joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004b78
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140004ba1
xor eax, eax
jmp 0x140004bf7
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x140004bca
xor eax, eax
jmp 0x140004bf7
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov eax, 1
add rsp, 0x18
ret

Function at 0x14000585c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140005887
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000588e
mov al, 1
jmp 0x1400059e7
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.1400060cc
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.1400060cc
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.1400060d4
movzx eax, al
test eax, eax
je 0x1400058e5
xor al, al
jmp 0x1400059e7
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140005955
cmp dword [rsp + 0x30], 1
je 0x140005961
cmp dword [rsp + 0x30], 3
je 0x1400059d5
jmp 0x1400059e5
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400059ad
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x1400059ad
xor al, al
jmp 0x1400059e7
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400059c7
mov dword [rsp + 0x34], 1
jmp 0x1400059cf
mov dword [rsp + 0x34], 0
mov al, byte [rsp + 0x34]
jmp 0x1400059e7
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400059e7
xor al, al
add rsp, 0xa8
ret
Function at 0x140007620
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140007645
xor eax, eax
jmp 0x14000780b
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14000766e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14000780b
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x14000770d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140001bcc
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140002dfc
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x1400077fb
mov rcx, qword [rsp + 0x70]
call fcn.140005cc8
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x1400077ae
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x1400077ac
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x14000780b
jmp 0x140007733
cmp qword [rsp + 0x20], 0
jbe 0x1400077fb
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x140007810
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140007849
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140007937
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x1400078df
cmp qword [rsp + 0x20], 0
jle 0x1400078df
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140007889
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140002dfc
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140007927
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140007927
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14000793c
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0xd0
call fcn.14000557c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000797b
cmp qword [rsp + 0x38], 0
je 0x14000797b
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x118], 0xa
je 0x140007985
mov eax, 1
jmp 0x140007b62
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
sub rax, 0x10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004b78
test eax, eax
je 0x1400079c6
cmp qword [rsp + 0x20], 0
jne 0x1400079d0
mov eax, 1
jmp 0x140007b62
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x88
rep stosb byte [rdi], al
movabs rax, 0xf5bd373480a6b89b
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007a1f
mov eax, 1
jmp 0x140007b62
movabs rax, 0x64dc7db288c5015f
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007a54
mov eax, 1
jmp 0x140007b62
movabs rax, 0x68a3c2ba486f0741
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007a8f
mov eax, 1
jmp 0x140007b62
movabs rax, 0x858bcb1046fb6a37
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007ac4
mov eax, 1
jmp 0x140007b62
movabs rax, 0xc6a2fa174e551bcb
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0xa0]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007afc
mov eax, 1
jmp 0x140007b62
movabs rax, 0xd902864579da8171
mov qword [rsp + 0xc0], rax
lea r8, [rsp + 0xb8]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007b34
mov eax, 1
jmp 0x140007b62
lea rcx, [rsp + 0x40]
call fcn.140004b10
cmp eax, 1
jne 0x140007b4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x40]
call fcn.140005230
mov ecx, 0x8c2e2800
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0xd0
pop rdi
ret
Function at 0x140004920
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14001c210]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor eax, eax
mov rbx, r8
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x7c], eax
call fcn.140004b60
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.1400049e0
lea rdx, str.SHA
mov r8d, 6
mov rcx, rbx
call fcn.14000c880
lea rcx, [rbx + 5]
lea rdx, [rsp + 0x80]
mov r8d, 0x14
call fcn.1400089c0
movsxd rcx, eax
mov byte [rcx + rbx + 5], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140011830
add rsp, 0xa0
pop rbx
ret
Function at 0x140008040
Capabilities:
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rdi, rcx
mov r10, rcx
movzx ecx, r9b
mov eax, ecx
lea rbx, [0x14001c070]
and ecx, 2
xor esi, esi
and eax, 1
shl ecx, 0xf
lea r12, [rsp + 0x38]
mov r14, rdx
mov r15, r8
xor r11d, r11d
sub r14, rbx
mov dword [rsp + 0x50], ecx
lea r12, [r12 + rax*4]
mov r13, r8
lea ebp, [rsi + 0x12]
sub r15, rbx
nop word [rax + rax]
xor edx, edx
xor r8d, r8d
xor eax, eax
nop word [rax + rax]
movzx r9d, byte [r10]
shl r8d, 8
shl edx, 8
movsx ecx, r9b
or r8d, r9d
or edx, ecx
test eax, eax
je 0x1400080d3
mov ecx, edx
and ecx, 0x80
or r11d, ecx
test r9b, r9b
jne 0x1400080dd
mov r10, rdi
jmp 0x1400080e0
inc r10
inc eax
cmp eax, 4
jb 0x1400080b0
mov dword [rsp + 0x38], r8d
xor r8d, edx
mov dword [rsp + 0x3c], edx
mov ecx, dword [r12]
add rbx, 4
or esi, r8d
mov dword [r14 + rbx - 4], ecx
mov eax, dword [rbx - 4]
xor eax, ecx
mov dword [r15 + rbx - 4], eax
dec rbp
jne 0x1400080a0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
shl r11d, 9
mov eax, esi
shr eax, 0x10
or eax, esi
movzx ecx, ax
add ecx, 0xffff
not ecx
and ecx, r11d
and ecx, dword [rsp + 0x50]
xor dword [r13], ecx
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x1400089c0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea eax, [r8 - 2]
xor r10d, r10d
mov rdi, rdx
cdqe
mov rbx, rcx
mov r9, rcx
lea rsi, [0x140014300]
test rax, rax
jle 0x140008a81
lea r10, [rax - 1]
lea r11, [rdx + 1]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r10
shr rdx, 1
inc rdx
lea r10d, [rdx + rdx*2]
movzx eax, byte [r11 - 1]
add r9, 4
lea r11, [r11 + 3]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [r9 - 4], al
movzx eax, byte [r11 - 4]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [r11 - 3]
shr eax, 4
or rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r9 - 3], al
movzx eax, byte [r11 - 3]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
movzx eax, byte [r11 - 2]
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r9 - 2], al
movzx eax, byte [r11 - 2]
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [r9 - 1], al
dec rdx
jne 0x140008a10
cmp r10d, r8d
jge 0x140008af8
movsxd rdx, r10d
add rdx, rdi
movzx eax, byte [rdx]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [r9], al
lea eax, [r8 - 1]
cmp r10d, eax
movzx eax, byte [rdx]
jne 0x140008abd
and eax, 3
shl eax, 4
cdqe
movzx eax, byte [rax + rsi]
mov byte [r9 + 1], al
mov byte [r9 + 2], 0x3d
jmp 0x140008aec
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [rdx + 1]
shr eax, 4
or rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r9 + 1], al
movzx eax, byte [rdx + 1]
and eax, 0xf
shl eax, 2
cdqe
movzx eax, byte [rax + rsi]
mov byte [r9 + 2], al
add r9, 3
inc r9
mov byte [r9 - 1], 0x3d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov byte [r9], 0
sub r9, rbx
mov rbx, qword [rsp + 8]
lea rax, [r9 + 1]
ret
Function at 0x14000a440
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push rsi
push r13
push r14
sub rsp, 0x50
mov r13, r8
mov rsi, rdx
mov r14, rcx
call fcn.14000a630
test eax, eax
jne 0x14000a61a
cmp dword [0x14001c300], eax
jne 0x14000a618
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rdi
mov ebx, 1
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
mov dword [0x14001c300], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x14000a4d1
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x14000a4d1
mov r8d, dword [rsp + 0x88]
mov rdx, rax
mov rcx, rsi
call fcn.1400104d0
mov rcx, rdi
mov dword [r14], eax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r15, qword [sym.imp.MSVCR110.dll__environ]
mov r14, rax
mov rcx, rax
cmp word [rcx], 0
jne 0x14000a4f3
cmp word [rcx + 2], 0
je 0x14000a4f9
inc ebx
add rcx, 2
jmp 0x14000a4e4
sub rcx, rax
add rcx, 2
sar rcx, 1
mov qword [rsp + 0x28], rcx
lea rcx, [rcx + rcx*2]
inc rcx
mov qword [rsp + 0x20], rcx
call qword [sym.imp.MSVCR110.dll_malloc]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, r14
mov r8, rax
mov qword [rsp + 0x30], rax
mov rdi, rax
call fcn.1400108d0
lea ecx, [rbx + 1]
movsxd r12, ecx
shl r12, 3
mov rcx, r12
call qword [sym.imp.MSVCR110.dll_malloc]
mov qword [r15], rax
xor r15d, r15d
mov rsi, rax
test ebx, ebx
jle 0x14000a5ab
mov qword [rsp + 0x78], rbp
mov ebp, ebx
nop
mov edx, r15d
mov rcx, rdi
cmp byte [rdi], dl
je 0x14000a57b
nop word [rax + rax]
lea rcx, [rcx + 1]
inc edx
cmp byte [rcx], r15b
jne 0x14000a570
inc edx
movsxd rbx, edx
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsi], rax
call sub.MSVCR110.dll_memcpy
add rdi, rbx
add rsi, 8
dec rbp
jne 0x14000a560
mov rbp, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov qword [rsi], r15
call qword [sym.imp.MSVCR110.dll_free]
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
test r13, r13
je 0x14000a5ed
mov rcx, r12
call qword [sym.imp.MSVCR110.dll_malloc]
mov r8, r12
mov qword [r13], rax
mov rdx, qword [sym.imp.MSVCR110.dll__environ]
mov rcx, rax
mov rdx, qword [rdx]
call sub.MSVCR110.dll_memcpy
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, qword [sym.imp.MSVCR110.dll__wenviron]
mov r12, qword [rsp + 0x48]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000a613
mov qword [rax], r15
call qword [sym.imp.MSVCR110.dll_free]
mov r15, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop rsi
ret
Function at 0x14000a630
Capabilities:
Allocate thread local storage
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x14001c210]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov eax, dword [0x14001c388]
mov ecx, eax
inc eax
mov dword [0x14001c388], eax
test ecx, ecx
jne 0x14000a709
lea rcx, [rsp + 0x28]
call fcn.1400106c0
test eax, eax
jne 0x14000a729
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14001cc38], eax
call fcn.14000af50
test eax, eax
jne 0x14000a72e
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.14000ad10
test eax, eax
je 0x14000a6bf
mov eax, 0x4e22
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140011830
add rsp, 0x1e8
ret
mov rcx, qword [rsp + 0x20]
lea rdx, str.apr_initialize
call fcn.14000b080
lea rdx, [rsp + 0x30]
mov ecx, 2
call qword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x14000a72e
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x14000a723
shr ax, 8
test al, al
jne 0x14000a723
mov rcx, qword [rsp + 0x20]
call fcn.140008830
mov rcx, qword [rsp + 0x20]
call fcn.140010d00
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140011830
add rsp, 0x1e8
ret
call qword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, 0x11
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140011830
add rsp, 0x1e8
ret
Function at 0x14000c590
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rcx
xor esi, esi
call qword [sym.imp.MSVCR110.dll___iob_func]
lea rdx, [rax + 0x60]
mov rcx, rbp
call qword [sym.imp.MSVCR110.dll_fputs]
call qword [sym.imp.MSVCR110.dll__getch]
xor edi, edi
mov ebx, eax
lea r14, [0x14001c4d0]
cmp eax, 0xd
je 0x14000c711
nop dword [rax]
cmp ebx, 0xffffffff
je 0x14000c791
test ebx, ebx
je 0x14000c694
cmp ebx, 0xe0
je 0x14000c694
cmp ebx, 8
je 0x14000c607
cmp ebx, 0x7f
jne 0x14000c622
test esi, esi
je 0x14000c622
dec rdi
dec esi
cmp rdi, 0x80
jb 0x14000c6cd
jmp 0x14000c7a4
cmp ebx, 3
je 0x14000c770
cmp ebx, 0x1a
je 0x14000c73c
cmp ebx, 0x1b
jne 0x14000c668
call qword [sym.imp.MSVCR110.dll___iob_func]
lea ecx, [rbx - 0x11]
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR110.dll_fputc]
call qword [sym.imp.MSVCR110.dll___iob_func]
mov rcx, rbp
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR110.dll_fputs]
xor esi, esi
xor edi, edi
jmp 0x14000c700
movsxd rax, esi
cmp rax, 0x7f
jae 0x14000c6eb
movzx ecx, bl
call qword [sym.imp.MSVCR110.dll_iscntrl]
test eax, eax
jne 0x14000c6eb
mov byte [rdi + r14], bl
inc rdi
inc esi
call qword [sym.imp.MSVCR110.dll___iob_func]
mov ecx, 0x2a
jmp 0x14000c6f6
call qword [sym.imp.MSVCR110.dll__getch]
shl ebx, 4
or eax, ebx
cmp eax, 0xe53
je 0x14000c6b7
cmp eax, 0xe4b
je 0x14000c6b7
cmp eax, 0x53
je 0x14000c6b7
cmp eax, 0x4b
jne 0x14000c6eb
test esi, esi
je 0x14000c6eb
dec rdi
dec esi
cmp rdi, 0x80
jae 0x14000c7aa
mov byte [rdi + r14], 0
call qword [sym.imp.MSVCR110.dll___iob_func]
lea rcx, [0x1400154d8]
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR110.dll_fputs]
jmp 0x14000c700
call qword [sym.imp.MSVCR110.dll___iob_func]
mov ecx, 7
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR110.dll_fputc]
call qword [sym.imp.MSVCR110.dll__getch]
mov ebx, eax
cmp eax, 0xd
jne 0x14000c5e0
call qword [sym.imp.MSVCR110.dll___iob_func]
mov ecx, 0xa
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR110.dll_fputc]
movsxd rcx, esi
cmp rcx, 0x80
jae 0x14000c7b0
mov byte [rcx + r14], 0
mov rax, r14
jmp 0x14000c755
call qword [sym.imp.MSVCR110.dll___iob_func]
lea rcx, [0x1400154e0]
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR110.dll_fputs]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call qword [sym.imp.MSVCR110.dll___iob_func]
lea rcx, [0x1400154dc]
lea rdx, [rax + 0x60]
call qword [sym.imp.MSVCR110.dll_fputs]
or ecx, 0xffffffff
call qword [sym.imp.MSVCR110.dll_exit]
int3
call qword [sym.imp.MSVCR110.dll___iob_func]
lea rcx, str._EOF__n
lea rdx, [rax + 0x60]
jmp 0x14000c74d
call fcn.140011978
int3
call fcn.140011978
int3
call fcn.140011978
int3
Function at 0x14000c7c0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
cmp dword [0x14001c950], 0x32
mov rsi, rcx
mov ecx, 0x40
mov eax, ebx
mov rdi, rdx
cmovge eax, ecx
lea r9d, [rbx + 1]
lea rcx, [rsp + 0x50]
or eax, 0xf0000000
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000c831
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000c868
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rax + 0xafc80]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x14000c85b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000c85b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rax + 0xafc80]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ca00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [rcx + 0x48], 0
mov rbx, rcx
je 0x14000cae4
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x38], r14
xor r14d, r14d
cmp dword [rcx + 0x78], 1
mov dword [rsp + 0x50], r14d
mov ebp, r14d
jne 0x14000cad2
mov qword [rsp + 0x68], rdi
mov rdi, qword [rcx + 0x60]
test rdi, rdi
je 0x14000cacd
mov qword [rsp + 0x60], rsi
mov rsi, qword [rcx + 0x58]
mov qword [rsp + 0x30], r15
mov r15d, 0xffffffff
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
mov r8d, edi
cmp rdi, r15
lea r9, [rsp + 0x50]
mov rdx, rsi
cmova r8d, r15d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000ca9a
mov eax, dword [rsp + 0x50]
add qword [rbx + 0x80], rax
add rsi, rax
sub rdi, rax
jne 0x14000ca60
jmp 0x14000cabf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000cab0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebp, [rax + 0xafc80]
mov ecx, dword [rsp + 0x50]
add qword [rbx + 0x80], rcx
test ebp, ebp
jne 0x14000cac3
mov qword [rbx + 0x60], r14
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x38]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret