joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074d20
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp - 0x44], rsi
push rdi
in al, dx
xor byte [rcx - 0x75], cl
invalid

Function at 0x140078e20
Capabilities:
Encode data using xor

Disassembly:
push rbx
int 0x83
in al, dx
xor byte [rax - 0x75], cl
fimul dword [rax - 0x77]
push rsp
and al, 0x28
xor eax, eax
mov dword [rbx + 0x570f2024], ebx
enter 0x110f, 2
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
mov rcx, qword [rdx - 0x3fc4764e]
jb 0x140078e22
adc rax, r8

Function at 0x14007ba10
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], al
call qword [0x14046a008]
cwde
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
movabs eax, dword [0x48a93ef5d015ffd2]
cmc
test eax, 0x814c8b48
invalid
xor rcx, rsp
xor ecx, esp
pop rax
add dword [rsi - 0x7cb7ffc7], 0xffffffc4
push rax
jle 0x14007ba36
pop rbx
ret

Function at 0x1400822c0
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rax + rdi + 0x10], rbx
pop rax
mov dword [rsp + 0x18], esi
push rdi
sub rsp, 0x30
invalid

Function at 0x1400a5890
Capabilities:
Execute syscall

Disassembly:
mov qword [rbx + 0x24], rbx
adc byte [rbx + 0x48], dl
sub esp, 0xfffffff5
mov esp, 0xc033c78b
mov dword [rsp - 0x3fa8dae0], esp
syscall
add cl, byte [rax - 0x77]
adc byte [rax - 0x39], cl
ltr word [rbx]
mov byte [0x1602e9d82], ch
add dword [rax], eax
add byte [rax], al
movups xmmword [rsp + 0x28], xmm0
mov edx, dword [rcx - 0x67]
mov esi, dword [rax - 0x7dc3dddc]
or dword [rcx], esp
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test qword [r13 - 9], r15
adc eax, 0x20418b48
mov rcx, rdx
mov bl, 0x41
push 0x6442ea4c
push 0xffffffffebc22b4c
xor esi, esi
ret 0x7504

Function at 0x1400d0f70
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
lea ebx, [rbx + 0x48491481]
sub esp, 0xe0
and al, byte [0x14056a2c0]
xor rax, rsp
or eax, 0xc0248489
add byte [rax], al
add bl, cl
invalid

Function at 0x1400d6090
Capabilities:
Encode data using xor

Disassembly:
push rdi
xchg esi, eax
test ah, ch
push rax
mov rax, qword [0x18256a2c0]
xor rbx, qword [rbx]
xor rbx, qword [rbx]
mov qword [rbx], rsp
and al, 0x9d
cmp qword [rcx + 0xcb4d], 0
stc
cmp al, 0x84
xchg ecx, eax
add dword [rax], eax
add byte [rax - 0x75], cl
mov dword [rax + 0x4889d600], ebx
test dword [rax], eax
or byte [rsi + rdx*8 + 0x48b10001], al
mov ecx, dword [rcx]
adc bl, byte [rdi - 0x76b7dfdc]
and al, 0x68
mov qword [rsp + 0x70], rbp
sub sil, byte [rsi + rdx*8 + 0xb]
mov rax, qword [rcx]
call qword [rax + 0x38]
sti
mov dh, 0x87
cwde
add byte [rax], al
add byte [rbp + 0x33], al
leave
xor r8d, r8d
mov edx, 0x7e6
mov rax, qword [rbx - 0x6d071c18]
mov r8d, dword [rdi]
adc eax, 0xd11aba2c
add byte [rax], al
sub r8d, dword [rsp + 0x35]
mov rbx, rax
loop 0x1400d609c
shr ebx, 1
and eax, dword [rax]
add byte [rbp + 0x63], cl
enter 0xffffffffffff8b44, 0x44
int 0x28
sub r8d, dword [rax + rbp*8 + 0x20]
retf 0x98b
Function at 0x1400f4f70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub esp, 0x30
mov rsi, r8
or byte [rbx - 0xe74b31e], cl
mov r12, rbp
loop 0x1400f4fe2
sub r9, r8
invalid
add edx, eax
out dx, eax
mov fs, ebx
cmp byte [rsi + 0x38e38e3], cl
cmp rsi, qword [r15 + rcx]
adc dword [rax + 1], edx
add byte [rcx - 0x7e9572b4], ah
lea ebp, [rdx - 0x7f]
xor rcx, qword [r14 + 0x51]
sub rcx, r8
cdq
mov eax, edx
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x9e
add rdx, rax
mov rcx, rdx
rcl qword [r10 + 0x48c18b49]
sub eax, ecx
cmpsb byte [rsi], byte [rdi]
ror byte [rdi], 1
xchg byte [rbp - 0x5ddedf00], dh
mov edi, ecx
mov rdx, r12
and al, 0xed
lea rcx, [rdi + rdi*8]
shl rcx, 3
call 0x17506b550
sbb ecx, dword [rbx - 0x7b26b749]
and al, 0x88
add byte [rax], al
add byte [rax - 0x73], cl
lea ecx, [rbx + rbx*8]
fld dword [rsp + 0x88]
lea rcx, [rbx + rbx*8]
lea ecx, [rbx + rbx*8]
lea rbx, [rcx + 0x487b8d4c]
je 0x1400f4fcc
jl 0x1400f5069
js 0x1400f5093
mov esi, edx
and al, 0x20
jne 0x1400f502d
pop rsp
and al, 0x28
mov eax, dword [rsi]
mov dword [rbx], eax
xorps xmm0, xmm0
movups xmm3, xmm2
or byte [rbx], dh
ror byte [rax - 0x64], 0x20
sbb byte [rax - 0x77], cl
and byte [r15], cl
adc byte [rsi + 8], al
movups xmmword [rdi + 0x4e6a0fae], xmm1
sbb byte [rdi], cl
adc dword [rbx + 0x18], ecx
mov qword [rsi + 0x18], rax
invalid
invalid

Function at 0x1400f7340
Capabilities:
Encode data using xor

Disassembly:
imul rbx, qword [rsp + 0x10], 0x2474bc48
and byte [rax - 0x77], cl
sub ah, byte [rax + rcx]
or dword [rcx - 1], eax
invalid
Function at 0x14011e840
Capabilities:
Delete file

Disassembly:
cmp byte [rcx + 0x48082494], cl
mov dword [rsp + 0x10], ebp
mov qword [rsp + 0x18], rsi
push rdi
push r14
cmovs eax, dword [r9 + 0xf0ec]
add al, ch
xor byte [rbp + rsi*8 - 0xf305901], cl
mov rcx, rax
call 0x140e1f970
mov rbx, qword [r14 + 0x78]
mov r15, qword [r14 + 0x8000080]
cmp rbx, r15
je 0x14011e98e
nop
sbb byte [rdx], 0x28
add byte [rdi], cl
test bh, dh
add byte [rax], al
add byte [rax - 0x75], cl
or ecx, dword [rax - 0x7b]
leave
je 0x14011e981
cmp rcx, qword [r14 + 0x70]
je 0x14012b081
movzx eax, byte [rbx + 0xa]
cmp byte [rbx + 0xb], al
jne 0x14011e8e8
lea rdi, [rbx]
in eax, dx
cmp qword [rdi + 0x18], 7
jbe 0x14011e8b7
int 0xea
test rdi, rdi
je 0x16e11e981
mov rcx, rdi
call qword [0x14046b74f]
cmp eax, 0xffffffff
pop rax
test byte [rdi + 0x51000000], ch
stosd dword [rdi], eax
jne 0x16811e981
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x140127981
lodsq rax, qword [rsi]
invalid
xchg esi, eax
add ebx, 9
cmp rbx, r15
invalid
lea r11, [rsp + 0xfff0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x14]
sub eax, 0x4930738b
mov esp, ebx
mov byte [rdi + 0x41], bl
fistp word [rdi - 0x3d]
int3
add byte [rax], al
nop
mov ecx, dword [rcx + 0xa30]
xor r9d, r9d
xor r8d, r8d
dec byte [rbx - 0x20]
cmc
dec dword [rax - 0x31]
cmp eax, 0xffad34ff
xor r9d, r9d
mov qword [r14], 0xffffffffffffffff
xor r8d, r8d
mov rcx, qword [rsi + 0x347e0a30]
mov edx, 0xb800fcd6
mov rdi, rax
mov esi, 0xff5fe092
shl dword [rax + rax*8], 0x7e
add al, 0x1c
test edi, edi
mov rcx, qword [rsi + 0xa30]
xor r9d, r9d
test byte [rcx - 0x45c7db94], 0xd7
invalid
dec dword [rax - 0x75]
fmul dword [rax - 0x7d]
lahf
invalid

Function at 0x14012c980
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + rbx*4 + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x30a4]
mov esi, edx
mov rbx, rcx
mov ebx, ecx

Function at 0x1401325d0
Capabilities:
Create directory

Disassembly:
invalid
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
sbb byte [rsp + 0x20], sil
push rdi
push r12
cld
push r14
push r15
sub rsp, 0x250
sbb eax, 0xe35b058b
and al, 0xc4
mov qword [rsp + 0x56000240], rax
mov rsi, qword [rbx + 0x48]
mov ecx, edx
cmp qword [rdx + 0x18], 7
jbe 0x140132611
js 0x14013259b
or byte [rbx], dh
sar bh, cl
adc eax, 0x33914f
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
adc qword [rbx], 0xffffffffffffff99
invalid
Function at 0x14015b7a0
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x15
cli
cmpsd dword [rsi], dword [rdi]
mov dh, 0x15
add byte [rsi + rsi*4], ah
adc eax, 0xcccccc00
adc al, 0x48
sub rsp, 0x28
sub rsp, 0x28
xor eax, eax
jp 0x14015b7ff
ror byte [rdi], 0x11
add dword [rax + 0x62], ecx
mov r10, rcx
pop rax
mov esp, esi
or byte [rbp + 0x3b], cl
jae 0x14015d42c
cmp byte [rbx + 0x4848104a], cl
mov eax, dword [rax + rbx*8]
mov byte [r10], 1
jrcxz 0x14015b791
or byte [rcx - 0x75], cl
in eax, 0x48
add esp, 0xffffffc1
ret
sbb byte [rbp + 0x3b], cl
retf
push rbp
pop rsi
sub r15d, 1
je 0x14015d4c0
sub r15d, 1
je 0x140205ad0
cmp r15d, 1
jne 0x14015d4c0
sar dword [r13 + 0xb], cl
add byte [rdi], cl
test byte [rdx + 0x29a40000], al
movzx eax, byte [rbp + 8]
cmp al, 0x67
je 0x14015d460
cmp al, 0x47
std
jne 0x14015d3ec
mov eax, ecx
sub eax, r8d
rol dword [rcx + 0x2b], 0xc0
outsd dx, dword [rsi]
jge 0x14015d499
add byte [rdi + 0x2bddff02], dl
clc
add esi, dword [rax]
and al, 0x34
mov dword [rbp + 0x3c], edi
cmp rcx, rdx
jne 0x14015d4d8
movaps xmm1, xmm6
cmp edx, dword [rbp + rcx - 0x29]
add dword [rbx], edi
add dl, dh
psubusw mm0, qword [0x14050cfe8]
comisd xmm0, xmm1
jbe 0x14015d4d8
xorps xmm0, xmm0
mov rax, cr6
jp 0x14015d49e
invalid
je 0x14015d4d8
ret 0x7488
out dx, eax
push qword [rsp + rcx + 0x48]
jmp [0x140635ea1]
add dword [rbp + 0x34], edi
cmp byte [r13 + 0xd], 0
je 0x14015d4f2
adc byte [r13 + 9], dil
cmp eax, 0x84450975
div byte [rax]
add al, 0xb0
add edi, ecx
add dh, byte [rdx]
mov dl, 0x88
cmp byte [r8 + 0x17], r9b
xor byte [r8 - 0x77], r9b
push rbx
xor dh, byte [rdx + 0x48384588]
invalid
or byte [rax - 0x73], 0x4d
xor dl, byte [rbx]
mov dword [rbx + 0x4d8d4888], eax
cmp byte [rax - 0x77], cl
xchg r8, rax
lea rcx, [rbp + 0x34]
mov qword [rcx - 0x68], rax
mov qword [rcx], r15
movabs al, byte [0x48000006608d8d48]
mov dword [rbp - 0x58], ecx
lea rcx, [rbp - 0x48]
call qword [rax + rsi*4]
lea rcx, [rbp + 0x28]
mov rdi, rdx
mov eax, 0x40df8d48
jrcxz 0x14015d4fe
lea rcx, [rbp + 0x7a]
mov qword [rbp - 0x38], rcx
lea rcx, [rbp + 0x20]
mov qword [rbp - 0x30], rcx
lea rdi, [rsi + 0x4d2ab95d]
invalid
add byte [rax + 3], cl
ret

Function at 0x14015d7c0
Capabilities:
Encode data using xor

Disassembly:
or byte [rax - 0x75], cl
add ecx, dword [rax - 0x75]
retf
or al, 0x20
add byte [rax], dh
mov rax, r12
mov rcx, qword [rbx + rdx*4 + 0x77]
xor rcx, rsp
call 0xcd4140c0
add rsp, 0x30
pop r14
sbb eax, 0xc35b5e5f
push rbx
push rbp
push rsi
push rdi
test al, 0x41
push rbp
sub rsp, 0x28000088
movabs rcx, 0xfd334847d7cae905
jbe 0x14015d7a0
movsd dword [rdi], dword [rsi]
and al, 0x78
ja 0x14015d76c
jno 0x14015d7e7
mov r13, r9
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x30], eax
mov rbx, rdx
mov r12, rcx
test dword [rbx + 0x79], eax
xor r8d, 0x36
jg 0x14015d85a
invalid
punpckhwd mm1, qword [r8]
xor edi, edi
mov dl, 0xfd
movd ebx, mm1
mov qword [rsp + 0xc8], r14
invalid
Function at 0x140218fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x40
test dl, dl
cmc
mov eax, dword [rbx + 0x992ba]
add byte [rdi], cl
test byte [rcx + rax], cl
add byte [rax], al
fisttp qword [rbx - 0x47bef7b7]
add eax, 0x48000000
mov dword [rsp + 0x50], ebx
movsq qword [rdi], qword [rsi]
mov fs, word [rax + rbx*2]
mov qword [rbx + rsi + 0x60], rdi
xor edx, esi
mov eax, dword [rdx]
call qword [rax + 0x253aef]
mov rbp, rax
test qword [rcx], rax
test dword [rsi + rbp*2 + 0x48000000], 0x48084e67
mov edx, eax
lahf
adc eax, 0x4c542423
test rax, rax
je 0x140219082
mov rcx, rax
stc
mov dword [rsp - 0x55], esi
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov r14, rax
test qword [0xcb6a2f87], rsp
or byte [rax - 0x75], r9b
invalid
mov r9, qword [rax]
adc byte [rdx + rcx*8 + 0xd], cl
cmp dword [rdi + rdi*8 + 0x4e8b48de], 8
push rsi
ror dword [rax - 0x77], cl
invalid

Function at 0x140225330
Capabilities:
Encode data using xor

Disassembly:
adc cl, byte [rcx]
xor dword [rax], edx
add byte [rsi + rbx*8 + 0x48], dh
mov edi, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
fimul word [rax - 0x75]
jl 0x140225341
xor byte [rax - 0x75], cl
pop rsp
and al, 0x38
cmp qword [rcx + 0x20], 0x5e
je 0x140225312
push rdx
invalid
pop r12
and al, 0x18
push rbp
push rsi
push rdi
push r12
push r15
xor al, byte [rbx - 0x7483b914]
clc
mov edi, eax
xor dil, dl
in al, 0xd9
mov rax, rcx
test qword [rsi - 0x12cce88c], rsi
xor ebp, ebp
cmp dword [rax - 0x72], eax
cmove rbp, rax
test rbp, rbp
jne 0x140225318
fild word [rax + 0x10]
test rax, rax
jne 0x140225351
xor ebp, ebp
adc eax, 0x453061cc
clc
shl byte [rdi - 0x10b73375], 0x15
ret 0x27b1

Function at 0x14024db00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
dec dword [rbx + 0x31c70305]
add bl, ch
xor ebp, dword [0x16469ad5c]
pop rax

Function at 0x140259270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rcx + 0x45576b4a], rdi
in eax, dx
in al, dx
movabs al, byte [0x1037a58b48000000]
xor dword [rax], eax
invalid

Function at 0x140268500
Capabilities:
Encode data using xor

Disassembly:
add rsp, rax
mov qword [rbx], rbp
adc dword [rbp - 5], 0xffffffed
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x63]
sub rsp, 0x130
setb byte [rax - 0x48]
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x14048a2bc]
xor rax, rsp
mov qword [rbp + 8], rax
loope 0x140268503
call 0x189191086
mov edi, dword [rbx]
cmp byte [rbx + 0x1050ff01], cl
push InitCommonControls
fmul dword [rbx + rcx*4 + 0xe]
invalid

Function at 0x1402692e0
Capabilities:
Encode data using xor

Disassembly:
mov sil, 0x5c
and al, 0x20
push rbp
push rsi
push rdi
sub rsp, 0xffffffffd30077c0
bsr edi, dword [rsp + 0x3b0]
mov rax, qword [0x14056a204]
xor rax, rsp
xchg rsi, rax
test byte [rax + riz*4], ah
and dword [rax], eax
add byte [rdi], cl
sub bl, bh
in eax, dx
ror byte [rax - 0x1e], 0xea
mov rsi, qword [rdx]
mov rdi, qword [rsp + 0x1d0400]
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, [0x1403fb7d0]
xor ecx, dword [0x128ee9a81]
imul edx, ebp, 0x1d
add byte [rax - 0x61], cl
invalid
Function at 0x140283110
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rbx]
xor eax, 0x574c9ca
call 0x11a414364
sbb edx, ebx
add rbx, 8
cmp rdx, rbp
jne 0x1402830e5
test eax, 0x30640a8b
and byte [rcx], al
pop rdi
ret
cmp rcx, rdx
je 0x1402830f0
mov rdx, rdx
and al, 0x1b
push rbp
insb byte [rdi], dx
and al, 0x18
push rsi
invalid

Function at 0x1402e5450
Capabilities:
Encode data using xor

Disassembly:
pushfq
mov dword [rsp + 0x36], ebx
mov qword [rsp + 0x20], rsi
push rdi
push r14
xor al, 0x57
sub rsp, 0x50
mov r14, r8
in al, 0xbb
test byte [rbx - 0x2474b707], 0x48
out 0x42, eax
or byte [rax - 0x27], cl
and al, 0x30
xor r9d, r9d
mov dword [rdi + rcx + 0x38], r9d
invalid

Function at 0x140359660
Capabilities:
Authenticate hmac

Disassembly:
fadd qword [rax]
std
cmp eax, dword [rdi]
je 0x140359635
cmp qword [rax + 0x58], 0xffffffffffffffa9
lea rcx, [rax + 0x40]
jbe 0x140359638
retf 0x2d8b
mov rbx, qword [rcx + 0x45]
xor edx, dword [0x1b45ece58]
xor r10d, dword [0x1b45ece58]
hlt
mov esi, dword [rax + 0x1f90]
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x10], xmm0
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14035961e
lea r14, [rsi]
adc byte [rax - 0x65], cl
movabs dword [0x922f8e831d38d48], eax
lodsd eax, dword [rsi]
mov rax, qword [rax]
cmp rax, qword [rdi]
je 0x1403596a0
add byte [rax + 0x3b], cl
invalid
mov esp, 0xf395683
mov al, byte [rax]
xchg ebx, eax
or byte [rax - 0x75], cl
js 0x14035968a
add esp, esp
mov esi, 0x293844cb
je 0x1403596b0
in al, 0xbe
retf
call fcn.1404226e4
mov r13d, eax
lea rax, [0x1404ff568]
mov qword [rbp - 8], 0x16
mov qword [rbp - 0x10], rax
mov rax, qword [r14 + 0x3e001f81]
movaps xmm0, xmmword [rbp - 0x54]
xor byte [rcx - 0x59992393], cl
jg 0x140359738
invalid
adc byte [rax - 0x75], cl
js 0x1403596e3
test rdi, rdi
je 0x140359706
movabs rsp, 0x558d48cf8b480445
invalid
add al, 0x48
mov ecx, edi
lea rdx, [rbp - 0x10]
call 0x1403f2d80
jnp 0x14770eaf6
mov byte [rsi], cl
invalid
insb byte [rdi], dx
cmp eax, dword [rax]
je 0x140359717
mov rsi, rcx
cmp eax, 0xc9ad1
xor ebx, ebx
jmp 0x1403596c7
xor ebx, ebx
mov ebp, dword [rdi]
test dword [rbp - 0x7abab08b], esp
in eax, dx
jne 0x140359736
invalid
test r13d, r13d
in eax, dx
invalid
Function at 0x140361ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rsi*4 - 0x6a], rbx
mov qword [rsp - 0x62], rbp
mov ecx, 0x18247489
push rbx
jl 0x140362027
and byte [rcx + 0x54], al
test al, 0x56
div dh
invalid
test dword [rbx + 0xab84c4], ecx
add byte [rax], al
nop
or r15b, r15b
je 0xe65e2112
lea rdi, [rbx + 0x78]
cmp eax, 0x24
jne 0x1403620fd
mov ecx, dword [rbx - 0x65]
lea rdi, [rbx + 0x78]
cmp ecx, 0x28
jne 0x140362073
mov edx, 0xe02a0d
mov rcx, rbx
call fcn.14030cc40
mov rcx, rbx
call fcn.140361eb0
mov eax, dword [rsi + 0x48]
mov ecx, ebx
call fcn.14030ccad
fstp qword [rax - 0x18]
sub dl, bh
invalid
call 0x140361aa0
test al, al
retfq
jmp 0x189361b62
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
cmp bl, byte [rbx + rax*8 + 0x68]
cmp edx, dword [rbp + rsi*2 - 0x1b804524]
je 0x140362157
cmp dword [rdi], r14d
jne 0x1403620b3
mov edx, 0xfd2600f0
mov rbp, qword [rbx - 0x34]
xchg edx, eax
invalid
out dx, al
test al, 0x8b
sbb eax, 0xe977f83b
xor eax, dword [rbp + rdx*2 + 0x1fe8cb8b]
stosd dword [rdi], eax
cli
jne 0x14036214d
insd dword [rdi], dx
int3

Function at 0x14042cd3c
Capabilities:
Parse pe header

Disassembly:
mov cl, 0x89
and al, 0x18
mov byte [rsp + 0x10], dl
push rbp
mov ebp, esp
sub rsp, 0x50
jb 0x14042cd95
loopne 0x14042cd69
call [rbp + 0x5c8948ff]
and al, 0x60
mov ebx, ecx
test r8d, r8d
jne 0x14042cdab
cmc
leave
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
movsxd rax, eax
je 0x14042cdab
mov ecx, 0x5a4d
sar byte [rcx], 8
jne 0x14042cdc1
movsxd rcx, dword [rax + 0x3c]
add rcx, rbx
cmp dword [rcx], 0x4550
jne 0x14042cdab
mov eax, 0x20b
cmp word [rcx - 0x10], ax
jne 0x14042cdab
cmp dword [rcx + 0x5a84], 0x32
pop rbp
adc dword [r14], 0x1b
pop rdx
add byte [rax], al
xor bl, byte [rbp + 0x41]
adc dword [rsi], 0x1b
mov byte [rax], al
add byte [rax], al
je 0x14042cdab
mov esp, dword [rbx - 0x18]
mov cl, 0xb9
test dword [rax], eax
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x5c]
mov qword [rbp + 0x4c], rax
lea rsi, [rsi]
and dword [rdx + 0x48f04589], 0x4828458d
mov dword [rbp - 8], eax
sub byte [r8 - 0x77], r9b
clc
mov eax, 0x540000c8
invalid
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14042cd3c

Function at 0x140432668
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rcx + 0x48572024], rbx
sub esp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14043269f
invalid
mov rdx, r9
invalid
Function at 0x100401080
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
mov rax, qword [0x10040c7d0]
lea rdx, str.usage:__s___v____param_value__..._resolution_unitwidth_font_n
mov r8, qword [rax]
call fcn.100403230
mov ecx, 1
call sub.cygwin1.dll_exit
nop
nop

Function at 0x100402260
Capabilities:
Terminate process
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xc0]
test rcx, rcx
mov rbp, rdx
mov r12, rcx
setne dl
mov r13d, r8d
mov ebx, r9d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb8]
mov esi, edx
mov r15, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov rax, qword [0x10040c7d0]
mov rdi, qword [rax]
mov eax, r8d
not eax
shr eax, 0x1f
and esi, eax
test rdi, rdi
je 0x100402410
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea rdx, [0x10040c2b3]
mov r8, rdi
call fcn.100403230
test sil, sil
jne 0x100402419
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0x20
call sub.cygwin1.dll_fputc
test ebx, ebx
je 0x100402390
cmp ebx, 2
jne 0x1004023c3
call sub.cygwin1.dll___getreent
mov r9, qword [rax + 0x18]
lea rcx, str.fatal_error:
mov r8d, 0xc
mov edx, 1
call sub.cygwin1.dll_fwrite
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0x20
call sub.cygwin1.dll_fputc
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r9, r15
mov r8, r14
call fcn.1004020d0
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0xa
call sub.cygwin1.dll_fputc
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
call sub.cygwin1.dll_fflush
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x100402640
call sub.cygwin1.dll___getreent
mov r9, qword [rax + 0x18]
lea rcx, str.warning:
mov edx, 1
mov r8d, 8
call sub.cygwin1.dll_fwrite
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0x20
call sub.cygwin1.dll_fputc
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r9, r15
mov r8, r14
call fcn.1004020d0
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0xa
call sub.cygwin1.dll_fputc
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.cygwin1.dll_fflush
test sil, sil
je 0x1004022ff
lea rdi, [0x10040c2b1]
mov rsi, r12
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
lea rax, str._standard_input_
cmove r12, rax
test rbp, rbp
je 0x100402470
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea rdx, str._s___s_:_d:
mov dword [rsp + 0x20], r13d
mov r9, rbp
mov r8, r12
call fcn.100403230
jmp 0x1004022ec
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea rdx, str._s:_d:
mov r9d, r13d
mov r8, r12
call fcn.100403230
jmp 0x1004022ec
sub rsp, 0x28
mov ecx, 3
call sub.cygwin1.dll_exit
nop
nop
Function at 0x100402640
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xc0]
test rcx, rcx
mov rbp, rdx
mov r12, rcx
setne dl
mov r13d, r8d
mov ebx, r9d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb8]
mov esi, edx
mov r15, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov rax, qword [0x10040c7d0]
mov rdi, qword [rax]
mov eax, r8d
not eax
shr eax, 0x1f
and esi, eax
test rdi, rdi
je 0x100402410
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea rdx, [0x10040c2b3]
mov r8, rdi
call fcn.100403230
test sil, sil
jne 0x100402419
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0x20
call sub.cygwin1.dll_fputc
test ebx, ebx
je 0x100402390
cmp ebx, 2
jne 0x1004023c3
call sub.cygwin1.dll___getreent
mov r9, qword [rax + 0x18]
lea rcx, str.fatal_error:
mov r8d, 0xc
mov edx, 1
call sub.cygwin1.dll_fwrite
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0x20
call sub.cygwin1.dll_fputc
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r9, r15
mov r8, r14
call fcn.1004020d0
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0xa
call sub.cygwin1.dll_fputc
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
call sub.cygwin1.dll_fflush
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x100402640
call sub.cygwin1.dll___getreent
mov r9, qword [rax + 0x18]
lea rcx, str.warning:
mov edx, 1
mov r8d, 8
call sub.cygwin1.dll_fwrite
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0x20
call sub.cygwin1.dll_fputc
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r9, r15
mov r8, r14
call fcn.1004020d0
call sub.cygwin1.dll___getreent
mov rdx, qword [rax + 0x18]
mov ecx, 0xa
call sub.cygwin1.dll_fputc
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.cygwin1.dll_fflush
test sil, sil
je 0x1004022ff
lea rdi, [0x10040c2b1]
mov rsi, r12
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
lea rax, str._standard_input_
cmove r12, rax
test rbp, rbp
je 0x100402470
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea rdx, str._s___s_:_d:
mov dword [rsp + 0x20], r13d
mov r9, rbp
mov r8, r12
call fcn.100403230
jmp 0x1004022ec
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea rdx, str._s:_d:
mov r9d, r13d
mov r8, r12
call fcn.100403230
jmp 0x1004022ec
sub rsp, 0x28
mov ecx, 3
call sub.cygwin1.dll_exit
nop
nop