joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rax, qword [rdx + 0xe0]
or byte [rdx + 0x24], 8
mov rbx, rdx
mov rdx, qword [rax + 0xc0]
mov rdi, rcx
mov rbp, r8
test rdx, rdx
je 0x482f2b
test byte [rdx + 0x24], 8
je 0x4830d0
mov rax, qword [rbx + 0xf0]
test byte [rbx + 0x20], 4
mov rax, qword [rax + 0xf0]
mov rsi, qword [rax + 0x350]
je 0x482fe0
mov eax, dword [rbx + 0x88]
test eax, eax
je 0x482fe0
cmp rbx, rsi
je 0x483030
lea r13, [rsp + 0x40]
mov r8, rbx
mov rdx, rdi
mov rcx, r13
call fcn.00476fb0
test rsi, rsi
setne r14b
test eax, eax
je 0x48301e
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rax
ja 0x482fad
jmp 0x4830e2
mov rax, qword [rsp + 0x48]
add rax, 0x18
cmp rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
jae 0x4830e2
mov r9, r13
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.00483100
test eax, eax
jne 0x482f94
xor r14d, r14d
xor r12d, r12d
xor eax, eax
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x3c], eax
call fcn.00470120
mov eax, dword [rsp + 0x3c]
jmp 0x482ff2
test rsi, rsi
mov r12d, 1
mov eax, 1
setne r14b
test r14b, r14b
mov rdx, qword [rbx + 0xe0]
jne 0x483037
mov rdx, qword [rdx + 0xd0]
test rdx, rdx
je 0x48301e
test r12b, r12b
je 0x48301e
test byte [rdx + 0x24], 8
mov eax, 1
je 0x4830b5
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [rbx + 0xe0]
cmp qword [rdx + 0xc8], 0
je 0x483070
lea r13, [rsp + 0x40]
mov rdx, rdi
mov r8, rsi
mov rcx, r13
xor r12d, r12d
call fcn.00476fb0
mov edx, eax
xor eax, eax
test edx, edx
jne 0x483080
mov rdx, qword [rbx + 0xe0]
jmp 0x482ffe
mov r12d, 1
mov eax, 1
jmp 0x482ffe
mov r9, rbp
mov r8, rsi
mov rdx, rbx
mov qword [rsp + 0x20], r13
mov rcx, rdi
call fcn.00488c20
mov rdx, rsi
mov rcx, r13
test eax, eax
setne r12b
movzx eax, r12b
mov dword [rsp + 0x3c], eax
call fcn.00470120
mov eax, dword [rsp + 0x3c]
jmp 0x48305f
mov r8, rbp
mov rcx, rdi
call fcn.00482ef0
test eax, eax
setne al
movzx eax, al
jmp 0x48301e
call fcn.00482ef0
test eax, eax
jne 0x482f2b
jmp 0x48301e
mov r12d, 1
mov eax, 1
jmp 0x482fca
Function at 0x490a60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, qword [rsp + 0xd0]
mov rax, qword [rdi + 8]
lea rsi, [r9 + 0x10]
mov r13, rcx
mov rbp, rdx
mov r12d, r8d
mov rbx, r9
cmp rsi, rax
jb 0x490ab0
add rax, 1
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [0x004fd53b]
mov r8, r9
sub r8, qword [rdi]
mov r9d, r12d
mov qword [rsp + 0x20], rax
lea rdx, str._03x__.s
call sub.msvcrt.dll_fprintf
cmp r12d, 2
je 0x490c94
cmp r12d, 4
je 0x490b02
test r12d, r12d
je 0x490cb3
lea rdx, str._unknown_directory_type:__d__n
mov r8d, r12d
mov rcx, r13
call sub.msvcrt.dll_fprintf
mov rax, qword [rdi + 8]
jmp 0x490a91
mov r9, r13
mov r8d, 8
mov edx, 1
lea rcx, str.Language
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 8]
lea rcx, [rbx + 0xe]
call qword [rax + 0x50]
lea rcx, [rbx + 0xc]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 8]
call qword [rax + 0x50]
lea rcx, [rbx + 0xa]
mov r15, rax
mov rax, qword [rbp + 8]
call qword [rax + 0x50]
lea rcx, [rbx + 8]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp + 8]
call qword [rax + 0x50]
lea rcx, [rbx + 4]
mov r14, rax
mov rax, qword [rbp + 8]
call qword [rax + 0x38]
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 8]
call qword [rax + 0x38]
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x30], r15d
lea rdx, str._Table:_Char:__d__Time:__08lx__Ver:__d__d__Num_Names:__d__IDs:__d_n
mov r8, qword [rsp + 0x58]
mov dword [rsp + 0x20], r14d
mov r15d, r15d
mov r9, qword [rsp + 0x48]
lea r14, [rbx + r15*8 + 0x10]
mov dword [rsp + 0x38], ecx
mov rcx, r13
mov dword [rsp + 0x28], r8d
mov r8d, eax
call sub.msvcrt.dll_fprintf
lea eax, [r12 + 1]
mov dword [rsp + 0x48], eax
jmp 0x490c15
mov rdx, qword [rdi + 8]
lea r15, [rsi + 8]
lea rax, [rdx + 1]
cmp r15, rdx
jae 0x490c02
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov qword [rsp + 0x28], rdi
mov rcx, r13
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rsi
mov r9d, 1
mov qword [rsp + 0x30], rax
call fcn.00490ce0
mov rdx, qword [rdi + 8]
cmp rbx, rax
mov rsi, r15
cmovb rbx, rax
cmp rax, rdx
jae 0x490a95
cmp rsi, r14
jne 0x490bc0
mov r14d, dword [rsp + 0x50]
add r12d, 1
lea r14, [rsi + r14*8]
jmp 0x490c80
mov rdx, qword [rdi + 8]
lea r15, [rsi + 8]
lea rax, [rdx + 1]
cmp r15, rdx
jae 0x490c6d
mov rdx, rbp
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8d, r12d
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rsi
mov rcx, r13
mov qword [rsp + 0x30], rax
call fcn.00490ce0
mov rdx, qword [rdi + 8]
cmp rbx, rax
mov rsi, r15
cmovb rbx, rax
cmp rax, rdx
jae 0x490a95
cmp rsi, r14
jne 0x490c30
cmp rsi, rbx
mov rax, rbx
cmovae rax, rsi
jmp 0x490a95
mov r9, r13
mov r8d, 4
mov edx, 1
lea rcx, str.Name
call sub.msvcrt.dll_fwrite
jmp 0x490b1c
mov r9, r13
mov r8d, 4
mov edx, 1
lea rcx, str.Type
call sub.msvcrt.dll_fwrite
jmp 0x490b1c
Function at 0x4a2730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rax, qword [rax + 0x360]
mov rbx, rdx
mov rdi, rcx
mov rsi, r8
lea rcx, [rbx + 0x10]
movzx ebp, byte [rax + 0x37d]
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
and ebp, 1
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov rax, qword [rdi]
call qword [rax + 0x98]
lea rcx, [rbx + 0x12]
mov word [rsi + 0x30], ax
mov rax, qword [rdi]
call qword [rax + 0x98]
lea rcx, [rbx + 0x14]
mov word [rsi + 0x32], ax
mov rax, qword [rdi]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x18]
test bpl, bpl
mov dword [rsi + 0x28], eax
mov rax, qword [rdi]
jne 0x4a2850
call qword [rax + pe_nt_image_headers64]
mov qword [rsi + 0x10], rax
mov rax, qword [rdi]
lea rcx, [rbx + 0x1c]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x20]
mov qword [rsi + 0x18], rax
mov rax, qword [rdi]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x24]
mov qword [rsi + 0x20], rax
mov rax, qword [rdi]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbx + 0x28]
mov dword [rsi + 0x2c], eax
mov rax, qword [rdi]
call qword [rax + 0x98]
lea rcx, [rbx + 0x2a]
mov dword [rsi + 0x34], eax
mov rax, qword [rdi]
call qword [rax + 0x98]
lea rcx, [rbx + 0x2c]
mov dword [rsi + 0x38], eax
mov rax, qword [rdi]
call qword [rax + 0x98]
lea rcx, [rbx + 0x2e]
mov dword [rsi + 0x3c], eax
mov rax, qword [rdi]
call qword [rax + 0x98]
lea rcx, [rbx + 0x30]
mov dword [rsi + 0x40], eax
mov rax, qword [rdi]
call qword [rax + 0x98]
lea rcx, [rbx + 0x32]
mov dword [rsi + 0x44], eax
mov rax, qword [rdi]
call qword [rax + 0x98]
mov dword [rsi + 0x48], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [rax + 0x88]
mov qword [rsi + 0x10], rax
jmp 0x4a27af
Function at 0x4a8d50
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8d, 1
mov rdx, rcx
lea rcx, [0x00533ac0]
jmp fcn.00427860

Function at 0x4a97d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x44]
mov r13d, dword [rcx + 0x40]
test eax, eax
mov rsi, rcx
mov r12, rdx
mov edi, r8d
mov ebp, r9d
jne 0x4a98a0
test r13d, r13d
je 0x4a99f5
lea eax, [r13 - 1]
xor r14d, r14d
lea r8, [rdx + rax + 1]
add rdx, 1
movzx ecx, byte [rdx - 1]
mov eax, ecx
shl eax, 0x11
add eax, ecx
add r14d, eax
mov eax, r14d
shr eax, 2
xor r14d, eax
cmp rdx, r8
jne 0x4a9810
xor edx, edx
mov eax, r14d
div dword [rsi + 0x18]
mov rax, qword [rsi]
mov edx, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x4a9960
mov r15d, r13d
jmp 0x4a985c
mov rbx, qword [rbx]
test rbx, rbx
je 0x4a9960
cmp dword [rbx + 0x10], r14d
jne 0x4a9850
cmp dword [rbx + 0x18], r13d
jne 0x4a9850
mov rcx, qword [rbx + 8]
mov r8, r15
mov rdx, r12
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4a9850
cmp dword [rbx + 0x1c], edi
jae 0x4a9985
test ebp, ebp
je 0x4a9a00
mov qword [rbx + 0x18], 0
jmp 0x4a9968
cmp r13d, 1
je 0x4a99a0
lea ebx, [r13 - 1]
mov r9, rdx
xor r11d, r11d
xor eax, eax
add rbx, 1
nop word [rax + rax]
test r13d, r13d
je 0x4a98f3
movzx edx, byte [r9]
lea r8, [r9 + 1]
xor ecx, ecx
mov r10, r8
test dl, dl
je 0x4a98eb
jmp 0x4a9920
add r10, 1
cmp byte [r10 - 1], 0
jne 0x4a9920
add ecx, 1
cmp ecx, r13d
jne 0x4a98e0
mov r14d, r11d
add eax, r11d
shl r14d, 0x11
imul r11d, r13d
add eax, r14d
mov r14d, eax
shr r14d, 2
add r13d, r11d
xor r14d, eax
jmp 0x4a9830
lea r10, [r9 + rbx]
jmp 0x4a9938
movzx edx, byte [r8]
add r8, 1
movzx ecx, dl
mov r9, r8
mov edx, ecx
shl edx, 0x11
add edx, ecx
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
cmp r8, r10
jne 0x4a9930
add r11d, 1
jmp 0x4a98c0
test ebp, ebp
je 0x4a9a00
mov r8d, r14d
mov rdx, r12
mov rcx, rsi
call fcn.00427680
test rax, rax
mov rbx, rax
je 0x4a9985
mov dword [rax + 0x18], r13d
mov dword [rax + 0x1c], edi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [rdx + 1]
movzx edx, byte [rdx]
test edx, edx
je 0x4a99f5
xor r13d, r13d
xor eax, eax
jmp 0x4a99b5
mov r13d, ecx
mov ecx, edx
add r8, 1
shl ecx, 0x11
add edx, ecx
lea ecx, [r13 + 1]
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
movzx edx, byte [r8 - 1]
test edx, edx
jne 0x4a99b2
mov r14d, ecx
add eax, ecx
add r13d, 2
shl r14d, 0x11
add eax, r14d
mov r14d, eax
shr r14d, 2
xor r14d, eax
jmp 0x4a9830
xor r14d, r14d
jmp 0x4a9830
xor ebx, ebx
jmp 0x4a9985
Function at 0x4d08f0
Capabilities:
Query environment variable

Disassembly:
mov r9d, 1
jmp fcn.004d03b0

Function at 0x4d0910
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x00533b20]
test rax, rax
je 0x4d0930
add rsp, 0x28
pop rbx
pop rsi
ret
xor edx, edx
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rsi
test eax, eax
mov ebx, eax
jne 0x4d0960
mov rax, qword [0x00533b20]
test rax, rax
je 0x4d0990
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, eax
call fcn.004d1690
mov ecx, ebx
mov qword [0x00533b20], rax
mov rdx, rax
call rsi
test eax, eax
jne 0x4d0943
mov rcx, qword [0x00533b20]
call fcn.004d4f88
mov qword [0x00533b20], 0
lea rcx, [0x005201d0]
call fcn.004d17b0
mov qword [0x00533b20], rax
jmp 0x4d0922

Function at 0x4d2050
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00534184]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4d21d8
mov rax, qword [0x00534188]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4d209c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4d2125
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4d2080
mov rcx, rbx
call fcn.004d2cf0
test rax, rax
mov r12, rax
je 0x4d220d
mov rax, qword [0x00534188]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.004d2e20
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00534188]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4d21f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4d211e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4d2180
add dword [0x00534184], 1
cmp edi, 8
jae 0x4d2153
test dil, 4
jne 0x4d21c4
test edi, edi
je 0x4d2148
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4d21df
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x4d2148
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x4d216c
jmp 0x4d2148
add rsi, qword [0x00534188]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4d211e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004d9a00
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x4d2148
xor esi, esi
jmp 0x4d20a7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x4d2148
mov rax, qword [0x00534188]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004d9a00
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004d9a00
nop
nop dword [rax]
Function at 0x4d2960
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00534460]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00534440]
test rbx, rbx
je 0x4d29b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4d29ab
test rsi, rsi
je 0x4d29ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4d2990
lea rcx, [0x00534460]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4d2cf0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00521140]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4d2d5d
mov rcx, r8
call fcn.004d2bd0
test eax, eax
je 0x4d2d5d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4d2d5d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4d2d54
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4d2d5f
add rax, 0x28
cmp rax, r9
jne 0x4d2d40
xor eax, eax
add rsp, 0x28
ret

Function at 0x4d2ff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x4d3180
cmp byte [rbx], 0
je 0x4d3141
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4d3170
test al, 0x10
je 0x4d3141
lea rdi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
mov rbx, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rbx]
add rbx, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4d304e
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
mov ecx, eax
cmove rbx, rdx
add cl, al
sbb rbx, 3
sub rbx, rdi
lea rcx, [rbx + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x4d3160
lea r9, [rax + 0x244]
mov rdx, rdi
lea rbp, [rbx + 1]
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0x244], 0
mov r9, rax
jne 0x4d3120
add rbx, rax
mov eax, 0x2a
mov ecx, 0x20
lea rdx, [rsi + 0x130]
mov word [rbx], ax
xor eax, eax
mov qword [rsi + 0x238], 0xffffffffffffffff
mov rdi, rdx
mov dword [rsi + 0x240], 0
mov qword [rsi + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rsi
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx eax, byte [rsi + rbx + 0x243]
add rbx, r9
cmp al, 0x5c
je 0x4d30c5
cmp al, 0x2f
je 0x4d30c5
mov edx, 0x5c
mov word [rbx], dx
lea rbx, [r9 + rbp]
jmp 0x4d30c5
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [rax], 0x14
mov rax, rsi
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x4d3107
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [rax], 2
jmp 0x4d3107
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [rax], 0xe
jmp 0x4d3107
Function at 0x4d9a00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004d5190
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.004d5190
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push rbp
mov rbp, rsp
pop rbp
jmp fcn.00401530
Function at 0x1400080a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14001d9d0], rbx
je 0x1400080ec
cmp rax, rbx
jne 0x1400080df
mov ebx, 1
mov esi, ebx
jmp 0x1400080f1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400080c4
mov ebx, 1
mov eax, dword [0x14001d9d8]
cmp eax, ebx
jne 0x140008107
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000816c
mov eax, dword [0x14001d9d8]
test eax, eax
jne 0x140008166
mov dword [0x14001d9d8], ebx
lea r15, [0x1400106b0]
lea rdi, [0x140010698]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140008158
test eax, eax
jne 0x14000815c
cmp qword [rdi], 0
je 0x14000814d
mov rax, qword [rdi]
mov rcx, qword [0x140010670]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000812e
test eax, eax
je 0x14000816c
mov eax, 0xff
jmp 0x140008248
mov dword [0x14001d404], ebx
mov eax, dword [0x14001d9d8]
cmp eax, ebx
jne 0x140008193
lea rdx, [0x140010690]
lea rcx, [0x140010678]
call sub.msvcrt.dll__initterm
mov dword [0x14001d9d8], 2
test esi, esi
jne 0x1400081a0
xor eax, eax
xchg qword [0x14001d9d0], rax
cmp qword [0x14001d9e0], 0
je 0x1400081d4
lea rcx, [0x14001d9e0]
call fcn.140008ac0
test eax, eax
je 0x1400081d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14001d9e0]
mov r9, qword [0x140010670]
call r9
mov r8, qword [0x14001d418]
mov rdx, qword [0x14001d410]
mov ecx, dword [0x14001d408]
call fcn.140004a48
mov dword [0x14001d400], eax
cmp dword [0x14001d420], 0
jne 0x140008204
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001d404], 0
jne 0x140008219
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14001d400]
jmp 0x140008248
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14015c000
add rsp, 0x28
jmp 0x1400080a0

Function at 0x140008590
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000859c
push rbx
sub rsp, 0x540
mov rax, qword [0x14001d0a0]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140008619
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140008639
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400082a0
add rsp, 0x540
pop rbx
ret
Function at 0xc94370
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xc9437d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xc9438d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xc94375
lea eax, [rcx + 1]
jmp 0xc9439b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xc943ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xc94394
sub eax, 3
jb 0xc943ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xc9441d
sar eax, 1
movsxd rbp, eax
jb 0xc94404
jmp 0xc943dc
add ebx, ebx
jne 0xc943da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xc94404
inc ecx
add ebx, ebx
jne 0xc943ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xc94404
call r11
adc ecx, ecx
add ebx, ebx
jne 0xc943fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xc943ec
add ecx, 2
jmp 0xc94409
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00c94332
jmp 0xc9437d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x379a00
mov dl, 0x8a
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xc94469
cmp rsi, rcx
jae 0xc94471
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xc94450
cmp al, 0x8f
ja 0xc94450
cmp byte [rsi - 2], 0xf
je 0xc94456
sub al, 0xe8
cmp al, 1
ja 0xc9443a
cmp rsi, rcx
jae 0xc94471
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xc94440
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xc94471
lodsb al, byte [rsi]
jmp 0xc94450
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x889000]
mov eax, dword [rdi]
or eax, eax
je 0xc944ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8943d8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xc9447e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xc944c8
mov qword [rbx], rax
add rbx, 8
jmp 0xc9449e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xc94512
cmp al, 0xef
ja 0xc944fa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xc944da
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xc944e9
mov eax, dword [rdi]
add rdi, 4
jmp 0xc944e9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xc94566
sub rsp, 0xffffffffffffff80
jmp 0x4715c0