joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14025b950
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xc8
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov ebp, r9d
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.14025c010
xor eax, eax
mov dword [rsp + 0x28], 0x6a09e667
mov r8d, edi
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov dword [rsp + 0x2c], 0xbb67ae85
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], 0x3c6ef372
mov dword [rsp + 0x34], 0xa54ff53a
mov dword [rsp + 0x38], 0x510e527f
mov dword [rsp + 0x3c], 0x9b05688c
mov dword [rsp + 0x40], 0x1f83d9ab
mov dword [rsp + 0x44], 0x5be0cd19
call fcn.14025bc20
test rsi, rsi
je 0x14025b9ea
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.14025bc20
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.14025bd40
lea rdi, [rsp + 0x90]
mov esi, 0x20
lea rbx, [0x140463c90]
movzx r8d, byte [rdi]
lea rdx, str._02x
mov rcx, rbx
call fcn.140001010
add rbx, 2
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x14025ba10
mov byte [0x140463cd0], sil
lea rax, [0x140463c90]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140001200
add rsp, 0xc8
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14025ba70
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, rcx
mov dword [rsp + 0x20], r9d
xor ecx, ecx
mov r13d, edx
mov r12, r8
call fcn.14001763c
mov rcx, rax
call fcn.14001aca8
xor edi, edi
lea rsi, [0x140463ce0]
mov r15d, edi
xor ecx, ecx
call fcn.14001763c
mov rbx, rax
call fcn.14001ac7c
xor al, bl
mov byte [r15 + rsi], al
inc r15
cmp r15, 0x3e7
jl 0x14025bac2
mov ebx, 0x3e8
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x30], ebx
mov ebp, recv
mov dword [rsp + 0x38], 0x6a09e667
mov dword [rsp + 0x3c], 0xbb67ae85
mov dword [rsp + 0x40], 0x3c6ef372
mov dword [rsp + 0x44], 0xa54ff53a
mov dword [rsp + 0x48], 0x510e527f
mov dword [rsp + 0x4c], 0x9b05688c
mov dword [rsp + 0x50], 0x1f83d9ab
mov dword [rsp + 0x54], 0x5be0cd19
nop word [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140259230
add ebx, 0xffffffc0
add rsi, 0x40
sub rbp, 1
jne 0x14025bb40
test ebx, ebx
je 0x14025bb6e
mov r8d, ebx
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.140003740
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
call fcn.14025bd40
test r13d, r13d
jle 0x14025bbaf
mov rcx, rdi
mov rdx, r13
nop dword [rax + rax]
mov rax, rcx
lea r14, [r14 + 1]
and eax, 0x1f
inc rcx
movzx eax, byte [rsp + rax + 0xa0]
mov byte [r14 - 1], al
sub rdx, 1
jne 0x14025bb90
test r12, r12
je 0x14025bbec
movsxd rdx, dword [rsp + 0x20]
test rdx, rdx
jle 0x14025bbec
mov ecx, r13d
nop dword [rax]
nop word [rax + rax]
mov rax, rcx
inc ecx
and eax, 0x1f
movzx eax, byte [rsp + rax + 0xa0]
mov byte [rdi + r12], al
inc rdi
cmp rdi, rdx
jl 0x14025bbd0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14028bcf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movzx ebp, word [r8 + 4]
mov esi, r9d
mov r14, r8
mov rbx, rdx
test rcx, rcx
je 0x14028bd85
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x14028bd85
mov eax, dword [rcx + 0x40]
test al, 0x40
jne 0x14028bd85
bt eax, 0x10
jae 0x14028bd44
mov rax, qword [0x140464280]
cmp rcx, rax
jbe 0x14028bd44
sub rcx, 0x68
test dword [rcx + 0x40], 0x10000
jne 0x14028bd32
movsxd rax, dword [rcx]
test eax, eax
js 0x14028bd85
imul r8, rax, 0x88
mov rax, qword [0x140464308]
mov rcx, qword [rax + 0x288]
mov r9d, dword [r8 + rcx + 0x24]
add rcx, 0x50
add r8, rcx
and r9d, 1
xor ecx, ecx
call fcn.14028bcf0
test eax, eax
je 0x14028bd85
mov eax, 1
jmp 0x14028bead
test rbx, rbx
je 0x14028bdd1
cmp rbx, 0xffffffffffffffff
jne 0x14028bd9f
xor edi, edi
test esi, esi
sete dil
mov eax, edi
jmp 0x14028bead
movsx ecx, word [rbx]
mov edx, 0x4e20
movzx eax, cx
sub ax, dx
mov edx, 0xbb7
cmp ax, dx
ja 0x14028be16
mov edx, dword [r14]
mov r8d, 0x5208
mov eax, ecx
cmp cx, r8w
jge 0x14028bdd8
add eax, 0xffffb1e0
cmp eax, edx
je 0x14028be0a
xor eax, eax
jmp 0x14028bead
mov r8d, 0x55f0
cmp cx, r8w
jge 0x14028bdfd
add eax, 0xffffadf8
cmp eax, edx
jne 0x14028bdd1
test esi, esi
jne 0x14028bdd1
movzx ecx, word [rbx + 2]
add rbx, 2
xor edi, edi
jmp 0x14028be1b
add eax, 0xffffaa10
cmp eax, edx
jne 0x14028bdd1
test esi, esi
je 0x14028bdd1
movzx ecx, word [rbx + 2]
add rbx, 2
xor edi, edi
jmp 0x14028be1b
mov edi, 1
mov qword [rsp + 0x40], r15
test cx, cx
je 0x14028bea3
mov r8d, dword [0x1404642d4]
mov r15d, 0x59d8
cmp cx, bp
je 0x14028bea6
cmp cx, r15w
jl 0x14028be96
movsx rax, cx
lea rdx, [rax + rax*2]
mov rax, qword [0x140464308]
mov rcx, qword [rax + 0x2a0]
mov rdx, qword [rcx + rdx*8 - 0x86c30]
test rdx, rdx
je 0x14028be96
cmp r8d, 0x1e
jge 0x14028be96
inc r8d
mov r9d, esi
mov dword [0x1404642d4], r8d
xor ecx, ecx
mov r8, r14
call fcn.14028bcf0
mov r8d, dword [0x1404642d4]
dec r8d
mov dword [0x1404642d4], r8d
test eax, eax
jne 0x14028bea6
movzx ecx, word [rbx + 2]
add rbx, 2
test cx, cx
jne 0x14028be36
xor edi, 1
mov r15, qword [rsp + 0x40]
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140294430
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
cmp dword [0x1404642f4], 0
mov rbx, r9
mov ebp, r8d
mov dword [rsp + 0x50], 0
mov esi, edx
mov rdi, rcx
je 0x14029446b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [rdi], 0
je 0x14029453d
mov r8, qword [0x140464320]
mov r9d, esi
mov rdx, qword [0x1404642b0]
mov rcx, rdi
mov eax, dword [r8 + 0x17ec]
mov dword [rdi + 0xb0], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
call fcn.1402349b0
cmp dword [0x1404642f4], 0
mov ebp, eax
je 0x1402944e4
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x38]
sub rcx, qword [rsp + 0x30]
add qword [rbx], rcx
cmp dword [rbx + 8], ecx
mov qword [rsp + 0x30], rcx
jns 0x1402944da
mov qword [rbx + 8], rcx
inc dword [rbx + 0x10]
test ebp, ebp
jle 0x1402944e4
inc dword [rbx + 0x14]
cmp dword [rsp + 0x50], 0
je 0x14029452c
cmp dword [0x14045b66c], 0
je 0x14029452c
mov rax, qword [0x1404642b0]
mov rcx, qword [rax + 0x20]
cmp dword [rcx + 0x264], 0
jne 0x14029452c
mov dword [rcx + 0x264], 1
lea rcx, str.redrawtime_exceeded__syntax_highlighting_disabled
call qword [case.0x1400407ae.0]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140182fb0
test ebp, ebp
jle 0x14029453d
add dword [rdi + 8], esi
mov eax, 1
add dword [rdi + 0x58], esi
jmp 0x14029453f
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1402c5d10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [0x14045b42c], 1
mov edi, r9d
mov ebx, r8d
mov esi, edx
mov rbp, rcx
jne 0x1402c5d49
test ebx, ebx
je 0x1402c5dac
lea rcx, [0x1404624b8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp ebx, 0xffffffff
je 0x1402c5d53
cmp ebx, 0x64
jle 0x1402c5dac
mov edx, dword [0x140420a38]
test dl, 1
je 0x1402c5d8b
cmp dword [0x14045b480], 0
je 0x1402c5d7d
cmp dword [0x14045b83c], 0
mov edx, 2
mov eax, 0x40
cmovne edx, eax
jmp 0x1402c5d8b
cmp dword [0x14045b7a4], 0
je 0x1402c5d8b
mov edx, 4
mov rax, qword [0x14045b410]
mov ecx, dword [rax + 0x1f40]
or ecx, dword [0x14045b8d8]
test edx, ecx
je 0x1402c5dac
mov dword [0x140423780], 0
mov r9d, edi
mov r8d, ebx
mov edx, esi
mov rcx, rbp
call fcn.1401db090
cmp dword [0x14045b42c], 1
mov edi, eax
mov dword [0x140423780], 1
jne 0x1402c5dfc
test ebx, ebx
je 0x1402c5dfc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x20]
mov eax, edi
sub rcx, qword [0x1404624b8]
add qword [0x140462498], rcx
mov qword [0x1404624b8], rcx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1402c6040
Capabilities:
Manipulate console buffer
Set console window title

Disassembly:
cmp dword [0x14045b564], 0
je 0x1402c6052
cmp dword [0x14046a3b4], 0
je 0x1402c6057
jmp fcn.1401d58e0
ret
Function at 0x1402c95d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov r14, qword [rcx + 0x18]
mov r13, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, 1
test r14, r14
je 0x1402c96e7
mov qword [rsp + 0x30], r12
mov r12d, r13d
mov qword [rsp + 0x70], rdx
mov rcx, rdx
test r13d, r13d
jle 0x1402c96ce
xor r15d, r15d
mov qword [rsp + 0x80], rsi
mov rax, qword [rbx + 0x28]
lea rdi, [0x140433880]
cmp qword [rbx + 0x20], rax
jb 0x1402c967b
mov r9, qword [rbx + 8]
mov r8d, 0x2000
mov rdx, rbp
mov rcx, r14
call fcn.14000bd5c
test rax, rax
je 0x1402c96be
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov r9, rdx
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], r15
movsxd r8, dword [rcx]
imul r10, r8, 0x68
mov r8, rax
mov dword [rsp + 0x20], r15d
call qword [r10 + rdi]
mov rcx, qword [rsp + 0x70]
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
mov rsi, qword [rbx + 0x28]
mov eax, r12d
sub rsi, rdi
cmp rax, rsi
lea rdx, [rdi + r14]
cmovbe rsi, rax
mov r8, rsi
call fcn.140003740
mov rcx, qword [rsp + 0x70]
lea rax, [rdi + rsi]
add rcx, rsi
mov qword [rbx + 0x20], rax
sub r12d, esi
mov qword [rsp + 0x70], rcx
test r12d, r12d
jle 0x1402c96c1
jmp 0x1402c9621
mov ebp, r15d
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x30]
test ebp, ebp
je 0x1402c9704
mov eax, ebp
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret
mov r9, qword [rcx + 8]
mov r8, rbp
mov rcx, rdi
mov rdx, r13
call fcn.14000bd5c
cmp rax, rbp
je 0x1402c9711
xor r15d, r15d
mov ebp, r15d
mov r8, r13
xor edx, edx
mov rcx, rdi
call fcn.140002810
mov eax, ebp
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret

Function at 0x1402ca780
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x28], 0x6a09e667
mov qword [rsp + 0x20], rax
mov ebx, 1
mov rax, qword [0x14045b410]
mov rdi, rcx
mov dword [rsp + 0x2c], 0xbb67ae85
mov dword [rsp + 0x30], 0x3c6ef372
mov dword [rsp + 0x34], 0xa54ff53a
mov dword [rsp + 0x38], 0x510e527f
mov dword [rsp + 0x3c], 0x9b05688c
mov dword [rsp + 0x40], 0x1f83d9ab
mov dword [rsp + 0x44], 0x5be0cd19
cmp dword [rax], ebx
jl 0x1402ca83b
nop dword [rax]
xor r8d, r8d
mov edx, ebx
mov rcx, rax
call fcn.140179dc0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1402ca814
inc r8d
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.14025bc20
mov rax, qword [0x14045b410]
inc ebx
cmp ebx, dword [rax]
jle 0x1402ca800
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14025bd40
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140001200
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x1402cd190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14045b88c], 0
mov edi, edx
mov esi, ecx
je 0x1402cd1b7
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp esi, edi
jge 0x1402cd25d
mov rcx, qword [0x14045b410]
mov edx, dword [rcx]
lea eax, [rdx + 1]
cmp edi, eax
jg 0x1402cd25d
lea eax, [rsi + 2]
cmp eax, edi
jne 0x1402cd244
mov qword [rsp + 0x30], rbx
lea ebx, [rsi + 1]
cmp ebx, dword [rcx + 0x1028]
je 0x1402cd23f
cmp ebx, 1
jl 0x1402cd23f
cmp ebx, edx
jg 0x1402cd23f
call fcn.1402cd2b0
mov rcx, qword [0x14045b410]
mov rax, qword [0x14046a618]
mov dword [rcx + 0x1028], ebx
cmp dword [rax + 0x38], ebx
jne 0x1402cd21c
mov eax, dword [rax + 0x3c]
mov dword [rcx + 0x102c], eax
jmp 0x1402cd226
mov dword [rcx + 0x102c], 0
add rcx, 0x1018
mov edx, ebx
call fcn.1402ca2d0
test eax, eax
jne 0x1402cd23f
xor ecx, ecx
call fcn.140032ad0
mov rbx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov ecx, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1402cc290
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14032d4a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
mov edx, dword [0x14045b40c]
test edx, edx
jne 0x14032d597
xor eax, eax
cmp dword [0x14045b4d8], eax
setne al
test eax, eax
jne 0x14032d597
mov r10, qword [0x14046a608]
cmp qword [r10], 0
jne 0x14032d4fc
cmp ecx, 1
jle 0x14032d5d8
cmp dword [0x14045b404], eax
jne 0x14032d5d8
xor ecx, ecx
call fcn.140122f90
mov ecx, 0x40
add rsp, 0x28
jmp fcn.14018aca0
test ecx, ecx
jne 0x14032d525
mov rax, qword [0x14046a5f0]
mov r9, qword [rax]
test r9, r9
cmove r9, r10
mov edx, 1
mov rcx, r9
mov r8d, edx
add rsp, 0x28
jmp fcn.140331380
jns 0x14032d55e
mov rdx, qword [0x14046a5f0]
neg ecx
mov r8d, ecx
mov rax, qword [r10]
mov r9, r10
cmp rax, rdx
je 0x14032d553
nop
test rax, rax
je 0x14032d553
mov rcx, qword [rax]
mov r9, rax
mov rax, rcx
cmp rcx, rdx
jne 0x14032d540
mov rdx, r9
sub r8, 1
jne 0x14032d533
jmp 0x14032d511
cmp ecx, 0x270f
jne 0x14032d581
mov rcx, qword [r10]
mov r9, r10
test rcx, rcx
je 0x14032d511
mov rax, qword [rcx]
mov r9, rcx
mov rcx, rax
test rax, rax
jne 0x14032d571
jmp 0x14032d511
call fcn.14032d460
mov r9, rax
test rax, rax
jne 0x14032d511
add rsp, 0x28
jmp fcn.14018aac0
test edx, edx
mov qword [rsp + 0x20], rbx
lea rax, str.E565:_Not_allowed_to_change_text_or_change_window
lea rcx, str.E11:_Invalid_in_command_line_window__:q_CR__closes_the_window
cmove rcx, rax
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x14032d5d3
mov rcx, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.140182400
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140330710
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x14046a618]
mov rdi, rcx
cmp dword [rbx + 0x160], 0
je 0x140330736
lea rcx, str.E994:_Not_allowed_in_a_popup_window
jmp 0x140330746
cmp dword [rcx + 0x160], 0
je 0x14033076e
lea rcx, str.E366:_Not_allowed_to_enter_a_popup_window
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x14033090c
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140182400
call fcn.1400fffc0
test eax, eax
je 0x14033079f
cmp dword [0x14045b404], 0
jne 0x14033090c
xor ecx, ecx
call fcn.140122f90
mov ecx, 0x40
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14018aca0
mov rax, qword [0x14045b410]
mov qword [rsp + 0x30], rsi
xor esi, esi
cmp qword [rdi + 8], rax
je 0x1403307e1
cmp dword [0x14045b480], esi
je 0x1403307d9
call fcn.1401a8940
mov rcx, qword [0x14045b410]
lea edx, [rsi + 0x14]
mov dword [reloc.WSOCK32.dll_closesocket], 3
call fcn.140089e80
mov dword [0x14046a2c0], esi
jmp 0x140330800
cmp dword [0x14045b480], esi
je 0x140330800
mov rax, qword [0x14046a618]
movsd xmm0, qword [rax + 0x38]
movsd qword [rdi + 0x38], xmm0
mov eax, dword [rax + 0x40]
mov dword [rdi + 0x40], eax
mov edx, 0x19
mov rcx, rdi
call fcn.1403252b0
mov edx, dword [0x14046a300]
test rbx, rbx
je 0x1403308e9
mov rax, qword [0x14046a5e8]
test rax, rax
je 0x140330836
cmp rax, rbx
je 0x140330879
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140330828
mov rax, qword [0x140469978]
test rax, rax
je 0x140330850
cmp rax, rbx
je 0x140330870
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140330842
mov rax, qword [0x14046a5f0]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140330875
cmp rcx, rbx
je 0x140330870
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x140330860
jmp 0x140330875
mov esi, 1
test esi, esi
je 0x1403308e9
cmp dword [rbx + 0x4c0], 0
jle 0x1403308e9
test edx, edx
jne 0x1403308e9
mov ecx, dword [rbx + 0x344]
mov eax, dword [rbx + 0x38]
test ecx, ecx
je 0x140330897
cmp ecx, eax
jle 0x14033089d
mov dword [rbx + 0x344], eax
mov ecx, dword [rbx + 0x348]
test ecx, ecx
je 0x1403308ab
cmp ecx, eax
jge 0x1403308b1
mov dword [rbx + 0x348], eax
cmp dword [0x14045b548], 0
jne 0x1403308e9
cmp dword [0x14045b4f4], 0
jne 0x1403308e9
cmp dword [rbx + 0x33c], 0xa
jge 0x1403308e9
cmp dword [0x14045b4d4], 0xa
mov dword [rbx + 0x33c], 0xa
jge 0x1403308e9
mov dword [0x14045b4d4], 0xa
mov rax, qword [0x14046a618]
mov rsi, qword [rsp + 0x30]
cmp dword [rax + 0x4c0], 0
jle 0x14033090c
test edx, edx
jne 0x14033090c
mov dword [0x14045b6c8], 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1403314c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14046a618]
mov ebx, edx
mov edi, ecx
cmp dword [rax + 0x160], 0
je 0x14033150c
lea rcx, str.E994:_Not_allowed_in_a_popup_window
call qword [case.0x1400407ae.0]
mov rbx, rax
call fcn.140182a30
test eax, eax
jne 0x1403314ff
mov rcx, rbx
call fcn.140182400
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.140329330
test eax, eax
je 0x1403314ff
mov ecx, dword [0x14046a508]
test ecx, ecx
cmove ecx, dword [0x14045b820]
test ecx, ecx
je 0x14033154b
xor eax, eax
mov dword [0x14046a508], eax
mov dword [0x14045b820], eax
call fcn.14032bf80
cmp eax, 1
jne 0x14033154b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
or ebx, dword [0x14046a504]
mov eax, ebx
and eax, 0x18
cmp al, 0x18
jne 0x140331563
lea rcx, str.E442:_Cant_split_topleft_and_botright_at_the_same_time
jmp 0x1403314e5
test bl, 0x20
je 0x140331588
xor ecx, ecx
call fcn.140330520
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov ecx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14032e820
mov rcx, qword [0x14046a5f0]
xor edx, edx
call fcn.140322de0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov ecx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14032e820

Function at 0x1403356a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14041f010]
xor rax, rsp
mov qword [rsp + 0x20], rax
movzx eax, byte [rsp + 0x1e]
test edx, edx
mov r11, rcx
mov byte [rsp + 0x1f], 0
mov r8, rcx
mov r9d, edx
mov ecx, 0x2d
cmovs eax, ecx
lea rcx, [rsp + 0x1f]
mov byte [rsp + 0x1e], al
mov eax, edx
cdq
mov r10d, eax
lea rax, [rsp + 0x1e]
xor r10d, edx
test r9d, r9d
cmovs rcx, rax
sub r10d, edx
je 0x140335737
lea r9, str.0123456789
nop word [rax + rax]
lea rax, [rsp]
cmp rcx, rax
jbe 0x140335737
mov eax, 0x66666667
dec rcx
imul r10d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r10d, eax
movsxd rax, r10d
mov r10d, edx
movzx eax, byte [rax + r9]
mov byte [rcx], al
test edx, edx
jne 0x140335700
movzx eax, byte [rcx]
test al, al
je 0x140335752
sub rcx, r11
mov byte [r8], al
inc r8
movzx eax, byte [rcx + r8]
test al, al
jne 0x140335741
jmp 0x14033575a
mov byte [r11], 0x30
lea r8, [r11 + 1]
mov byte [r8], 0
sub r8d, r11d
mov eax, r8d
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140001200
add rsp, 0x38
ret
Function at 0x140335cb0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx]
mov r12d, r8d
mov r15d, r8d
mov r14, rdx
mov r13, rcx
mov esi, 0x1505
and r12d, 0x1e
je 0x140335dd6
cmp rdi, rdx
jae 0x140335d29
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
nop
movzx eax, byte [rdi]
cmp al, 0xa
je 0x140335d1f
cmp r12d, 0x10
jne 0x140335d3d
cmp al, 0xd
jne 0x140335d0f
lea rax, [rdi + 1]
cmp rax, r14
jae 0x140335d0f
cmp byte [rax], 0xa
je 0x140335d17
movsx eax, byte [rdi]
imul esi, esi, 0x21
xor esi, eax
inc rdi
cmp rdi, r14
jb 0x140335cf0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
cmp rdi, r14
lea rcx, [rdi + 1]
cmovae rcx, rdi
mov qword [r13], rcx
jmp 0x140335e02
mov ecx, eax
call fcn.140012a60
test eax, eax
je 0x140335d0f
lea rbx, [rdi + 1]
mov rbp, rdi
cmp rbx, r14
jae 0x140335d70
movzx ecx, byte [rbx]
call fcn.140012a60
test eax, eax
je 0x140335d70
cmp byte [rbx], 0xa
je 0x140335d70
inc rdi
inc rbx
cmp rbx, r14
jb 0x140335d54
lea rcx, [rdi + 1]
cmp r14, rcx
jbe 0x140335d82
cmp byte [rcx], 0xa
je 0x140335d82
xor eax, eax
jmp 0x140335d87
mov eax, 1
test r15b, 2
jne 0x140335d17
test r15b, 4
je 0x140335da2
test eax, eax
jne 0x140335da2
imul esi, esi, 0x21
xor esi, 0x20
jmp 0x140335d17
test r15b, 8
je 0x140335d17
test eax, eax
jne 0x140335d17
cmp rbp, rcx
je 0x140335d17
nop dword [rax]
movsx eax, byte [rbp]
inc rbp
imul esi, esi, 0x21
xor esi, eax
cmp rbp, rcx
jne 0x140335dc0
jmp 0x140335d17
cmp rdi, r14
jae 0x140335df4
nop dword [rax + rax]
movsx eax, byte [rdi]
cmp al, 0xa
je 0x140335df4
imul esi, esi, 0x21
inc rdi
xor esi, eax
cmp rdi, r14
jb 0x140335de0
cmp rdi, r14
lea rax, [rdi + 1]
cmovae rax, rdi
mov qword [rcx], rax
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140377b60
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x40], rbx
mov ebx, edx
mov qword [rsp + 0x30], rdi
mov rdi, rcx
mov qword [rsp + 0x20], r15
mov dword [rcx + 0x24], edx
call fcn.14018a010
xor r15d, r15d
test ebx, ebx
jne 0x140377cda
cmp dword [rdi + 0x150], r15d
je 0x140377cda
lea rdx, str.Moving_postponed_scrollback_to_scrollback
mov qword [rsp + 0x48], rbp
xor ecx, ecx
call fcn.1401522a0
mov rcx, rdi
call fcn.140378680
mov ebp, r15d
cmp dword [rdi + 0x150], r15d
jle 0x140377c98
mov qword [rsp + 0x28], r14
lea rbx, [rdi + 0x130]
mov r14d, r15d
mov qword [rsp + 0x50], rsi
nop word [rax + rax]
mov eax, dword [rbx + 4]
sub eax, dword [rbx]
cmp eax, 1
jge 0x140377bff
mov edx, 1
mov rcx, rbx
call fcn.1400326e0
test eax, eax
je 0x140377c8e
mov rsi, qword [rdi + 0x160]
lea rdx, [0x1403b051f]
add rsi, r14
mov r8, 0xffffffffffffffff
mov rax, qword [rsi + 0x20]
test rax, rax
cmovne rdx, rax
inc r8
cmp byte [rdx + r8], r15b
jne 0x140377c22
mov rcx, rdi
call fcn.1403788d0
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140377c4a
cmp dword [0x14045b3f8], r15d
jne 0x140377c4a
call fcn.140005660
movsxd rax, dword [rbx]
inc ebp
add r14, 0x28
lea rcx, [rax + rax*4]
mov rax, qword [rdi + 0x140]
lea rdx, [rax + rcx*8]
mov eax, dword [rsi]
mov dword [rdx], eax
mov rax, qword [rsi + 8]
mov qword [rdx + 8], rax
movups xmm0, xmmword [rsi + 0x10]
mov qword [rdx + 0x20], r15
movups xmmword [rdx + 0x10], xmm0
inc dword [rdi + 0x148]
inc dword [rbx]
cmp ebp, dword [rdi + 0x150]
jl 0x140377be0
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rdi + 0x160]
mov rbp, qword [rsp + 0x48]
test rcx, rcx
je 0x140377cb7
cmp dword [0x14045b3f8], r15d
jne 0x140377cb7
call fcn.140005660
lea rdx, [rdi + 0x130]
mov qword [rdi + 0x160], r15
mov r8d, 1
mov qword [rdi + 0x150], r15
mov rcx, rdi
call fcn.1403761e0
mov rcx, qword [rdi + 0x108]
mov rbx, qword [rsp + 0x40]
test rcx, rcx
je 0x140377d00
cmp dword [0x14045b3f8], r15d
jne 0x140377cf9
call fcn.140005660
mov qword [rdi + 0x108], r15
mov rax, qword [0x14045b410]
cmp qword [rdi + 0x18], rax
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x20]
jne 0x140377d20
add rsp, 0x38
jmp fcn.14004c9d0
add rsp, 0x38
ret