joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x1400578f7
movzx edx, byte [rax]
test edx, edx
jne 0x1400577b4
nop dword [rax]
test r8b, r8b
jne 0x1400577b4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x1400577c7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x1400578b7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x1400578a5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x140057897
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x14005781d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x140057860
mov eax, 1
cmp rax, rbx
ja 0x14005784b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.14006be80
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x14005788f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x140057853
mov rcx, r11
mov eax, r12d
jmp 0x140057822
mov rcx, rbx
call fcn.14006bdc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.14006bdc0
mov eax, r8d
mov rcx, rbx
call fcn.14006be80
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x1400578ed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x1400578b0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x1400577cd
mov eax, edx
mov rcx, rbx
call fcn.14006bdc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.14006bdc0
nop
int3
Function at 0x14005f140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005f1ef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x14005f240]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.1400699a0
xorps xmm15, xmm15
mov r14, qword [0x140a71fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140069ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.14005f140
Function at 0x14006b920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x140a72340]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x140a71bef], 0
je 0x14006b956
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140a727a0]
aesenc xmm0, xmmword [0x140a727b0]
aesenc xmm0, xmmword [0x140a727c0]
movq rax, xmm0
ret
jmp 0x14000d8a0

Function at 0x14047bed0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1409fa120]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14047bef0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14047bef8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14047bef0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14047bf45
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14047bf3c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14047bef0
add rax, 0x28
cmp rax, r9
jne 0x14047bf28
xor eax, eax
ret

Function at 0x14047bf50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1409fa120]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14047bf70
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14047bf78
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14047bf70
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14047c000
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1409fa120]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14047c020
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14047c028
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x180001c60
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
cmp edx, 1
jne 0x180001cad
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x180001a90]
mov rdi, rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
test rsi, rsi
je 0x180001cad
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x180019000
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov eax, dword [0x1800487ec]
test rax, rax
je 0x180019048
mov edi, ecx
mov r14d, 0x20
mov rcx, qword [0x1800487e0]
xor ebx, ebx
nop dword [rax]
mov edx, dword [rcx + r14]
shr edx, 1
and edx, 1
cmp edx, edi
jne 0x18001904f
add r14, 0x38
inc rbx
cmp eax, ebx
jne 0x180019030
xor esi, esi
jmp 0x18001913d
xor r8d, r8d
test edi, edi
setne r8b
lea rcx, [rsp + 0x28]
mov edx, 0xffffffff
call fcn.1800195d0
mov esi, eax
test eax, eax
jne 0x18001913d
mov eax, dword [0x1800487ec]
xor esi, esi
cmp ebx, eax
jae 0x1800190c9
mov rcx, qword [0x1800487e0]
jmp 0x18001909e
inc rbx
mov edx, eax
add r14, 0x38
cmp rbx, rdx
jae 0x1800190c9
mov edx, dword [rcx + r14]
shr edx, 1
and edx, 1
cmp edx, edi
je 0x180019090
mov ecx, ebx
mov edx, edi
call fcn.180019980
test eax, eax
jne 0x1800190c7
mov rcx, qword [0x1800487e0]
mov eax, dword [0x1800487ec]
jmp 0x180019090
mov esi, eax
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x18001913d
mov r14d, dword [rsp + 0x34]
test r14, r14
je 0x18001912b
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180019108
inc r15
cmp r14, r15
je 0x18001912b
mov r8d, dword [rdi + r15*4]
mov ecx, 0x5a
xor edx, edx
call r12
test rax, rax
je 0x180019100
mov rbx, rax
mov rcx, rax
call r13
mov rcx, rbx
call rbp
jmp 0x180019100
mov rcx, qword [0x1800487d8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800193b0
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rcx
mov esi, 1
xor eax, eax
lock cmpxchg dword [0x1800487d0], esi
je 0x1800193fb
xor ebx, ebx
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
xor ecx, ecx
cmp rbx, 0x20
setae cl
call r14
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800487d0], esi
jne 0x1800193e0
cmp qword [0x1800487d8], 0
je 0x180019446
mov edx, dword [0x1800487ec]
mov eax, 4
test rdx, rdx
je 0x1800195a8
mov rcx, qword [0x1800487e0]
imul rdx, rdx, 0x38
xor esi, esi
xor r14d, r14d
nop dword [rax]
cmp qword [rcx + r14], rdi
je 0x180019450
add r14, 0x38
dec esi
cmp rdx, r14
jne 0x180019430
jmp 0x1800195a8
mov eax, 2
jmp 0x1800195a8
cmp esi, 1
je 0x1800195a8
neg esi
test byte [rcx + r14 + 0x20], 2
jne 0x180019507
mov rcx, qword [rcx + r14 + 0x10]
call fcn.18001a710
mov ecx, dword [0x1800487ec]
dec ecx
cmp ecx, esi
jbe 0x1800194b3
mov rax, qword [0x1800487e0]
mov edx, ecx
imul rdx, rdx, 0x38
mov r8, qword [rax + rdx + 0x30]
mov qword [rax + r14 + 0x30], r8
movups xmm0, xmmword [rax + rdx]
movups xmm1, xmmword [rax + rdx + 0x10]
movups xmm2, xmmword [rax + rdx + 0x20]
movups xmmword [rax + r14 + 0x20], xmm2
movups xmmword [rax + r14 + 0x10], xmm1
movups xmmword [rax + r14], xmm0
mov dword [0x1800487ec], ecx
mov edx, dword [0x1800487e8]
xor eax, eax
cmp edx, 0x40
jb 0x1800195a8
shr edx, 1
cmp edx, ecx
jb 0x1800195a8
imul r9, rdx, 0x38
mov r8, qword [0x1800487e0]
mov rcx, qword [0x1800487d8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180019500
shr dword [0x1800487e8], 1
mov qword [0x1800487e0], rax
xor eax, eax
jmp 0x1800195a8
lea rcx, [rsp + 0x28]
mov edx, esi
xor r8d, r8d
call fcn.1800195d0
test eax, eax
jne 0x1800195a8
mov ecx, esi
xor edx, edx
call fcn.180019980
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x1800195a4
mov dword [rsp + 0x24], eax
mov r15d, dword [rsp + 0x34]
test r15, r15
je 0x18001958e
xor r12d, r12d
mov r13, qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180019568
inc r12
cmp r15, r12
je 0x18001958e
mov r8d, dword [rdi + r12*4]
mov ecx, 0x5a
xor edx, edx
call r13
test rax, rax
je 0x180019560
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call rbp
jmp 0x180019560
mov rcx, qword [0x1800487d8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1800195c1
xor ecx, ecx
xchg dword [0x1800487d0], ecx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x1800487e0]
jmp 0x180019467
Function at 0x180019980
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov r15, qword [0x1800487e0]
mov eax, ecx
imul r12, rax, 0x38
mov rax, qword [r15 + r12]
movzx ecx, byte [r15 + r12 + 0x20]
xor edx, edx
test cl, 1
sete dl
lea rdx, [rdx + rdx*4]
lea rdi, [rax + rdx]
add rdi, 0xfffffffffffffffb
and ecx, 1
lea rbx, [rcx*2 + 5]
lea r9, [rsp + 0x24]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180019a0f
lea r14, [r15 + r12]
add r14, 0x20
test esi, esi
je 0x180019a16
mov byte [rdi], 0xe9
mov eax, dword [r15 + r12 + 8]
sub eax, edi
add eax, 0xfffffffb
mov dword [rdi + 1], eax
test byte [r14], 1
je 0x180019a38
add r15, r12
mov rax, qword [r15]
mov word [rax], 0xf9eb
jmp 0x180019a38
mov eax, 0xa
jmp 0x180019a7e
test byte [r14], 1
lea rax, [r15 + r12 + 0x18]
jne 0x180019a2e
movzx ecx, byte [rax + 4]
mov byte [rdi + 4], cl
mov eax, dword [rax]
mov dword [rdi], eax
jmp 0x180019a38
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rdi + 3], eax
mov dword [rdi], ecx
mov r8d, dword [rsp + 0x24]
lea r9, [rsp + 0x24]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [r14]
and sil, 1
lea ecx, [rsi + rsi]
and al, 0xf9
or al, cl
shl sil, 2
or sil, al
mov byte [r14], sil
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18001c438
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18001c472
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18001c477
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18001c4c0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180040ff0]
cmp byte [rcx + rax], 0
je 0x18001c4c0
dec r8
sub rdx, 1
jne 0x18001c4a6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x2fc4d9180
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d9b82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4d9c1a
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4d9bfe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9bf2
cmp qword [rbp - 0x10], 0
je 0x2fc4d9bf2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9bb8
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d9c1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9d20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d9d48
mov eax, 0
jmp 0x2fc4d9d96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d9d71
mov eax, 0
jmp 0x2fc4d9d96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9d91
mov eax, 0
jmp 0x2fc4d9d96
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9d9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d9e1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9e11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9e11
mov rax, qword [rbp - 8]
jmp 0x2fc4d9e2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9de4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x418290
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4182c0
mov rcx, rax
call sub.msvcrt.dll_atoi
test eax, eax
jle 0x4182c0
add rsp, 0x28
ret
mov eax, 0x7fffffff
add rsp, 0x28
ret
Function at 0x41a0d0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.GCC_COLORS
call sub.msvcrt.dll_getenv
test rax, rax
mov rbp, rax
je 0x41a244
movzx r14d, byte [rax]
xor eax, eax
test r14b, r14b
je 0x41a249
mov rdi, rbp
xor r13d, r13d
xor esi, esi
xor r12d, r12d
jmp 0x41a137
test r12, r12
je 0x41a12b
cmp r14b, 0x3b
je 0x41a12b
sub r14d, 0x30
cmp r14b, 9
ja 0x41a244
lea rax, [rdi + 1]
movzx r14d, byte [rdi + 1]
mov rdi, rax
test r14b, r14b
je 0x41a170
cmp r14b, 0x3a
je 0x41a170
cmp r14b, 0x3d
jne 0x41a112
cmp rbp, rdi
je 0x41a244
test r12, r12
jne 0x41a244
lea rax, [rdi + 1]
mov rsi, rdi
sub rsi, rbp
mov r12, rax
jmp 0x41a12f
test r12, r12
mov rcx, qword [0x004920c0]
je 0x41a230
mov r13, rdi
sub r13, r12
test rcx, rcx
je 0x41a26a
lea rbx, [0x004920c0]
jmp 0x41a1ac
add rbx, 0x18
mov rcx, qword [rbx]
test rcx, rcx
je 0x41a1c4
movzx eax, byte [rbx + 0x10]
cmp rax, rsi
jne 0x41a1a0
mov r8, rsi
mov rdx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x41a1a0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x41a21b
test r12, r12
je 0x41a21b
cmp byte [rbx + 0x11], 0
jne 0x41a260
lea rcx, [r13 + 7]
call fcn.00474400
mov r8, r13
mov rdx, r12
mov rbp, rax
mov eax, 0x5b1b
mov word [rbp], ax
lea rcx, [rbp + 2]
call sub.msvcrt.dll_memcpy
lea rax, [rbp + r13 + 2]
mov qword [rbx + 8], rbp
mov dword [rax], 0x4b5b1b6d
mov byte [rax + 4], 0
mov byte [rbx + 0x11], 1
movzx r14d, byte [rdi]
test r14b, r14b
je 0x41a244
lea rax, [rdi + 1]
xor r12d, r12d
mov rbp, rax
jmp 0x41a12f
mov rsi, rdi
sub rsi, rbp
test rcx, rcx
jne 0x41a18f
test r14b, r14b
jne 0x41a220
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call sub.msvcrt.dll_free
jmp 0x41a1dc
lea rbx, [0x004920c0]
jmp 0x41a1c4
Function at 0x41e000
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test r8, r8
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x41e069
mov rbx, r8
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0xffffffff
lea r14, [rsp + 0x3c]
jmp 0x41e03b
mov eax, dword [rsp + 0x3c]
sub rbx, rax
je 0x41e069
cmp rbx, rsi
mov r8, rsi
mov rdx, rdi
mov qword [rsp + 0x20], 0
cmovbe r8, rbx
sub rdx, rbx
mov r9, r14
add rdx, r12
mov rcx, rbp
mov dword [rsp + 0x3c], r8d
call r13
test eax, eax
jne 0x41e032
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x420c20
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x28]
test rax, rax
mov rbx, rcx
je 0x420c50
cmp rax, qword [rcx + 0x20]
je 0x420c50
sub rax, 1
cmp qword [rcx + 0x30], rax
jae 0x420c50
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_feof
test eax, eax
jne 0x420c42
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x420c42
mov rsi, qword [rbx + 0x20]
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
cmp rsi, rax
jne 0x420ca2
lea rax, [rsi + rsi]
test rsi, rsi
mov esi, 0x1000
cmovne rsi, rax
mov rdx, rsi
call fcn.00474480
mov qword [rbx + 0x20], rsi
mov rcx, rax
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov r9, qword [rbx + 0x10]
sub rsi, rax
add rcx, rax
mov edx, 1
mov r8, rsi
call sub.msvcrt.dll_fread
mov rcx, qword [rbx + 0x10]
mov rsi, rax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x420c42
add qword [rbx + 0x28], rsi
test rsi, rsi
setne al
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x432be0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movzx eax, byte [rdx + 0x8d]
test al, al
mov r12, rcx
mov r15, rdx
mov r13d, r8d
jne 0x432c89
movzx ebp, byte [rdx + 0x8b]
test bpl, bpl
jne 0x432c89
mov edx, dword [rdx + 0x84]
test edx, edx
jne 0x432c89
cmp dword [r15 + 0x80], 0xffffffff
je 0x432ca0
movzx eax, word [r15 + 0x4e]
and ax, 0xf000
cmp ax, 0x3000
jne 0x432cd0
mov rax, qword [r15 + 8]
mov r8d, r13d
mov edx, 3
mov rcx, r12
lea r9, str._s_is_a_block_device
mov ebp, 1
mov qword [rsp + 0x20], rax
call fcn.0042db90
mov ecx, dword [r15 + 0x80]
mov byte [r15 + 0x8b], bpl
call sub.msvcrt.dll__close_1
movzx eax, byte [r15 + 0x8b]
mov dword [r15 + 0x80], 0xffffffff
xor eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.004324d0
test al, al
jne 0x432c28
mov r9d, r13d
xor r8d, r8d
mov rdx, r15
mov byte [rsp + 0x4f], al
mov rcx, r12
call fcn.004327a0
movzx eax, byte [rsp + 0x4f]
jmp 0x432c89
cmp ax, 0x8000
je 0x432da0
xor r14d, r14d
mov ecx, 0x2010
mov esi, 0x2000
call fcn.00474400
xor ebx, ebx
mov rdi, rax
mov ecx, dword [r15 + 0x80]
lea rdx, [rdi + rbx]
mov r8d, esi
sub r8d, ebx
call sub.msvcrt.dll__read_1
cdqe
test rax, rax
jle 0x432d33
add rbx, rax
cmp rsi, rbx
jne 0x432cf1
test r14b, r14b
jne 0x432db3
add rsi, rsi
mov rcx, rdi
lea rdx, [rsi + 0x10]
call fcn.00474480
mov rdi, rax
jmp 0x432cf1
jne 0x432dc0
cmp rsi, rbx
je 0x432d60
test r14b, r14b
je 0x432d60
mov rax, qword [r15 + 8]
lea r9, str._s_is_shorter_than_expected
mov r8d, r13d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.0042db90
lea rax, [r15 + 0x60]
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rcx, r12
mov rdx, qword [r12 + 0x4b0]
mov qword [rsp + 0x30], rax
lea rax, [r15 + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsi + 0x10]
call fcn.00429a10
mov byte [r15 + 0x8d], 1
mov qword [r15 + 0x28], rax
jmp 0x432c60
mov rsi, qword [r15 + 0x60]
mov r14d, 1
lea rcx, [rsi + 0x10]
jmp 0x432ce7
mov rbx, rsi
jmp 0x432d60
mov r8, qword [r15 + 8]
mov r9d, r13d
mov edx, 3
mov rcx, r12
mov ebp, 1
call fcn.0042dc70
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x432c60
Function at 0x436190
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movzx eax, byte [rcx + 4]
mov rdi, rcx
mov rcx, rax
shl rax, 4
mov rsi, rdx
mov rdx, rax
lea rax, [0x004e4a20]
add rax, rdx
mov edx, dword [rax]
cmp edx, 1
je 0x4361f0
test edx, edx
je 0x436260
cmp edx, 2
jne 0x4361e2
mov rcx, qword [rdi + 0x18]
mov r9, rsi
mov edx, 1
mov r8d, dword [rdi + 0x10]
call sub.msvcrt.dll_fwrite
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rdi + 0x10]
mov edx, dword [rax + 8]
mov rbp, qword [rax]
test edx, edx
je 0x4361e2
lea r12, [rsp + 0x26]
xor ebx, ebx
jmp 0x436243
mov rcx, r12
call fcn.00434f00
mov r9, rsi
mov edx, 1
mov rcx, r12
lea rbx, [rax + rbx - 1]
mov r8d, 0xa
call sub.msvcrt.dll_fwrite
mov rax, qword [rdi + 0x10]
add rbx, 1
mov edx, dword [rax + 8]
cmp rdx, rbx
jbe 0x4361e2
lea rdx, [rbp + rbx]
test byte [rdx], 0x80
jne 0x436210
mov rax, qword [rax]
mov rdx, rsi
movzx ecx, byte [rax + rbx]
call sub.msvcrt.dll_fputc
jmp 0x436233
movzx edx, word [rdi + 8]
test dl, 2
jne 0x436293
and edx, 0x10
jne 0x4361f0
mov rbx, qword [rax + 8]
movzx ecx, byte [rbx]
add rbx, 1
mov rdx, rsi
call sub.msvcrt.dll_putc
movzx ecx, byte [rbx]
test ecx, ecx
jne 0x436275
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rax, [0x004e4f80]
sub ecx, 0x25
movsxd rcx, ecx
mov rbx, qword [rax + rcx*8]
jmp 0x436272