joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427837
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
not dword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
add rax, rdx
mov qword [rbp - 8], rax
jmp 0x427892
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax]
movzx eax, al
xor eax, dword [rbp + 0x10]
movzx eax, al
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x00539700]
mov eax, dword [rdx + rax]
mov edx, dword [rbp + 0x10]
shr edx, 8
xor eax, edx
mov dword [rbp + 0x10], eax
add qword [rbp + 0x18], 1
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbp - 8]
jb 0x42785e
mov eax, dword [rbp + 0x10]
not eax
add rsp, 0x10
pop rbp
ret

Function at 0x428930
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov dword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp - 8], rax
cmp dword [rbp + 0x38], 0
je 0x4289f8
mov r9, qword [rbp + 0x10]
mov r8d, 0x26
mov edx, 1
lea rcx, str.__TAG_FILE_FORMAT_t2_t_extended_format__n
call main
mov r9, qword [rbp + 0x10]
mov r8d, 0x2b
mov edx, 1
lea rcx, str.__TAG_FILE_SORTED_t0_t_0unsorted__1sorted__n
call main
mov r9, qword [rbp + 0x10]
mov r8d, 0x48
mov edx, 1
lea rcx, str.__TAG_PROGRAM_AUTHOR_tIan_Lance_Taylor__Salvador_E._Tropea_and_others_t___n
call main
mov r9, qword [rbp + 0x10]
mov r8d, 0x2f
mov edx, 1
lea rcx, str.__TAG_PROGRAM_NAME_tobjdump_t_From_GNU_binutils__n
call main
cmp dword [rbp + 0x38], 0
je 0x428a1a
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x18]
mov r8, rdx
lea rdx, [0x00539f60]
mov rcx, rax
call fcn.00430c81
jmp 0x428a34
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x18]
mov r8, rdx
lea rdx, [0x00539e00]
mov rcx, rax
call fcn.00430c81
add rsp, 0x60
pop rbp
ret

Function at 0x42be09
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x18]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call fcn.0044a713
mov qword [0x005849e0], rax
mov dword [0x005849fc], 0
mov rax, qword [rbp + 0x28]
mov r8, rax
lea rdx, [0x0042bd1d]
mov rcx, qword [rbp + 0x10]
call fcn.00454a40
mov eax, dword [0x005849fc]
test eax, eax
jne 0x42be8a
mov rax, qword [rbp + 0x20]
mov r9, rax
mov r8d, 2
mov edx, 1
lea rcx, [0x0053a5c4]
call main
jmp 0x42bea6
mov edx, dword [0x005849f8]
mov rax, qword [rbp + 0x20]
mov r8d, edx
lea rdx, [0x0053a3cb]
mov rcx, rax
call sub.msvcrt.dll_fprintf
nop
add rsp, 0x20
pop rbp
ret
Function at 0x42e36a
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rax
mov r8d, 0x21
mov edx, 1
lea rcx, str.Last_stabs_entries_before_error:_n
call main
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rax
mov r8d, 0x1e
mov edx, 1
lea rcx, str.n_type_n_desc_n_value__string_n
call main
mov eax, dword [0x00584b80]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
lea rax, [0x00584a00]
add rax, rdx
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x42e531
mov rax, qword [rbp - 0x50]
mov eax, dword [rax]
mov ecx, eax
call fcn.004554b0
mov qword [rbp - 0x58], rax
cmp qword [rbp - 0x58], 0
je 0x42e441
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov rdx, qword [rbp - 0x58]
mov r8, rdx
lea rdx, str.__6s
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x42e499
mov rax, qword [rbp - 0x50]
mov eax, dword [rax]
test eax, eax
jne 0x42e474
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rax
mov r8d, 6
mov edx, 1
lea rcx, str.HdrSym
call main
jmp 0x42e499
mov rax, qword [rbp - 0x50]
mov ebx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r8d, ebx
lea rdx, str.__6d
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [rbp - 0x50]
mov ebx, dword [rax + 4]
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r8d, ebx
lea rdx, str.___6d
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [rbp - 0x50]
mov rbx, qword [rax + 8]
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r8, rbx
lea rdx, [0x0053a9bf]
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [rbp - 0x50]
mov eax, dword [rax]
test eax, eax
je 0x42e517
mov rax, qword [rbp - 0x50]
mov rbx, qword [rax + 0x10]
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r8, rbx
lea rdx, [0x0053a9c8]
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [rbp - 0x44]
lea edx, [rax + 1]
mov eax, edx
sar eax, 0x1f
shr eax, 0x1c
add edx, eax
and edx, 0xf
sub edx, eax
mov eax, edx
mov dword [rbp - 0x44], eax
mov eax, dword [0x00584b80]
cmp dword [rbp - 0x44], eax
jne 0x42e3cf
nop
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x438bfe
Capabilities:
Parse credit card information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x30]
mov qword [rax], 0
mov rax, qword [rbp + 0x38]
mov dword [rax], 0
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp + 0x40]
jb 0x438c4a
mov eax, 0
jmp 0x438dfa
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
cmp al, 0x3b
jne 0x438c6a
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
cmp al, 0x7e
je 0x438c82
mov eax, 1
jmp 0x438dfa
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
cmp al, 0x3d
je 0x438cbe
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
cmp al, 0x2b
je 0x438cbe
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
cmp al, 0x2d
jne 0x438cd0
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
cmp al, 0x25
je 0x438ce8
mov eax, 1
jmp 0x438dfa
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp - 0x28]
mov rax, qword [rbp + 0x20]
mov r8, rcx
mov rcx, rax
call fcn.00436358
test eax, eax
jne 0x438d2a
mov eax, 0
jmp 0x438dfa
mov edx, dword [rbp - 0x28]
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
cmp edx, eax
jne 0x438d57
mov edx, dword [rbp - 0x24]
mov rax, qword [rbp + 0x28]
add rax, 4
mov eax, dword [rax]
cmp edx, eax
jne 0x438d57
mov rax, qword [rbp + 0x38]
mov dword [rax], 1
jmp 0x438df5
mov rax, qword [rbp + 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rax], rdx
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x40]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.00435408
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp - 8], rax
jmp 0x438da7
add qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
cmp al, 0x3b
je 0x438dbd
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
test al, al
jne 0x438da2
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
cmp al, 0x3b
je 0x438ddb
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.00433b03
mov eax, 0
jmp 0x438dfa
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp - 0x20]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x43a0f6
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x5f
jne 0x43a14b
mov rax, qword [rbp + 0x20]
add rax, 1
movzx eax, byte [rax]
cmp al, 0x5a
jne 0x43a14b
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.0043c8ff
jmp 0x43a237
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0
mov dword [rbp - 0x18], 0
mov dword [rbp - 4], 0xa
mov eax, dword [rbp - 4]
mov eax, eax
shl rax, 4
mov rcx, rax
call fcn.0050c076
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 0
mov ecx, dword [rbp + 0x30]
lea rdx, [rbp + 0x20]
lea rax, [rbp - 0x30]
mov r8d, ecx
mov rcx, rax
call fcn.0043a23d
test eax, eax
je 0x43a219
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
test al, al
je 0x43a1c6
lea rdx, [rbp + 0x20]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0043a578
test eax, eax
je 0x43a21c
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 0x20]
test rax, rax
jne 0x43a20a
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rax
mov r8d, 0x24
mov edx, 1
lea rcx, str.no_argument_types_in_mangled_string_n
call main
mov edx, dword [rbp - 0x18]
mov rax, qword [rbp + 0x28]
mov dword [rax], edx
mov rax, qword [rbp - 0x20]
jmp 0x43a237
nop
jmp 0x43a21d
nop
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x43a232
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
add rsp, 0x50
pop rbp
ret

Function at 0x43c8ff
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, dword [0x00511a40]
or eax, 1
mov edx, eax
lea rcx, [rbp - 0x18]
mov rax, qword [rbp + 0x20]
mov r8, rcx
mov rcx, rax
call fcn.00500845
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x43c956
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.00439f1c
mov eax, 0
jmp 0x43c9e4
mov rax, qword [rbp - 8]
mov eax, dword [rax]
cmp eax, 3
jne 0x43c970
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov eax, dword [rax]
cmp eax, 0x29
je 0x43c9aa
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rax
mov r8d, 0x21
mov edx, 1
lea rcx, str.Demangled_name_is_not_a_function_n
call main
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x43c9e4
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.0043c9ea
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x10]
add rsp, 0x40
pop rbp
ret
Function at 0x43c9ea
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov dword [rbp - 0xc], 0xa
mov eax, dword [rbp - 0xc]
shl rax, 3
mov rcx, rax
call fcn.0050c076
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x28]
mov dword [rax], 0
mov dword [rbp - 0x10], 0
mov rax, qword [rbp + 0x20]
mov qword [rbp - 8], rax
jmp 0x43cb41
mov rax, qword [rbp - 8]
mov eax, dword [rax]
cmp eax, 0x2e
je 0x43ca82
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rax
mov r8d, 0x29
mov edx, 1
lea rcx, str.Unexpected_type_in_v3_arglist_demangling_n
call main
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x43cb6c
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
test rax, rax
je 0x43cb4e
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 8]
mov rax, qword [rbp + 0x18]
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.0043cb72
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x43caee
mov eax, dword [rbp - 0x24]
test eax, eax
je 0x43cadb
mov rax, qword [rbp + 0x28]
mov dword [rax], 1
jmp 0x43cb35
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x43cb6c
mov eax, dword [rbp - 0x10]
add eax, 1
cmp dword [rbp - 0xc], eax
ja 0x43cb18
add dword [rbp - 0xc], 0xa
mov eax, dword [rbp - 0xc]
lea rdx, [rax*8]
mov rax, qword [rbp - 0x18]
mov rcx, rax
call fcn.0050c11c
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 0x10]
lea rdx, [rax*8]
mov rax, qword [rbp - 0x18]
add rdx, rax
mov rax, qword [rbp - 0x20]
mov qword [rdx], rax
add dword [rbp - 0x10], 1
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x43ca3a
jmp 0x43cb4f
nop
mov eax, dword [rbp - 0x10]
lea rdx, [rax*8]
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rax], 0
mov rax, qword [rbp - 0x18]
add rsp, 0x60
pop rbp
ret

Function at 0x43f3bd
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
jne 0x43f3f4
mov rax, qword [rbp + 0x18]
mov r9, rax
mov r8d, 0x12
mov edx, 1
lea rcx, str.Supported_targets:
call main
jmp 0x43f40b
mov rax, qword [rbp + 0x18]
mov r8, qword [rbp + 0x10]
lea rdx, str._s:_supported_targets:
mov rcx, rax
call sub.msvcrt.dll_fprintf
call fcn.00457c41
mov qword [rbp - 0x10], rax
mov dword [rbp - 4], 0
jmp 0x43f44e
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp - 0x10]
add rax, rdx
mov rdx, qword [rax]
mov rax, qword [rbp + 0x18]
mov r8, rdx
lea rdx, [0x0053c35f]
mov rcx, rax
call sub.msvcrt.dll_fprintf
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp - 0x10]
add rax, rdx
mov rax, qword [rax]
test rax, rax
jne 0x43f41d
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
nop
add rsp, 0x30
pop rbp
ret
Function at 0x43f48e
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
jne 0x43f4c5
mov rax, qword [rbp + 0x18]
mov r9, rax
mov r8d, 0x18
mov edx, 1
lea rcx, str.Supported_architectures:
call main
jmp 0x43f4dc
mov rax, qword [rbp + 0x18]
mov r8, qword [rbp + 0x10]
lea rdx, str._s:_supported_architectures:
mov rcx, rax
call sub.msvcrt.dll_fprintf
call fcn.004481ba
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], rax
jmp 0x43f511
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x18]
mov r8, rdx
lea rdx, [0x0053c35f]
mov rcx, rax
call sub.msvcrt.dll_fprintf
add qword [rbp - 8], 8
mov rax, qword [rbp - 8]
mov rax, qword [rax]
test rax, rax
jne 0x43f4ef
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
nop
add rsp, 0x30
pop rbp
ret

Function at 0x43fa37
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x10], 0
mov dword [rbp - 0xc], 2
jmp 0x43fa87
mov eax, dword [rbp - 0xc]
mov edx, 0
mov ecx, eax
call fcn.00448a80
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp - 0x2c], eax
mov eax, dword [rbp - 0x2c]
cmp eax, dword [rbp - 0x10]
jle 0x43fa83
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 0x10], eax
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0x59
jbe 0x43fa53
mov dword [rbp - 4], 0
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x43faba
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x43fac7
mov dword [rbp - 4], 0x50
mov dword [rbp - 8], 0
jmp 0x43fba5
mov eax, dword [rbp - 4]
sub eax, dword [rbp - 0x10]
lea edx, [rax - 1]
mov eax, dword [rbp - 8]
mov r8, qword [rbp + 0x10]
mov ecx, eax
call fcn.0043f876
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x10]
add eax, 1
lea r8, [0x0053c41b]
mov edx, eax
lea rcx, str._n_s
call sub.msvcrt.dll_printf
mov edx, dword [rbp - 0x1c]
mov eax, dword [rbp - 8]
mov r8, qword [rbp + 0x10]
mov ecx, eax
call fcn.0043f8eb
mov ecx, 0xa
call sub.msvcrt.dll_putchar
mov dword [rbp - 0xc], 2
jmp 0x43fb99
mov eax, dword [rbp - 0xc]
mov edx, 0
mov ecx, eax
call fcn.00448a80
lea rdx, [0x0053c422]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x43fb95
mov eax, dword [rbp - 0xc]
mov edx, 0
mov ecx, eax
call fcn.00448a80
mov rdx, rax
mov eax, dword [rbp - 0x10]
mov r8, rdx
mov edx, eax
lea rcx, str._s
call sub.msvcrt.dll_printf
mov ecx, dword [rbp - 0xc]
mov edx, dword [rbp - 0x1c]
mov eax, dword [rbp - 8]
mov r9, qword [rbp + 0x10]
mov r8d, ecx
mov ecx, eax
call fcn.0043f944
mov ecx, 0xa
call sub.msvcrt.dll_putchar
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0x59
jbe 0x43fb2c
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0xc]
cmp dword [rbp - 8], eax
jl 0x43fad3
nop
add rsp, 0x50
pop rbp
ret
Function at 0x441e07
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov edx, dword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov r8d, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x441e57
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rdx, rax
lea rcx, str._s:_failed_to_seek_to_next_file_name_n
call fcn.0044059f
mov eax, 0
jmp 0x441ef5
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x10]
add rax, 0x4c
mov r9, rdx
mov r8d, 0x3c
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0x3c
je 0x441ea5
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rdx, rax
lea rcx, str._s:_failed_to_read_archive_header_n
call fcn.0044059f
mov eax, 0
jmp 0x441ef5
mov rax, qword [rbp + 0x10]
add rax, 0x86
mov r8d, 2
lea rdx, [0x0053cd2e]
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x441ee5
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rdx, rax
lea rcx, str._s:_did_not_find_a_valid_archive_header_n
call fcn.0044059f
mov eax, 0
jmp 0x441ef5
mov rax, qword [rbp + 0x20]
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.00441b18
add rsp, 0x30
pop rbp
ret
Function at 0x452d9b
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
not dword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
add rax, rdx
mov qword [rbp - 8], rax
jmp 0x452df6
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax]
movzx eax, al
xor eax, dword [rbp + 0x10]
movzx eax, al
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x0053e160]
mov eax, dword [rdx + rax]
mov edx, dword [rbp + 0x10]
shr edx, 8
xor eax, edx
mov dword [rbp + 0x10], eax
add qword [rbp + 0x18], 1
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbp - 8]
jb 0x452dc2
mov eax, dword [rbp + 0x10]
not eax
add rsp, 0x10
pop rbp
ret

Function at 0x4578e5
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x457906
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
jmp 0x457916
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x457934
mov rax, qword [rbp - 8]
lea rdx, str.default
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x457982
mov rax, qword [0x00511f10]
test rax, rax
je 0x45794d
mov rax, qword [0x00511f10]
mov qword [rbp - 0x10], rax
jmp 0x45795b
mov rax, qword [0x00511f00]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
cmp qword [rbp + 0x18], 0
je 0x45797c
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp + 0x18]
movzx edx, byte [rax + 0x43]
or edx, 4
mov byte [rax + 0x43], dl
mov rax, qword [rbp - 0x10]
jmp 0x4579cc
cmp qword [rbp + 0x18], 0
je 0x457997
mov rax, qword [rbp + 0x18]
movzx edx, byte [rax + 0x43]
and edx, 0xfffffffb
mov byte [rax + 0x43], dl
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.004577c0
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x4579b5
mov eax, 0
jmp 0x4579cc
cmp qword [rbp + 0x18], 0
je 0x4579c8
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbp
ret
Function at 0x48dbb6
Capabilities:
Hash data using djb2

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0x1505
jmp 0x48dbe9
mov eax, dword [rbp - 0xc]
shl eax, 5
mov edx, eax
mov eax, dword [rbp - 0xc]
add edx, eax
movzx eax, byte [rbp - 0xd]
add eax, edx
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov qword [rbp - 8], rdx
movzx eax, byte [rax]
mov byte [rbp - 0xd], al
cmp byte [rbp - 0xd], 0
jne 0x48dbd3
mov eax, dword [rbp - 0xc]
add rsp, 0x10
pop rbp
ret
Function at 0x4cb09c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.004cafbb
test eax, eax
jne 0x4cb0d6
mov eax, 0
jmp 0x4cb13e
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp - 8], rax
sub qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
and eax, 0x7f
xor eax, 0x40
sub eax, 0x40
movsxd rdx, eax
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
jmp 0x4cb12f
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
shl rax, 7
mov rdx, rax
sub qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
and eax, 0x7f
or rdx, rax
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
cmp rax, qword [rbp - 0x10]
ja 0x4cb105
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x4dc394
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x20]
jge 0x4dc3ef
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
je 0x4dc3ef
mov ecx, 1
call fcn.00448bcd
mov rax, qword [rbp - 8]
jmp 0x4dc407
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x20]
jge 0x4dc403
mov ecx, 0x12
call fcn.00448bcd
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret