joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026800
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
call fcn.140025960
lea r8, [0x1402b28c4]
mov qword [rsp + 0x50], 0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14027b890
test eax, eax
jne 0x14002694c
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14002694c
mov rcx, rbx
mov qword [rsp + 0x40], r14
call fcn.140025960
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140278ef0
mov rcx, rdi
call fcn.1402786d8
cmp eax, 0xffffffff
jne 0x140026884
mov rcx, rdi
call fcn.14027b8e8
test eax, eax
jne 0x140026919
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.140278ef0
mov rcx, rdi
call fcn.14027be64
xor r8d, r8d
movsxd rsi, eax
xor edx, edx
mov rcx, rdi
call fcn.140278ef0
cmp esi, 0xffffffff
je 0x140026919
cmp esi, 0xffffffff
jae 0x140026919
test esi, esi
jne 0x1400268bd
lea edx, [rsi + 0xf]
jmp 0x14002691e
lea eax, [rsi + 1]
movsxd rcx, eax
call fcn.140252074
mov r9, rdi
mov qword [rbx + 0x98], rax
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.140278be0
cmp eax, esi
jne 0x140026919
mov rax, qword [rbx + 0x98]
mov rcx, rbx
mov byte [rsi + rax], 0
call fcn.140026c40
mov rcx, rdi
call fcn.1402782dc
mov eax, dword [rbx + 0x6c]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov edx, 5
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.140028430
mov rcx, rdi
call fcn.1402782dc
mov eax, dword [rbx + 0x6c]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rsi, rsi
lea rax, [0x1402b28c8]
lea r9, str.filename_s
mov rcx, rbx
cmovne rax, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r8 + 3]
call fcn.140028430
mov eax, dword [rbx + 0x6c]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140026aa0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 8], 0
mov rsi, rdx
mov qword [rsp + 0x40], rbp
mov rbx, rcx
mov qword [rsp + 0x48], r14
movzx ebp, r8b
je 0x140026af2
mov rdx, qword [rcx + 0x78]
mov byte [rcx + 8], 0
test rdx, rdx
je 0x140026adb
mov ecx, 0x3e
call fcn.14027882c
jmp 0x140026af2
add rcx, 0x110
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0x3e
mov eax, dword [rbx + 0x6c]
mov rdi, 0xffffffffffffffff
lea ecx, [rax + 1]
cmp ecx, dword [rbx + 0x68]
jle 0x140026b5f
mov qword [rsp + 0x50], r15
mov eax, 8
lea r15d, [rcx + rcx]
movsxd rcx, r15d
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140252074
movsxd r8, dword [rbx + 0x6c]
mov rcx, rax
mov rdx, qword [rbx + 0x10]
mov r14, rax
shl r8, 3
call fcn.14026fce0
mov rcx, qword [rbx + 0x10]
lea rdx, [rbx + 0x18]
cmp rcx, rdx
je 0x140026b4d
call fcn.1402518d0
mov eax, dword [rbx + 0x6c]
mov dword [rbx + 0x68], r15d
mov r15, qword [rsp + 0x50]
mov qword [rbx + 0x10], r14
jmp 0x140026b63
mov r14, qword [rbx + 0x10]
cdqe
mov qword [r14 + rax*8], rsi
inc dword [rbx + 0x6c]
cmp dword [rbx + 0x84], 0
mov r14, qword [rsp + 0x48]
jge 0x140026bb3
cmp byte [rbx + 0x70], 0
jne 0x140026bb3
test bpl, bpl
jne 0x140026bc7
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x140026b9a
mov ecx, 0xa
call fcn.14027882c
jmp 0x140026bb8
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0xa
jmp 0x140026bb8
test bpl, bpl
jne 0x140026bc7
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x80]
call qword [rax + 0x58]
mov r9, qword [rbx + 0x78]
mov rbp, qword [rsp + 0x40]
test r9, r9
je 0x140026beb
mov edx, 1
lea rcx, [0x1402b2858]
mov r8d, edx
call fcn.140279148
jmp 0x140026c10
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
movzx ecx, byte [0x1402b2858]
mov byte [rax - 1], cl
mov byte [rax], 0
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140026c10
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140029310
inc dword [rbx + 0x80]
mov byte [rbx + 8], 1
mov byte [rbx + 0x70], 0
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140027a00
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jle 0x140027a6d
push rdi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov rdi, rcx
mov ebx, edx
mov r9, qword [rdi + 0x78]
test r9, r9
je 0x140027a33
mov edx, 1
lea rcx, [0x1402b290c]
lea r8d, [rdx + 2]
call fcn.140279148
jmp 0x140027a5d
lea rcx, [rdi + 0x110]
mov edx, 3
call fcn.140027d10
movzx ecx, word [0x1402b290c]
mov word [rax - 1], cx
movzx ecx, byte [0x1402b290e]
mov byte [rax + 1], cl
mov byte [rax + 2], 0
sub rbx, 1
jne 0x140027a13
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140027a70
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x88]
mov r14, rdx
test cl, cl
je 0x140027c0d
mov qword [rsp + 0x60], r15
movzx r15d, r8b
shl r15, 6
add r15, rbp
cmp byte [rdx], 0
je 0x140027bff
mov qword [rsp + 0x50], r12
lea rsi, str.quot
mov qword [rsp + 0x58], r13
lea r12, str.apos
lea r13, [0x1402b1eac]
nop dword [rax + rax]
movzx ecx, byte [r14]
lea eax, [rcx - 1]
cmp al, 0x3e
ja 0x140027be1
movzx eax, cl
cmp byte [rax + r15 + 0x8a], 0
je 0x140027be1
cmp rbx, r14
jae 0x140027b55
nop word [rax + rax]
mov r9, qword [rbp + 0x78]
mov edx, r14d
sub edx, ebx
movsxd rsi, edx
test r9, r9
je 0x140027b23
mov r8, rsi
mov edx, 1
mov rcx, rbx
call fcn.140279148
jmp 0x140027b46
lea rcx, [rbp + 0x110]
call fcn.140027d10
mov r8, rsi
mov rdx, rbx
mov rdi, rax
lea rcx, [rax - 1]
call fcn.14026fce0
mov byte [rsi + rdi - 1], 0
add rbx, rsi
cmp rbx, r14
jb 0x140027b00
lea rsi, str.quot
movzx ecx, byte [r14]
xor edi, edi
mov rax, r13
nop
cmp byte [rax], cl
je 0x140027b72
inc rdi
add rax, 0x10
cmp rax, r12
jl 0x140027b60
jmp 0x140027bde
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x140027b87
mov ecx, 0x26
call fcn.14027882c
jmp 0x140027b9e
lea rcx, [rbp + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0x26
add rdi, rdi
mov rcx, rbp
mov r8d, dword [rsi + rdi*8 + 8]
mov rdx, qword [rsi + rdi*8]
call fcn.140029310
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x140027bc7
mov ecx, 0x3b
call fcn.14027882c
jmp 0x140027bde
lea rcx, [rbp + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0x3b
inc rbx
inc r14
cmp byte [r14], 0
jne 0x140027ad0
movzx ecx, byte [rbp + 0x88]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov r15, qword [rsp + 0x60]
test cl, cl
je 0x140027c0d
cmp rbx, r14
jae 0x140027c5c
mov r9, qword [rbp + 0x78]
sub r14d, ebx
movsxd rsi, r14d
test r9, r9
je 0x140027c36
mov r8, rsi
mov edx, 1
mov rcx, rbx
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140279148
lea rcx, [rbp + 0x110]
mov edx, r14d
call fcn.140027d10
mov r8, rsi
mov rdx, rbx
mov rdi, rax
lea rcx, [rax - 1]
call fcn.14026fce0
mov byte [rsi + rdi - 1], 0
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140027da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, r8
mov rdx, qword [rcx + 0x78]
mov rbx, rcx
test rdx, rdx
je 0x140027dcd
mov ecx, 0x20
call fcn.14027882c
jmp 0x140027de4
add rcx, 0x110
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0x20
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140027df0
mov rdx, rdi
mov rcx, rbx
call fcn.140029310
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x140027e25
mov edx, 1
lea rcx, [0x1402b2914]
lea r8d, [rdx + 1]
call fcn.140279148
jmp 0x140027e45
lea rcx, [rbx + 0x110]
mov edx, 2
call fcn.140027d10
movzx ecx, word [0x1402b2914]
mov word [rax - 1], cx
mov byte [rax + 1], 0
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.140027a70
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x140027e75
mov ecx, 0x22
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14027882c
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov word [rax - 1], 0x22
add rsp, 0x20
pop rdi
ret

Function at 0x140027f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 8], 0
mov rdi, rdx
mov rbx, rcx
je 0x140027fc6
mov rdx, qword [rcx + 0x78]
mov byte [rcx + 8], 0
test rdx, rdx
je 0x140027faf
mov ecx, 0x3e
call fcn.14027882c
jmp 0x140027fc6
add rcx, 0x110
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0x3e
cmp dword [rbx + 0x84], 0
jge 0x140028019
cmp byte [rbx + 0x70], 0
jne 0x140028019
cmp byte [rbx + 0x89], 0
jne 0x140028019
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x140027ff3
mov ecx, 0xa
call fcn.14027882c
jmp 0x14002800a
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0xa
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x80]
call qword [rax + 0x58]
mov r9, qword [rbx + 0x78]
mov byte [rbx + 0x70], 0
test r9, r9
je 0x14002803d
mov edx, 1
lea rcx, [0x1402b2840]
lea r8d, [rdx + 3]
call fcn.140279148
jmp 0x14002805b
lea rcx, [rbx + 0x110]
mov edx, 4
call fcn.140027d10
mov ecx, dword [0x1402b2840]
mov dword [rax - 1], ecx
mov byte [rax + 3], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x140028062
mov rdx, rdi
mov rcx, rbx
call fcn.140029310
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x14002809f
mov edx, 1
lea rcx, [0x1402b2890]
lea r8d, [rdx + 2]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140279148
lea rcx, [rbx + 0x110]
mov edx, 3
call fcn.140027d10
movzx ecx, word [0x1402b2890]
mov rbx, qword [rsp + 0x30]
mov word [rax - 1], cx
movzx ecx, byte [0x1402b2892]
mov byte [rax + 1], cl
mov byte [rax + 2], 0
add rsp, 0x20
pop rdi
ret
Function at 0x1400280e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 8], 0
mov rdi, rdx
mov rbx, rcx
je 0x140028126
mov rdx, qword [rcx + 0x78]
mov byte [rcx + 8], 0
test rdx, rdx
je 0x14002810f
mov ecx, 0x3e
call fcn.14027882c
jmp 0x140028126
add rcx, 0x110
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0x3e
cmp dword [rbx + 0x84], 0
jge 0x140028179
cmp byte [rbx + 0x70], 0
jne 0x140028179
cmp byte [rbx + 0x89], 0
jne 0x140028179
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x140028153
mov ecx, 0xa
call fcn.14027882c
jmp 0x14002816a
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0xa
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x80]
call qword [rax + 0x58]
mov r9, qword [rbx + 0x78]
mov byte [rbx + 0x70], 0
test r9, r9
je 0x14002819d
mov edx, 1
lea rcx, [0x1402b283c]
lea r8d, [rdx + 1]
call fcn.140279148
jmp 0x1400281bd
lea rcx, [rbx + 0x110]
mov edx, 2
call fcn.140027d10
movzx ecx, word [0x1402b283c]
mov word [rax - 1], cx
mov byte [rax + 1], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x1400281c4
mov rdx, rdi
mov rcx, rbx
call fcn.140029310
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x140028201
mov edx, 1
lea rcx, [0x1402b2894]
lea r8d, [rdx + 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140279148
lea rcx, [rbx + 0x110]
mov edx, 2
call fcn.140027d10
movzx ecx, word [0x1402b2894]
mov rbx, qword [rsp + 0x30]
mov word [rax - 1], cx
mov byte [rax + 1], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140028230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
movzx esi, r8b
dec eax
mov rdi, rdx
cmp byte [rcx + 8], 0
mov rbx, rcx
mov dword [rcx + 0x84], eax
je 0x14002828d
mov rdx, qword [rcx + 0x78]
mov byte [rcx + 8], 0
test rdx, rdx
je 0x140028276
mov ecx, 0x3e
call fcn.14027882c
jmp 0x14002828d
add rcx, 0x110
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0x3e
test sil, sil
je 0x14002836c
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x1400282b6
mov edx, 1
lea rcx, str.___CDATA_
lea r8d, [rdx + 8]
call fcn.140279148
jmp 0x1400282e2
lea rcx, [rbx + 0x110]
mov edx, 9
call fcn.140027d10
movsd xmm0, qword [str.___CDATA_]
movsd qword [rax - 1], xmm0
movzx ecx, byte [0x1402b2850]
mov byte [rax + 7], cl
mov byte [rax + 8], 0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1400282f0
mov rdx, rdi
mov rcx, rbx
call fcn.140029310
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x140028332
mov edx, 1
lea rcx, [0x1402b288c]
lea r8d, [rdx + 2]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140279148
lea rcx, [rbx + 0x110]
mov edx, 3
call fcn.140027d10
movzx ecx, word [0x1402b288c]
mov word [rax - 1], cx
movzx ecx, byte [0x1402b288e]
mov byte [rax + 1], cl
mov byte [rax + 2], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8b, 1
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140027a70
Function at 0x140028dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rdx]
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call qword [rax + 0x30]
test rax, rax
je 0x140028de2
xor edi, edi
jmp 0x140028dee
lea rcx, [rdi + 0x18]
call fcn.140026170
mov rdi, rax
cmp byte [rbx + 8], 0
je 0x140028e26
mov rdx, qword [rbx + 0x78]
mov byte [rbx + 8], 0
test rdx, rdx
je 0x140028e0d
mov ecx, 0x3e
call fcn.14027882c
jmp 0x140028e26
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
dec rax
mov word [rax], 0x3e
cmp dword [rbx + 0x84], 0
jge 0x140028e79
cmp byte [rbx + 0x70], 0
jne 0x140028e79
cmp byte [rbx + 0x89], 0
jne 0x140028e79
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x140028e53
mov ecx, 0xa
call fcn.14027882c
jmp 0x140028e6a
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0xa
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x80]
call qword [rax + 0x58]
mov r9, qword [rbx + 0x78]
mov byte [rbx + 0x70], 0
test r9, r9
je 0x140028e9d
mov edx, 1
lea rcx, [0x1402b2840]
lea r8d, [rdx + 3]
call fcn.140279148
jmp 0x140028ebd
lea rcx, [rbx + 0x110]
mov edx, 4
call fcn.140027d10
mov ecx, dword [0x1402b2840]
dec rax
mov dword [rax], ecx
mov byte [rax + 4], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x140028ec4
mov rdx, rdi
mov rcx, rbx
call fcn.140029310
mov r9, qword [rbx + 0x78]
test r9, r9
je 0x140028f04
mov edx, 1
lea rcx, [0x1402b2890]
lea r8d, [rdx + 2]
call fcn.140279148
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0x110]
mov edx, 3
call fcn.140027d10
movzx ecx, word [0x1402b2890]
dec rax
mov rbx, qword [rsp + 0x30]
mov word [rax], cx
movzx ecx, byte [0x1402b2892]
mov byte [rax + 2], cl
mov byte [rax + 3], 0
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140028ff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rdx]
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call qword [rax + 0x30]
test rax, rax
je 0x140029012
xor edi, edi
jmp 0x14002901e
lea rcx, [rdi + 0x18]
call fcn.140026170
mov rdi, rax
cmp byte [rbx + 8], 0
je 0x140029056
mov rdx, qword [rbx + 0x78]
mov byte [rbx + 8], 0
test rdx, rdx
je 0x14002903d
mov ecx, 0x3e
call fcn.14027882c
jmp 0x140029056
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
dec rax
mov word [rax], 0x3e
cmp dword [rbx + 0x84], 0
jge 0x1400290a9
cmp byte [rbx + 0x70], 0
jne 0x1400290a9
cmp byte [rbx + 0x89], 0
jne 0x1400290a9
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x140029083
mov ecx, 0xa
call fcn.14027882c
jmp 0x14002909a
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov word [rax - 1], 0xa
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rbx + 0x80]
call qword [rax + 0x58]
mov r9, qword [rbx + 0x78]
mov byte [rbx + 0x70], 0
test r9, r9
je 0x1400290cd
mov edx, 1
lea rcx, [0x1402b2854]
lea r8d, [rdx + 1]
call fcn.140279148
jmp 0x1400290ef
lea rcx, [rbx + 0x110]
mov edx, 2
call fcn.140027d10
movzx ecx, word [0x1402b2854]
dec rax
mov word [rax], cx
mov byte [rax + 2], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x1400290f6
mov rdx, rdi
mov rcx, rbx
call fcn.140029310
mov rdx, qword [rbx + 0x78]
test rdx, rdx
je 0x14002912b
mov ecx, 0x3e
call fcn.14027882c
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0x110]
mov edx, 1
call fcn.140027d10
mov rbx, qword [rsp + 0x30]
dec rax
mov word [rax], 0x3e
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140029160
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movzx eax, byte [rdx + 0x69]
mov byte [rcx + 0x88], al
cmp byte [rdx + 0x68], 0
je 0x140029206
mov qword [rsp + 0x38], rsi
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x20], rdi
lea rsi, [0x1402b2910]
inc rax
cmp byte [rsi + rax], 0
jne 0x140029190
mov r9, qword [rcx + 0x78]
movsxd rdi, eax
test r9, r9
je 0x1400291c6
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.140279148
mov rsi, qword [rsp + 0x38]
mov al, 1
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
add rcx, 0x110
mov qword [rsp + 0x30], rbx
mov edx, eax
call fcn.140027d10
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax - 1]
call fcn.14026fce0
mov rsi, qword [rsp + 0x38]
mov al, 1
mov byte [rdi + rbx - 1], 0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret

Function at 0x140029310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x78]
mov rsi, rdx
movsxd rdi, r8d
test r9, r9
je 0x140029343
mov r8, rdi
mov edx, 1
mov rcx, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140279148
add rcx, 0x110
mov qword [rsp + 0x30], rbx
mov edx, r8d
call fcn.140027d10
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax - 1]
call fcn.14026fce0
mov rsi, qword [rsp + 0x38]
mov byte [rdi + rbx - 1], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400403d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140040404
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400403f0
ret
Function at 0x14016ea30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.140252020
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1428], rbx
mov qword [rsp + 0x1430], rbp
mov qword [rsp + 0x1438], rsi
mov rax, qword [0x140356158]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rdi, r9
mov r15, r8
mov r12, rdx
mov rsi, rcx
call fcn.1402504b4
mov ecx, 0xffffffff
mov dword [rsp + 0x13d4], ecx
mov dword [rsp + 0x54], eax
mov r10d, 1
mov r9d, r10d
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r10d
mov dword [rsp + r9*4 + 0x54], eax
inc r10d
inc r9
cmp r9, 0x270
jl 0x14016eab0
mov dword [rsp + 0x50], 0x270
mov r14, qword [rsi + 0x38]
xor ebx, ebx
mov ecx, ebx
mov edx, ebx
test r14, r14
jle 0x14016eb08
mov r8, qword [rsi + 0x30]
nop
lea rax, [rcx + 1]
cmp dword [r8 + rdx*4], 3
cmovne rax, rcx
mov rcx, rax
inc rdx
cmp rdx, r14
jl 0x14016eaf0
mov rbp, r14
sub rbp, rcx
je 0x14016ec78
movss xmm1, dword [r15]
movaps xmm4, xmm1
addss xmm4, dword [r12]
addss xmm4, dword [rdi]
xorps xmm2, xmm2
cvtsi2ss xmm2, rbp
movaps xmm0, xmm2
mulss xmm0, xmm1
divss xmm0, xmm4
cvttss2si r12, xmm0
mulss xmm2, dword [rdi]
divss xmm2, xmm4
cvttss2si r13, xmm2
sub rbp, r13
sub rbp, r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
lea r15, [r14 - 1]
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140029f50
mov rdi, qword [rsp + 0x40]
mov qword [rdi], rbx
mov ecx, 1
cmp rcx, r15
jge 0x14016eb94
nop dword [rax]
mov rax, qword [rdi + rcx*8 - 8]
inc rax
mov qword [rdi + rcx*8], rax
inc rcx
cmp rcx, r15
jl 0x14016eb80
mov qword [rdi + r14*8 - 8], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
mov edx, 0xffffffff
dec rcx
shr rax, 1
cmp rax, rdx
ja 0x14016ebb4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x48]
lea rdx, [rdi + rax*8]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140154140
mov rax, rbx
mov rcx, rbx
test rbp, rbp
je 0x14016ec0e
nop word [rax + rax]
mov rdx, qword [rdi + rax*8]
mov r8, qword [rsi + 0x30]
cmp dword [r8 + rdx*4], 3
je 0x14016ec06
mov dword [r8 + rdx*4], ebx
inc rcx
inc rax
cmp rcx, rbp
jne 0x14016ebf0
mov rcx, rbx
test r12, r12
je 0x14016ec42
nop word [rax + rax]
mov rdx, qword [rdi + rax*8]
mov r8, qword [rsi + 0x30]
cmp dword [r8 + rdx*4], 3
je 0x14016ec3a
mov dword [r8 + rdx*4], 1
inc rcx
inc rax
cmp rcx, r12
jne 0x14016ec20
test r13, r13
je 0x14016ec70
lea rcx, [rdi + rax*8]
nop dword [rax + rax]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x30]
cmp dword [rdx + rax*4], 3
je 0x14016ec67
mov dword [rdx + rax*4], 2
inc rbx
add rcx, 8
cmp rbx, r13
jne 0x14016ec50
mov rcx, rdi
call fcn.140277f94
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140251ca0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14019b860
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [r8]
mov rdx, qword [rdx]
mov rcx, qword [rcx + 8]
jmp 0x14019b860
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
movups xmm1, xmmword [rcx + 0x40]
mov rax, r8
movups xmm0, xmmword [rcx]
sub rax, rdx
movss xmm3, dword [rcx + 0x28]
movups xmmword [rsp + 0x40], xmm1
mov rbx, qword [rsp + 0x40]
movups xmmword [rsp], xmm0
mov rdi, qword [rsp]
movups xmm1, xmmword [rcx + 0x60]
movups xmmword [rsp + 0x60], xmm1
mov rsi, qword [rsp + 0x68]
movups xmm1, xmmword [rcx + 0x80]
cmp rax, 4
jl 0x14019b98f
lea r9, [r8 - 0x10]
cmp rdx, r9
jg 0x14019b933
movdqa xmm2, xmmword [0x1402b1e90]
lea rcx, [rbx + rdx*4]
sub r9, rdx
mov r10, rdi
shr r9, 4
mov r11, rsi
inc r9
movaps xmm1, xmm3
mov rax, r9
shufps xmm1, xmm1, 0
shl rax, 4
sub r10, rbx
sub r11, rbx
add rdx, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 4
nop word [rax + rax]
movups xmm0, xmmword [rcx]
xorps xmm0, xmm2
divps xmm0, xmmword [r11 + rcx]
mulps xmm0, xmm1
movups xmmword [r10 + rcx], xmm0
add rcx, 0x10
sub rax, 1
jne 0x14019b910
sub r9, 1
jne 0x14019b900
lea rax, [r8 - 4]
cmp rdx, rax
jg 0x14019b98f
movdqa xmm2, xmmword [0x1402b1e90]
lea rcx, [rbx + rdx*4]
sub rax, rdx
mov r9, rdi
mov r10, rsi
shr rax, 2
sub r9, rbx
sub r10, rbx
inc rax
movaps xmm1, xmm3
shufps xmm1, xmm1, 0
lea rdx, [rdx + rax*4]
nop dword [rax]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x10]
xorps xmm0, xmm2
divps xmm0, xmmword [rcx + r10 - 0x10]
mulps xmm0, xmm1
movups xmmword [rcx + r9 - 0x10], xmm0
sub rax, 1
jne 0x14019b970
cmp rdx, r8
jge 0x14019ba85
movss xmm2, dword [0x1402b1e90]
mov rax, r8
sub rax, rdx
cmp rax, 4
jl 0x14019ba52
mov rcx, r8
lea rax, [rsi + 4]
sub rcx, rdx
lea rax, [rax + rdx*4]
sub rcx, 4
mov r9, rbx
mov r10, rdi
shr rcx, 2
sub r9, rsi
sub r10, rsi
inc rcx
lea rdx, [rdx + rcx*4]
nop dword [rax]
movss xmm0, dword [r9 + rax - 4]
lea rax, [rax + 0x10]
xorps xmm0, xmm2
divss xmm0, dword [rax - 0x14]
mulss xmm0, xmm3
movss dword [r10 + rax - 0x14], xmm0
movss xmm1, dword [r9 + rax - 0x10]
xorps xmm1, xmm2
divss xmm1, dword [rax - 0x10]
mulss xmm1, xmm3
movss dword [r10 + rax - 0x10], xmm1
movss xmm0, dword [r9 + rax - 0xc]
xorps xmm0, xmm2
divss xmm0, dword [rax - 0xc]
mulss xmm0, xmm3
movss dword [r10 + rax - 0xc], xmm0
movss xmm1, dword [r9 + rax - 8]
xorps xmm1, xmm2
divss xmm1, dword [rax - 8]
mulss xmm1, xmm3
movss dword [r10 + rax - 8], xmm1
sub rcx, 1
jne 0x14019b9e0
cmp rdx, r8
jge 0x14019ba85
sub rbx, rsi
lea rax, [rsi + rdx*4]
sub rdi, rsi
sub r8, rdx
movss xmm0, dword [rax + rbx]
lea rax, [rax + 4]
xorps xmm0, xmm2
divss xmm0, dword [rax - 4]
mulss xmm0, xmm3
movss dword [rax + rdi - 4], xmm0
sub r8, 1
jne 0x14019ba64
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret