joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404dcb4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov al, spl
mov qword [rsp + 0x18], rbp
lahf
push rsi
cmovs eax, r13d
mov ax, r10w
movsx rax, ax
push rdi
lahf
movzx rax, r8w
cdqe
push r14
cmove ax, r12w
mov ax, r15w
mov eax, 0x1450
jmp 0x1404dcb84
call fcn.140448f9b
sub rsp, rax
mov rax, qword [0x1400b7288]
xor rax, rsp
xchg sil, r14b
movsx r10d, r15w
cmovs esi, r14d
mov qword [rsp + 0x1440], rax
movsxd r10, edx
cdq
mov rdi, rcx
or dh, 0xc5
and dl, dil
bts edx, esp
mov rax, r10
bswap dx
adc rsi, 0x7a140deb
cmp rbx, 0x55d764d4
mov ebp, r9d
sar rax, 6
test dil, cl
or r14b, bpl
bt cx, r14w
lea rcx, [0x1400ba940]
shr r14b, 0x7e
rol r14b, cl
and r10d, 0x3f
shl edx, 0xe8
adc si, 0x14ab
and dx, 0x7594
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
movsx r14d, dx
mov r14, qword [rax + rdx*8 + 0x28]
cmp bp, 0x5916
jmp 0x1404dcc1f
xor eax, eax
mov qword [rdi], rax
test rbx, 0x248832fe
test r9w, r13w
cmp si, r14w
mov dword [rdi + 8], eax
cmc
stc
cmp r8, rbp
jae 0x1404dcd3d
lea rbx, [rsp + 0x40]
cmc
clc
cmp rsi, rbp
jae 0x1404dcca5
mov al, byte [rsi]
jmp 0x1404dcc58
inc rsi
stc
cmp al, 0xa
jmp 0x1404dcc63
jne 0x1404dcc7c
inc dword [rdi + 8]
jmp 0x1404dcc71
mov byte [rbx], 0xd
jmp 0x1404dcc79
inc rbx
mov byte [rbx], al
setno al
inc rbx
cmp bl, r12b
xadd ax, ax
sub al, r12b
lea rax, [rsp + 0x143f]
clc
cmp rbx, rax
jmp 0x1404dcc9f
jb 0x1404dcc48
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
inc r8d
and r9b, 0xd0
rcr dh, 0
sub ebx, eax
movzx dx, r14b
cqo
xchg r9w, r9w
lea r9, [rsp + 0x30]
movsx r8d, r10w
mov r8d, ebx
cmovb dx, ax
xchg dl, cl
lea rdx, [rsp + 0x40]
movzx rcx, bp
bswap cx
mov cl, 0x50
mov rcx, r14
jmp 0x1404dccef
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dccfc
je 0x1404dcd2e
mov eax, dword [rsp + 0x30]
stc
test bpl, 0x29
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404dcd15
jb 0x1404dcd3d
cmp rsi, rbp
jmp 0x1404dcd23
jb 0x1404dcc41
jmp 0x1404dcd3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bts ecx, esi
movzx rax, bx
mov rax, rdi
setnp cl
mov rcx, qword [rsp + 0x1440]
cmc
stc
xor rcx, rsp
jmp 0x1404dcd55
call fcn.1404a0622
lea r11, [rsp + 0x1450]
movzx r14w, sil
movsx rbx, di
mov rbx, qword [r11 + 0x20]
movsxd rsi, r10d
movzx di, r12b
bswap esi
mov rbp, qword [r11 + 0x30]
mov rsp, r11
xchg sil, dil
movzx rsi, r13w
pop r14
cmovg rdi, r9
pop rdi
pop rsi
jmp 0x1404dcd94
ret
Function at 0x1404dcd95
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cbw
setnp al
mov qword [rsp + 0x18], rbp
movsx rax, r14w
not al
mov ax, r14w
push rsi
push rdi
cmovp ax, r14w
push r14
mov eax, 0x1450
jmp 0x1404dcdc2
call fcn.140448f9b
sub rsp, rax
sal dil, 3
or r14w, r12w
mov rax, qword [0x1400b7288]
adc r10b, r10b
bt r10w, 0xf5
xor rax, rsp
mov qword [rsp + 0x1440], rax
btc edi, 0xa3
bts r14d, r8d
movsxd r10, edx
shrd eax, ecx, 0x1f
setle sil
mov rdi, rcx
and r14b, sil
cqo
mov rax, r10
mov ebp, r9d
test bx, r12w
bsr cx, r10w
sar rax, 6
inc cl
cwd
lea rcx, [0x1400ba940]
xor r14b, 0x5e
btc r14w, r8w
inc sil
and r10d, 0x3f
sal dx, 0xfd
lea rbp, [rbp + r8]
test r13w, 0x3655
setbe r14b
sar r14b, cl
mov rsi, r8
mov rax, qword [rcx + rax*8]
adc r14b, cl
shr r14b, 0x30
lea rdx, [r10 + r10*8]
sar r14, cl
adc r14b, bpl
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
jmp 0x1404dce75
mov qword [rdi], rax
test dil, al
mov dword [rdi + 8], eax
cmc
test sp, 0x6e45
clc
cmp r8, rbp
jmp 0x1404dce8d
jae 0x1404dcfb3
lea rbx, [rsp + 0x40]
cmc
stc
cmp rsi, rbp
jmp 0x1404dcea2
jae 0x1404dcf15
movzx eax, word [rsi]
cmp bpl, sil
cmp al, 0xca
add rsi, 2
clc
test si, 0x5a07
cmp ax, 0xa
jmp 0x1404dcec3
jne 0x1404dcee9
add dword [rdi + 8], 2
xor cx, sp
cmp r12b, 0xd6
btc ecx, ecx
mov ecx, 0xd
clc
test bp, r12w
mov word [rbx], cx
cmc
add rbx, 2
mov word [rbx], ax
sal al, 0x23
mov ax, 0x3257
bsr ax, r15w
add rbx, 2
cbw
lea rax, [rsp + 0x143e]
cmc
cmp rbx, rax
jmp 0x1404dcf0f
jb 0x1404dce9a
and qword [rsp + 0x20], 0
cwd
sal dh, cl
lea rax, [rsp + 0x40]
sar r8b, 0x58
sub rbx, rax
bts r9d, r14d
rcl r9b, 0x8c
and ecx, 0x561e1b79
lea r9, [rsp + 0x30]
shr dl, cl
sar rbx, 1
test r15w, cx
lea rdx, [rsp + 0x40]
inc cl
add ebx, ebx
mov rcx, r14
xchg r8b, r8b
mov r8d, ebx
jmp 0x1404dcf5e
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dcf6b
je 0x1404dcf9f
mov eax, dword [rsp + 0x30]
jmp 0x1404dcf7a
add dword [rdi + 4], eax
clc
cmc
cmp eax, ebx
jmp 0x1404dcf86
jb 0x1404dcfb3
cmp rsi, rbp
jmp 0x1404dcf94
jb 0x1404dce93
jmp 0x1404dcfb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rol ax, 0xef
sub rcx, r9
shld ecx, r11d, 0xdc
mov rax, rdi
btr rcx, rdx
mov rcx, qword [rsp + 0x1440]
cmp dil, dil
clc
xor rcx, rsp
call fcn.1404a0622
lea r11, [rsp + 0x1450]
cmovge si, dx
movsx r14d, dx
movzx bp, r11b
mov rbx, qword [r11 + 0x20]
movzx ebp, r8w
movsx r14d, r12w
mov rbp, qword [r11 + 0x30]
movzx rsi, r8w
mov rsp, r11
movsx r14w, r15b
bswap r14w
cmovno rsi, r12
pop r14
xchg si, si
mov di, 0x69c5
movsx rsi, bx
pop rdi
setns sil
pop rsi
jmp 0x1404dd01f
ret
Function at 0x1404e089e
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
movzx r8w, al
sub rsp, 0x20
xchg bl, r9b
rcr dx, 0xfb
mov rbx, rcx
shl r9b, cl
lea r9, [0x1400c8e90]
shr r8w, cl
sal r8b, cl
clc
sub ecx, ecx
movzx dx, dil
lea r8, [0x1400c8e88]
lea rdx, [0x1400cfb70]
jmp 0x1404e08df
call fcn.1404e0b82
test rax, rax
jmp 0x1404e08ec
je 0x1404e0915
mov rcx, rbx
adc ebx, 0x2adc49bc
sub bx, r15w
add rsp, 0x20
movzx bx, r11b
pop rbx
jmp 0x1404e090e
push qword [0x1400b8d90]
ret
add rsp, 0x20
movzx rbx, bx
mov ebx, eax
pop rbx
jmp 0x1404e0925
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404e09a6
Capabilities:
Get thread local storage value

Disassembly:
push rbx
movzx dx, r15b
sub rsp, 0x20
cdq
mov ebx, ecx
movsx edx, r14w
movsxd rcx, eax
lea r9, [0x1400c8ea0]
movzx edx, sp
cqo
mov ecx, 2
movzx r8w, r12b
bswap dx
mov rdx, rsp
lea r8, [0x1400c8e98]
mov edx, 0x215d1d40
jmp 0x1404e09e8
lea rdx, [0x1400cf758]
call fcn.1404e0b82
mov ecx, ebx
stc
test rax, rax
je 0x1404e0a1b
add rsp, 0x20
movsx ebx, di
xchg bl, bl
movsx bx, r14b
pop rbx
jmp 0x1404e0a14
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsx bx, sil
movsxd rbx, r11d
pop rbx
jmp 0x1404e0a2d
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404e0a34
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
rcl r8w, cl
push rdi
sub r9b, r13b
shl r9b, cl
btr r9d, 0x5d
sub rsp, 0x20
movsxd rdi, r15d
movzx edi, r12w
xchg dil, bl
mov rbx, rdx
not r9d
mov dil, 0xc7
jmp 0x1404e0a65
lea r9, [0x1400c8ea8]
movzx r8, r8w
bswap rdx
jmp 0x1404e0a78
mov edi, ecx
mov dh, 0xea
cdq
lea rdx, [0x1400cf748]
movzx r8w, dil
mov ecx, 3
movsx r8d, bp
bswap r8w
lea r8, [0x1400c8ea0]
jmp 0x1404e0aa3
call fcn.1404e0b82
mov rdx, rbx
mov ecx, edi
cmp r14, 0x75a84383
test rax, rax
jmp 0x1404e0abc
je 0x1404e0acd
call qword [0x1400b8d90]
jmp 0x1404e0ad3
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
jmp 0x1404e0ae1
pop rdi
jmp 0x1404e0ae7
ret
Function at 0x1404e4c8d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
clc
sub rsp, 0x30
and r10w, 0x6f79
xadd r10b, r10b
sub eax, eax
inc r10b
xadd r10b, r10b
mov r10d, ecx
test rdx, rdx
jne 0x1404e4ce6
call fcn.1404b615c
mov ebx, 0x16
mov dword [rax], ebx
jmp 0x1404e4cc4
call fcn.1404b6dc7
mov eax, ebx
bts bx, sp
mov bx, 0x63ed
add rsp, 0x30
movsxd rbx, r11d
jmp 0x1404e4cdf
pop rbx
jmp 0x1404e4ce5
ret
test r8, r8
jmp 0x1404e4cee
je 0x1404e4cb3
movzx ecx, byte [rsp + 0x60]
jmp 0x1404e4d05
mov word [rdx], ax
and rax, rsp
movsx ax, r10b
lea rax, [rcx + 1]
cmp r8, rax
jmp 0x1404e4d1c
ja 0x1404e4d36
call fcn.1404b615c
mov ebx, 0x22
jmp 0x1404e4d31
jmp 0x1404e4cbd
lea eax, [r9 - 2]
mov ebx, 0x22
jmp 0x1404e4d4b
cmp eax, ebx
jmp 0x1404e4d52
ja 0x1404e4cb3
mov byte [rsp + 0x60], cl
cmp spl, bpl
mov ecx, r10d
rcr bh, 0x10
btc rbx, 0x19
xadd bl, bl
add rsp, 0x30
not ebx
pop rbx
jmp 0x1404e4d79
jmp 0x1404e4d7e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
rol bx, 0xc1
bts bx, r10w
mov qword [rsp + 0x18], rsi
not bx
mov bx, r14w
push rdi
push r14
xchg r11b, r11b
push r15
add r11b, r10b
sbb r11b, dl
movsx r10, dx
sub rsp, 0x20
bts r11w, r12w
and bp, 0x310c
sub r15d, r15d
rol bl, cl
mov ebp, r9d
mov rdi, r8
rcr r10, cl
bsr rbx, r14
mov r11, rdx
test bh, 0xa1
add ebx, r13d
mov r10, rdx
mov ebx, r15d
stc
clc
cmp byte [rsp + 0x60], r15b
jmp 0x1404e4dea
je 0x1404e4e07
lea eax, [r15 + 0x2d]
sbb rbx, rsi
neg ecx
mov word [rdx], ax
cmovp rsi, r14
lea ebx, [rax - 0x2c]
lea r10, [rdx + 2]
mov r8, r10
bts r9w, dx
shrd r9w, cx, 0x34
shr r14b, 0x38
xor edx, edx
clc
cmc
lea rsi, [r10 + 2]
movzx r14w, al
mov eax, ecx
mov r9, r10
not r14b
div ebp
sal ch, 0x5c
test r11b, r13b
adc cl, sil
mov ecx, eax
mov r14w, 0x5dfd
cmp edx, 9
cbw
lahf
mov al, r11b
mov eax, 0x57
setnp r14b
jmp 0x1404e4e57
lea r14d, [rax - 0x27]
jmp 0x1404e4e60
cmovbe ax, r14w
jmp 0x1404e4e6a
inc rbx
cmc
add ax, dx
mov word [r10], ax
cmp r14b, 0xdd
clc
test ecx, ecx
jmp 0x1404e4e81
je 0x1404e4e93
mov r10, rsi
cmp rbx, rdi
jb 0x1404e4e19
cmp rbx, rdi
jb 0x1404e4ecc
mov word [r11], r15w
jmp 0x1404e4ea5
call fcn.1404b615c
mov ebx, 0x22
jmp 0x1404e4eb4
mov dword [rax], ebx
jmp 0x1404e4ebb
call fcn.1404b6dc7
mov eax, ebx
jmp 0x1404e4ec7
jmp 0x1404e4f25
mov word [rsi], r15w
movzx eax, word [r8]
xor rcx, r15
bts cx, r14w
bt ecx, r12d
movzx ecx, word [r9]
cmp r10d, 0x95e41da
stc
mov word [r9], ax
cmc
sub r9, 2
cmp r15w, 0x1579
jmp 0x1404e4f00
mov word [r8], cx
stc
cmc
add r8, 2
cmp r12, r8
test bp, r10w
test r10b, 0x6b
cmp r8, r9
jmp 0x1404e4f1d
jb 0x1404e4ed0
xor eax, eax
mov rbx, qword [rsp + 0x40]
bsf r15w, ax
or r15b, bl
mov rbp, qword [rsp + 0x48]
shr sil, cl
shl di, 0x64
mov rsi, qword [rsp + 0x50]
ror dil, cl
add rsp, 0x20
xchg r15, rdi
setle dil
pop r15
movsx edi, r13w
pop r14
movzx rdi, r14w
mov dil, 0xae
pop rdi
ret
Function at 0x100401300
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x10040d010]
call sub.msys_2.0.dll___getreent
lea r9, str.__e_names____o_dir____R_name____v_n_____V____w_n_____1aCDcfGgIKLNrsTtUx__source_file_n
mov r8, rbx
lea rdx, str.Usage:__s__s_n
mov rcx, qword [rax + 0x18]
call sub.msys_2.0.dll_fprintf
call sub.msys_2.0.dll___getreent
mov r8d, 0x64e
mov edx, 1
lea rcx, str.Options:_n___0_________format_translation_output_all_capabilities_on_one_line_n___1_________format_translation_output_one_capability_per_line_n___a_________retain_commented_out_capabilities__sets__x_also__n___C_________translate_entries_to_termcap_source_form_n___D_________print_list_of_tics_database_locations__first_must_be_writable__n___c_________check_only__validate_input_without_compiling_or_translating_n___e_names___translate_compile_only_entries_named_by_comma_separated_list_n___f_________format_complex_strings_for_readability_n___G_________format__number_to__char_n___g_________format__char_to__number_n___I_________translate_entries_to_terminfo_source_form_n___K_________translate_entries_to_termcap_source_form_with_BSD_syntax_n___L_________translate_entries_to_full_terminfo_source_form_n___N_________disable_smart_defaults_for_source_translation_n___o_dir_____set_output_directory_for_compiled_entry_writes_n___Q_n_______dump_compiled_description_n___q____brief_listing__removes_headers_n___R_name____restrict_translation_to_given_terminfo_termcap_version_n___r_________force_resolution_of_all_use_entries_in_source_translation_n___s_________print_summary_statistics_n___T_________remove_size_restrictions_on_compiled_description_n___t_________suppress_commented_out_capabilities_n___U_________suppress_post_processing_of_entries_n___V_________print_version_n___W_________wrap_long_strings_according_to__w_n__option_n___v_n_______set_verbosity_level_n___w_n_______set_format_width_for_translation_output_n___x_________treat_unknown_capabilities_as_user_defined_n_nParameters:_n___file______file_to_translate_or_compile_n
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word cs:[rax + rax]

Function at 0x100401ee0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.msys_2.0.dll_perror
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word cs:[rax + rax]
nop

Function at 0x100401f00
Capabilities:
Get file attributes

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
jmp 0x100401f14
add r12, 1
call sub.msys_2.0.dll___locale_ctype_ptr
movzx edx, byte [r12]
mov r8, rax
test byte [rdx + r8 + 1], 8
jne 0x100401f10
test dl, dl
je 0x100401f80
mov rcx, r12
call sub.msys_2.0.dll_strdup
mov r13, rax
test rax, rax
je 0x100401f8f
mov rcx, rax
call sub.msys_2.0.dll_strlen
sub rax, 1
mov r12, rax
jne 0x100401f5c
jmp 0x100401f6e
mov byte [r13 + r12], 0
sub r12, 1
je 0x100401f6e
call sub.msys_2.0.dll___locale_ctype_ptr
movzx edx, byte [r13 + r12]
test byte [rdx + rax + 1], 8
jne 0x100401f50
mov rax, r13
add rsp, 0x28
pop r12
pop r13
ret
xor r13d, r13d
mov rax, r13
add rsp, 0x28
pop r12
pop r13
ret
lea rcx, str.strdup
call fcn.100401ee0
nop
nop dword [rax]
Function at 0x100401fa0
Capabilities:
Get file attributes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0xa8
call sub.msys_2.0.dll_strdup
lea r13, [rsp + 0x20]
mov rdx, r13
mov rcx, rax
mov r12, rax
call sub.msys_2.0.dll_stat
test eax, eax
js 0x100402006
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x4000
jne 0x100401fea
mov edx, 7
mov rcx, r12
call sub.msys_2.0.dll_access
test eax, eax
je 0x100401ff5
mov rcx, r12
xor r12d, r12d
call sub.msys_2.0.dll_free
mov rax, r12
add rsp, 0xa8
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r12
call sub.msys_ncursesw6.dll__nc_pathlast
test eax, eax
je 0x100401fea
mov eax, eax
mov rdx, r13
mov rcx, r12
lea rbx, [r12 + rax]
movzx esi, byte [rbx]
mov byte [rbx], 0
call sub.msys_2.0.dll_stat
test eax, eax
js 0x100401fea
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x4000
jne 0x100401fea
mov edx, 7
mov rcx, r12
call sub.msys_2.0.dll_access
test eax, eax
jne 0x100401fea
mov byte [rbx], sil
jmp 0x100401ff5

Function at 0x1004020c0
Capabilities:
Terminate process

Disassembly:
push r15
mov eax, 0x1028
push r14
push r13
push r12
call fcn.10040a080
sub rsp, rax
mov r14, r8
lea rax, [rsp + 0x20]
test r8, r8
mov r12, rcx
cmove r14, rax
mov r15, rdx
test rcx, rcx
je 0x1004021b8
mov rcx, r14
call fcn.100402060
mov r13, rax
test rax, rax
je 0x1004021ac
and word [r12 + 0x10], 0xff9f
jmp 0x100402120
test al, 0x40
jne 0x100402178
test ecx, ecx
je 0x100402180
mov rdx, r13
call sub.msys_2.0.dll_fputc
mov rcx, r12
call sub.msys_2.0.dll_fgetc
mov ecx, eax
movzx eax, word [r12 + 0x10]
test al, 0x20
je 0x100402110
mov rcx, r12
call sub.msys_2.0.dll_fclose
lea rdx, [0x10040e366]
mov rcx, r14
call sub.msys_2.0.dll_fopen
mov rcx, r13
mov r12, rax
call sub.msys_2.0.dll_fclose
mov rcx, r14
call sub.msys_2.0.dll_strdup
mov qword [0x100417038], rax
mov rax, r12
add rsp, 0x1028
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.100401ee0
mov r12, qword [0x10040d010]
call sub.msys_2.0.dll___getreent
mov r9, r15
lea rdx, str._s:__s_is_not_a_text_file_n
mov rcx, qword [rax + 0x18]
mov r8, r12
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
lea rcx, str.copy_input__target_
call fcn.100401ee0
lea rcx, str.copy_input__source_
call fcn.100401ee0
nop
nop word cs:[rax + rax]
Function at 0x100402560
Capabilities:
Get file attributes
Terminate process
Write file on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0xb0
cmp byte [rcx], 0x2d
mov r12, rcx
mov rsi, rdx
jne 0x1004025a0
cmp byte [rcx + 1], 0
jne 0x1004025a0
call sub.msys_2.0.dll___getreent
mov r8, rsi
lea rdx, str._stdin_
mov rcx, qword [rax + 8]
add rsp, 0xb0
pop rbx
pop rsi
pop r12
jmp fcn.1004020c0
lea rdx, [rsp + 0x30]
mov rcx, r12
call sub.msys_2.0.dll_stat
test eax, eax
js 0x10040261b
mov ebx, dword [rsp + 0x40]
and ebx, 0xf000
cmp ebx, 0x4000
je 0x10040265b
lea eax, [rbx - 0x1000]
test eax, 0xffffe000
je 0x1004025dc
cmp ebx, 0x8000
jne 0x10040265b
lea rdx, [0x10040e413]
mov rcx, r12
call sub.msys_2.0.dll_fopen
test rax, rax
je 0x100402687
cmp ebx, 0x8000
je 0x10040260f
test rsi, rsi
je 0x10040265b
mov r8, rsi
mov rdx, r12
mov rcx, rax
call fcn.1004020c0
add rsp, 0xb0
pop rbx
pop rsi
pop r12
ret
call sub.msys_2.0.dll___errno
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
mov rsi, qword [0x10040d010]
mov rbx, rax
call sub.msys_2.0.dll___getreent
mov r9, r12
mov r8, rsi
lea rdx, str._s:__s__s_n
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rbx
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
mov rbx, qword [0x10040d010]
call sub.msys_2.0.dll___getreent
mov r9, r12
lea rdx, str._s:__s_is_not_a_file_n
mov rcx, qword [rax + 0x18]
mov r8, rbx
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
mov rbx, qword [0x10040d010]
call sub.msys_2.0.dll___getreent
mov r9, r12
lea rdx, str._s:_Cant_open__s_n
mov rcx, qword [rax + 0x18]
mov r8, rbx
call sub.msys_2.0.dll_fprintf
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word cs:[rax + rax]
nop
Function at 0x1004026c0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x420
mov r13, rcx
test rcx, rcx
je 0x100402890
mov edx, 0x2f
call sub.msys_2.0.dll_strchr
mov r12, rax
test rax, rax
je 0x1004027d8
mov rcx, r13
xor edx, edx
mov edi, 2
xor r12d, r12d
call fcn.100402560
lea rbx, [rsp + 0x20]
mov r13, rax
xor esi, esi
jmp 0x100402729
mov rcx, rbx
call fcn.100401f00
test rax, rax
jne 0x100402850
mov r8, r13
mov edx, 0x400
mov rcx, rbx
call sub.msys_2.0.dll_fgets
test rax, rax
jne 0x100402718
cmp edi, 2
je 0x100402863
cmp edi, 3
jne 0x100402880
mov rcx, r13
call sub.msys_2.0.dll_fclose
cmp byte [0x10041704c], 0
je 0x1004027c0
test r12, r12
je 0x100402890
mov r9, qword [0x100417058]
mov r8d, 0x1f
mov edx, 1
lea rcx, str.Entries_that_will_be_compiled:_n
call sub.msys_2.0.dll_fwrite
mov r9, qword [r12]
test r9, r9
je 0x1004027c0
xor ebx, ebx
lea rsi, str._u:_s_n
nop word [rax + rax]
add ebx, 1
mov rcx, qword [0x100417058]
mov rdx, rsi
mov r8d, ebx
call sub.msys_2.0.dll_fprintf
mov eax, ebx
mov r9, qword [r12 + rax*8]
test r9, r9
jne 0x1004027a0
mov rax, r12
add rsp, 0x420
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, 1
mov ebp, 2
mov rcx, r13
xor r14d, r14d
xor esi, esi
jmp 0x1004027f3
add esi, 1
mov eax, esi
add rax, r13
movsx ebx, byte [rax]
cmp ebx, 0x2c
je 0x100402804
test ebx, ebx
jne 0x1004027f0
cmp edi, 1
je 0x100402848
mov byte [rax], 0
call fcn.100401f00
test rax, rax
je 0x100402821
mov edx, r14d
add r14d, 1
mov qword [r12 + rdx*8], rax
lea ecx, [rsi + 1]
add rcx, r13
test ebx, ebx
jne 0x1004027f0
cmp edi, 1
je 0x1004028a2
cmp ebp, 3
je 0x100402758
add ebp, 1
add edi, 1
jmp 0x1004027e2
add r14d, 1
jmp 0x100402827
test r12, r12
je 0x100402898
mov edx, esi
mov qword [r12 + rdx*8], rax
add esi, 1
jmp 0x100402729
lea ecx, [rsi + 1]
mov edx, 8
call sub.msys_2.0.dll_calloc
mov r12, rax
test rax, rax
je 0x1004028bc
mov rcx, r13
call sub.msys_2.0.dll_rewind
add edi, 1
jmp 0x10040270d
xor r12d, r12d
jmp 0x1004027c0
mov rcx, rax
call sub.msys_2.0.dll_free
jmp 0x10040285b
lea ecx, [r14 + 1]
mov edx, 8
call sub.msys_2.0.dll_calloc
mov r12, rax
test rax, rax
jne 0x100402839
lea rcx, str.make_namelist
call fcn.100401ee0
nop
nop dword [rax]

Function at 0x1004066d0
Capabilities:
Terminate process

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 8]
lea rdi, [r8 + 1]
mov rsi, r8
mov r8, qword [rcx + 0x10]
mov r12, rdx
lea rdx, [rax + rdi]
mov rbx, rcx
mov rcx, qword [rcx]
cmp r8, rdx
jae 0x10040671a
lea rdx, [r8 + rdx + 0x400]
mov qword [rbx + 0x10], rdx
call sub.msys_ncursesw6.dll__nc_doalloc
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x100406741
mov rax, qword [rbx + 8]
add rcx, rax
mov r8, rdi
mov rdx, r12
call sub.msys_2.0.dll_strncpy
mov rax, qword [rbx]
add rsi, qword [rbx + 8]
mov qword [rbx + 8], rsi
mov byte [rax + rsi], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str.strncpy_DYN
call sub.msys_2.0.dll_perror
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop dword [rax + rax]
Function at 0x100406810
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rsi, [0x1004170a0]
mov edi, ecx
test ecx, ecx
jle 0x10040689a
nop word cs:[rax + rax]
mov rax, qword [0x1004170a8]
mov rdx, qword [0x1004170b0]
mov rcx, qword [rsi]
lea r8, [rax + 2]
cmp r8, rdx
jbe 0x100406870
lea rdx, [r8 + rdx + 0x400]
mov qword [0x1004170b0], rdx
call sub.msys_ncursesw6.dll__nc_doalloc
mov qword [rsi], rax
mov rcx, rax
test rax, rax
je 0x1004068a2
mov rax, qword [0x1004170a8]
mov edx, 9
add ebx, 1
mov word [rcx + rax], dx
mov rax, qword [0x1004170a8]
lea rdx, [rax + 1]
mov qword [0x1004170a8], rdx
mov rdx, qword [rsi]
mov byte [rdx + rax + 1], 0
cmp ebx, edi
jne 0x100406830
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.strncpy_DYN
call sub.msys_2.0.dll_perror
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop dword [rax]
Function at 0x140088690
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x140563c9c]
cmp eax, 0x27
jg 0x1400886f3
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rcx, rbx
mov edx, 0x9710c822
mov r8d, 0xe566b99
mov r9d, 0xf991729
call fcn.1400ac7d0
cmp dword [0x140563f24], 0
je 0x140088752
mov ecx, 0xdab323d6
nop dword [rax + rax]
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov edx, dword [0x140563c98]
mov eax, 0x3574c18
sub eax, edx
mov r8d, eax
not r8d
xor eax, 0xfca8b3e7
and r8d, 0x3574c18
lea eax, [rax + r8*2]
imul eax, edx
mov r8d, dword [0x1404f14e8]
add r8d, ecx
xor edx, edx
div r8d
test edx, edx
jne 0x140088700
jmp 0x1400886bd
mov r14, rax
movabs rax, 0x6c92fe8685d0b001
add rax, qword [0x1404f14e0]
cmp r14, rax
jbe 0x1400887fe
lea rcx, [rbp - 0x20]
mov rdx, r14
mov r9, rbx
call fcn.140088500
movups xmm0, xmmword [rdi]
movaps xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
lea r8, [rbp - 0x20]
mov rcx, rsi
call fcn.1400889d0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x1400887e4
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400887df
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
movabs rdx, 0x6c92fe8685d0b012
add rdx, qword [0x1404f14e0]
cmp rcx, rdx
jae 0x140088891
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400a9560
lea rax, [0x140427348]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r15, [rbp - 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x140563c98]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x14008886c
mov qword [rbp - 0x10], r14
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14040bf30
mov byte [rbp + r14 - 0x20], 0
mov ecx, dword [0x140563c98]
lea eax, [rcx - 1]
imul eax, ecx
xor ecx, ecx
sub ecx, dword [0x1404f14e8]
mov edx, ecx
xor edx, 0x254cdc2a
and ecx, 0x254cdc2a
lea ecx, [rdx + rcx*2]
neg ecx
xor edx, edx
div ecx
test edx, edx
je 0x14008877e
mov qword [rbp - 0x10], r14
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14040bf30
mov byte [rbp + r14 - 0x20], 0
mov eax, dword [0x140563c9c]
cmp eax, 0xc
jge 0x140088810
jmp 0x140088821
call fcn.1403c3cac
int3