joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013d40
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
int3
sub rsp, 0x48
lea rax, [0x1800182df]
mov qword [rsp + 0x20], rax
lea rax, [0x180013aa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
jo 0x180013d9a
push rbp
push rcx
push rdx
push rdi
pop rdi
pop rdx
pop rcx
pop rbp
jno 0x180013d9a
invalid
adc al, 0x8c
test byte [rcx - 0x1eb88383], bl
je 0x180013d3e
xor byte [r9], r14b
fstp xword [rsp + rdi*2 + 0x45]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x18001b020]
mov qword [0x18001b440], rax
add byte [rax], al
jo 0x180013ddd
push rsp
push rbp
push rdx
nop
pop rdx
pop rbp
pop rsp
jno 0x180013ddd
xor byte [rcx], dh
stosb byte [rdi], al
jge 0x180013df2
invalid
jge 0x180013e38
adc al, 0x99
xor byte [rdx + rax*2], dl
xor dword [rsp + rdx + 0x307447db], ecx
cdq
cdq
jl 0x180013e1c
je 0x180013deb
cdq
adc al, 0xe1
stosb byte [rdi], al
test byte [rcx], dh
cmp qword [0x18001b440], 0
jne 0x180013dee
mov eax, 1
jmp 0x180013e32
add bl, ch
js 0x180013e1a
js 0x180013e1a
jns 0x180013e1a
jo 0x180013e24
jge 0x180013e38
je 0x180013e6c
xor ecx, esp
jge 0x180013e79
jl 0x180013d8a
test byte [rdi + 0x47], al
cdq
mov word [rsp + rax*4], ss
jl 0x180013e24
mov word [rsp + rsi*2 - 0x736673d0], es
jge 0x180013e84
stosb byte [rdi], al
jl 0x180013e43
stosb byte [rdi], al
loope 0x180013daf
jge 0x180013dc2
je 0x180013dc4
lea rcx, [rsp + 0x20]
and al, 0x20
call qword [0x18001b198]
test eax, eax
jne 0x180013e30
add byte [rbp - 0x47f88a40], al
add dword [rax], eax
add byte [rax], al
mov eax, 1
jmp 0x180013e32
xor eax, eax
add rsp, 0x48
ret
int3
cmp byte [rax - 0x39], cl
and al, 0x10
add byte [rax], al
add byte [rax], al
mov qword [rsp + 0x18], 0
mov qword [rsp + 8], 0
mov qword [rsp], 0
mov qword [rsp + 0x20], 0
add byte [rax], al
add byte [rax], al
mov rax, qword gs:[0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x238]
mov eax, dword [rax + 0x238]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180013eed
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0
jle 0x180013eed
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0x190
jge 0x180013eed
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180013eed
jmp 0x180013efc
mov rax, qword [rsp + 8]
dec rax
mov qword [rsp + 8], rax
jmp 0x180013e99
mov rax, qword [rsp + 8]
add rsp, 0x38
ret

Function at 0x180013e40
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x10], 0
Function at 0x180013f10
Capabilities:
Hash data with crc32
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 8]
and al, 8
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
mov dword [rsp + 8], 0
mov dword [rsp], 0xffffffff
jp 0x180013f64
push rbp
push rbp
push rbx
pop rbx
pop rbp
pop rbp
jnp 0x180013f64
jge 0x180013eee
loope 0x180013ef0
jl 0x180013f79
invalid
mov dword [rsp + 4], 0
jmp 0x180013f78
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
and al, 0x28
cmp dword [rsp + 4], eax
jae 0x180014043
jp 0x180013fb2
push rsp
push rcx
nop
pop rcx
pop rsp
jnp 0x180013fb2
adc al, 0x8c
mov word [0x1f415d923], ds
sbb eax, 0xdb14aa42
cdq
mov word [rcx + rsi + 0x1d147c1d], es
xor bl, bl
mov word [rbx + rbx*8], ss
invalid
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
and eax, 0xff
enter 0xffffffffffffc18b, 0x25
inc dword [rax]
add byte [rax], al
mov dword [rsp + 8], eax
jle 0x180013ffb
push rdx
pop rdx
jg 0x180013ffb
invalid
jge 0x180014007
jo 0x180014026
je 0x18001403a
test byte [rcx + rsi - 0x75], bh
add al, 0x24
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp + 8]
lea rdx, [0x18001a810]
adc eax, 0x6804
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
jo 0x18001403e
nop
jno 0x18001403e
cdq
jl 0x180013ff5
jl 0x180014098
xor byte [r11 + 0x74e1997d], r10b
loope 0x18001403b
adc al, 0x70
jo 0x1800140a6
jge 0x180013fc3
cdq
xor dword [rbx + rbx*8 - 0x1e556674], eax
test byte [rbx + rbx*8 + 0x74], dh
adc al, 0x1d
loope 0x180014069
mov word [rdx + rax*2 + 0x2be97c84], es
test byte [rdx - 0x7c], al
jl 0x180014028
test byte [rcx + r13*8 + 0x2b], dil
jmp 0x180013f6e
sub edi, edi
invalid
invalid
jl 0x18001406f
push rdi
pop rdi
jge 0x18001406f
loope 0x180013ff5
jl 0x18001407e
jo 0x1800140bf
jo 0x180014094
adc al, 0x7d
xor byte [rdx - 0x247b66cf], ch
jge 0x1800140d8
cdq
invalid
jo 0x180014015
je 0x180013ff1
jo 0x1800140b6
mov eax, dword [rsp]
xor eax, 0xffffffff
mov dword [rsp], eax
jg 0x1800140a4
and al, 0x83
lock dec dword [rcx + 0x2a7f2404]
push rsp
push rdi
push rsi
nop
pop rsi
pop rdi
pop rsp
jle 0x1800140a4
test byte [r10 + 0x7caa317c], r13b
test byte [rdx + rbp*4 - 0x74], dh
stosb byte [rdi], al
jge 0x18001410f
invalid
je 0x180014071
jge 0x1800140b5
jl 0x1800140ae
xor dword [rax - 0x56], esi
stosb byte [rdi], al
xor byte [rdx - 0x25], al
fild dword [rdx + 0x48]
mov eax, dword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
and al, 0x30
mov ecx, dword [rsp]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x18
ret
int3
int3
int3
add byte [rax], al
add byte [rax], al
and al, 0x38
Function at 0x180015570
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0
jbe 0x1800155a9
push rdi
pop rdi
ja 0x1800155a9
fdisi8087_nop
cdq
adc al, 0x14
cdq
fistp dword [0x1b19aeed6]
cdq
fstp xword [rcx + rsi - 0x25]
test byte [rax], dh
jo 0x180015608
test byte [rcx - 0x55838bec], bl

Function at 0x180015620
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x308

Function at 0x140b239f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], r9
push 0x671d913d
mov ebx, 0xe4a1728d
lea r9, [0x140b21080]
lea rsp, [rsp + 8]
mov ebx, 0xed37c900
movzx ebx, byte [r11]
push 0xffffffffb697ac8b
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [r9 + rbx*4]
sub dword [rsp + 4], 0xa8deae
shr ecx, 8
push 0xffffffffe3b835bd
xor ecx, ebx
push 0x583128bf
inc r11
and byte [rsp + 0xb], 0x35
xor ecx, 0xf20f2e9b
push 0x7fbc771e
neg word [rsp + 0x18]
dec rax
lea rsp, [rsp + 0x20]
jne 0x140b23a0a
pop r9
Function at 0x402d80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x402d9f
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x402ff0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.00417310]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__sljicswgentyihmsamwtujlrskwexqdjsibqxlxemmrjpdviznhbemjfqj
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x403030
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.00417310]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__eqaaircpydmwjauocsmtuqrtahxyfpdweivqbfqeixbmppotlybcsehfmjwycolauzhiga
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x4077c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rdx
je 0x407831
cmp qword [rcx + 8], 0
js 0x407840
call fcn.004075c0
test rax, rax
je 0x407831
mov r10, qword [rax]
test r10, r10
jle 0x40782b
mov r9, rax
add r10, rbx
sub r9, rbx
nop
mov r8, rbx
mov rdx, rbx
sar r8, 8
sar rdx, 0x10
xor r8d, ebx
and edx, 0xffffffee
and r8d, 0xffffffee
xor r8b, byte [r9 + rbx + 0x10]
xor r8d, edx
mov rdx, rbx
sar rdx, 0x18
and edx, 0xffffffee
xor r8d, edx
mov byte [r9 + rbx + 0x10], r8b
add rbx, 1
cmp rbx, r10
jne 0x4077f0
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rax, rcx
jmp 0x4077de
Function at 0x407cf0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbx, [0x0041d0e0]
mov r14, rcx
mov ebp, edx
mov edx, 0x1a0ff9aa
lea rcx, [0x0041cf80]
call fcn.004077c0
lea rsi, [r14 + 2]
mov edx, 0x2df7164e
mov rcx, rax
call fcn.00407ad0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
lea rdi, [rax + 0x20]
nop dword [rax]
nop word cs:[rax + rax]
movzx eax, word [r14]
mov rdx, r14
test ax, ax
je 0x407d80
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x407f00
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x407d60
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
je 0x407f22
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [r12 - 0x41]
cmp dx, 0x19
ja 0x407f30
add r12d, 0x20
add rax, 2
mov word [rax - 2], r12w
movzx r12d, word [rax]
test r12w, r12w
jne 0x407da0
movzx r15d, word [r14]
movzx r12d, word [rcx]
test r15w, r15w
je 0x407e35
test r12w, r12w
je 0x407f50
mov r10, rsi
mov eax, r15d
sub r10, rcx
jmp 0x407df6
cmp word [rcx], 0
je 0x407e35
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x407f50
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x407df0
mov edx, 0x76e9ab2a
mov rcx, rbx
call fcn.004077c0
mov edx, 0x3f63bace
mov rcx, rax
call fcn.00407ad0
cmp r15w, r12w
je 0x407f6f
mov r13, qword [r13]
cmp rdi, r13
jne 0x407d50
test ebp, ebp
je 0x407f84
lea rcx, [0x0041d080]
mov edx, 0x23bd1f0a
call fcn.004077c0
lea rbx, [rsp + 0x30]
mov edx, 0x1089ca6e
mov rcx, rax
call fcn.00407ad0
mov rcx, rbx
mov rdx, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x00424548]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x00424540]
mov edx, 0x4cb7dcae
lea rcx, [0x0041d040]
mov ebx, eax
call fcn.004077c0
mov edx, 0x76e9ab2a
mov rcx, rax
call fcn.00407ad0
test ebx, ebx
jne 0x407fa2
mov rax, qword [rsp + 0x28]
jmp 0x407f73
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x407d60
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
jne 0x407d92
movzx r15d, word [r14]
jmp 0x407e35
add rax, 2
movzx r12d, word [rax]
test r12w, r12w
jne 0x407da0
jmp 0x407dc6
mov rcx, rbx
mov edx, 0x76e9ab2a
call fcn.004077c0
mov edx, 0x3f63bace
mov rcx, rax
call fcn.00407ad0
jmp 0x407e59
mov rax, qword [r13 + 0x20]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x0041d000]
mov edx, 0x5bd8730e
call fcn.004077c0
mov edx, 0x17ff124a
mov rcx, rax
call fcn.00407ad0
xor eax, eax
jmp 0x407f73
Function at 0x407fb0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rsi, [0x0041d0e0]
mov edx, 0x1a0ff9aa
mov r13, rcx
lea rcx, [0x0041cf80]
call fcn.004077c0
lea rdi, [r13 + 2]
mov edx, 0x2df7164e
mov rcx, rax
call fcn.00407ad0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea rbp, [rax + 0x20]
nop
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x408030
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x4081b0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x408010
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
je 0x4081d1
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [rbx - 0x41]
cmp dx, 0x19
ja 0x4081e0
add ebx, 0x20
add rax, 2
mov word [rax - 2], bx
movzx ebx, word [rax]
test bx, bx
jne 0x408050
movzx r14d, word [r13]
movzx ebx, word [rcx]
test r14w, r14w
je 0x4080e5
test bx, bx
je 0x408200
mov r10, rdi
mov eax, r14d
sub r10, rcx
jmp 0x4080a6
cmp word [rcx], 0
je 0x4080e5
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x408200
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x4080a0
mov edx, 0x76e9ab2a
mov rcx, rsi
call fcn.004077c0
mov edx, 0x3f63bace
mov rcx, rax
call fcn.00407ad0
cmp r14w, bx
je 0x40821f
mov r12, qword [r12]
cmp rbp, r12
jne 0x408000
lea rcx, [0x0041d080]
mov edx, 0x23bd1f0a
call fcn.004077c0
lea rbx, [rsp + 0x30]
mov edx, 0x1089ca6e
mov rcx, rax
call fcn.00407ad0
mov rcx, rbx
mov rdx, r13
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x00424548]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x00424540]
mov edx, 0x4cb7dcae
lea rcx, [0x0041d040]
mov ebx, eax
call fcn.004077c0
mov edx, 0x76e9ab2a
mov rcx, rax
call fcn.00407ad0
xor eax, eax
test ebx, ebx
jne 0x408224
mov rax, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x408010
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
jne 0x408041
movzx r14d, word [r13]
jmp 0x4080e5
add rax, 2
movzx ebx, word [rax]
test bx, bx
jne 0x408050
jmp 0x408070
mov rcx, rsi
mov edx, 0x76e9ab2a
call fcn.004077c0
mov edx, 0x3f63bace
mov rcx, rax
call fcn.00407ad0
jmp 0x408109
mov rax, qword [r12 + 0x20]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x40d3b0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [fcn.00417310]
mov rsi, qword [rcx]
mov ecx, 1
call rbp
mov rdi, rax
test rsi, rsi
je 0x40d490
cmp qword [rsi], 0
lea r8, [rsi + 0x10]
mov rcx, rdi
lea rax, [section..rdata]
lea rdx, [0x00419138]
cmove r8, rax
call sub.msvcrt.dll_fprintf
lea r12, [0x00419138]
mov ebx, eax
movsxd rax, ebx
cmp rax, qword [rsi]
jge 0x40d42a
cmp byte [rsi + rax + 0x10], 0
jne 0x40d470
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x40d42a
add ebx, 1
movsxd rax, ebx
cmp rax, qword [rsi]
jl 0x40d40a
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x004190b6]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fflush
lea r8, [rsi + rax + 0x10]
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_fprintf
test eax, eax
jle 0x40d42a
add ebx, eax
jmp 0x40d402
lea r8, [section..rdata]
mov rcx, rax
lea rdx, [0x00419138]
call sub.msvcrt.dll_fprintf
lea rsi, [0x00419138]
mov ebx, eax
nop
test ebx, ebx
jns 0x40d42a
movsxd r8, ebx
cmp byte [r8 + 0x10], 0
jne 0x40d4e9
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x40d42a
add ebx, 1
test ebx, ebx
jns 0x40d42a
movsxd r8, ebx
cmp byte [r8 + 0x10], 0
je 0x40d4c2
add r8, 0x10
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_fprintf
test eax, eax
jle 0x40d42a
add ebx, eax
jmp 0x40d4b0
Function at 0x416290
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00435524]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x416418
mov rax, qword [0x00435528]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4162dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x416365
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4162c0
mov rcx, rbx
call fcn.00416f30
test rax, rax
mov r12, rax
je 0x41644d
mov rax, qword [0x00435528]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00417060
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00435528]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x416430
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x41635e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4163c0
add dword [0x00435524], 1
cmp edi, 8
jae 0x416393
test dil, 4
jne 0x416404
test edi, edi
je 0x416388
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x41641f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x416388
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x4163ac
jmp 0x416388
add rsi, qword [0x00435528]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41635e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.syyteejdrqldxcjxecccnoeeldvkaneua_0x_x
mov edx, eax
call fcn.004174e0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x416388
xor esi, esi
jmp 0x4162e7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x416388
mov rax, qword [0x00435528]
lea rcx, str.__zdnbfbbndutkhrnwftx_for__d_bcmbstekbxhwbbaf__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004174e0
lea rcx, str.mqkyhblpzoleivqzpomamghefaxsima
mov rdx, rbx
call fcn.004174e0
nop
nop dword [rax]

Function at 0x416ba0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00435800]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004357e0]
test rbx, rbx
je 0x416bf4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x416beb
test rsi, rsi
je 0x416beb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x416bd0
lea rcx, [0x00435800]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x416f30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0041dce0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x416f9d
mov rcx, r8
call fcn.00416e10
test eax, eax
je 0x416f9d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x416f9d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x416f94
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x416f9f
add rax, 0x28
cmp rax, r9
jne 0x416f80
xor eax, eax
add rsp, 0x28
ret

Function at 0x4174e0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00417310
mov r8d, 0x1b
mov edx, 1
lea rcx, str.xrerxoftwsieuwopvcfluwyuld_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00417310
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1400066d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140081100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400814e0]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x1f4d], 0
jne 0x140006737
cmp byte [rbx + 0x1f4e], 0
jne 0x140006737
mov r9d, dword [rbx + 0x2ff8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000ae40
test sil, 1
je 0x140006866
jmp 0x1400067cf
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14004c018]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x14004c00c]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
or dword [rbx + 0x1cb0], 1
mov qword [rbx + 0x1cc8], rax
movss dword [rbx + 0x1cc0], xmm0
mov dword [rbx + 0x1cb4], 1
movss dword [rbx + 0x1cc4], xmm1
movss xmm0, dword [rbx + 0x1670]
mov rax, qword [0x1400814e0]
mulss xmm0, dword [0x14004bfbc]
or dword [rax + 0x1cb0], 0x40
movss dword [rax + 0x1d10], xmm0
mov r9d, dword [rbx + 0x2ff8]
call fcn.14000ae40
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140006820
lea r11, [0x14004b7d0]
nop
cmp r9b, 0x23
jne 0x140006803
cmp byte [r8], r9b
jne 0x140006803
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400067f0
not ecx
call fcn.140009a50
test rax, rax
je 0x140006866
cmp byte [rax + 0x8e], 0
je 0x140006866
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ff8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ff8]
call fcn.14000ae40
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140003b50
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140048d90
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140009ad0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140009b20
lea r11, [0x14004b7d0]
cmp r9b, 0x23
jne 0x140009b03
cmp byte [r8], r9b
jne 0x140009b03
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140009af0
not ecx
jmp fcn.140009a50

Function at 0x14000a470
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rcx + 0xc8]
mov r9, r8
mov r8, qword [rcx + 0xd0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [r8 + rax*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.14000af90
Function at 0x14000af90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000afed
lea rbx, [0x14004b7d0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000afd4
cmp r10, 2
jb 0x14000afd4
cmp byte [r9], r8b
jne 0x14000afd4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000afb0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000b02f
lea rbx, [0x14004b7d0]
cmp r8b, 0x23
jne 0x14000b013
cmp byte [r9], r8b
jne 0x14000b013
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000b000
mov rbx, qword [rsp + 8]
not eax
ret