joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14003dae0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
jge 0x14003db13
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
test ebp, ebp
jg 0x14003db29
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov eax, dword [rcx + 0x28]
mov qword [rsp + 0x38], rdi
xor edi, edi
test eax, eax
js 0x14003db50
inc rsi
mov byte [rdx], al
mov edi, 1
mov dword [rcx + 0x28], 0xffffffff
cmp ebp, edi
jle 0x14003dbed
cmp byte [rbx + 0x30], 0
jne 0x14003db79
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x14003db69
mov rcx, rbx
call fcn.140002c8e
jmp 0x14003dbd8
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + rdx]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
jmp 0x14003dbda
cmp byte [rbx + 0x31], 0
je 0x14003dbd0
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x14003db94
mov rcx, rbx
call fcn.140002c8e
mov ecx, eax
jmp 0x14003dba2
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + rdx]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
test ecx, ecx
js 0x14003dbed
mov r8d, dword [rbx + 0x34]
movzx edx, cl
lea eax, [rdx + r8]
sar r8d, 8
imul ecx, eax, 0x3193
mov eax, 0x58bf
sub eax, ecx
movzx ecx, r8b
movzx eax, ax
xor ecx, edx
mov dword [rbx + 0x34], eax
jmp 0x14003dbda
mov rcx, rbx
call fcn.140001816
mov ecx, eax
test ecx, ecx
js 0x14003dbed
mov byte [rsi], cl
inc edi
inc rsi
cmp edi, ebp
jl 0x14003db50
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x14000213a
Capabilities:
Terminate process

Disassembly:
jmp 0x14005f270
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400022b6
Capabilities:
Terminate process

Disassembly:
jmp 0x14005f250
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.14000312f
test al, al
je 0x14005f11b
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.140002a77
mov bl, al
mov ecx, dword [0x140091fa8]
cmp ecx, 1
je 0x14005f126
test ecx, ecx
jne 0x14005f051
mov dword [0x140091fa8], 1
lea rdx, [0x14006b800]
lea rcx, [0x14006b4d0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x14005f032
mov eax, 0xff
jmp 0x14005f10b
lea rdx, [0x14006b3c0]
lea rcx, [section..rdata]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x140091fa8], 2
jmp 0x14005f059
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.14000295a
call fcn.1400025d1
mov rbx, rax
cmp qword [rax], 0
je 0x14005f08c
mov rcx, rax
call fcn.140001ba4
test al, al
je 0x14005f08c
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x14009c020]
call fcn.14000277a
mov rbx, rax
cmp qword [rax], 0
je 0x14005f0ae
mov rcx, rax
call fcn.140001ba4
test al, al
je 0x14005f0ae
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_wide_environment
mov rdi, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv
mov rbx, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
call fcn.140001104
mov ebx, eax
call fcn.140002545
test al, al
je 0x14005f130
test sil, sil
jne 0x14005f0e5
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140001b09
mov eax, ebx
jmp 0x14005f10b
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.1400029aa
nop
mov ecx, 7
call fcn.1400029aa
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.140002586
add rsp, 0x28
jmp 0x14005efc4
Function at 0x1400023fb
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003d8c0
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000218a
cmp dword [rdi + 0x40], 0
je 0x14003d97c
mov rdx, qword [rdi + 0x48]
mov ecx, 0x80
mov qword [rsp + 0x30], rbx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
xor ecx, ecx
cmp byte [rdi + 0x50], cl
setne cl
inc ecx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov ebx, dword [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 8
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 0x10
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
sar ebx, 0x18
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
movsxd r8, dword [rdi + 0x40]
mov edx, 1
mov r9, qword [rdi + 0x48]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [rdi + 0x44], 0
mov rbx, qword [rsp + 0x30]
jge 0x14003d975
mov dword [rdi + 0x44], 0
mov qword [rdi + 0x38], 0
mov dword [rdi + 0x40], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140002545
Capabilities:
Parse pe header

Disassembly:
jmp 0x14005ff70
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005ffba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005ffba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005ffba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005ffba
cmp dword [rcx + 0x84], 0xe
jbe 0x14005ffba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005ffbc
xor al, al
add rsp, 0x28
ret
Function at 0x140010500
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x50
mov rdi, r8
mov rbx, rcx
mov eax, dword [r8 + 8]
mov dword [rsp + 0x78], eax
call fcn.140002eb9
test al, al
je 0x1400105b5
mov r8d, dword [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140001a37
nop
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
movsxd r8, dword [rsp + 0x28]
mov r9, rax
mov edx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp eax, dword [rsp + 0x28]
je 0x14001058b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov r8, rax
lea rdx, [0x14006c8cc]
mov rcx, rdi
call fcn.140002595
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14001063d
mov ecx, dword [rax]
sub ecx, 1
mov rax, qword [rsp + 0x30]
mov dword [rax], ecx
jne 0x14001063d
mov rcx, qword [rsp + 0x30]
jmp 0x140010637
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.14000137a
mov rbx, rax
movsxd rdx, dword [rax + 8]
add rdx, qword [rax]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1400105ea
mov ecx, dword [rax + 8]
mov rax, qword [rbx + 0x10]
add rax, 0xc
add rcx, rax
cmp rdx, rcx
jae 0x1400105ef
cmp byte [rdx], 0
je 0x140010607
mov edx, 1
mov rcx, rbx
call fcn.1400029dc
test rax, rax
je 0x140010607
mov byte [rax], 0
dec dword [rbx + 8]
mov r8, qword [rbx]
lea rdx, str.no____s___table
mov rcx, rdi
call fcn.140001c12
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14001063d
mov ecx, dword [rax]
sub ecx, 1
mov rax, qword [rsp + 0x48]
mov dword [rax], ecx
jne 0x14001063d
mov rcx, qword [rsp + 0x48]
call fcn.1400019ec
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140037950
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140037950
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x20]
mov rdi, rcx
test ebx, ebx
js 0x1400379b3
add rcx, 8
call fcn.140002a13
xor r9d, r9d
mov r8, rax
cmp dword [rdi + 0x10], r9d
jle 0x1400379ac
nop dword [rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, ebx
inc r9d
sar ecx, 8
xor cl, dl
lea eax, [rbx + rdx]
mov byte [r8 - 1], cl
imul ecx, eax, 0x3193
mov ebx, 0x58bf
sub ebx, ecx
cmp r9d, dword [rdi + 0x10]
jl 0x140037980
mov dword [rdi + 0x20], 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140039940
Capabilities:
Read file on windows

Disassembly:
jmp 0x140039940
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x8c0
mov rax, qword [0x14008c588]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_tmpfile]
mov rdi, rax
test rax, rax
je 0x140039b47
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001f55
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 8]
call fcn.140002478
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
lea rdx, [rsp + 0x80]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.FontDirectory__
mov rcx, rsi
call fcn.1400027de
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rax]
mov r8d, dword [rdx - 4]
mov rcx, rsi
call fcn.1400027de
mov r8d, 8
lea rdx, str._known_n
mov rcx, rsi
call fcn.1400027de
mov r8d, 1
lea rdx, [0x14006c8b0]
mov rcx, rsi
call fcn.1400027de
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rax]
mov r8d, dword [rdx - 4]
mov rcx, rsi
call fcn.1400027de
mov r8d, 0x31
lea rdx, str._findfont_dup__UniqueID_known_dup__UniqueID_get
mov rcx, rsi
call fcn.1400027de
mov edx, dword [rbx + 0x10]
mov rcx, rsi
call fcn.14000240a
mov rbx, rax
mov r8d, 0x59
lea rdx, str._eq_exch__FontType_get_1_eq_andpop_falseifelse__nsave_userdict_fbufstr_512_string_put_n
mov rcx, rax
call fcn.1400027de
mov eax, dword [rsp + 0x94]
cdq
and edx, 0x1ff
add edx, eax
sar edx, 9
mov rcx, rbx
call fcn.14000240a
mov rbx, rax
mov r8d, 0x86
lea rdx, str.currentfile_fbufstr_readstringpopclear_currentfile_nclosefile_fontdownload_unexpectedEOF_.error_cvx_execifelserepeat_ncurrentfile
mov rcx, rax
call fcn.1400027de
mov edx, dword [rsp + 0x94]
and edx, 0x800001ff
jge 0x140039ab9
dec edx
or edx, 0xfffffe00
inc edx
mov rcx, rbx
call fcn.14000240a
mov r8d, 0x74
lea rdx, str._string_readstringpopclear_currentfile_nclosefile_fontdownload_unexpectedEOF_.error_cvx_execifelse_nrestoreifif_n
mov rcx, rax
call fcn.1400027de
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov r9, rdi
mov edx, 1
mov r8d, 0x800
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jle 0x140039b33
nop
mov r8d, eax
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.1400027de
mov r9, rdi
mov edx, 1
mov r8d, 0x800
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jg 0x140039b00
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
lea rcx, [rsp + 0x30]
call fcn.140001677
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.140001ef6
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140039c10
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140039c10
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
mov rbx, rdx
mov qword [rsp + 0x38], rsi
mov rsi, rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov r14d, dword [rcx + 0x30]
jl 0x140039c3e
add rcx, 0x20
call fcn.140002720
mov rdi, qword [rsi + 0x28]
lea rax, [0x14008e5ec]
mov qword [rsp + 0x30], rbp
cmp qword [rsi + 8], rax
jne 0x140039c9c
mov r8d, 4
lea rdx, str.dup
mov rcx, rbx
call fcn.1400027de
mov edx, dword [rsi + 0x10]
mov rcx, rbx
call fcn.14000240a
mov rbp, rax
cmp dword [rax + 0x10], 0x400
jl 0x140039c88
mov rcx, rax
call fcn.14000297d
movsxd rdx, dword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov byte [rdx + rcx], 0x20
mov rcx, rbp
inc dword [rbp + 0x10]
jmp 0x140039cef
cmp dword [rbx + 0x10], 0x400
jl 0x140039cad
mov rcx, rbx
call fcn.14000297d
movsxd rcx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rcx + rax], 0x2f
mov rcx, rbx
inc dword [rbx + 0x10]
mov rdx, qword [rsi + 8]
mov r8d, dword [rdx - 4]
call fcn.1400027de
cmp dword [rbx + 0x10], 0x400
jl 0x140039cdd
mov rcx, rbx
call fcn.14000297d
movsxd rcx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rcx + rax], 0x20
mov rcx, rbx
inc dword [rbx + 0x10]
mov edx, dword [rbx + 0x30]
add edx, r14d
call fcn.14000240a
mov rdx, qword [rbx + 0x28]
mov rcx, rax
mov r8d, dword [rdx - 4]
call fcn.1400027de
mov eax, dword [rbx + 0x30]
test eax, eax
jns 0x140039d24
mov r8d, r14d
mov rdx, rdi
mov rcx, rbx
call fcn.1400027de
jmp 0x140039dc4
add eax, r14d
movsxd rcx, eax
call fcn.140001d66
xor r9d, r9d
mov rbp, rax
mov r8, rax
mov edx, 0x10ea
cmp dword [rbx + 0x30], r9d
jle 0x140039d76
nop dword [rax]
nop word [rax + rax]
mov ecx, edx
inc r9d
shr ecx, 8
mov byte [r8], cl
inc r8
movzx eax, cl
add eax, edx
mov edx, 0x58bf
imul ecx, eax, 0x3193
sub edx, ecx
cmp r9d, dword [rbx + 0x30]
jl 0x140039d50
test r14d, r14d
jle 0x140039daa
sub r8, rdi
mov r9, r14
mov eax, edx
lea rdi, [rdi + 1]
shr eax, 8
xor al, byte [rdi - 1]
mov byte [r8 + rdi - 1], al
movzx eax, al
add eax, edx
mov edx, 0x58bf
imul ecx, eax, 0x3193
sub edx, ecx
sub r9, 1
jne 0x140039d81
mov r8d, dword [rbx + 0x30]
mov rdx, rbp
add r8d, r14d
mov rcx, rbx
call fcn.1400027de
mov rcx, rbp
call fcn.140001ee7
mov rdx, qword [rsi + 0x18]
mov rcx, rbx
mov r8d, dword [rdx - 4]
call fcn.1400027de
cmp dword [rbx + 0x10], 0x400
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
jl 0x140039df9
mov rcx, rbx
call fcn.14000297d
movsxd rcx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rcx + rax], 0xa
inc dword [rbx + 0x10]
add rsp, 0x20
pop rbx
ret
Function at 0x14003d680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14003d680
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rdx, dword [rcx + 0x14]
mov rbx, rcx
cmp edx, dword [rcx + 0x10]
jl 0x14003d6a4
call fcn.140002c8e
mov esi, eax
jmp 0x14003d6b2
mov rax, qword [rcx + 8]
movzx esi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rcx + 0x14], eax
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x14003d6ef
nop
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x14003d6d5
mov rcx, rbx
call fcn.140002c8e
mov esi, eax
jmp 0x14003d6e3
mov rax, qword [rbx + 8]
movzx esi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x14003d6c0
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x14003d704
mov rcx, rbx
call fcn.140002c8e
mov edi, eax
jmp 0x14003d712
mov rax, qword [rbx + 8]
movzx edi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x14003d74f
nop
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x14003d735
mov rcx, rbx
call fcn.140002c8e
mov edi, eax
jmp 0x14003d743
mov rax, qword [rbx + 8]
movzx edi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x14003d720
test edi, edi
jns 0x14003d768
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9d, dword [rbx + 0x34]
mov rdx, qword [0x14008c080]
movsxd rax, esi
mov rsi, qword [rsp + 0x38]
movzx ecx, byte [rax + rdx]
shl cl, 4
movzx r8d, cl
movsxd rax, edi
movzx ecx, byte [rax + rdx]
or r8d, ecx
lea eax, [r8 + r9]
sar r9d, 8
imul ecx, eax, 0x3193
mov eax, 0x58bf
sub eax, ecx
movzx eax, ax
mov dword [rbx + 0x34], eax
mov rbx, qword [rsp + 0x30]
movzx eax, r9b
xor eax, r8d
add rsp, 0x20
pop rdi
ret
Function at 0x14003d8c0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003d8c0
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000218a
cmp dword [rdi + 0x40], 0
je 0x14003d97c
mov rdx, qword [rdi + 0x48]
mov ecx, 0x80
mov qword [rsp + 0x30], rbx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
xor ecx, ecx
cmp byte [rdi + 0x50], cl
setne cl
inc ecx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov ebx, dword [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 8
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 0x10
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
sar ebx, 0x18
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
movsxd r8, dword [rdi + 0x40]
mov edx, 1
mov r9, qword [rdi + 0x48]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [rdi + 0x44], 0
mov rbx, qword [rsp + 0x30]
jge 0x14003d975
mov dword [rdi + 0x44], 0
mov qword [rdi + 0x38], 0
mov dword [rdi + 0x40], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14003dae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14003dae0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
jge 0x14003db13
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
test ebp, ebp
jg 0x14003db29
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov eax, dword [rcx + 0x28]
mov qword [rsp + 0x38], rdi
xor edi, edi
test eax, eax
js 0x14003db50
inc rsi
mov byte [rdx], al
mov edi, 1
mov dword [rcx + 0x28], 0xffffffff
cmp ebp, edi
jle 0x14003dbed
cmp byte [rbx + 0x30], 0
jne 0x14003db79
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x14003db69
mov rcx, rbx
call fcn.140002c8e
jmp 0x14003dbd8
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + rdx]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
jmp 0x14003dbda
cmp byte [rbx + 0x31], 0
je 0x14003dbd0
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x14003db94
mov rcx, rbx
call fcn.140002c8e
mov ecx, eax
jmp 0x14003dba2
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + rdx]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
test ecx, ecx
js 0x14003dbed
mov r8d, dword [rbx + 0x34]
movzx edx, cl
lea eax, [rdx + r8]
sar r8d, 8
imul ecx, eax, 0x3193
mov eax, 0x58bf
sub eax, ecx
movzx ecx, r8b
movzx eax, ax
xor ecx, edx
mov dword [rbx + 0x34], eax
jmp 0x14003dbda
mov rcx, rbx
call fcn.140001816
mov ecx, eax
test ecx, ecx
js 0x14003dbed
mov byte [rsi], cl
inc edi
inc rsi
cmp edi, ebp
jl 0x14003db50
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x14003dc50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14003dc50
push rbx
sub rsp, 0x20
movsxd r9, dword [rcx + 0x18]
mov rbx, rcx
test r9d, r9d
js 0x14003dc6e
cmp dword [rcx + 0x1c], 0
jge 0x14003dc6e
mov eax, dword [rcx + 0x10]
mov dword [rcx + 0x1c], eax
cmp r9d, dword [rcx + 0x1c]
jge 0x14003dcba
mov r10, r9
nop word [rax + rax]
mov edx, dword [rbx + 0x20]
lea r10, [r10 + 1]
mov r8, qword [rbx + 8]
inc r9d
sar edx, 8
xor dl, byte [r8 + r10 - 1]
movzx eax, dl
add eax, dword [rbx + 0x20]
imul ecx, eax, 0x3193
mov eax, 0x58bf
sub eax, ecx
movzx eax, ax
mov dword [rbx + 0x20], eax
mov byte [r8 + r10 - 1], dl
cmp r9d, dword [rbx + 0x1c]
jl 0x14003dc80
mov rax, qword [rbx]
mov rcx, rbx
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 8]
call qword [rax + 0x18]
movzx eax, byte [rbx + 0x14]
neg al
mov dword [rbx + 0x10], 0
mov dword [rbx + 0x1c], 0xffffffff
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rbx + 0x18], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14003dd20
Capabilities:
Read file on windows

Disassembly:
jmp 0x14003dd20
sub rsp, 0x28
mov r9, qword [rcx + 0x38]
mov rax, rdx
mov rcx, rax
movsxd r8, r8d
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
mov ecx, 0xffffffff
cmovne ecx, eax
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14003dd60
Capabilities:
Read file on windows

Disassembly:
jmp 0x14003dd60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x44]
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test eax, eax
jne 0x14003ddf9
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp eax, 0x80
jne 0x14003ddfb
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp eax, 3
je 0x14003ddfb
lea ecx, [rax - 1]
cmp ecx, 2
ja 0x14003ddfb
mov rcx, qword [rdi + 0x38]
cmp eax, 2
sete al
mov byte [rdi + 0x40], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [rdi + 0x38]
mov dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [rdi + 0x38]
shl eax, 8
or dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [rdi + 0x38]
shl eax, 0x10
or dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
shl eax, 0x18
or eax, dword [rdi + 0x44]
mov dword [rdi + 0x44], eax
je 0x14003dd84
test eax, eax
jns 0x14003de02
mov eax, 0xffffffff
jmp 0x14003de21
mov r9, qword [rdi + 0x38]
cmp esi, eax
mov edx, 1
mov rcx, rbp
cmovg esi, eax
sub eax, esi
movsxd r8, esi
mov dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003e190
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003e190
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x14], 0
mov rdi, rdx
movsxd rsi, r8d
mov rbx, rcx
je 0x14003e238
test r8d, r8d
je 0x14003e24d
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rsp + 0x38], r14
lea r14, str.0123456789ABCDEF
nop
movzx eax, byte [rdi]
mov rdx, qword [rbx + 0x38]
shr rax, 4
movsx ecx, byte [rax + r14]
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_putc]
movzx eax, byte [rdi]
mov rdx, qword [rbx + 0x38]
and eax, 0xf
movsx ecx, byte [rax + r14]
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_putc]
inc dword [rbx + 0x40]
cmp dword [rbx + 0x40], 0x27
jne 0x14003e216
mov rdx, qword [rbx + 0x38]
mov ecx, 0xa
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_putc]
mov dword [rbx + 0x40], ebp
inc rdi
sub esi, 1
jne 0x14003e1d0
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x38]
mov r8, rsi
mov rcx, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret