joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b654
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, qword gs:[0x30]
xor ebx, ebx
xor r9d, r9d
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rdx, qword [rax]
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov edx, dword [rax + r10 + 0x88]
add rdx, r10
mov eax, dword [rdx + 0x14]
mov r14d, dword [rdx + 0x1c]
mov r13d, dword [rdx + 0x20]
add r14, r10
mov r12d, dword [rdx + 0x24]
add r13, r10
mov r8d, dword [rdx + 0x18]
add r12, r10
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14006b73a
movzx ecx, word [0x1400df8ac]
cmp dword [r14 + r9*4], 0
je 0x14006b732
mov ebp, r8d
xor r8d, r8d
test rbp, rbp
je 0x14006b72d
movzx esi, word [r12 + r8*2]
cmp rsi, r9
jne 0x14006b720
mov r11d, dword [r13 + r8*4]
add r11, r10
xor edi, edi
jmp 0x14006b70b
mov edx, edi
mov eax, edi
shl eax, 0x19
shr edx, cl
mov edi, edx
or edi, eax
movsx eax, r15b
add edi, eax
inc r11
mov r15b, byte [r11]
test r15b, r15b
jne 0x14006b6f5
cmp edi, dword [rsp + 0x40]
jne 0x14006b720
mov ebx, dword [r14 + rsi*4]
add rbx, r10
inc r8
cmp r8, rbp
jb 0x14006b6df
mov rax, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
inc r9
cmp r9, rax
jb 0x14006b6cd
mov rax, rbx
mov rbx, qword [rsp + 0x58]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14006ba9c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x430
cmp dword [0x1401a9a74], 3
mov rbx, rcx
movsxd r14, edx
mov ebp, r14d
jne 0x14006bb6c
xor edi, edi
lea rcx, str.jason
mov qword [rax - 0x18], rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rcx, [rsp + 0x20]
call fcn.14006bbf0
mov r8d, r14d
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14006bc88
test r14d, r14d
je 0x14006bb14
mov rax, rbx
mov ecx, ebp
xor byte [rax], 0x69
inc rax
sub rcx, 1
jne 0x14006bb08
mov rcx, rbp
call fcn.14006d9e0
mov rsi, rax
test rax, rax
je 0x14006bb36
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.14006f390
mov byte [rsi], dil
jmp 0x14006bb39
mov rsi, rdi
mov rcx, r14
sub rcx, 1
js 0x14006bb7c
lea rdx, [rcx + rsi]
mov al, byte [rdi + rbx]
inc rdi
mov byte [rdx], al
dec rdx
cmp rdi, rcx
jle 0x14006bb46
sub rsi, rbx
inc rcx
mov al, byte [rsi + rbx]
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14006bb5c
jmp 0x14006bb7c
test edx, edx
je 0x14006bb7c
xor byte [rbx], 0x69
inc rbx
sub rbp, 1
jne 0x14006bb70
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14006bbf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
xor r9d, r9d
mov ebx, r8d
mov r10, rcx
test r8d, r8d
je 0x14006bc7f
mov eax, r9d
movd xmm0, eax
add eax, 4
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x1401a2c10]
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
cmp eax, 0x100
jl 0x14006bc06
mov r11d, r9d
mov r8, r10
xor edx, edx
mov eax, r11d
div ebx
lea rax, str.jason
movzx eax, byte [rdx + rax]
add r9d, eax
add r9d, dword [r8]
and r9d, 0x800000ff
jge 0x14006bc5d
dec r9d
or r9d, 0xffffff00
inc r9d
movzx ecx, byte [r8]
inc r11d
movsxd rdx, r9d
mov eax, dword [r10 + rdx*4]
mov dword [r8], eax
add r8, 4
mov dword [r10 + rdx*4], ecx
cmp r11d, 0x100
jl 0x14006bc2f
mov rbx, qword [rsp + 8]
ret

Function at 0x14006bc88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x14006bd38
mov r11d, r8d
mov eax, dword [r9 + 0x400]
inc eax
and eax, 0x800000ff
jge 0x14006bcb3
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
mov dword [r9 + 0x400], eax
mov eax, dword [r9 + r8*4]
add eax, dword [r9 + 0x404]
and eax, 0x800000ff
jge 0x14006bcd8
dec eax
or eax, 0xffffff00
inc eax
mov dword [r9 + 0x404], eax
movzx edx, byte [r9 + r8*4]
cdqe
mov ecx, dword [r9 + rax*4]
mov dword [r9 + r8*4], ecx
movsxd rax, dword [r9 + 0x404]
mov dword [r9 + rax*4], edx
movsxd rax, dword [r9 + 0x404]
movsxd rcx, dword [r9 + 0x400]
mov edx, dword [r9 + rax*4]
add edx, dword [r9 + rcx*4]
and edx, 0x800000ff
jge 0x14006bd21
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
mov cl, byte [r9 + rax*4]
xor byte [r10], cl
inc r10
sub r11, 1
jne 0x14006bc9a
ret

Function at 0x140079574
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400793a0
Function at 0x18003c900
Capabilities:
Encode data using xor

Disassembly:
fild qword [rdx - 0x767970db]
fabs
outsb dx, byte [rsi]
scasd eax, dword [rdi]
xor dword [rdi + rsi*4 + 0x53], esi
jg 0x18003c8f6
invalid

Function at 0x18003e070
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xa9405276
adc r15d, 0x7dad4071
shr byte [rbp + 0x68598215], 1
mov cl, 0x9d
popfq
sub dl, dl
stc
xor eax, 0x41efe1a5
jrcxz 0x18003e083
jrcxz 0x18003e083
jb 0x18003e08b
leave
mov eax, 0xf6ccb2d0
or dh, byte [rdi + rbp*8 - 0x3a71395e]
invalid

Function at 0x18004d4f0
Capabilities:
Encode data using xor

Disassembly:
sar qword [r15], cl
sbb dl, byte [rdx - 0x26]
out dx, al
sbb ebp, dword [0x1cd4887c6]
jne 0x18004d515
invalid
cdq

Function at 0x180741058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1807411df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180741089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18074106f
add dl, dl
jne 0x180741096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807410f6
xor eax, eax
add dl, dl
jne 0x1807410a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807411ad
add dl, dl
jne 0x1807410b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807410c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807410d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807410dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807410ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18074107e
mov eax, 1
add dl, dl
jne 0x180741106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180741113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807410fb
sub eax, ebx
mov ebx, 1
jne 0x18074114c
mov ecx, 1
add dl, dl
jne 0x18074112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18074113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180741123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18074107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180741168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180741175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18074115d
cmp eax, 0x7d00
jae 0x18074119b
cmp eax, 0x500
jb 0x180741196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18074107e
cmp eax, 0x7f
ja 0x18074119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18074107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807411d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18074107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0048ed30]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0048ed40]
mov dword [rax], 1
mov rax, qword [0x0048ed50]
mov dword [rax], 1
mov rax, qword [0x0048ed20]
mov dword [rax], 1
mov rax, qword [0x0048eba0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x0048ed10]
mov dword [0x004aa008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x0048ec50]
mov qword [rdx], rax
mov rdx, qword [0x0048ec40]
mov qword [rdx], rax
mov rax, qword [0x0048ecd0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x0048e2a0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x4021e1
Capabilities:
Get disk information

Disassembly:
push rbp
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov byte [rbp + 0xcf], 0x30
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
call rax
mov dword [rbp + 0xc4], eax
lea rax, [rbp + 0xc3]
mov rcx, rax
call fcn.00447740
lea rdx, [rbp + 0xc3]
lea rax, [rbp + 0xb0]
mov r8, rdx
lea rdx, [0x0048a0ff]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xc3]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov dword [rbp + 0xc8], 0
jmp 0x4022f3
mov eax, dword [rbp + 0xc8]
cdqe
movzx eax, byte [rbp + rax - 0x60]
cmp al, 0x40
jle 0x4022ec
mov eax, dword [rbp + 0xc8]
cdqe
movzx eax, byte [rbp + rax - 0x60]
cmp al, 0x59
jg 0x4022ec
mov eax, dword [rbp + 0xc8]
cdqe
movzx eax, byte [rbp + rax - 0x60]
movsx edx, al
lea rax, [rbp + 0xb0]
mov r8d, edx
mov edx, 1
mov rcx, rax
call method.std::string.append_unsigned_long_long__char_
mov eax, dword [rbp + 0xc8]
cdqe
movzx eax, byte [rbp + rax - 0x60]
movsx eax, al
mov r8d, 0
mov edx, eax
lea rcx, [0x004aa030]
call method.std::string.find_char__unsigned_long_long__const
cmp rax, 0x64
seta al
test al, al
je 0x4022ec
mov eax, dword [rbp + 0xc8]
cdqe
movzx eax, byte [rbp + rax - 0x60]
mov byte [rbp + 0xcf], al
add dword [rbp + 0xc8], 1
mov eax, dword [rbp + 0xc8]
cmp eax, dword [rbp + 0xc4]
jb 0x402261
lea rax, [rbp + 0xb0]
mov rdx, rax
lea rcx, [0x004aa030]
call method.std::string.operator_std::string_const_
movzx ebx, byte [rbp + 0xcf]
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.00450dd0
mov eax, ebx
jmp 0x40236f
add rsp, 0x158
pop rbx
pop rbp
ret
Function at 0x4024b9
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
mov dword [rbp + 0xa8], 0x101
lea rdx, [rbp + 0xa8]
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
test eax, eax
setne al
test al, al
je 0x402538
lea rax, [rbp + 0xae]
mov rcx, rax
call fcn.00447740
lea rdx, [rbp + 0xae]
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xae]
mov rcx, rax
call sym.std::allocator_char_::allocator__
jmp 0x4025af
lea rax, [rbp + 0xaf]
mov rcx, rax
call fcn.00447740
lea rax, [rbp + 0xaf]
mov r8, rax
lea rdx, [0x0048a0ff]
mov rcx, qword [rbp + 0xd0]
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xaf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
jmp 0x4025af
mov rax, qword [rbp + 0xd0]
add rsp, 0x138
pop rbx
pop rbp
ret

Function at 0x40ee50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x004aa064]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40ef6a
mov rax, qword [0x004aa068]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40ee9e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x40ef50
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x40ee82
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x40efa2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x004aa068]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004aa068]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40ef85
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40ef49
sub eax, 0x40
and eax, 0xffffffbf
je 0x40ef49
mov r9, rbp
add r9, qword [0x004aa068]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40ef71
add dword [0x004aa064], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x40eeab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x004aa068]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x40fb80
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x40fb90
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0
Function at 0x40fba0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x40fbe1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x40fbd8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x40fbe3
add rax, 0x28
cmp rax, r9
jne 0x40fbc4
xor eax, eax
repz ret

Function at 0x40fc90
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x0048eba0]
cmp word [rbx], 0x5a4d
je 0x40fcb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40fca4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection

Function at 0x40ff00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004aa9c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004aa9a0]
test rbx, rbx
je 0x40ff54
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40ff4b
test rsi, rsi
je 0x40ff4b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40ff30
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004aa9c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x410ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rbx, rcx
call sym._errno
test rbx, rbx
mov dword [rax], 0
je 0x410c9e
cmp byte [rbx], 0
je 0x410c60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x410c80
test al, 0x10
je 0x410c60
lea rdi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
mov rbx, rdi
call sym._fullpath
mov r8d, dword [rbx]
add rbx, 4
lea eax, [r8 - 0x1010101]
not r8d
and eax, r8d
and eax, 0x80808080
je 0x410b2d
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
cmove rbx, rdx
add al, al
sbb rbx, 3
sub rbx, rdi
lea rcx, [rbx + 0x24b]
call sym.malloc
test rax, rax
mov rsi, rax
je 0x410c8f
lea r9, [rax + 0x244]
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, r9
call sym.memcpy
cmp byte [rsi + 0x244], 0
mov r9, rax
je 0x410bc0
movzx eax, byte [rsi + rbx + 0x243]
cmp al, 0x2f
je 0x410bc0
cmp al, 0x5c
je 0x410bc0
mov r8d, 0x5c
mov word [r9 + rbx], r8w
nop dword [rax + rax]
mov rcx, r9
mov eax, dword [rcx]
add rcx, 4
lea edx, [rax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x410bc3
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [rcx + 2]
cmove rcx, rax
add dl, dl
mov eax, 0x2a
sbb rcx, 3
xor edx, edx
mov word [rcx], ax
mov word [rsi + 0x12c], dx
lea rdx, [rsi + 0x130]
xor ecx, ecx
xor eax, eax
mov qword [rsi + 0x238], 0xffffffffffffffff
mov word [rsi + 0x12e], cx
mov rdi, rdx
mov ecx, 0x20
mov dword [rsi + 0x240], 0
mov dword [rsi + 0x128], 0
rep stosq qword [rdi], rax
mov rax, rsi
mov dword [rdi], 0
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
call sym._errno
mov dword [rax], 0x14
xor eax, eax
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
call sym._errno
mov dword [rax], 2
xor eax, eax
jmp 0x410c4d
call sym._errno
mov dword [rax], 0xc
xor eax, eax
jmp 0x410c4d
call sym._errno
mov dword [rax], 0xe
xor eax, eax
jmp 0x410c4d
Function at 0x417450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, rcx
movzx ecx, word [rcx + 0xa]
and cx, 0x7fff
cmp cx, 0x7fff
je 0x4174e3
movzx ecx, word [rdx + 0xa]
and cx, 0x7fff
cmp cx, 0x7fff
je 0x417512
lea rsi, [rsp + 0x20]
lea rdi, [rsp + 0x40]
mov rcx, rax
mov rbx, rdx
mov rdx, rsi
call dbg.__emovi
mov rdx, rdi
mov rcx, rbx
call dbg.__emovi
movzx r8d, word [rsp + 0x20]
xor eax, eax
lea rcx, [rsi + 2]
cmp r8w, word [rsp + 0x40]
lea rdx, [rdi + 2]
je 0x417530
cmp word [rcx + rax], 0
jne 0x417570
cmp word [rdx + rax], 0
jne 0x417570
add rax, 2
cmp rax, 0xe
jne 0x4174b9
xor al, al
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea r8, [rax + 0xa]
mov rcx, rax
add rcx, 2
cmp word [rcx - 2], 0
jne 0x417585
cmp rcx, r8
jne 0x4174ea
movzx ecx, word [rdx + 0xa]
and cx, 0x7fff
cmp cx, 0x7fff
jne 0x41747e
lea r8, [rdx + 0xa]
mov rcx, rdx
add rcx, 2
cmp word [rcx - 2], 0
jne 0x417585
cmp rcx, r8
jne 0x417519
jmp 0x41747e
cmp r8w, 1
sbb eax, eax
xor ecx, ecx
add rsi, 2
and eax, 2
sub eax, 1
movzx edx, word [rsi + rcx]
add rcx, 2
movzx r8d, word [rdi + rcx]
cmp dx, r8w
jne 0x417592
cmp rcx, 0xe
jne 0x417543
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
cmp r8w, 1
sbb eax, eax
and eax, 2
sub eax, 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, 0xfffffffe
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
cmp r8w, dx
setae dl
movzx edx, dl
mov ecx, edx
neg ecx
xor eax, ecx
add eax, edx
jmp 0x4174db

Function at 0x41c270
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x004ab508]
test rbx, rbx
je 0x41c2a0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x004ab508]
test rax, rax
je 0x41c2c4
cmp dword [rax], 0xffffffff
je 0x41c2e5
add rsp, 0x20
pop rbx
ret
lea r8, [sym.__shmem_winpthreads_init__pthread_tls_shmem]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.__shmem_winpthreads_grab
mov rbx, rax
mov qword [0x004ab508], rax
jmp 0x41c281
lea r8, [sym.__shmem_winpthreads_init__pthread_tls_shmem]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab508], rax
jmp 0x41c295
call sym.abort
nop
nop dword [rax + rax]
Function at 0x41c780
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004ab510]
test rcx, rcx
je 0x41c8c0
call sym._pthread_once_raw.constprop.5
mov rax, qword [0x004ab508]
test rax, rax
je 0x41c8e3
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x41c7c3
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.pop_pthread_mem
test rax, rax
mov rbx, rax
je 0x41c92b
cmp qword [sym.__dyn_tls_pthread], 0
je 0x41c92b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41c932
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004ab508]
test rax, rax
je 0x41c907
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41c932
mov rax, rbx
jmp 0x41c7ba
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004ab510], rax
jmp 0x41c798
lea r8, [sym.__shmem_winpthreads_init__pthread_tls_shmem]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab508], rax
jmp 0x41c7ad
lea r8, [sym.__shmem_winpthreads_init__pthread_tls_shmem]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call sym.__shmem_winpthreads_grab
mov qword [0x004ab508], rax
jmp 0x41c8a8
xor eax, eax
jmp 0x41c7ba
call sym.abort
nop
nop dword [rax + rax]

Function at 0x41c940
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41c960
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_cancelling_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41c980
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_concur_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41c9a0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41c9c0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init__pthread_tls_shmem]
lea rcx, str._pthread_tls_shmem
mov edx, 4
jmp sym.__shmem_winpthreads_grab
Function at 0x41c9e0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init__pthread_key_lock_shmem]
lea rcx, str._pthread_key_lock_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41ca00
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_key_max_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41ca20
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str._pthread_key_sch_shmem
xor r8d, r8d
mov edx, 4
jmp sym.__shmem_winpthreads_grab

Function at 0x41ca40
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.pthr_root_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41ca60
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.pthr_last_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41ca80
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
lea rcx, str.mtx_pthr_locked_shmem
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41caa0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idList_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41cac0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idListCnt_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41cae0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idListMax_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab

Function at 0x41cb00
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.idListNextId_shmem
xor r8d, r8d
mov edx, 8
jmp sym.__shmem_winpthreads_grab