joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008552
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
mov ecx, 0x81a46190
xor eax, eax
mov ebp, 0x67b5fb43
mov r14d, 0x83f50b0b
mov r15d, 0x50d2e95c
cmp ecx, 0xca9ecb2
jg 0x1400085b9
cmp ecx, 0x9b30f48c
jle 0x1400085db
cmp ecx, 0xbf7a5910
je 0x140008621
cmp ecx, 0xe7b8a952
je 0x140008614
cmp ecx, 0x9b30f48d
jne 0x14000858c
invalid
jmp 0x14000866a
cmp ecx, 0x50d2e95b
jg 0x1400085f2
cmp ecx, 0xca9ecb3
je 0x140008614
cmp ecx, 0x2dd08aec
jne 0x14000858c
mov rbx, qword [rbx]
mov ecx, 0x81a46190
jmp 0x14000858c
cmp ecx, 0x81a46190
je 0x140008638
cmp ecx, 0x83f50b0b
jne 0x14000858c
mov ecx, 0x2dd08aec
jmp 0x14000858c
cmp ecx, 0x50d2e95c
je 0x14000864d
cmp ecx, 0x67b5fb43
jne 0x14000858c
test r12b, 1
mov ecx, 0xe7b8a952
cmovne ecx, r15d
jmp 0x14000858c
mov ecx, 0x9b30f48d
mov rdi, rax
mov edi, eax
jmp 0x14000858c
test rax, rax
sete byte [rsp + 0x2f]
mov ecx, 0x67b5fb43
mov r12b, byte [rsp + 0x2f]
jmp 0x14000858c
cmp qword [rbx + 0x30], 0
mov ecx, 0xbf7a5910
cmove ecx, ebp
xor r12d, r12d
jmp 0x14000858c
mov rcx, qword [rbx + 0x30]
mov rdx, rsi
call fcn.140007a0a
test rax, rax
mov ecx, 0xca9ecb3
cmove ecx, r14d
jmp 0x14000858c
mov rax, rdi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14000b66f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
movzx eax, byte [rcx + 0x100]
mov r9b, byte [rcx + 0x101]
mov r10d, 0x410a48fa
mov r11d, 0x1897fbff
cmp r11d, 0x7f75f355
je 0x14000b6b6
cmp r11d, 0x410a48fa
je 0x14000b6e3
cmp r11d, 0x1897fbff
jne 0x14000b68b
sub r8d, 1
mov r11d, 0x7f75f355
cmovb r11d, r10d
jmp 0x14000b68b
inc eax
movzx eax, al
mov r11b, byte [rcx + rax]
add r9b, r11b
movzx esi, r9b
mov bl, byte [rcx + rsi]
mov byte [rcx + rax], bl
mov byte [rcx + rsi], r11b
add bl, r11b
movzx r11d, bl
mov r11b, byte [rcx + r11]
xor byte [rdx], r11b
inc rdx
jmp 0x14000b685
mov byte [rcx + 0x100], al
mov byte [rcx + 0x101], r9b
pop rbx
pop rsi
ret
Function at 0x14000bee2
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov qword [rsp + 0x28], rcx
call fcn.140007709
mov rbx, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
mov eax, 0x97aab986
mov ebp, 0x7ec318bc
cmove ebp, eax
mov eax, 0x93e4cbd1
mov ecx, eax
cmp eax, 0xd3f293b6
jle 0x14000bf74
cmp ecx, 0x65e703bc
jg 0x14000bfbc
cmp ecx, 0xf4cb2810
jg 0x14000c040
cmp ecx, 0xd3f293b7
je 0x14000c115
cmp ecx, 0xd66812bb
je 0x14000c137
mov eax, ecx
cmp ecx, 0xe215372f
jne 0x14000bf1c
cmp dword [r12 + 0x3c], 0x41
mov eax, 0x192345aa
mov ecx, 0xd3f293b7
cmovge eax, ecx
jmp 0x14000bf1c
cmp ecx, 0x9ab6552a
jle 0x14000bff8
cmp ecx, 0xb6a9d119
jg 0x14000c07f
cmp ecx, 0x9ab6552b
je 0x14000c150
cmp ecx, 0xab2214f2
je 0x14000c15a
mov eax, ecx
cmp ecx, 0xb374e554
jne 0x14000bf1c
add r15, 0x28
mov eax, 0x70e28058
jmp 0x14000bf1c
cmp ecx, 0x7304fada
jg 0x14000c0b4
cmp ecx, 0x65e703bd
je 0x14000c170
cmp ecx, 0x6b7b007c
je 0x14000c189
mov eax, ecx
cmp ecx, 0x70e28058
jne 0x14000bf1c
mov eax, 0x8432ee54
jmp 0x14000bf1c
cmp ecx, 0x906c346f
jle 0x14000c0ef
cmp ecx, 0x906c3470
je 0x14000c193
cmp ecx, 0x93e4cbd1
je 0x14000c1a8
mov eax, ecx
cmp ecx, 0x97aab986
jne 0x14000bf1c
mov r14d, dword [r15 + 0xc]
add r14, rbx
mov eax, 0xbb35a189
mov esi, 1
jmp 0x14000bf1c
cmp ecx, 0xf4cb2811
je 0x14000c1c1
cmp ecx, 0x192345aa
je 0x14000c1cb
mov eax, ecx
cmp ecx, 0x1ff802dd
jne 0x14000bf1c
mov eax, dword [rsp + 0x24]
cmp eax, 4
mov eax, 0x8631e1d5
mov ecx, 0x7c0cea24
cmove eax, ecx
jmp 0x14000bf1c
cmp ecx, 0xb6a9d11a
je 0x14000c1d5
cmp ecx, 0xbb35a189
je 0x14000c1f6
mov eax, ecx
cmp ecx, 0xc8a8ece5
jne 0x14000bf1c
mov eax, 0xbb35a189
mov esi, 4
jmp 0x14000bf1c
cmp ecx, 0x7304fadb
je 0x14000c204
cmp ecx, 0x7c0cea24
je 0x14000c220
mov eax, ecx
cmp ecx, 0x7ec318bc
jne 0x14000bf1c
mov eax, dword [r15 + 0x10]
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
mov eax, 0x97aab986
jmp 0x14000bf1c
mov eax, ebp
cmp ecx, 0x81dc549f
je 0x14000bf1c
cmp ecx, 0x8432ee54
jne 0x14000c232
inc edi
mov eax, 0x65e703bd
jmp 0x14000bf1c
movsxd rax, dword [r12 + 0x3c]
cmp dword [rbx + rax], 0x4550
lea r13, [rbx + rax]
mov eax, 0x9ab6552b
mov ecx, 0x6b7b007c
cmove eax, ecx
jmp 0x14000bf1c
movzx eax, word [r13 + 0x14]
invalid
invalid
invalid
Function at 0x14002a8f0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rdx, [0x1400fe2c4]
lea rcx, str.BFD_header_file_version__s_n
call fcn.14002a2f2
xor ecx, ecx
call fcn.1400d24e3
lea rdx, [rsp + 0x30]
lea rcx, [0x14002a49c]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.1400533a6
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll__unlink
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
mov esi, dword [rsp + 0x38]
test esi, esi
jne 0x14002ab16
xor edi, edi
mov ebx, 2
xor edx, edx
mov ecx, ebx
call fcn.14004a6ee
mov rcx, rax
call sub.msvcrt.dll_strlen
cmp edi, eax
cmovl edi, eax
inc ebx
cmp ebx, 0x57
jne 0x14002a968
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
jne 0x14002a9a1
mov r12d, 0x50
jmp 0x14002aa1c
call sub.msvcrt.dll_atoi
mov r12d, eax
test eax, eax
je 0x14002a999
jmp 0x14002aa1c
mov ecx, 0xa
mov ebp, 2
call sub.msvcrt.dll_putchar
xor edx, edx
mov ecx, ebp
call fcn.14004a6ee
lea rdx, [0x1400fe307]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14002aa13
xor edx, edx
mov ecx, ebp
lea r15d, [rbp - 2]
mov r13d, esi
call fcn.14004a6ee
mov edx, edi
lea rcx, str._s
mov r8, rax
call fcn.14002a2f2
mov r14, qword [rsp + 0x20]
cmp ebx, r13d
jne 0x14002aaa9
mov ecx, 0xa
call sub.msvcrt.dll_putchar
inc ebp
cmp ebp, 0x57
jne 0x14002a9be
mov esi, ebx
mov r14d, dword [rsp + 0x3c]
cmp esi, r14d
jge 0x14002ab16
mov ebp, r12d
movsxd r13, esi
mov r15, qword [rsp + 0x48]
sub ebp, edi
mov rbx, r13
dec ebp
cmp r14d, ebx
jle 0x14002aa5d
imul rax, rbx, 0x60
mov rcx, qword [r15 + rax]
call sub.msvcrt.dll_strlen
sub ebp, eax
lea rax, [rbx + 1]
dec ebp
js 0x14002aa5d
mov rbx, rax
jmp 0x14002aa3c
lea edx, [rdi + 1]
lea r8, [0x1400fe2fc]
mov ebp, esi
lea rcx, str._n_s
call fcn.14002a2f2
imul rax, r13, 0x60
lea r13, [0x1400fe303]
mov qword [rsp + 0x20], rax
mov r14, rax
cmp ebp, ebx
je 0x14002a9af
mov rax, qword [rsp + 0x48]
mov rcx, r13
inc ebp
mov rdx, qword [rax + r14]
add r14, 0x60
call fcn.14002a2f2
jmp 0x14002aa88
mov rax, qword [rsp + 0x48]
add rax, r14
cmp byte [rax + r15 + 8], 0
je 0x14002aad7
mov ecx, 1
call qword [fcn.1400e7db0]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + r14]
call sub.msvcrt.dll_fputs
jmp 0x14002aafb
mov rcx, qword [rax]
call sub.msvcrt.dll_strlen
mov edx, eax
test edx, edx
je 0x14002aafb
mov ecx, 0x2d
mov dword [rsp + 0x2c], edx
call sub.msvcrt.dll_putchar
mov edx, dword [rsp + 0x2c]
dec edx
jmp 0x14002aae1
inc r13d
cmp ebx, r13d
je 0x14002ab0d
mov ecx, 0x20
call sub.msvcrt.dll_putchar
add r14, 0x60
jmp 0x14002aa00
mov eax, dword [rsp + 0x38]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14002b93b
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
mov rbp, r8
mov rsi, rdx
mov r13, r9
call sub.msvcrt.dll__strdup
xor edx, edx
xor ecx, ecx
mov qword [rbx + 8], rbp
mov qword [rbx], rax
mov eax, dword [rsp + 0x80]
xor r8d, r8d
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], rdx
mov qword [rbx + 0x20], rdx
mov qword [rbx + 0x28], rdx
mov qword [rbx + 0x30], rdx
mov qword [rbx + 0x38], rdx
mov qword [rbx + 0x40], rdx
mov edx, 8
mov dword [rbx + 0x54], ecx
mov rcx, rbp
mov dword [rbx + 0x50], eax
mov qword [rbx + 0x48], 8
call sub.msvcrt.dll_fseek
mov rdx, rsi
lea rcx, str._s:_failed_to_seek_to_first_archive_header_n
mov r12d, eax
test eax, eax
jne 0x14002b9ed
lea rdi, [rbx + 0x58]
mov r9, rbp
mov r8d, 0x3c
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fread
cmp rax, 0x3c
je 0x14002b9fd
test rax, rax
je 0x14002bb69
mov rdx, rsi
lea rcx, str._s:_failed_to_read_archive_header_n
call fcn.14002b2b5
mov r12d, 1
jmp 0x14002bb69
lea rdx, [0x1400fe924]
mov rcx, rdi
call fcn.14002b222
test al, al
je 0x14002ba1f
mov r8d, dword [rsp + 0x88]
mov edx, 4
jmp 0x14002ba46
lea rdx, [0x1400fe935]
mov rcx, rdi
call fcn.14002b222
test al, al
je 0x14002ba54
mov dword [rbx + 0x54], 1
mov r8d, dword [rsp + 0x88]
mov edx, 8
mov rcx, rbx
call fcn.14002b5a9
test eax, eax
jne 0x14002ba6d
jmp 0x14002b9f2
cmp dword [rsp + 0x88], 0
je 0x14002ba6d
mov rdx, rsi
lea rcx, str._s_has_no_archive_index_n
call fcn.14002b26f
lea rdx, [0x1400fe946]
mov rcx, rdi
call fcn.14002b222
test al, al
je 0x14002bb69
mov r14b, byte [rbx + 0x92]
mov byte [rbx + 0x92], 0
lea rcx, [rbx + 0x88]
xor edx, edx
mov r8d, 0xa
call sub.msvcrt.dll_strtoul
mov byte [rbx + 0x92], r14b
mov edi, eax
mov qword [rbx + 0x38], rdi
cmp rdi, 7
ja 0x14002bac8
mov r8, rdi
mov rdx, rsi
lea rcx, str._s:_long_name_table_is_too_small___size___lld__n
jmp 0x14002bade
cmp rdi, r13
jg 0x14002bad1
test eax, eax
jns 0x14002bae8
mov r8, rdi
mov rdx, rsi
lea rcx, str._s:_long_name_table_is_too_big___size___llx__n
call fcn.14002b2b5
jmp 0x14002b9f2
mov rax, qword [rbx + 0x48]
lea rcx, [rdi + 1]
lea rax, [rdi + rax + 0x3c]
mov qword [rbx + 0x48], rax
call sub.msvcrt.dll_malloc
mov qword [rbx + 0x30], rax
mov rcx, rax
test rax, rax
jne 0x14002bb1b
lea rcx, str.Out_of_memory_reading_long_symbol_names_in_archive_n
call fcn.14002b2b5
jmp 0x14002b9f2
mov r9, rbp
mov r8d, 1
mov rdx, rdi
call sub.msvcrt.dll_fread
dec rax
je 0x14002bb4f
mov rcx, qword [rbx + 0x30]
call sub.msvcrt.dll_free
xor eax, eax
mov rdx, rsi
lea rcx, str._s:_failed_to_read_long_symbol_name_string_table_n
mov qword [rbx + 0x30], rax
jmp 0x14002b9ed
test byte [rbx + 0x38], 1
je 0x14002bb5d
mov rcx, rbp
call sub.msvcrt.dll_getc
mov rdx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x38]
mov byte [rdx + rax], 0
mov eax, r12d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14003a636
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rcx
lea rcx, str.LIBCTF_WRITE_FOREIGN_ENDIAN
mov r13, rdx
mov r14, r8
call sub.msvcrt.dll_getenv
mov rcx, rbx
mov r15, qword [rbx + 0x1c0]
mov r12, rax
call fcn.140039236
test eax, eax
js 0x14003a6d6
mov ecx, dword [rbx + 0x1c0]
call fcn.1400d4de6
mov eax, eax
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x1c0]
cmp rax, r14
jae 0x14003a694
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + 0x34]
call sub.msvcrt.dll_malloc
mov rbp, rax
test rax, rax
jne 0x14003a6dd
mov edx, 0xc
mov rcx, rbx
call fcn.14003dbfd
mov eax, dword [rsp + 0x48]
add eax, 0x34
lea r9, str.ctf_write_mem:_cannot_allocate__li_bytes
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.14003b59d
xor ebp, ebp
jmp 0x14003a80a
mov rsi, qword [rbx + 8]
mov rdi, rax
mov ecx, 0xd
lea rax, [rax + 0x34]
rep movsd dword [rdi], dword [rsi]
cmp r15, r14
mov qword [rsp + 0x38], rax
mov qword [r13], 0x34
mov al, byte [rbp + 3]
jae 0x14003a709
and eax, 0xfffffffe
jmp 0x14003a70c
or eax, 1
mov byte [rbp + 3], al
mov r8, qword [rbx + 0x1b8]
mov rcx, qword [rbx + 0x1c0]
test r12, r12
je 0x14003a78b
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
jne 0x14003a747
mov edx, 0xc
mov rcx, rbx
call fcn.14003dbfd
mov eax, dword [rbx + 0x1c0]
jmp 0x14003a6bb
mov rcx, rbp
mov rdi, r12
call fcn.1400375dc
mov rsi, qword [rbx + 0x1b8]
mov rdx, qword [rbx + 8]
mov r8, r12
mov rcx, qword [rbx + 0x1c0]
mov r9d, 1
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call fcn.140037665
mov r8, r12
test eax, eax
jns 0x14003a78b
mov rcx, rbp
call sub.msvcrt.dll_free
mov rcx, r12
jmp 0x14003a7eb
mov r9, qword [rbx + 0x1c0]
cmp r15, r14
jae 0x14003a7a6
mov rdi, qword [rsp + 0x38]
mov rsi, r8
mov rcx, r9
rep movsb byte [rdi], byte [rsi]
jmp 0x14003a7fa
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
call fcn.1400d4dd0
mov esi, eax
test eax, eax
je 0x14003a7f5
mov edx, 0x413
mov rcx, rbx
call fcn.14003dbfd
mov ecx, esi
call fcn.1400dc2ae
mov rcx, rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9, str.zlib_deflate_err:__s
call fcn.14003b59d
mov rcx, rbp
call sub.msvcrt.dll_free
jmp 0x14003a6d6
mov r9, qword [rsp + 0x48]
add r9, qword [r13]
mov rcx, r12
mov qword [r13], r9
call sub.msvcrt.dll_free
mov rax, rbp
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003b35a
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rdx
mov rdi, r8
xor edx, edx
mov r8d, 1
mov esi, ecx
mov rbx, r9
call fcn.1400df9b0
mov r12, rax
test rax, rax
jns 0x14003b38e
or rbx, 0xffffffffffffffff
jmp 0x14003b404
xor r8d, r8d
mov rdx, rbx
mov ecx, esi
call fcn.1400df9b0
test rax, rax
js 0x14003b388
mov r14, qword [sym.imp.msvcrt.dll__errno]
xor r13d, r13d
test rdi, rdi
jle 0x14003b3ef
call r14
xor edx, edx
mov r8d, edi
mov ecx, esi
mov dword [rax], edx
mov rdx, rbp
call sub.msvcrt.dll__read
movsxd rbx, eax
test rbx, rbx
js 0x14003b3d5
call r14
cmp dword [rax], 4
jne 0x14003b3df
jmp 0x14003b3aa
call r14
cmp dword [rax], 4
je 0x14003b3cb
jmp 0x14003b404
add r13, rbx
test rbx, rbx
je 0x14003b3ef
sub rdi, rbx
add rbp, rbx
jmp 0x14003b3aa
xor r8d, r8d
mov rdx, r12
mov ecx, esi
call fcn.1400df9b0
test rax, rax
js 0x14003b388
mov rbx, r13
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x14003b466
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1401f8e04], 0
jne 0x14003b498
lea rcx, str.LIBCTF_DEBUG
call sub.msvcrt.dll_getenv
mov dword [0x1401f8e04], 1
test rax, rax
setne al
movzx eax, al
mov dword [0x1401f8e00], eax
add rsp, 0x28
ret
Function at 0x1400509de
Capabilities:
Hash data with crc32

Disassembly:
lea r9, [0x1401a4d80]
mov eax, ecx
add r8, rdx
not eax
cmp rdx, r8
jae 0x140050a04
mov cl, byte [rdx]
inc rdx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [r9 + rcx*4]
jmp 0x1400509ec
not eax
ret

Function at 0x1400531b2
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
jne 0x1400531e8
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
jne 0x1400531e8
mov rax, qword [0x1400ec1e0]
test rax, rax
jne 0x140053204
mov rax, qword [0x1401e2000]
jmp 0x140053204
lea rdx, str.default
mov qword [rsp + 0x30], rcx
call sub.msvcrt.dll_strcmp
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140053213
jmp 0x1400531d3
test rbx, rbx
je 0x14005322f
or byte [rbx + 0x44], 0x40
mov qword [rbx + 8], rax
jmp 0x14005322f
test rbx, rbx
je 0x14005321c
and byte [rbx + 0x44], 0xbf
call fcn.140053020
test rax, rax
je 0x14005322f
test rbx, rbx
je 0x14005322f
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
Function at 0x140081fe9
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140081fff
imul eax, eax, 0x21
add eax, edx
jmp 0x140081fee
ret
Function at 0x1400d2312
Capabilities:
Query environment variable

Disassembly:
mov r9d, 1
jmp fcn.1400d1f36

Function at 0x1400d2359
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [0x1401f91b0], 0
jne 0x1400d23c9
mov rsi, qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor edx, edx
xor ecx, ecx
call rsi
mov ebx, eax
test eax, eax
je 0x1400d23ac
mov ecx, eax
call fcn.1400d4a13
mov ecx, ebx
mov qword [0x1401f91b0], rax
mov rdx, rax
call rsi
test eax, eax
jne 0x1400d23ac
mov rcx, qword [0x1401f91b0]
call sub.msvcrt.dll_free
xor eax, eax
mov qword [0x1401f91b0], rax
jmp 0x1400d23b6
cmp qword [0x1401f91b0], 0
jne 0x1400d23c9
lea rcx, [0x1401dc5f8]
call fcn.1400d4ad0
mov qword [0x1401f91b0], rax
mov rax, qword [0x1401f91b0]
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400dc692
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, 8
lea r8, [0x1401e07a0]
mov rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r8 + rax*4]
shr rcx, 8
xor rax, rcx
dec edx
jne 0x1400dc6a1
ret
Function at 0x1400dd561
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [0x1401f9230], 0
mov rsi, rcx
mov r13, rdx
mov r12, r8
jne 0x1400dd5a8
lea rcx, str.SFRAME_DEBUG
call sub.msvcrt.dll_getenv
mov dword [0x1401f9230], 1
test rax, rax
setne al
movzx eax, al
mov dword [0x1401f9234], eax
test rsi, rsi
je 0x1400dd5b2
test r13, r13
jne 0x1400dd5c1
test r12, r12
je 0x1400dd5d4
mov dword [r12], 0x7d2
jmp 0x1400dd5d4
cmp r13, 0x1b
ja 0x1400dd5db
test r12, r12
je 0x1400dd5d4
mov dword [r12], 0x7d3
xor ebx, ebx
jmp 0x1400dd742
movzx edx, word [rsi]
movzx r9d, byte [rsi + 3]
lea rcx, str.sframe_decode:_magic0x_x_version_u_flags_u_n
movzx r8d, byte [rsi + 2]
call fcn.1400dcfb4
mov ax, word [rsi]
cmp ax, 0xdee2
je 0x1400dd60b
mov r14d, 1
cmp ax, 0xe2de
je 0x1400dd60e
jmp 0x1400dd5c7
xor r14d, r14d
mov ecx, 0x40
call sub.msvcrt.dll_malloc
mov qword [rsp + 0x28], rax
mov rbx, rax
test rax, rax
jne 0x1400dd634
test r12, r12
je 0x1400dd5d4
mov dword [r12], 0x7d1
jmp 0x1400dd5d4
mov ecx, 0x10
xor eax, eax
mov rdi, rbx
xor ebp, ebp
rep stosd dword [rdi], eax
test r14d, r14d
je 0x1400dd68d
mov rcx, r13
call sub.msvcrt.dll_malloc
mov rbp, rax
test rax, rax
je 0x1400dd625
mov rdi, rax
mov rcx, r13
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
mov rcx, rax
call fcn.1400dcec5
mov rdx, r13
mov rcx, rbp
call fcn.1400dd1df
test eax, eax
je 0x1400dd686
mov rcx, rbp
call sub.msvcrt.dll_free
jmp 0x1400dd5c7
mov qword [rbx + 0x38], rbp
mov rsi, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0xc]
mov rcx, rbx
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0xc], xmm1
call fcn.1400dd048
test eax, eax
jne 0x1400dd6b6
test r12, r12
je 0x1400dd721
mov dword [r12], 0x7d1
jmp 0x1400dd721
imul r15d, dword [rbx + 8], 0x11
movzx eax, byte [rbx + 7]
lea rsi, [rsi + rax + 0x1c]
movsxd r13, r15d
mov rcx, r13
call sub.msvcrt.dll_malloc
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400dd6a7
mov rdi, rax
mov rcx, r13
mov edx, r15d
rep movsb byte [rdi], byte [rsi]
lea rcx, str._u_total_fidx_size_n
call fcn.1400dcfb4
mov r13d, dword [rbx + 0x10]
mov rcx, r13
call sub.msvcrt.dll_malloc
mov qword [rbx + 0x28], rax
test rax, rax
je 0x1400dd6a7
mov rdi, rax
mov rcx, r13
mov dword [rbx + 0x30], r13d
mov edx, r13d
rep movsb byte [rdi], byte [rsi]
lea rcx, str._u_total_fre_bytes_n
call fcn.1400dcfb4
jmp 0x1400dd742
test rbp, rbp
je 0x1400dd733
test r14d, r14d
je 0x1400dd733
mov rcx, rbp
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x28]
call fcn.1400dd3d7
jmp 0x1400dd5d4
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400de8d4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1401f92b8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1401f92b4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400de922
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400de91a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400dea09
inc ebx
add rax, 0x28
jmp 0x1400de8fa
mov rcx, r12
call fcn.1400df101
mov rbp, rax
test rax, rax
jne 0x1400de941
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400de870
movsxd rbx, ebx
mov rax, qword [0x1401f92b8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.1400df1af
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401f92b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400de9a3
mov rax, qword [0x1401f92b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400de870
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400dea03
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400dea03
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1401f92b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400dea03
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400de870
inc dword [0x1401f92b4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400dee30
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1401f9320]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401f9300]
test rbx, rbx
je 0x1400dee7c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x1400dee76
test eax, eax
jne 0x1400dee76
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x1400dee4e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400df030
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400df053
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400df053
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400df054
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x1400df08e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x1400df085
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400df090
inc r8d
add rax, 0x28
jmp 0x1400df06c
xor eax, eax
ret
Function at 0x1400df101
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1401e1a20]
mov r8, rcx
mov rcx, r9
call fcn.1400df030
test eax, eax
je 0x1400df12d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400df054
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400df2c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rbx, rcx
call sub.msvcrt.dll__errno
xor ecx, ecx
mov dword [rax], ecx
test rbx, rbx
jne 0x1400df2e8
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x1400df2f8
cmp byte [rbx], 0
jne 0x1400df2ff
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
xor ebx, ebx
jmp 0x1400df3dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400df31a
call sub.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x1400df2f8
test al, 0x10
je 0x1400df2ed
lea rdi, [rsp + 0x2c]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
call sub.msvcrt.dll__fullpath
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rcx, [rax + 0x24b]
call sub.msvcrt.dll_malloc
mov rbx, rax
test rax, rax
jne 0x1400df35d
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x1400df2f8
lea rsi, [rax + 0x244]
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_strcpy
cmp byte [rbx + 0x244], 0
je 0x1400df39e
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov al, byte [rbx + rax + 0x243]
cmp al, 0x5c
je 0x1400df39e
cmp al, 0x2f
je 0x1400df39e
lea rdx, [0x1401e1350]
mov rcx, rsi
call sub.msvcrt.dll_strcat
lea rdx, [0x1401e1352]
mov rcx, rsi
call sub.msvcrt.dll_strcat
xor edx, edx
xor eax, eax
mov ecx, 0x41
mov qword [rbx + 0x128], rdx
lea rdx, [rbx + 0x130]
mov dword [rbx + 0x240], eax
mov rdi, rdx
xor eax, eax
mov qword [rbx + 0x238], 0xffffffffffffffff
rep stosd dword [rdi], eax
mov rax, rbx
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret