joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027ecc
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140027f16
call fcn.140013134
mov dword [rax], recv
call fcn.140013154
mov dword [rax], recv
call fcn.14001a3f4
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001200
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140027f21
lea eax, [rbx + 1]
jmp 0x140027f03
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140027f01
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140027f03

Function at 0x140027fdc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000ca34
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140028066
cmp byte [rbp - 0x21], r15b
je 0x140028061
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14002809c
call fcn.14002476c
test eax, eax
jne 0x140028088
cmp byte [rbp - 0x21], r15b
je 0x140028080
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14002809c
cmp byte [rbp - 0x21], r15b
je 0x140028099
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c324
test eax, eax
jne 0x14002813c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000ca34
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400280db
cmp byte [rbp - 0x21], r15b
je 0x140028110
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140028110
call fcn.14002476c
test eax, eax
jne 0x1400280fc
cmp byte [rbp - 0x21], r15b
je 0x1400280f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140028110
cmp byte [rbp - 0x21], r15b
je 0x14002810d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c324
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14002813c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002813f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14002814d
mov rcx, rdi
call fcn.140021dac
cmp byte [rbp + 0x3f], r15b
je 0x14002815c
mov rcx, qword [rbp + 0x27]
call fcn.140021dac
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140028214
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400156e0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400156e0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028364
cmp rax, 0xffffffffffffffff
je 0x140028364
xor edi, edi
test rbp, rbp
jle 0x14002830f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400252ec
mov rbx, rax
test rax, rax
jne 0x14002829c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028305
mov edx, 0x8000
mov ecx, r14d
call fcn.14001dbd0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001f3c4
cmp eax, 0xffffffff
je 0x1400282e5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400282ac
mov edx, r15d
mov ecx, r14d
call fcn.14001dbd0
jmp 0x140028305
cmp byte [rsi + 0x38], dil
je 0x1400282fc
cmp dword [rsi + 0x34], 5
jne 0x1400282fc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
cmp byte [rsi + 0x30], dil
je 0x140028305
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140021dac
jmp 0x140028378
jns 0x140028378
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400156e0
cmp rax, 0xffffffffffffffff
jne 0x140028330
cmp byte [rsi + 0x30], dil
je 0x140028378
mov edi, dword [rsi + 0x2c]
jmp 0x140028378
mov ecx, r14d
call fcn.140016ffc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028378
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
jmp 0x140028378
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028371
mov eax, dword [rsi + 0x2c]
jmp 0x140028376
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400156e0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14002db0c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400238f4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14002dbad
cmp ebx, dword [rsp + 0x30]
je 0x14002dba6
test esi, esi
je 0x14002dba6
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14002db81
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14002db8e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14002db6b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14002db92
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14002dbaf
mov eax, 1
jmp 0x14002dbaf
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140031e50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140031e78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140031e78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140035e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov dword [rcx + 8], 8
mov qword [rcx + 0x10], rbp
mov esi, r8d
mov qword [rcx], rbp
mov rbx, rdx
mov dword [rcx + 0xc], socket
mov rdi, rcx
cmp byte [rdx], bpl
je 0x140035f90
movabs r14, 0x8000040000000001
lea r15, [0x14045ea20]
mov eax, dword [rdi + 4]
sub eax, dword [rdi]
cmp eax, 1
jge 0x140035ee1
mov edx, 1
mov rcx, rdi
call fcn.1400326e0
mov rcx, qword [rdi + 0x10]
test eax, eax
jne 0x140035ee5
test rcx, rcx
je 0x140035ed3
cmp dword [0x14045b3f8], ebp
jne 0x140035ed3
call fcn.140005660
mov qword [rdi + 0x10], rbp
xor eax, eax
mov qword [rdi], rbp
jmp 0x140035f95
mov rcx, qword [rdi + 0x10]
movsxd rax, dword [rdi]
mov qword [rcx + rax*8], rbx
inc dword [rdi]
test esi, esi
je 0x140035f90
movzx ecx, byte [rbx]
mov r10d, ebp
mov r8, rbx
test cl, cl
je 0x140035f74
cmp cl, 0x5c
jne 0x140035f42
movzx edx, byte [rbx + 1]
lea r9, [rbx + 1]
cmp dl, 0x80
jae 0x140035f42
cmp dl, 0x20
je 0x140035f30
cmp dl, 0x3f
ja 0x140035f25
bt r14, rdx
jb 0x140035f42
test dl, dl
je 0x140035f30
test byte [rdx + r15], 0x40
jne 0x140035f42
mov byte [r8], cl
mov rbx, r9
movzx eax, byte [r9]
inc r8
mov byte [r8], al
jmp 0x140035f66
test r10d, r10d
jne 0x140035f53
lea eax, [rcx - 9]
cmp al, 4
jbe 0x140035f74
cmp cl, 0x20
je 0x140035f74
mov eax, r10d
mov byte [r8], cl
xor eax, 1
cmp cl, 0x60
cmovne eax, r10d
mov r10d, eax
movzx ecx, byte [rbx + 1]
inc rbx
inc r8
test cl, cl
jne 0x140035f03
movzx eax, byte [rbx]
cmp al, 0x20
je 0x140035f7f
cmp al, 9
jne 0x140035f84
inc rbx
jmp 0x140035f74
mov byte [r8], bpl
cmp byte [rbx], bpl
jne 0x140035ea2
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14003f900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10f0
call fcn.140031f40
sub rsp, rax
movaps xmmword [rsp + 0x10e0], xmm6
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x1090
call fcn.140002810
xorps xmm2, xmm2
mov dword [rsp + 0x10c0], 0x40
xorps xmm1, xmm1
lea rax, [0x1404334a0]
lea rcx, [0x1404334e0]
xorps xmm6, xmm6
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax]
add rax, 0x20
xorps xmm1, xmm0
cmp rax, rcx
jl 0x14003f970
xorps xmm1, xmm2
lea rax, [0x1404334d0]
movdqa xmm0, xmm1
lea rcx, [0x1404334d8]
psrldq xmm0, 8
xorps xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movd edx, xmm1
xor edx, dword [rax]
add rax, 4
cmp rax, rcx
jl 0x14003f9b5
movdqa xmm2, xmm6
lea rax, [0x140432430]
movdqa xmm1, xmm6
lea r8, [0x140433430]
nop word [rax + rax]
mov ecx, 0x20
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax]
add rax, 0x20
xorps xmm1, xmm0
sub rcx, 1
jne 0x14003f9f0
cmp rax, r8
jl 0x14003f9e0
xorps xmm1, xmm2
lea r8, str.salt
movdqa xmm0, xmm1
xor esi, esi
psrldq xmm0, 8
mov edi, esi
xorps xmm1, xmm0
mov r9, 0xffffffffffffffff
movdqa xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movd eax, xmm1
xor eax, edx
cmp eax, 0x6ffa520a
setne dil
nop word [rax + rax]
inc r9
cmp byte [r8 + r9], sil
jne 0x14003fa50
lea rdx, [0x140433420]
lea rcx, [rsp + 0x30]
call fcn.14003fcc0
mov rax, rsi
movdqa xmm2, xmm6
movdqa xmm1, xmm6
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax*4 + 0x30]
xorps xmm2, xmm0
movdqu xmm0, xmmword [rsp + rax*4 + 0x40]
add rax, 8
xorps xmm1, xmm0
cmp rax, 0x10
jl 0x14003fa80
xorps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movd edx, xmm1
cmp rax, 0x12
jge 0x14003face
xor edx, dword [rsp + rax*4 + 0x30]
inc rax
cmp rax, 0x12
jl 0x14003fac1
movdqa xmm1, xmm6
lea rax, [rsp + 0x88]
mov r8d, 4
mov ecx, 0x20
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm6, xmm0
movdqu xmm0, xmmword [rax]
add rax, 0x20
xorps xmm1, xmm0
sub rcx, 1
jne 0x14003faf0
sub r8, 1
jne 0x14003fae0
xorps xmm1, xmm6
lea ebx, [rdi + 1]
movdqa xmm0, xmm1
lea r8, [rsp + 0x24]
psrldq xmm0, 8
lea rcx, [rsp + 0x30]
xorps xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movd eax, xmm1
xor edx, eax
mov rax, qword [str.plaintxt]
cmp edx, dword [str._epV]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
cmove ebx, edi
call fcn.14003ff80
mov rax, qword [rsp + 0x20]
cmp rax, qword [0x140433472]
je 0x14003fb9a
test ebx, ebx
jne 0x14003fb98
cmp rax, qword [str.rP_8]
jne 0x14003fb98
lea rcx, str.E817:_Blowfish_big_little_endian_use_wrong
call qword [case.0x1400407ae.0]
mov rdi, rax
call fcn.140182a30
test eax, eax
jne 0x14003fb98
mov rcx, rdi
call fcn.140182400
inc ebx
test ebx, ebx
sete sil
mov eax, esi
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.140001200
lea r11, [rsp + 0x10f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
Function at 0x14003fcc0
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov r15d, r9d
mov r12, r8
mov rax, rdx
mov rsi, rcx
mov r13d, edi
lea rbp, [rdi - 1]
test rdx, rdx
je 0x14003fd16
cmp byte [rdx], dil
je 0x14003fd16
mov rdx, rbp
nop
inc rdx
cmp byte [rax + rdx], dil
jne 0x14003fd00
mov rcx, rax
call fcn.14025b950
mov rbx, rax
jmp 0x14003fd1d
lea rbx, [0x1403b051f]
mov r14d, 0x3e8
test rbx, rbx
je 0x14003fd4c
cmp byte [rbx], dil
je 0x14003fd4c
mov rdx, rbp
inc rdx
cmp byte [rbx + rdx], dil
jne 0x14003fd30
mov r9d, r15d
mov r8, r12
mov rcx, rbx
call fcn.14025b950
mov rbx, rax
jmp 0x14003fd53
lea rbx, [0x1403b051f]
sub r14, 1
jne 0x14003fd23
nop dword [rax]
inc rbp
cmp byte [rbx + rbp], dil
jne 0x14003fd60
mov rax, rbp
cdq
sub eax, edx
sar eax, 1
movsxd r12, eax
jne 0x14003fda9
call fcn.140182a30
test eax, eax
jne 0x14003feff
lea rcx, str.E340:_Internal_error__if_you_can_reproduce_please_report_a_bug
call qword [case.0x1400407ae.0]
mov rcx, rax
call fcn.140182400
lea rcx, str.E831:_bf_key_init___called_with_empty_password
call fcn.140182400
jmp 0x14003feff
test eax, eax
jle 0x14003fddd
mov r14, rdi
mov ebp, edi
movsxd rcx, ebp
lea r8, [rsp + 0x24]
add rcx, rbx
lea rdx, [0x1403b068c]
call fcn.140001080
movzx eax, byte [rsp + 0x24]
add ebp, 2
mov byte [r14 + rbx], al
inc r14
cmp r14, r12
jl 0x14003fdb2
lea rcx, [rsi + 0x48]
mov r8d, 0x1000
lea rdx, [0x140432420]
call fcn.140003740
lea r9, [0x140433490]
mov r10, rsi
sub r9, rsi
mov r11d, reloc.WSOCK32.dll_select
nop word [rax + rax]
mov eax, r13d
lea r10, [r10 + 4]
cdq
idiv r12d
movsxd rax, edx
movzx r8d, byte [rax + rbx]
lea eax, [r13 + 1]
cdq
shl r8d, 8
idiv r12d
movsxd rax, edx
movzx ecx, byte [rax + rbx]
lea eax, [r13 + 2]
cdq
or r8d, ecx
idiv r12d
shl r8d, 8
movsxd rax, edx
movzx ecx, byte [rax + rbx]
lea eax, [r13 + 3]
or r8d, ecx
cdq
idiv r12d
shl r8d, 8
add r13d, 4
movsxd rax, edx
movzx ecx, byte [rax + rbx]
or r8d, ecx
xor r8d, dword [r9 + r10 - 4]
mov dword [r10 - 4], r8d
sub r11, 1
jne 0x14003fe10
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x68], edi
lea r8, [rsp + 0x20]
mov rcx, rsi
lea rdx, [rsp + 0x68]
call fcn.14003ff80
mov eax, dword [rsp + 0x68]
mov dword [rsi + rdi*4], eax
mov eax, dword [rsp + 0x20]
mov dword [rsi + rdi*4 + 4], eax
add rdi, 2
cmp rdi, 0x12
jl 0x14003fe80
lea rbx, [rsi + 0x4c]
mov ebp, 4
nop dword [rax]
nop dword [rax + rax]
mov edi, 0x80
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rsi
lea rdx, [rsp + 0x68]
call fcn.14003ff80
mov eax, dword [rsp + 0x68]
mov dword [rbx - 4], eax
mov eax, dword [rsp + 0x20]
mov dword [rbx], eax
add rbx, 8
sub rdi, 1
jne 0x14003fed0
sub rbp, 1
jne 0x14003fec0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400448d0
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14045e9b0]
test rcx, rcx
je 0x14004491c
xor edx, edx
mov qword [rsp + 0x20], rbx
call fcn.140321ad0
mov rbx, rax
test rax, rax
je 0x140044917
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x14045b3f8], 0
jne 0x140044917
mov rcx, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.140005660
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1400675a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x14045b480], 0
je 0x140067634
test byte [0x140420a38], 1
je 0x140067634
cmp dword [0x140469ca0], 0
je 0x140067634
lea rcx, [0x140469ca0]
call fcn.140067670
call fcn.140065dc0
cmp dword [0x140469ca4], 0
jne 0x1400675f2
cmp dword [0x140469ca0], 0
je 0x1400675fe
mov dword [0x140469ca4], 0
jmp 0x1400675fe
lea rcx, [0x140469ca0]
call fcn.140065ae0
cmp dword [0x1404334f0], 0
jne 0x140067624
mov eax, dword [0x14045b5c8]
test al, 2
jne 0x140067615
test al, 1
je 0x140067624
mov dword [0x14045eb68], 1
add rsp, 0x28
ret
lea rcx, [0x140469ca0]
add rsp, 0x28
jmp fcn.140322110
add rsp, 0x28
ret

Function at 0x1400727e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r15, rdx
mov r14, rcx
mov edx, reloc.WSOCK32.dll_ioctlsocket
mov r9, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 0xb]
call fcn.14000bd5c
cmp rax, 1
jne 0x1400728a6
mov edx, dword [rsp + 0x28]
lea rax, str.VimCrypt01_
mov r8, qword [rsp + 0x20]
lea r9, str.sodium_init
xor ebx, ebx
nop
mov rcx, qword [rax]
cmp r8, qword [rcx]
jne 0x14007284d
cmp edx, dword [rcx + 8]
je 0x1400728c9
inc ebx
add rax, 0x68
cmp rax, r9
jl 0x140072840
lea rdx, str.VimCrypt
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x140072866
cmp eax, 0xc
jg 0x1400728a6
movsxd r8, eax
lea rcx, [rsp + 0x20]
call fcn.140032120
test eax, eax
jne 0x1400728a6
lea rcx, str.E821:_File_is_encrypted_with_unknown_method
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x1400728a6
mov rcx, rbx
call fcn.140182400
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test ebx, ebx
js 0x1400728a6
movsxd rax, ebx
mov edx, 1
imul rcx, rax, 0x68
lea rax, [0x140433820]
mov esi, dword [rcx + rax + 0x10]
add esi, dword [rcx + rax + 0x14]
add esi, dword [rcx + rax + 0x18]
lea ebp, [rsi + 0xc]
movsxd rcx, ebp
call fcn.140032b90
mov rdi, rax
test rax, rax
je 0x1400728a6
mov r8d, reloc.WSOCK32.dll_ioctlsocket
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140003740
cmp ebp, 0xc
jle 0x14007294c
movsxd rdx, esi
lea rcx, [rdi + 0xc]
mov r9, r14
mov r8d, 1
call fcn.14000bd5c
cmp rax, 1
je 0x14007294c
cmp dword [0x14045b3f8], 0
jne 0x1400728a6
mov rcx, rdi
call fcn.140005660
jmp 0x1400728a6
mov r8, rdi
mov rdx, r15
mov ecx, ebx
call fcn.140072980
cmp dword [0x14045b3f8], 0
mov rbx, rax
jne 0x14007296d
mov rcx, rdi
call fcn.140005660
mov rax, rbx
jmp 0x1400728a8
Function at 0x140090e90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
cmp dword [0x140421fcc], 0
mov rcx, qword [0x14046a618]
jl 0x140090eb6
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
test byte [0x14045b5b8], 4
je 0x140090f67
mov rax, qword [0x14046a608]
cmp qword [rax], 0
je 0x140090f62
add rcx, 0x38
mov edx, 1
call fcn.140095f60
mov edx, dword [0x14045b40c]
test edx, edx
jne 0x140090f2a
xor eax, eax
cmp dword [0x14045b4d8], eax
setne al
test eax, eax
jne 0x140090f2a
mov rdx, qword [0x14046a608]
cmp qword [rdx], 0
je 0x140090f62
mov rax, qword [0x14046a5f0]
mov rcx, qword [rax]
test rcx, rcx
cmove rcx, rdx
mov edx, 1
mov r8d, edx
add rsp, 0x38
jmp fcn.140331380
test edx, edx
mov qword [rsp + 0x30], rbx
lea rax, str.E565:_Not_allowed_to_change_text_or_change_window
lea rcx, str.E11:_Invalid_in_command_line_window__:q_CR__closes_the_window
cmove rcx, rax
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x140090f5d
mov rcx, rbx
call fcn.140182400
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
movsd xmm0, qword [rcx + 0x38]
mov edx, 1
mov eax, dword [rcx + 0x40]
mov ecx, edx
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
call fcn.140198af0
cmp eax, 1
jne 0x140090fa5
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
add rsp, 0x38
ret
mov ecx, 4
add rsp, 0x38
jmp fcn.14018aca0

Function at 0x140090fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [0x140421fcc], 0
mov ebx, ecx
mov rcx, qword [0x14046a618]
mov esi, dword [rcx + 0xd8]
mov edi, dword [rcx + 0xe4]
jl 0x140090fff
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
movsd xmm0, qword [rcx + 0x38]
mov edx, 1
mov eax, dword [rcx + 0x40]
mov ecx, edx
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
call fcn.140094ea0
cmp eax, 1
jne 0x1400910b5
test ebx, ebx
je 0x14009103d
lea rcx, [0x14046a080]
call fcn.140058110
mov ecx, eax
call fcn.14018ea90
mov rax, qword [0x14046a618]
cmp esi, dword [rax + 0xd8]
jne 0x140091054
cmp edi, dword [rax + 0xe4]
je 0x14009108c
cmp dword [0x14045b548], 0
jne 0x14009108c
cmp dword [0x14045b4f4], 0
jne 0x14009108c
cmp dword [rax + 0x33c], 0xa
jge 0x14009108c
cmp dword [0x14045b4d4], 0xa
mov dword [rax + 0x33c], 0xa
jge 0x14009108c
mov dword [0x14045b4d4], 0xa
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 4
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14018aca0
Function at 0x1400910e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
cmp dword [0x140421fcc], 0
mov rcx, qword [0x14046a618]
jl 0x140091106
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
test byte [0x14045b5b8], 4
je 0x1400911cb
mov rax, qword [0x14046a608]
cmp qword [rax], 0
je 0x1400911c6
add rcx, 0x38
mov edx, 1
call fcn.140095f60
mov edx, dword [0x14045b40c]
test edx, edx
jne 0x14009118e
xor eax, eax
cmp dword [0x14045b4d8], eax
setne al
test eax, eax
jne 0x14009118e
mov r9, qword [0x14046a608]
cmp qword [r9], 0
je 0x1400911c6
mov rdx, qword [0x14046a5f0]
mov rcx, qword [r9]
cmp rcx, rdx
je 0x14009117a
test rcx, rcx
je 0x14009117a
mov rax, qword [rcx]
mov r9, rcx
mov rcx, rax
cmp rax, rdx
jne 0x140091167
mov edx, 1
mov rcx, r9
mov r8d, edx
add rsp, 0x38
jmp fcn.140331380
test edx, edx
mov qword [rsp + 0x30], rbx
lea rax, str.E565:_Not_allowed_to_change_text_or_change_window
lea rcx, str.E11:_Invalid_in_command_line_window__:q_CR__closes_the_window
cmove rcx, rax
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x1400911c1
mov rcx, rbx
call fcn.140182400
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
movsd xmm0, qword [rcx + 0x38]
mov edx, 1
mov eax, dword [rcx + 0x40]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
lea ecx, [rdx - 2]
call fcn.140198af0
cmp eax, 1
jne 0x14009120a
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
add rsp, 0x38
ret
mov ecx, 4
add rsp, 0x38
jmp fcn.14018aca0

Function at 0x140091220
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [0x140421fcc], 0
mov esi, ecx
mov rcx, qword [0x14046a618]
mov edi, dword [rcx + 0xd8]
mov ebx, dword [rcx + 0xe4]
jl 0x14009125f
mov edx, dword [rcx + 0x38]
mov dword [0x140421fcc], 0xffffffff
call fcn.14008f590
cmp dword [rcx + 0x38], 1
movsd xmm0, qword [rcx + 0x38]
mov eax, dword [rcx + 0x40]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
jle 0x140091328
mov edx, 1
call fcn.140095130
mov rcx, qword [0x14046a618]
mov ecx, dword [rcx + 0x44]
call fcn.14018ea90
call fcn.14019a210
test esi, esi
je 0x1400912b0
lea rcx, [0x14046a080]
call fcn.140058110
mov ecx, eax
call fcn.14018ea90
mov rax, qword [0x14046a618]
cmp edi, dword [rax + 0xd8]
jne 0x1400912c7
cmp ebx, dword [rax + 0xe4]
je 0x1400912ff
cmp dword [0x14045b548], 0
jne 0x1400912ff
cmp dword [0x14045b4f4], 0
jne 0x1400912ff
cmp dword [rax + 0x33c], 0xa
jge 0x1400912ff
cmp dword [0x14045b4d4], 0xa
mov dword [rax + 0x33c], 0xa
jge 0x1400912ff
mov dword [0x14045b4d4], 0xa
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140095f60
mov dword [0x14045f35c], 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 4
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14018aca0