joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov eax, 0x68
call fcn.005555e0
sub rsp, rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rsi
mov rsi, qword [rsp + 0x98]
mov ebx, dword [rsi]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
test ebx, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov r14, qword [rsp + 0x90]
mov r10, r9
mov rdi, r8
mov r12, rdx
mov r13, rcx
je 0x5001e7
test rdi, rdi
je 0x5001e7
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x5001c2
cmp rdi, 0x10
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x28], r15
movsxd r15, ebx
jb 0x5002c0
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x58], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
nop
nop
nop
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x500287
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [rsi + rcx - 8], rax
jne 0x500271
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
dec r12
jne 0x500250
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x58]
test rdi, rdi
mov r15, qword [rsp + 0x28]
je 0x500305
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop
nop
nop
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
dec rdi
mov byte [rcx + r12 - 1], al
jne 0x5002f0
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov dword [rsi], ebx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x523b40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.005555e0
sub rsp, rax
mov eax, dword [r8 + 8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
cmp dword [rdx + 8], eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, rcx
jge 0x523b70
mov rbx, r8
jmp 0x523b76
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
cmp edx, dword [rcx + 0xc]
jg 0x523b83
mov rax, rcx
jmp 0x523b88
call fcn.00480fa0
test rax, rax
jne 0x523ba1
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x523bd4
mov r9, r8
nop
mov rax, qword [rbx]
mov rcx, qword [rsi]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x523bb0
cmp r8d, dword [rbx + 8]
movsxd rdx, r8d
jge 0x523bfd
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x523be1
mov edx, dword [rbx + 8]
test edx, edx
mov dword [rdi + 8], edx
jle 0x523c29
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rdi]
lea r8, [rax + rcx*8]
mov rax, qword [r8]
sub r8, 8
test rax, rax
jne 0x523c26
dec edx
test edx, edx
jg 0x523c14
mov dword [rdi + 8], edx
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x28
ret
Function at 0x52e2c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x218
call fcn.005555e0
sub rsp, rax
mov rax, qword [0x005c3458]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x210], rbx
mov qword [rsp + 0x208], rbp
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1f8], rdi
mov rdi, qword [rsp + 0x258]
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1e8], r13
mov r13, rcx
mov qword [rsp + 0x1d8], r15
mov r15, qword [rsp + 0x248]
mov r12d, 1
movsxd rbx, r9d
mov rcx, r15
mov qword [rsp + 0x50], r8
mov esi, edx
mov dword [rsp + 0x44], r12d
call fcn.004c3f70
test eax, eax
mov ebp, eax
mov dword [rsp + 0x48], eax
jns 0x52e355
xor eax, eax
jmp 0x52e4fd
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x1e0], r14
call fcn.005421a0
test r13, r13
mov r14d, dword [rsp + 0x250]
jne 0x52e378
xor esi, esi
jmp 0x52e39e
cmp esi, 0xffffffff
jne 0x52e39e
xor esi, esi
mov rax, r13
cmp byte [r13], sil
je 0x52e39a
cmp esi, 0x80000000
jae 0x52e39a
inc rax
inc esi
cmp byte [rax], 0
jne 0x52e388
btr esi, 0x1f
test r14d, r14d
je 0x52e4e6
mov qword [rsp + 0x58], rbx
nop
mov eax, r12d
mov ebx, r14d
cmp r14d, ebp
cmovg ebx, ebp
shr eax, 0x18
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x40], al
mov eax, r12d
mov r9, r15
shr eax, 0x10
mov r8d, esi
mov rdx, r13
mov byte [rsp + 0x41], al
mov eax, r12d
mov dword [rsp + 0x4c], ebx
shr eax, 8
mov byte [rsp + 0x43], r12b
mov qword [rsp + 0x20], 0
mov byte [rsp + 0x42], al
call fcn.00541df0
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.005420a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov r8d, 4
call fcn.005420a0
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.005420c0
movsxd rbp, ebx
lea rdx, [rsp + 0x180]
mov r8, rbp
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x240]
cmp eax, 1
jle 0x52e4ce
movsxd r12, dword [rsp + 0x48]
lea ebx, [rax - 1]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x180]
mov qword [rsp + 0x28], rax
mov r8d, esi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], r12
call fcn.005423c0
test rbp, rbp
jle 0x52e4c0
lea r8, [rsp + 0x180]
mov rcx, rdi
mov rdx, rbp
sub r8, rdi
nop
nop
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x52e4b0
dec rbx
jne 0x52e464
mov r12d, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x4c]
inc r12d
add rdi, rbp
sub r14d, ebx
mov ebp, dword [rsp + 0x48]
mov dword [rsp + 0x44], r12d
jne 0x52e3b0
lea rcx, [rsp + 0x60]
call fcn.00542290
mov r14, qword [rsp + 0x1e0]
mov eax, 1
mov r15, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1e8]
mov r12, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x200]
mov rbp, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x1c0]
call fcn.005555b0
add rsp, 0x218
ret
Function at 0x5342e0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.005555e0
sub rsp, rax
lea rcx, str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test rax, rax
je 0x53430a
mov rcx, rax
add rsp, 0x28
jmp fcn.004768e0
call fcn.0054a210
xor edx, edx
mov ecx, edx
cmp byte [rax], cl
je 0x534328
cmp ecx, 0x80000000
jae 0x534328
inc rax
inc ecx
cmp byte [rax], dl
jne 0x534317
btr ecx, 0x1f
lea rax, [0x005de378]
inc ecx
cmp byte [reloc.WS2_32.dll_WSAGetLastError], dl
je 0x534352
nop
cmp edx, 0x80000000
jae 0x534352
inc rax
inc edx
cmp byte [rax], 0
jne 0x534340
btr edx, 0x1f
mov qword [rsp + 0x40], rbx
mov r8d, 0x231
lea ebx, [rdx + rcx + 1]
lea rdx, [0x005de388]
mov qword [rsp + 0x48], rdi
mov ecx, ebx
call fcn.00472400
test rax, rax
mov rdi, rax
jne 0x53438f
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
movsxd rbx, ebx
call fcn.0054a210
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.004766d0
lea rdx, [0x005de3a4]
mov r8, rbx
mov rcx, rdi
call fcn.00476730
lea rdx, str.openssl.cnf
mov r8, rbx
mov rcx, rdi
call fcn.00476730
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
Function at 0x541df0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, pe_nt_image_headers64
call fcn.005555e0
sub rsp, rax
mov rax, qword [0x005c3458]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xc0], r14
xor eax, eax
test r9, r9
mov qword [rsp + 0xb8], r15
mov r15, qword [rsp + 0x120]
mov r12, r9
movsxd rdi, r8d
mov r14, rdx
mov rsi, rcx
je 0x541e59
mov eax, 1
mov qword [rcx], r9
jmp 0x541e5c
mov r12, qword [rcx]
test rdx, rdx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xc8], r13
je 0x541f55
mov rcx, r12
call fcn.004c3f40
mov ebx, 0x80
cmp eax, ebx
mov ebp, eax
jle 0x541ea6
lea r8, str.j____int_sizeof_ctx__key_
lea edx, [rbx - 0x2e]
lea rcx, [0x005df9c8]
call fcn.00473480
cmp ebp, edi
jge 0x541efc
lea rcx, [rsi + 8]
mov r8, r15
mov rdx, r12
call fcn.004d5f70
test eax, eax
je 0x542040
lea rcx, [rsi + 8]
mov r8, rdi
mov rdx, r14
call fcn.004d61e0
test eax, eax
je 0x542040
lea rbp, [rsi + 0x98]
lea rdx, [rsi + 0x9c]
lea rcx, [rsi + 8]
mov r8, rbp
call fcn.004d6200
test eax, eax
je 0x542040
jmp 0x541f38
test edi, edi
js 0x541f04
cmp edi, ebx
jle 0x541f1c
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x5f
call fcn.00473480
lea rcx, [rsi + 0x9c]
mov r8, rdi
mov rdx, r14
call sub.msvcrt.dll_memcpy
lea rbp, [rsi + 0x98]
mov dword [rbp], edi
mov eax, dword [rbp]
cmp eax, ebx
je 0x541f5d
sub ebx, eax
lea rcx, [rax + rsi + 0x9c]
xor edx, edx
mov r8d, ebx
call sub.msvcrt.dll_memset
jmp 0x541f5d
test eax, eax
je 0x54202f
lea rbx, [rsi + 0x9d]
mov edi, 0x40
lea rcx, [rsp + 0x21]
mov rdx, rbx
mov r8, rdi
nop
nop
nop
movzx eax, byte [rdx - 1]
add rcx, 2
add rdx, 2
xor al, 0x36
mov byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor al, 0x36
dec r8
mov byte [rcx - 2], al
jne 0x541f80
lea rcx, [rsi + 0x38]
mov r8, r15
mov rdx, r12
call fcn.004d5f70
test eax, eax
je 0x542040
mov rcx, r12
call fcn.004c3f40
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x38]
movsxd r8, eax
call fcn.004d61e0
test eax, eax
je 0x542040
lea rdx, [rsp + 0x21]
nop
nop
movzx eax, byte [rbx - 1]
add rdx, 2
add rbx, 2
xor al, 0x5c
mov byte [rdx - 3], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
dec rdi
mov byte [rdx - 2], al
jne 0x541fe0
lea rcx, [rsi + 0x68]
mov r8, r15
mov rdx, r12
call fcn.004d5f70
test eax, eax
je 0x542040
mov rcx, r12
call fcn.004c3f40
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x68]
movsxd r8, eax
call fcn.004d61e0
test eax, eax
je 0x542040
lea rdx, [rsi + 0x38]
lea rcx, [rsi + 8]
call fcn.004d6500
test eax, eax
jne 0x542044
xor eax, eax
jmp 0x542049
mov eax, 1
mov r15, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xa0]
call fcn.005555b0
add rsp, 0xf8
ret
Function at 0x544190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov eax, 0xb8
call fcn.005555e0
sub rsp, rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x90], r12
mov r12, rcx
xor ebx, ebx
mov rcx, r9
mov qword [rsp + 0x78], r15
mov rbp, rdx
mov rsi, rbx
call fcn.004c3f70
test eax, eax
movsxd r15, eax
js 0x544486
mov qword [rsp + 0x98], rdi
mov edi, dword [rsp + 0xe0]
cmp edi, 0xffffffff
jne 0x544292
mov edi, r15d
mov rcx, qword [r12 + 0x18]
mov qword [rsp + 0x80], r14
call fcn.00480cb0
mov rcx, r12
lea r14d, [rax - 1]
call fcn.004bf460
and r14d, 7
mov r12d, eax
jne 0x544235
mov byte [rbp], bl
inc rbp
dec r12d
cmp edi, 0xfffffffe
jne 0x5442c9
mov edi, r12d
sub edi, r15d
sub edi, 2
test edi, edi
jle 0x544348
lea rdx, [0x005dfbe8]
mov r8d, 0xda
mov ecx, edi
call fcn.00472400
test rax, rax
mov rsi, rax
jne 0x544336
lea r9, str..crypto_rsa_rsa_pss.c
lea edx, [rax + 0x7d]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], 0xde
call fcn.00475480
jmp 0x54446e
cmp edi, 0xfffffffe
jne 0x54429c
jmp 0x544205
cmp edi, 0xfffffffe
jge 0x544205
mov edx, 0x7d
lea r9, [0x005dfbb8]
mov dword [rsp + 0x20], SetErrorInfo
lea ecx, [rdx - 0x79]
lea r8d, [rdx + 0xb]
call fcn.00475480
mov eax, ebx
jmp 0x544301
lea eax, [r15 + rdi + 2]
cmp r12d, eax
jge 0x544247
mov edx, 0x7d
lea r9, [0x005dfbd0]
mov dword [rsp + 0x20], 0xd5
lea ecx, [rdx - 0x79]
lea r8d, [rdx - 0xf]
call fcn.00475480
mov eax, ebx
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0x78]
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov edx, edi
mov rcx, rax
call fcn.004c3c10
test eax, eax
jle 0x54446e
mov qword [rsp + 0x88], r13
mov r13d, r12d
lea rcx, [rsp + 0x38]
sub r13d, r15d
lea eax, [r13 - 1]
cdqe
add rax, rbp
mov qword [rsp + 0x30], rax
call fcn.004d5f00
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.004d5f70
lea rdx, [0x00588088]
lea rcx, [rsp + 0x38]
mov r8d, 8
call fcn.004d61e0
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x38]
mov r8, r15
call fcn.004d61e0
test edi, edi
je 0x5443c3
lea rcx, [rsp + 0x38]
movsxd r8, edi
mov rdx, rsi
call fcn.004d61e0
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.004d63b0
lea rcx, [rsp + 0x38]
call fcn.004d62b0
mov rax, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x30]
lea edx, [r13 - 1]
mov r9d, r15d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.004e1990
test eax, eax
jne 0x544466
sub r13d, edi
sub r13d, 2
movsxd rdx, r13d
add rdx, rbp
inc rdx
xor byte [rdx - 1], 1
test edi, edi
jle 0x544442
test edi, edi
movsxd r8, edi
jle 0x544442
nop
nop
nop
nop
movzx eax, byte [rbx + rsi]
inc rbx
inc rdx
xor byte [rdx - 1], al
cmp rbx, r8
jl 0x544430
test r14d, r14d
je 0x544459
mov ecx, 8
mov eax, 0xff
sub ecx, r14d
sar eax, cl
and byte [rbp], al
movsxd rax, r12d
mov ebx, 1
mov byte [rax + rbp - 1], 0xbc
mov r13, qword [rsp + 0x88]
test rsi, rsi
je 0x5442f7
mov rcx, rsi
call fcn.004728d0
mov eax, ebx
jmp 0x5442f9
mov eax, ebx
jmp 0x544309
Function at 0x547cb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.005555e0
sub rsp, rax
mov rax, qword [0x005c3458]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
mov ebp, dword [rsp + 0xb0]
test bpl, 7
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r15
mov r15, r8
mov rbx, rdx
mov r13, rcx
jne 0x547db8
cmp ebp, 8
jb 0x547db8
mov qword [rsp + 0x68], rdi
lea rcx, [r15 + 8]
mov r8, rbp
mov rdx, r9
mov qword [rsp + 0x60], r12
mov edi, 1
mov qword [rsp + 0x50], r14
call sub.msvcrt.dll_memcpy
lea rax, [0x00589740]
test rbx, rbx
lea r12d, [rdi + 5]
mov qword [rsp + 0x70], rsi
cmovne rax, rbx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
test ebp, ebp
lea rbx, [r15 + 8]
je 0x547d92
lea esi, [rbp - 1]
shr esi, 3
inc esi
nop
nop
nop
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov r8, r13
mov qword [rsp + 0x28], rax
call fcn.004d73a0
xor byte [rsp + 0x27], dil
mov rax, qword [rsp + 0x28]
mov qword [rbx], rax
add rbx, 8
inc edi
dec rsi
jne 0x547d60
dec r12
jne 0x547d45
mov rax, qword [rsp + 0x20]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov qword [r15], rax
lea eax, [rbp + 8]
jmp 0x547dbd
mov eax, 0xffffffff
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.005555b0
add rsp, 0x88
ret

Function at 0x54b730
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x48
call fcn.005555e0
sub rsp, rax
test r8, r8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rbx, rdx
mov rsi, rcx
mov rdi, r8
jne 0x54b770
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
test rcx, rcx
je 0x54b808
test rdx, rdx
je 0x54b7c8
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.00477b90
test rax, rax
jne 0x54b7f0
lea rdx, [0x005e2118]
sub rdx, rbx
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x54b7b7
inc rbx
test eax, eax
jne 0x54b7a5
test ecx, ecx
jne 0x54b7c8
mov rcx, rdi
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x54b810
mov rcx, qword [rsi + 0x10]
lea rax, str.default
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.00477b90
test rax, rax
je 0x54b75a
mov rax, qword [rax + 0x10]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
mov rcx, r8
call sub.msvcrt.dll_getenv
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x7ff74be6f020
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7ff74be6f1a7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x7ff74be6f051
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff74be6f037
add dl, dl
jne 0x7ff74be6f05e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff74be6f0be
xor eax, eax
add dl, dl
jne 0x7ff74be6f06d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff74be6f175
add dl, dl
jne 0x7ff74be6f07e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff74be6f08b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff74be6f098
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff74be6f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x7ff74be6f0b2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x7ff74be6f046
mov eax, 1
add dl, dl
jne 0x7ff74be6f0ce
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ff74be6f0db
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff74be6f0c3
sub eax, ebx
mov ebx, 1
jne 0x7ff74be6f114
mov ecx, 1
add dl, dl
jne 0x7ff74be6f0f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff74be6f103
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff74be6f0eb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff74be6f046
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7ff74be6f130
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ff74be6f13d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff74be6f125
cmp eax, 0x7d00
jae 0x7ff74be6f163
cmp eax, 0x500
jb 0x7ff74be6f15e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff74be6f046
cmp eax, 0x7f
ja 0x7ff74be6f166
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff74be6f046
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x7ff74be6f19a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x7ff74be6f046
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4d9510
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d9f12
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4d9faa
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4d9f8e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9f82
cmp qword [rbp - 0x10], 0
je 0x2fc4d9f82
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9f48
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d9fab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da0b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da0d8
mov eax, 0
jmp 0x2fc4da126
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da101
mov eax, 0
jmp 0x2fc4da126
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da121
mov eax, 0
jmp 0x2fc4da126
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da12c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da1aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da1a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da1a1
mov rax, qword [rbp - 8]
jmp 0x2fc4da1bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da174
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1407b7268
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407b73ef
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407b7299
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b727f
add dl, dl
jne 0x1407b72a6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b7306
xor eax, eax
add dl, dl
jne 0x1407b72b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b73bd
add dl, dl
jne 0x1407b72c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b72d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b72e0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b72ed
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407b72fa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407b728e
mov eax, 1
add dl, dl
jne 0x1407b7316
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b7323
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b730b
sub eax, ebx
mov ebx, 1
jne 0x1407b735c
mov ecx, 1
add dl, dl
jne 0x1407b733e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b734b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b7333
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b728e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407b7378
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b7385
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b736d
cmp eax, 0x7d00
jae 0x1407b73ab
cmp eax, 0x500
jb 0x1407b73a6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b728e
cmp eax, 0x7f
ja 0x1407b73ae
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b728e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407b73e2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407b728e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20