp, 0x20
pop rbx
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x41fbc0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, rdx
mov rbp, r8
mov rdi, r9
mov rsi, rcx
call fcn.00423e30
mov ecx, eax
call fcn.00423e40
mov ecx, 1
mov rbx, qword [fcn.004d5190]
mov r13, rax
call rbx
mov rcx, rax
call sub.msvcrt.dll_fflush
mov r14, qword [0x005344d0]
mov ecx, 2
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
call rbx
mov rdx, rax
mov rcx, r14
call sub.msvcrt.dll_fputs
test r12, r12
je 0x41fc60
test rsi, rsi
je 0x41fce2
test rbp, rbp
je 0x41fc60
mov rbp, qword [rbp]
test rbp, rbp
je 0x41fc60
mov ecx, 2
call rbx
lea rdx, str.:_s__s_
mov r9, rbp
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x41fc79
mov ecx, 2
call rbx
lea rdx, [0x004e8ca9]
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_fprintf
test rdi, rdi
je 0x41fcb9
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x004e8cad]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call rbx
mov rdx, rdi
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
mov ecx, 2
call rbx
lea rdx, str.:__s_n
mov r8, r13
mov rcx, rax
call sub.msvcrt.dll_fprintf
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, r12
call fcn.0041fad0
mov rsi, rax
jmp 0x41fc33
Function at 0x42a220
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test rdx, rdx
mov rbp, rdx
mov r12, rcx
sete dl
test r8, r8
mov rdi, r8
sete al
or dl, al
jne 0x42a2d2
test rcx, rcx
je 0x42a2d2
lea rdx, [0x004e9b97]
mov rcx, r8
xor ebx, ebx
call fcn.00425cc0
lea r14, [0x0052f400]
lea r13, [0x004e9c20]
test rax, rax
mov rsi, rax
je 0x42a392
mov r9, rsi
mov r8d, 0x2000
mov edx, 1
mov rcx, r14
call sub.msvcrt.dll_fread
test rax, rax
je 0x42a2f0
add rax, r14
not ebx
cmp rax, r14
mov edx, ebx
jbe 0x42a2cc
lea rcx, [0x0052f400]
nop
movzx r8d, byte [rcx]
add rcx, 1
xor r8d, edx
shr edx, 8
movzx r8d, r8b
xor edx, dword [r13 + r8*4]
cmp rax, rcx
jne 0x42a2b0
mov ebx, edx
not ebx
jmp 0x42a281
mov ecx, 5
call fcn.00424130
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rcx, rdi
call fcn.004d00a0
mov rcx, rax
mov r15, rax
call sub.msvcrt.dll_strlen
lea rsi, [rax + 4]
mov r14, rax
and rsi, 0xfffffffffffffffc
lea r13, [rsi + 4]
mov rcx, r13
call fcn.004280a0
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x42a2de
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rdi + r14]
mov r8, rsi
xor edx, edx
sub r8, r14
call sub.msvcrt.dll_memset
mov rax, qword [r12 + 8]
lea rdx, [rdi + rsi]
mov ecx, ebx
call qword [rax + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, rbp
mov rcx, r12
call fcn.0042ac50
test eax, eax
je 0x42a37d
mov eax, 1
jmp 0x42a2de
mov rcx, rdi
mov dword [rsp + 0x3c], eax
call fcn.004d4f88
mov eax, dword [rsp + 0x3c]
jmp 0x42a2de
mov ecx, 1
call fcn.00424130
xor eax, eax
jmp 0x42a2de

Function at 0x42ab20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, dword [rcx + 0x18]
mov eax, dword [r8 + 0x10]
mov r9, qword [rcx]
mov rbx, rdx
xor edx, edx
div r10d
mov edx, edx
lea rax, [r9 + rdx*8]
mov rdx, qword [rax]
test rdx, rdx
je 0x4279e0
cmp rdx, r8
jne 0x4279d8
jmp 0x427a03
cmp rax, r8
je 0x427a00
mov rdx, rax
mov rax, qword [rdx]
test rax, rax
jne 0x4279d0
lea r8, str.bfd_hash_rename
mov edx, 0x243
lea rcx, str..._.._.._src_binutils_2.30_bfd_hash.c
call fcn.004240d0
nop dword [rax + rax]
mov rax, rdx
mov rdx, qword [r8]
mov qword [rax], rdx
lea rax, [rbx + 1]
xor edx, edx
mov qword [r8 + 8], rbx
movzx ecx, byte [rbx]
test ecx, ecx
je 0x427a3f
nop word [rax + rax]
mov r11d, ecx
add rax, 1
shl r11d, 0x11
add ecx, r11d
add edx, ecx
mov ecx, edx
shr ecx, 2
xor edx, ecx
movzx ecx, byte [rax - 1]
test ecx, ecx
jne 0x427a20
sub rax, rbx
sub eax, 1
add edx, eax
shl eax, 0x11
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
xor edx, edx
mov dword [r8 + 0x10], eax
div r10d
mov eax, edx
lea rax, [r9 + rax*8]
mov rdx, qword [rax]
mov qword [r8], rdx
mov qword [rax], r8
add rsp, 0x20
pop rbx
ret
mov rax, r8
mov qword [rdx], r8
add rcx, 0x60
lea r8, [rdx - 0x18]
mov rdx, rax
jmp 0x4279a0
Function at 0x42c470
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rax, rcx
mov rbx, rdx
je 0x42c4c0
lea rdi, str.default
mov ecx, 8
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
je 0x42c4d1
test rbx, rbx
je 0x42c503
and byte [rbx + 0x43], 0xfb
mov rcx, rax
call fcn.0042c2e0
test rax, rax
je 0x42c4af
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x42c482
mov rax, qword [0x004db550]
test rax, rax
je 0x42c4f2
test rbx, rbx
je 0x42c4af
or byte [rbx + 0x43], 4
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [0x004db560]
test rbx, rbx
mov rax, qword [rax]
jne 0x42c4e2
jmp 0x42c4af
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.0042c2e0
Function at 0x436600
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, qword [rsp + 0xd0]
mov rax, qword [rdi + 8]
lea rsi, [r9 + 0x10]
mov r13, rcx
mov rbp, rdx
mov r12d, r8d
mov rbx, r9
cmp rsi, rax
jb 0x436650
add rax, 1
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [0x004ee503]
mov r8, r9
sub r8, qword [rdi]
mov r9d, r12d
mov qword [rsp + 0x20], rax
lea rdx, [0x004ee4f8]
call sub.msvcrt.dll_fprintf
cmp r12d, 2
je 0x436834
cmp r12d, 4
je 0x4366a2
test r12d, r12d
je 0x436853
lea rdx, [0x004ee518]
mov r8d, r12d
mov rcx, r13
call sub.msvcrt.dll_fprintf
mov rax, qword [rdi + 8]
jmp 0x436631
mov r9, r13
mov r8d, 8
mov edx, 1
lea rcx, [0x004ee50f]
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 8]
lea rcx, [rbx + 0xe]
call qword [rax + 0x50]
lea rcx, [rbx + 0xc]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 8]
call qword [rax + 0x50]
lea rcx, [rbx + 0xa]
mov r15, rax
mov rax, qword [rbp + 8]
call qword [rax + 0x50]
lea rcx, [rbx + 8]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp + 8]
call qword [rax + 0x50]
lea rcx, [rbx + 4]
mov r14, rax
mov rax, qword [rbp + 8]
call qword [rax + 0x38]
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 8]
call qword [rax + 0x38]
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x30], r15d
lea rdx, [0x004ee538]
mov r8, qword [rsp + 0x58]
mov dword [rsp + 0x20], r14d
mov r15d, r15d
mov r9, qword [rsp + 0x48]
lea r14, [rbx + r15*8 + 0x10]
mov dword [rsp + 0x38], ecx
mov rcx, r13
mov dword [rsp + 0x28], r8d
mov r8d, eax
call sub.msvcrt.dll_fprintf
lea eax, [r12 + 1]
mov dword [rsp + 0x48], eax
jmp 0x4367b5
mov rdx, qword [rdi + 8]
lea r15, [rsi + 8]
lea rax, [rdx + 1]
cmp r15, rdx
jae 0x4367a2
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov qword [rsp + 0x28], rdi
mov rcx, r13
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rsi
mov r9d, 1
mov qword [rsp + 0x30], rax
call fcn.00436880
mov rdx, qword [rdi + 8]
cmp rbx, rax
mov rsi, r15
cmovb rbx, rax
cmp rax, rdx
jae 0x436635
cmp rsi, r14
jne 0x436760
mov r14d, dword [rsp + 0x50]
add r12d, 1
lea r14, [rsi + r14*8]
jmp 0x436820
mov rdx, qword [rdi + 8]
lea r15, [rsi + 8]
lea rax, [rdx + 1]
cmp r15, rdx
jae 0x43680d
mov rdx, rbp
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8d, r12d
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rsi
mov rcx, r13
mov qword [rsp + 0x30], rax
call fcn.00436880
mov rdx, qword [rdi + 8]
cmp rbx, rax
mov rsi, r15
cmovb rbx, rax
cmp rax, rdx
jae 0x436635
cmp rsi, r14
jne 0x4367d0
cmp rsi, rbx
mov rax, rbx
cmovae rax, rsi
jmp 0x436635
mov r9, r13
mov r8d, 4
mov edx, 1
lea rcx, [0x004ee50a]
call sub.msvcrt.dll_fwrite
jmp 0x4366bc
mov r9, r13
mov r8d, 4
mov edx, 1
lea rcx, [0x004ee505]
call sub.msvcrt.dll_fwrite
jmp 0x4366bc
Function at 0x441950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, qword [rdx + 0xf0]
mov rax, qword [rbx + 8]
mov r14, rdx
mov rsi, rcx
mov rcx, rbx
mov rax, qword [rax + 0x360]
call qword [rax + 0xd8]
mov ecx, dword [r14 + 0x88]
mov eax, 1
test ecx, ecx
jne 0x4419a0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rax, qword [rbx + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r14 + 0xf0]
mov rdi, qword [rax + 0x80]
mov r12, qword [rax]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call fcn.00441700
mov r13, rax
xor eax, eax
test r13, r13
je 0x44198f
mov eax, dword [r14 + 0x88]
lea rax, [rax + rax*2]
lea rbp, [r13 + rax*8]
cmp r13, rbp
jae 0x441ad3
mov rbx, r13
jmp 0x441a66
mov rdx, qword [r14 + 0xf0]
xor r9d, r9d
mov r8, rbx
mov rcx, r14
mov rdx, qword [rdx + 0xf0]
mov rdx, qword [rdx + 8]
mov eax, dword [rdx + rax*4]
mov rdx, rsi
lea rax, [rax + rax*8]
mov rax, qword [r12 + rax*8 + 0x30]
add rax, 8
mov qword [rsp + 0x20], rax
call fcn.00441480
test rax, rax
je 0x441a5d
movzx edx, byte [rax + 0x24]
test dl, 8
jne 0x441a5d
mov rcx, qword [rax + 0xf0]
or edx, 8
mov rcx, qword [rcx + 8]
cmp dword [rcx + 8], 2
mov byte [rax + 0x24], dl
je 0x441ab0
add rbx, 0x18
cmp rbx, rbp
jae 0x441ad3
movsxd rax, dword [rbx + 8]
mov r9, qword [rdi + rax*8]
test r9, r9
je 0x441a00
movzx eax, byte [r9 + 0x18]
sub eax, 6
cmp al, 1
ja 0x441a90
nop
mov r9, qword [r9 + 0x28]
movzx eax, byte [r9 + 0x18]
sub eax, 6
cmp al, 1
jbe 0x441a80
mov qword [rsp + 0x20], 0
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.00441480
jmp 0x441a38
test byte [rax + 0x20], 4
je 0x441a5d
mov edx, dword [rax + 0x88]
test edx, edx
je 0x441a5d
mov rdx, rax
mov rcx, rsi
call fcn.00441950
test eax, eax
jne 0x441a5d
xor eax, eax
jmp 0x441ad8
mov eax, 1
mov rdx, qword [r14 + 0xe0]
test rdx, rdx
je 0x44198f
cmp qword [rdx], r13
je 0x44198f
mov rcx, r13
mov dword [rsp + 0x3c], eax
call fcn.004d4f88
mov eax, dword [rsp + 0x3c]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x461230
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movzx edx, byte [rcx]
lea r8, [rcx + 1]
test dl, dl
je 0x461256
mov ecx, eax
add r8, 1
shl ecx, 5
add edx, ecx
add eax, edx
movzx edx, byte [r8 - 1]
test dl, dl
jne 0x461240
ret
Function at 0x482df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [rsp + 0x60]
mov rbx, r8
mov r8, qword [r9 + 8]
mov r11, rcx
mov r10, rdx
mov ecx, dword [r9 + 0x40]
mov rax, qword [r8 + 8]
shr rax, cl
test eax, eax
je 0x482ee0
mov eax, eax
cmp qword [r9 + 0x28], rax
jbe 0x482e53
mov rdx, rax
shl rdx, 5
add rdx, qword [r9 + 0x18]
movzx ecx, byte [rdx + 0x14]
shr cl, 4
test cl, cl
jne 0x482e53
mov qword [rsp + 0x60], rdx
xor r9d, r9d
mov rdx, r11
mov rcx, r10
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp rax
sub rax, qword [r9 + 0x30]
mov rdx, qword [r9 + 0x38]
mov r9, qword [rdx + rax*8]
test r9, r9
jne 0x482e86
mov rax, qword [r11 + 0x20]
lea rcx, str._F_P:_corrupt_input:__B_n
mov rdx, qword [r10 + 0xf0]
call qword [rax + 0x58]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov r9, qword [r9 + 0x28]
movzx eax, byte [r9 + 0x18]
sub eax, 6
cmp al, 1
jbe 0x482e82
movzx edx, byte [r9 + 0x5d]
or byte [r9 + 0x5c], 0x20
test dl, 0x20
je 0x482eb2
mov rax, r9
mov rax, qword [rax + 0x68]
test byte [rax + 0x5d], 0x20
jne 0x482ea4
or byte [rax + 0x5c], 0x20
test rsi, rsi
jne 0x482ec5
mov qword [rsp + 0x60], 0
jmp 0x482e41
and edx, 0x10
je 0x482eb7
mov rax, qword [r9 + 0x78]
movzx edx, byte [rax + 0x24]
shr dl, 3
xor edx, 1
and edx, 1
mov dword [rsi], edx
jmp 0x482e7b
xor eax, eax
jmp 0x482e7b