joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d836a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1261693b006f4f47
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3a6e27741e441261
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6547484a20032426
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9040d120e0e1004
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x130b0114080f0904
mov qword [rsp + 0x22], rdx
movabs rdx, 0x704030809130707
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4d830d
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x3d]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x3d]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x16
jge 0x4d833a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4d835d
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x4d82f0
jmp 0x4d8351
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00450f00
mov eax, edi
mov ecx, 0x16
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004d8280

Function at 0x4d8380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d847d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5f5453205131562d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x53275f5453205131
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6551163248643e07
mov qword [rsp + 0x26], rdx
movabs rdx, 0x60b1001020b020f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0907080a0d0e0e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7000f0907080a0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3020307060b0110
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d8420
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4d844d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4d8470
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x4d83ff
jmp 0x4d8464
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004d8380
Function at 0x4db160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db24c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9caeca011ed70407
mov qword [rsp + 0x19], rdx
movabs rdx, 0x649caeca011ed704
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf60aeb1320eaf161
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd07000b05030206
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd0d0a0101060d07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100a0f020e04070f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4db1ea
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4e]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x4db21c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4db23f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4e]
cmp rsi, 0x11
jb 0x4db1d0
jmp 0x4db233
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f00
mov eax, edi
mov ecx, 0x11
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004db160

Function at 0x4dc7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc88a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x8e76998c61729f53
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xacf07ad38c8e7699
mov qword [rsp + 0x20], rdx
movabs rdx, 0x65a4a9be2064b57a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x913090e0a0d1207
mov qword [rsp + 0x30], rdx
movabs rdx, 0x130b050e11071311
mov qword [rsp + 0x38], rdx
movabs rdx, 0x104080c0505130c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4dc82d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x4dc85a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4dc87d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4dc810
jmp 0x4dc871
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004dc7a0
Function at 0x4ddd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dddec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5c74534b8e886946
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6e6e5c74534b8e88
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x656669547c3c727b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20a0e100c0d0403
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x904030a020a0e10
mov qword [rsp + 0x30], rdx
movabs rdx, 0x109100c0e070a04
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4ddd8a
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1f]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4dddbc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4ddddf
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1f]
cmp rsi, 0x12
jb 0x4ddd70
jmp 0x4dddd3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004ddd00

Function at 0x4e6d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6e12
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc5e168bf0c65a0fc
mov qword [rsp + 0x19], rdx
movabs rdx, 0xbaefaf6fbcc461c5
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10a060d03070e09
mov qword [rsp + 0x28], rdx
movabs rdx, 0x604000d0000070c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4e6dac
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x10
jge 0x4e6dde
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4e6e05
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5d]
cmp rsi, 0xf
jb 0x4e6d92
jmp 0x4e6df5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00450f00
mov eax, edi
mov ecx, 0xf
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004e6d40
Function at 0x4e7020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e711d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xac9e6164414701f7
mov qword [rsp + 0x18], rdx
movabs rdx, 0x41f2728cac9e6164
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xaa1973d85954da01
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd070f0e08100f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100f130206010c0a
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe0e1207100f1302
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10f021212081213
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e70c0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4e70ed
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4e7110
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x14
jb 0x4e709f
jmp 0x4e7104
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00450f00
mov eax, edi
mov ecx, 0x14
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004e7020

Function at 0x4e8d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e8e32
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe1bf8c688696a19a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8f6544e1bf8c6886
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa00060a01020007
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5020001000a0703
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4e8dcc
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x4e8dfe
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4e8e25
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2d]
cmp rsi, 0xb
jb 0x4e8db2
jmp 0x4e8e15
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00450f00
mov eax, edi
mov ecx, 0xb
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004e8d60
Function at 0x4ef8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef992
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6268e26166e3e675
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6577626268e26166
mov qword [rsp + 0x22], rdx
movabs rdx, 0x202070707090209
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x505010903010202
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ef92c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x4ef95e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4ef985
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
cmp rsi, 0xb
jb 0x4ef912
jmp 0x4ef975
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00450f00
mov eax, edi
mov ecx, 0xb
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004ef8c0

Function at 0x4f71c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4f72ca
push rbp
mov rbp, rsp
sub rsp, 0x90
movzx edx, byte [rax + 0x4c]
mov byte [rax + 0x4c], cl
nop
movabs rsi, 0xa63844f24eeb5f65
mov qword [rsp + 0x57], rsi
movabs rsi, 0x72a63844f24eeb5f
mov qword [rsp + 0x58], rsi
movabs rsi, 0x947456bca4b527eb
mov qword [rsp + 0x60], rsi
movabs rsi, 0x910e71c67dd96e55
mov qword [rsp + 0x46], rsi
movabs rsi, 0x4a910e71c67dd96e
mov qword [rsp + 0x47], rsi
movabs rsi, 0xec1233d8c7d746d2
mov qword [rsp + 0x4f], rsi
xor ecx, ecx
nop
jmp 0x4f7256
movzx esi, byte [rsp + rcx + 0x57]
movzx edi, byte [rsp + rcx + 0x46]
xor edi, esi
mov byte [rsp + rcx + 0x46], dil
inc rcx
cmp rcx, 0x11
jl 0x4f7242
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x37], dl
mov qword [rsp + 0x38], rbx
lea rdx, [rax + 0x40]
mov qword [rsp + 0x88], rdx
lea rbx, [rsp + 0x46]
mov ecx, 0x11
lea rax, [rsp + 0x68]
call fcn.00440c20
mov ecx, 0x10
xor edi, edi
mov esi, 0x76
mov r8, rax
mov r9, rbx
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x38]
call fcn.004f4ba0
movzx edx, byte [rsp + 0x37]
mov rsi, qword [rsp + 0xa0]
mov byte [rsi + 0x4c], dl
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0044ec80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004f71c0
Function at 0x4fbf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc03b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc8696cc2e26ee3af
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x45e5bdd565da20c8
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5165ea6c4bcd2ecf
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc0016140b16140b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x30c0e16070c0f12
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x11041607030c0e16
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1090f0b030d0e0b
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4fbfd9
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4fc00b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fc02e
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6d]
cmp rsi, 0x17
jb 0x4fbfbf
jmp 0x4fc022
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.00440c20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00450f00
mov eax, edi
mov ecx, 0x17
call fcn.00450f00
nop
nop dword [rax + rax]
call fcn.0044ec80
jmp fcn.004fbf40

Function at 0x4fd080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd16c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xef36e7539a7a50c0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x95ef36e7539a7a50
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x78668b6463629539
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe00010305080a04
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2070e0001030508
mov qword [rsp + 0x30], rdx
movabs rdx, 0x802030a0703030a
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4fd10a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x4fd13c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4fd15f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6f]
cmp rsi, 0x11
jb 0x4fd0f0
jmp 0x4fd153
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f00
mov eax, edi
mov ecx, 0x11
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004fd080
Function at 0x4fd180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd26a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xd13635aa7c3231fb
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x14d13635aa7c3231
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x859b7d9df5f47d12
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa04090310070f0d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb0c030e0a040903
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80e0b0c10000008
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4fd20d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x35]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x35]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x4fd23a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4fd25d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x4fd1f0
jmp 0x4fd251
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f00
mov eax, edi
mov ecx, 0x11
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004fd180
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14003b420]
mov dword [rax], 1
mov rax, qword [0x14003b430]
mov dword [rax], 1
mov rax, qword [0x14003b440]
mov dword [rax], 1
mov rax, qword [0x14003b410]
mov dword [rax], 1
mov rax, qword [0x14003b2d0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400064c0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
mov r9, r13
call sym.fread
mov r12, rax
cmp rbx, rax
je 0x1400064f3
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x140006500
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x140006550
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, [0x1400383c0]
mov r14, rcx
mov r13, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
test rbx, rbx
jle 0x1400066c8
mov rcx, qword [0x14003b2b0]
lea rdi, [rsp + 0x30]
movabs r15, 0x7fffffffffffffff
movabs rbp, 0x8000000000000000
call sym.__emutls_get_address
mov rsi, rax
nop dword [rax]
mov rax, qword [rsp + 0x48]
mov r9, r13
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov r12, rax
cmp rax, 0xfa0
je 0x140006660
mov rcx, r13
call sym.ferror
test eax, eax
je 0x140006623
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
cmp byte [rsi], 0
je 0x140006710
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140006640
test byte [rcx + 7], 0x40
je 0x140006700
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, r14
movups xmmword [r14], xmm0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsi], 0
jne 0x14000662c
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rbx, rbx
jle 0x1400066c8
mov r8, rbx
add r8, 1
jo 0x1400066dd
test r8, r8
js 0x1400066e8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add rdx, 8
lea rcx, [rcx + rax + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x1400066dd
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x1400065e8
nop dword [rax]
xor ecx, ecx
lea rdx, [rbx - 1]
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x140006631
call sym.raiseOverflow
jmp 0x1400066b3
mov r8, r15
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x1400066b3
call sym.deallocShared
jmp 0x140006640
test r12, r12
js 0x140006788
lea rcx, [rsp + 0x40]
mov rdx, r12
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140006631
mov r8, rbx
add r8, 1
jo 0x1400067cb
test r8, r8
js 0x1400067a6
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea r9, [rdx + rax + 8]
lea rdx, [rcx + 8]
mov rcx, r9
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x1400067cb
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x48]
jmp 0x140006631
movabs r8, 0x7fffffffffffffff
mov rcx, r12
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140006631
movabs rcx, 0x8000000000000000
xor edx, edx
movabs r8, 0x7fffffffffffffff
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140006631
call sym.raiseOverflow
jmp 0x14000662c
Function at 0x1400067e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r14, rcx
mov r13, rdx
mov r12, r8
test r8, r8
js 0x1400068d0
lea rdi, [rsp + 0x20]
mov rdx, r8
mov rcx, rdi
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
test rdx, rdx
jle 0x140006920
mov rax, qword [rsp + 0x38]
mov r9, r13
mov r8, r12
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov r15, rax
cmp r12, rax
je 0x140006862
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x1400068f0
mov rcx, qword [0x14003b2b0]
call sym.__emutls_get_address
cmp byte [rax], 0
mov rbx, rax
jne 0x1400068ae
mov rcx, r13
call sym.fgetc
mov rdx, r13
mov ecx, eax
mov esi, eax
call sym.ungetc
cmp byte [rbx], 0
jne 0x1400068ae
test esi, esi
jns 0x140006930
cmp r12, r15
jle 0x1400068ae
test r15, r15
js 0x140006900
lea rcx, [rsp + 0x30]
mov rdx, r15
call sym.setLengthStrV2
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, r14
movups xmmword [r14], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r12
call sym.raiseRangeErrorI
jmp 0x1400068ae
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
jmp 0x140006862
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r15
call sym.raiseRangeErrorI
jmp 0x1400068ae
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
jmp 0x1400068ae
mov rdx, r13
mov rcx, rdi
call sym.readAllBuffer__stdZsyncio_u511
cmp byte [rbx], 0
mov rsi, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
jne 0x14000698f
lea rcx, [rsp + 0x30]
mov rdx, rsi
call sym.prepareAdd
test rsi, rsi
jle 0x14000698f
mov r8, rsi
add r8, 1
jo 0x1400069b1
test r8, r8
js 0x1400069c0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea rcx, [rdx + rax + 8]
lea rdx, [r12 + 8]
call sym.memcpy
add rsi, qword [rsp + 0x30]
jo 0x1400069b1
mov qword [rsp + 0x30], rsi
test r12, r12
je 0x1400068ae
test byte [r12 + 7], 0x40
jne 0x1400068ae
mov rcx, r12
call sym.deallocShared
jmp 0x1400068ae
call sym.raiseOverflow
jmp 0x14000698f
movabs r8, 0x7fffffffffffffff
xor edx, edx
movabs rcx, 0x8000000000000000
call sym.raiseRangeErrorI
jmp 0x14000698f

Function at 0x140006ec0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov r13, rdx
call sym.strlen
mov rcx, r13
mov r9, r12
mov edx, 1
mov r8, rax
call sym.fwrite
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush

Function at 0x14000de10
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r13, rcx
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov rcx, r13
mov r8, rbx
mov edx, 1
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.fflush