joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6629863b8
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x7ff66298c008]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor ebx, ebx
mov rdi, rdx
mov esi, ebx
mov rbp, rcx
mov r9d, esi
lea r8, [0x7ff662989970]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.7ff66298114c
mov r8, rbp
mov edx, 0x104
mov rcx, rdi
inc esi
call fcn.7ff662981008
lea r8, [rsp + 0x20]
mov edx, 0x104
mov rcx, rdi
call fcn.7ff662987ba8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x7ff6629864b6
cmp esi, 0x190
jl 0x7ff6629863e3
mov r9, rdi
lea rdx, [0x7ff66298997c]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop dword [rax + rax]
test eax, eax
je 0x7ff662986490
mov rcx, rdi
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [rax + rax]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.7ff662988470
mov rbx, qword [rsp + 0x170]
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop dword [rax + rax]
test eax, eax
je 0x7ff66298644b
mov dword [0x7ff66298cd00], 1
mov ebx, 1
jmp 0x7ff662986490
Function at 0x7ff6629864e4
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x7ff66298c008]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov r9, rcx
test edx, edx
je 0x7ff6629865df
lea rdx, [rsp + 0x50]
call fcn.7ff6629863b8
test eax, eax
je 0x7ff662986688
lea rbx, [0x7ff66298d610]
mov edi, 0x104
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, rbx
sub r8, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x7ff662986560
mov al, byte [r8 + rcx]
test al, al
je 0x7ff662986560
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x7ff662986541
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
test byte [0x7ff66298de64], 0x20
je 0x7ff6629865cc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x20]
test ecx, ecx
je 0x7ff6629865bb
sub ecx, 1
je 0x7ff6629865b2
sub ecx, 1
je 0x7ff6629865a9
cmp ecx, 1
jne 0x7ff6629865cc
lea r8, [0x7ff662989998]
jmp 0x7ff6629865c2
lea r8, [0x7ff662989990]
jmp 0x7ff6629865c2
lea r8, [0x7ff662989988]
jmp 0x7ff6629865c2
lea r8, [0x7ff662989980]
mov edx, edi
mov rcx, rbx
call fcn.7ff662987ba8
lea r8, [0x7ff662989700]
mov edx, edi
mov rcx, rbx
call fcn.7ff662987ba8
jmp 0x7ff66298661e
lea rbx, [0x7ff66298d610]
mov edi, 0x104
mov rcx, rbx
sub r9, rbx
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x7ff662986610
mov al, byte [r9 + rcx]
test al, al
je 0x7ff662986610
mov byte [rcx], al
inc rcx
sub rdi, 1
jne 0x7ff6629865f1
test rdi, rdi
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
mov rcx, rbx
call fcn.7ff662986b70
test eax, eax
jne 0x7ff662986649
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop dword [rax + rax]
test eax, eax
je 0x7ff66298667d
mov dword [0x7ff66298cd00], 1
test esi, esi
je 0x7ff66298668c
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.7ff662986ca4
test eax, eax
jne 0x7ff66298668c
cmp dword [0x7ff66298cd00], eax
je 0x7ff662986688
and dword [0x7ff66298cd00], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop dword [rax + rax]
jmp 0x7ff662986688
call fcn.7ff662987700
mov dword [0x7ff66298d544], eax
xor eax, eax
jmp 0x7ff662986698
and dword [0x7ff66298d544], 0
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.7ff662988470
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff662986b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x7ff662986b8b
add ebx, 0x14
mov ecx, 0x40
mov edx, ebx
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x7ff662986bf5
and dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
mov edx, 0x4b5
xor ecx, ecx
call fcn.7ff662984dcc
call fcn.7ff662987700
mov dword [0x7ff66298d544], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.7ff662981008
lea r8, [0x7ff6629899b0]
mov edx, ebx
mov rcx, rsi
call fcn.7ff662987ba8
and qword [rsp + 0x30], 0
mov ebp, 1
mov dword [rsp + 0x28], 0x4000080
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebp
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop dword [rax + rax]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
je 0x7ff662986bd2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x7ff662986bd2
test al, 0x10
je 0x7ff662986bd2
and dword [0x7ff66298d544], 0
mov eax, ebp
jmp 0x7ff662986bdf
Function at 0x7ff66298772c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x7ff66298c008]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor esi, esi
mov rbp, rcx
xor r9d, r9d
mov edi, 1
jmp 0x7ff6629877c9
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7ff662987813
lea r8, [rax + 8]
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x7ff662987792
mov edx, dword [rbx + 4]
lea r9, [rax + 1]
mov ecx, dword [rbx]
add r9, r8
mov rax, rbp
call qword [0x7ff662989650]
mov rcx, rbx
test eax, eax
je 0x7ff662987803
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop dword [rax + rax]
add esi, edi
mov r9d, esi
lea r8, [0x7ff6629899d0]
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.7ff66298114c
mov r8d, 0xa
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
nop dword [rax + rax]
test rax, rax
jne 0x7ff66298775e
jmp 0x7ff66298781f
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop dword [rax + rax]
jmp 0x7ff66298781f
mov dword [0x7ff66298d544], 0x80070714
xor edi, edi
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.7ff662988470
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x7ff6629879f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x148
mov rax, qword [0x7ff66298c008]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edx, 0x104
lea r9, [0x7ff66298d610]
lea rax, [rsp + 0x20]
mov r8d, edx
sub r9, rax
lea rcx, [rsp + 0x20]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x7ff662987a44
mov al, byte [r9 + rcx]
test al, al
je 0x7ff662987a44
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x7ff662987a25
test r8, r8
lea rax, [rcx - 1]
lea r8, [0x7ff6629897a8]
cmovne rax, rcx
lea rcx, [rsp + 0x20]
mov byte [rax], 0
call fcn.7ff662987ba8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x7ff662987a96
test al, 0x10
jne 0x7ff662987a96
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
nop dword [rax + rax]
jmp 0x7ff662987aa9
lea rcx, [0x7ff6629897a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.7ff662988470
add rsp, 0x148
ret
Function at 0x7ff662987ac8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [0x7ff66298de70]
mov rbp, r8
mov rcx, rbx
mov r8d, 5
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceA]
nop dword [rax + rax]
test rax, rax
je 0x7ff662987b63
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7ff662987b63
mov rax, qword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
test rax, rax
jne 0x7ff662987b3a
and qword [rsp + 0x20], rax
jmp 0x7ff662987b3f
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
nop dword [rax + rax]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
jne 0x7ff662987b87
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
mov edx, 0x4fb
xor ecx, ecx
call fcn.7ff662984dcc
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff662987f04
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x18]
sub rsp, 0x110
mov rax, qword [0x7ff66298c008]
xor rax, rsp
mov qword [rbp], rax
mov esi, dword [0x7ff66298c20c]
mov dword [rsp + 0x30], 0xc
cmp esi, 0xfffffffe
jne 0x7ff66298809c
xor edi, edi
mov dword [rsp + 0x50], 0x94
lea rcx, [rsp + 0x50]
mov dword [0x7ff66298c20c], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
nop dword [rax + rax]
test eax, eax
je 0x7ff662988096
lea esi, [rdi + 1]
cmp dword [rsp + 0x60], esi
jne 0x7ff662988096
cmp dword [rsp + 0x54], 4
jne 0x7ff662988096
cmp dword [rsp + 0x58], 0xa
jae 0x7ff662988096
lea ecx, [rdi + 0x4a]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
je 0x7ff662988096
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff6629899e0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x7ff662988096
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x7ff662989700]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x7ff662988096
lea rcx, [rbp - 0x10]
mov al, byte [rcx]
sub al, 0x30
cmp al, 9
ja 0x7ff66298803f
movsx eax, byte [rcx]
add edi, 0xfffffffd
shl edi, 4
add edi, eax
jmp 0x7ff662988065
mov al, byte [rcx]
sub al, 0x20
cmp byte [rcx], 0x61
movzx edx, al
movzx eax, byte [rcx]
cmovl edx, eax
movsx r8d, dl
lea eax, [r8 - 0x41]
cmp eax, 5
ja 0x7ff662988076
shl edi, 4
add edi, 0xffffffc9
add edi, r8d
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rcx, rax
jmp 0x7ff66298802a
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x7ff662988096
and edi, 0x3ff
cmp edi, esi
je 0x7ff66298808e
cmp edi, 0xd
jne 0x7ff662988096
mov dword [0x7ff66298c20c], esi
jmp 0x7ff66298809c
mov esi, dword [0x7ff66298c20c]
mov eax, esi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.7ff662988470
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400327a0]
xor edi, edi
mov rax, qword gs:[0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x1400327b0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140039008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400326e0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.14001e960
mov rcx, qword [0x140032840]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140032790]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.14001e770
mov ebx, dword [0x140039028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test ebx, ebx
mov rbp, qword [0x140039020]
mov r12, rax
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [rbp + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [r12 + rbx], rax
mov rdx, qword [rbp + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, r12
mov qword [rdi], 0
mov qword [0x140039020], r12
call fcn.14001e570
mov rax, qword [0x140032720]
mov r8, qword [0x140039018]
mov ecx, dword [0x140039028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140039020]
call fcn.14002a3b0
mov ecx, dword [0x14003900c]
mov dword [0x140039010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140039008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x1400327b0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call fcn.140024820
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1400327e0]
mov rcx, qword [0x1400327d0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
test edi, edi
mov dword [rsi], 2
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140039010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140032800]
mov dword [rsi], 1
mov rcx, qword [0x1400327f0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b6
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
sub rsp, 0x28
mov rax, qword [0x140032740]
mov dword [rax], 1
call fcn.140001180
nop
nop
add rsp, 0x28
ret
Function at 0x140001910
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ebx, 0x17
mov r8d, 0x64
lea r9, [rsp + 0x27]
mov rbp, rcx
mov rax, rdx
lea rcx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
cmp rax, 0x63
ja 0x140001943
cmp rax, 9
jbe 0x140001981
jmp 0x140001976
xor edx, edx
div r8
add rdx, rdx
cmp rbx, 0xffffffffffffffff
jne 0x14000195f
mov edx, 0x17
or rcx, 0xffffffffffffffff
jmp 0x140001a0a
mov r10b, byte [rcx + rdx + 1]
mov dl, byte [rcx + rdx]
mov byte [rsp + rbx + 0x28], r10b
mov byte [r9 + rbx], dl
sub rbx, 2
jmp 0x140001935
add rax, rax
cmp rbx, 0x17
jbe 0x14000198c
jmp 0x140001951
add eax, 0x30
cmp rbx, 0x17
jbe 0x1400019a7
jmp 0x140001951
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
mov cl, byte [rdx + rax + 1]
mov byte [rsp + rbx + 0x28], cl
dec rbx
cmp rbx, 0x17
ja 0x140001951
mov al, byte [rdx + rax]
mov byte [rsp + rbx + 0x28], al
mov rsi, qword [rbp]
mov edi, 0x18
sub rdi, rbx
mov rcx, rdi
add rcx, rsi
jo 0x1400019dd
test rcx, rcx
jns 0x1400019ea
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140005075
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400049da
mov rdx, rcx
mov rcx, rbp
call fcn.140005b1a
test rsi, rsi
js 0x140001a00
cmp rsi, qword [rbp]
jl 0x140001a17
mov rdx, qword [rbp]
mov rcx, rsi
dec rdx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14000603a
mov rax, qword [rbp + 8]
mov ecx, edi
lea rax, [rax + rsi + 8]
lea rsi, [rsp + rbx + 0x28]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
push rsi
push rbx
sub rsp, 0x28
test rdx, rdx
mov rbx, rcx
mov rsi, rdx
jns 0x140001a8a
mov eax, 1
shl rax, 0x3f
cmp rdx, rax
je 0x140001a5c
neg rsi
mov edx, 1
mov rcx, rbx
call fcn.1400058d6
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov byte [rdx + rax + 8], 0x2d
add rax, 1
jo 0x140001a85
mov qword [rbx], rax
mov byte [rdx + rax + 8], 0
jmp 0x140001a8a
call fcn.1400049da
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp 0x140001910
Function at 0x140001a3a
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ebx, 0x17
mov r8d, 0x64
lea r9, [rsp + 0x27]
mov rbp, rcx
mov rax, rdx
lea rcx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
cmp rax, 0x63
ja 0x140001943
cmp rax, 9
jbe 0x140001981
jmp 0x140001976
xor edx, edx
div r8
add rdx, rdx
cmp rbx, 0xffffffffffffffff
jne 0x14000195f
mov edx, 0x17
or rcx, 0xffffffffffffffff
jmp 0x140001a0a
mov r10b, byte [rcx + rdx + 1]
mov dl, byte [rcx + rdx]
mov byte [rsp + rbx + 0x28], r10b
mov byte [r9 + rbx], dl
sub rbx, 2
jmp 0x140001935
add rax, rax
cmp rbx, 0x17
jbe 0x14000198c
jmp 0x140001951
add eax, 0x30
cmp rbx, 0x17
jbe 0x1400019a7
jmp 0x140001951
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
mov cl, byte [rdx + rax + 1]
mov byte [rsp + rbx + 0x28], cl
dec rbx
cmp rbx, 0x17
ja 0x140001951
mov al, byte [rdx + rax]
mov byte [rsp + rbx + 0x28], al
mov rsi, qword [rbp]
mov edi, 0x18
sub rdi, rbx
mov rcx, rdi
add rcx, rsi
jo 0x1400019dd
test rcx, rcx
jns 0x1400019ea
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140005075
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400049da
mov rdx, rcx
mov rcx, rbp
call fcn.140005b1a
test rsi, rsi
js 0x140001a00
cmp rsi, qword [rbp]
jl 0x140001a17
mov rdx, qword [rbp]
mov rcx, rsi
dec rdx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14000603a
mov rax, qword [rbp + 8]
mov ecx, edi
lea rax, [rax + rsi + 8]
lea rsi, [rsp + rbx + 0x28]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
push rsi
push rbx
sub rsp, 0x28
test rdx, rdx
mov rbx, rcx
mov rsi, rdx
jns 0x140001a8a
mov eax, 1
shl rax, 0x3f
cmp rdx, rax
je 0x140001a5c
neg rsi
mov edx, 1
mov rcx, rbx
call fcn.1400058d6
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov byte [rdx + rax + 8], 0x2d
add rax, 1
jo 0x140001a85
mov qword [rbx], rax
mov byte [rdx + rax + 8], 0
jmp 0x140001a8a
call fcn.1400049da
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp 0x140001910

Function at 0x140001b70
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140001bcf
mov rcx, rax
add rcx, 1
jo 0x140001bab
test rcx, rcx
jns 0x140001bb2
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140001bab
mov qword [r8], rax
pop rsi
pop rdi
ret
Function at 0x1400021d3
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
mov rcx, rdx
mov qword [rbx], rdx
jns 0x1400021fc
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140005075
call fcn.140004475
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret

Function at 0x1400024b8
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400024c6
jmp fcn.140004902
ret

Function at 0x14000251c
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
mov r12b, byte [rcx]
mov rbp, qword [rcx + 0x10]
mov r13, qword [rdx + 8]
mov rsi, qword [rdx + 0x10]
lea r8, [rcx + 1]
mov rbx, rcx
mov ecx, 0x17
mov rdi, r8
rep stosb byte [rdi], al
mov al, byte [rdx]
test al, al
mov byte [rbx], al
je 0x14000255c
dec al
jne 0x140002590
mov qword [rbx + 8], r13
jmp 0x140002590
test rsi, rsi
je 0x140002576
mov rax, qword [rsi - 0x10]
add rax, 0x10
jo 0x140002571
mov qword [rsi - 0x10], rax
jmp 0x140002576
call fcn.1400049da
xor ecx, ecx
mov qword [rbx + 0x10], rsi
mov qword [rbx + 8], r13
call fcn.1400024d0
test al, al
je 0x140002590
xor ecx, ecx
call fcn.140004a9a
test r12b, r12b
jne 0x1400025b5
mov rcx, rbp
call fcn.1400024d0
test al, al
je 0x1400025b5
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140004a9a
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x1400025fc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
jne 0x140002624
mov rcx, qword [rcx + 0x10]
call fcn.1400024d0
test al, al
je 0x140002624
mov rcx, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140004a9a
add rsp, 0x20
pop rbx
ret

Function at 0x14000286d
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor edi, edi
mov rsi, qword [rcx + 8]
mov rbp, qword [rcx]
lea rbx, [rsi + 0x18]
cmp rdi, rbp
jl 0x14000288e
test rsi, rsi
jne 0x1400028b1
jmp 0x1400028cc
cmp byte [rbx - 0x10], 0
jne 0x1400028a8
mov rcx, qword [rbx]
call fcn.1400024d0
test al, al
je 0x1400028a8
mov rcx, qword [rbx]
call fcn.140004a9a
inc rdi
add rbx, 0x18
jmp 0x140002882
test byte [rsi + 7], 0x40
jne 0x1400028cc
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140004904
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14000290a
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140002969
mov rcx, rax
add rcx, 1
jo 0x140002945
test rcx, rcx
jns 0x14000294c
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140002945
mov qword [r8], rax
pop rsi
pop rdi
ret