joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140070530
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
xor edx, edx
mov r9d, 0x658
mov rcx, rbp
mov rax, rsi
lea r8d, [rdx + 8]
call qword [case.0x1400d90b6.0]
test rax, rax
je 0x14007078b
mov qword [rsp + 0x90], rbx
xor ecx, ecx
lea rbx, [rax + 0xd0]
mov word [rax + 0x10], 0x808
mov byte [rbx + 0x64], 8
mov qword [rax + 0x20], rbx
mov qword [rsp + 0x98], rdi
lea rdi, [rax + 8]
mov qword [rdi + 0x50], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140070530]
mov qword [rbx], rsi
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov dword [rdi + 0xb0], r14d
add dword [rdi + 0xb0], 0x10000
mov qword [rdi + 0x30], r14
mov qword [rdi + 0x20], r14
lea esi, [r14 + 0x18]
mov word [rdi + 0xc], r14w
mov qword [rdi + 0x58], r14
mov qword [rdi + 0xa0], r14
mov qword [rsp + 0x48], rax
mov dword [rdi + 0xc0], r14d
mov qword [rdi + 0xb8], r14
mov word [rdi + 0xa], 0x100
mov qword [rdi + 0x38], r14
mov qword [rdi + 0xa8], r14
mov dword [rdi + 0xb4], r14d
mov qword [rbx + 0x70], rdi
mov qword [rdi], r14
mov qword [rbx + 8], rbp
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x108], rdi
mov qword [rsp + 0x38], rdi
call fcn.1401b3c78
xor eax, esi
nop dword [rax]
movzx edx, byte [rsp + rsi + 0x37]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub rsi, 1
jne 0x140070640
mov dword [rbx + 0x60], eax
lea rdx, [0x140070150]
mov dword [rbx + 0x6a], 0x19320002
xor r8d, r8d
mov qword [rbx + 0x38], r14
mov rcx, rdi
mov qword [rbx + 0x30], r14
mov byte [rbx + 0x48], r14b
mov qword [rbx + 0x100], r14
mov dword [rbx + 0x65], 0x14000008
mov qword [rbx + 0xb8], r14
mov qword [rbx + 0xb0], r14
mov qword [rbx + 0x80], r14
mov qword [rbx + 0xd0], r14
mov qword [rbx + 0xc8], r14
mov qword [rbx + 0xc0], r14
mov qword [rbx + 0xd8], r14
mov qword [rbx + 0xf0], r14
mov qword [rbx + 0xe8], r14
mov qword [rbx + 0xe0], r14
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x90], r14
mov qword [rbx + 0x88], r14
mov qword [rbx + 0xa8], r14
mov qword [rbx + 0xa0], r14
mov qword [rbx + 0x98], r14
mov qword [rbx + 0xf8], r14
mov qword [rbx + 0x10], 0x658
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x28], r14
mov qword [rbx + 0x50], r14
mov byte [rbx + 0x58], 3
mov byte [rbx + 0x6e], 0xd
mov byte [rbx + 0x69], 0x19
mov qword [rbx + 0x1e0], r14
mov qword [rbx + 0x1e8], r14
mov qword [rbx + 0x1f0], r14
mov qword [rbx + 0x1f8], r14
mov qword [rbx + 0x200], r14
mov qword [rbx + 0x208], r14
mov qword [rbx + 0x210], r14
mov qword [rbx + 0x218], r14
mov qword [rbx + 0x220], r14
call fcn.140078bf0
mov rbx, qword [rsp + 0x90]
test eax, eax
je 0x14007077b
mov rcx, rdi
call fcn.1400703e0
mov rdi, r14
mov r14, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140185380
add rsp, 0x68
pop rsi
pop rbp
ret
Function at 0x140078850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
cmp r8, 0x28
ja 0x140078878
lfence
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140078650
movabs rax, 0x7fffffffffffffdf
cmp rdi, rax
jae 0x1400788bc
mov qword [rsp + 0x30], rbx
lfence
mov rdx, rdi
call fcn.1400785e0
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax + 0x18]
call fcn.1401a9040
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14007f0a0
int3
Function at 0x14007b030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r12d, r8d
mov esi, ebp
mov r10, rdx
mov rbx, rcx
mov r15d, ebp
cmp byte [rdx + 0xa], sil
jge 0x14007b094
mov ecx, dword [rdx + 0xc]
lea eax, [rcx - 1]
test ecx, eax
je 0x14007b094
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
jmp 0x14007b097
mov eax, dword [rdx + 0xc]
movzx ecx, byte [rdx + 0xb]
mov r14d, 1
shl r14d, cl
test eax, eax
je 0x14007b0dd
mov r11, rbp
mov edi, eax
nop dword [rax]
mov rax, qword [r10 + 0x10]
test byte [r11 + rax + 8], 0x40
je 0x14007b0d3
mov rdx, qword [r11 + rax]
test byte [rdx + 9], 0x18
je 0x14007b0d3
mov rcx, rbx
mov esi, 1
call fcn.14007aac0
add r11, 0x10
sub rdi, 1
jne 0x14007b0b0
mov edi, ebp
test r14d, r14d
je 0x14007b17f
lfence
nop dword [rax + rax]
mov rdx, qword [r10 + 0x18]
mov ecx, r14d
sub ecx, edi
mov eax, edi
dec ecx
test r12d, r12d
cmovne eax, ecx
lea rcx, [rax + rax*2]
movzx eax, byte [rdx + rcx*8 + 8]
lea r11, [rdx + rcx*8]
movzx ecx, byte [rdx + rcx*8 + 9]
and cl, 0x40
test al, 0xf
jne 0x14007b127
test cl, cl
je 0x14007b174
mov byte [r11 + 9], 0xb
jmp 0x14007b174
test cl, cl
je 0x14007b158
mov rdx, qword [r11 + 0x10]
test rdx, rdx
je 0x14007b158
movzx ecx, byte [rdx + 8]
movzx r8d, byte [rdx + 9]
and cl, 0xf
cmp cl, 4
jne 0x14007b1a1
test r8b, 0x18
je 0x14007b158
mov rcx, rbx
call fcn.14007aac0
movzx eax, byte [r11 + 8]
and al, 0x40
test al, al
je 0x14007b174
mov rdx, qword [r11]
test byte [rdx + 9], 0x18
je 0x14007b174
mov rcx, rbx
mov esi, 1
call fcn.14007aac0
inc edi
cmp edi, r14d
jb 0x14007b0f0
cmp byte [rbx + 0x65], 0
jne 0x14007b1c0
mov rcx, qword [rbx + 0x90]
mov qword [r10 + 0x30], rcx
mov qword [rbx + 0x90], r10
and byte [r10 + 9], 0xc7
jmp 0x14007b236
and al, 0x40
test r8b, 0x18
je 0x14007b15a
mov ebp, 1
test al, al
je 0x14007b174
mov rax, qword [r11]
test byte [rax + 9], 0x18
je 0x14007b174
mov r15d, ebp
jmp 0x14007b174
test r15d, r15d
je 0x14007b1de
mov rax, qword [rbx + 0xa0]
mov qword [r10 + 0x30], rax
mov qword [rbx + 0xa0], r10
and byte [r10 + 9], 0xc7
jmp 0x14007b236
test ebp, ebp
je 0x14007b1fb
mov rax, qword [rbx + 0xa8]
mov qword [r10 + 0x30], rax
mov qword [rbx + 0xa8], r10
and byte [r10 + 9], 0xc7
jmp 0x14007b236
movzx eax, byte [r10 + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x14007b22b
mov rcx, r10
call fcn.14007a970
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], r10
and byte [r10 + 9], 0xc7
jmp 0x14007b236
cmp cl, 6
jne 0x14007b236
xor al, 2
mov byte [r10 + 9], al
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14007b260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov r10, qword [rdx + 0x18]
mov eax, 1
mov rbx, rcx
mov qword [rsp + 0x30], rbp
movzx ecx, byte [rdx + 0xb]
mov r11, rdx
shl eax, cl
cmp byte [rdx + 0xa], 0
cdqe
lea r8, [rax + rax*2]
lea rbp, [r10 + r8*8]
jge 0x14007b2c4
mov edx, dword [rdx + 0xc]
lea eax, [rdx - 1]
test edx, eax
je 0x14007b2c4
mov eax, edx
shr eax, 1
or edx, eax
mov eax, edx
shr eax, 2
or edx, eax
mov eax, edx
shr eax, 4
or edx, eax
mov eax, edx
shr eax, 8
or edx, eax
mov eax, edx
shr eax, 0x10
or eax, edx
inc eax
jmp 0x14007b2c8
mov eax, dword [r11 + 0xc]
xor esi, esi
test eax, eax
je 0x14007b311
mov qword [rsp + 0x38], rdi
mov r10d, esi
mov edi, eax
nop dword [rax + rax]
mov rax, qword [r11 + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x14007b2fe
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x14007b2fe
mov rcx, rbx
call fcn.14007aac0
add r10, 0x10
sub rdi, 1
jne 0x14007b2e0
mov r10, qword [r11 + 0x18]
mov rdi, qword [rsp + 0x38]
cmp r10, rbp
jae 0x14007b378
add r10, 9
nop word [rax + rax]
movzx ecx, byte [r10]
movzx eax, byte [r10 - 1]
and cl, 0x40
test al, 0xf
jne 0x14007b33a
test cl, cl
je 0x14007b36b
mov byte [r10], 0xb
jmp 0x14007b36b
test cl, cl
je 0x14007b355
mov rdx, qword [r10 + 7]
test byte [rdx + 9], 0x18
je 0x14007b355
mov rcx, rbx
call fcn.14007aac0
movzx eax, byte [r10 - 1]
test al, 0x40
je 0x14007b36b
mov rdx, qword [r10 - 9]
test byte [rdx + 9], 0x18
je 0x14007b36b
mov rcx, rbx
call fcn.14007aac0
add r10, 0x18
lea rax, [r10 - 9]
cmp rax, rbp
jb 0x14007b320
movzx eax, byte [r11 + 9]
mov rbp, qword [rsp + 0x30]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x14007b3f4
movzx eax, byte [r11 + 8]
add eax, 0xfffffffb
cmp eax, 0x21
ja case.0x14007b3b5.9
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x7b424]
mov ecx, dword [rdx + rax*4 + 0x7b40c]
add rcx, rdx
jmp rcx
lea rsi, [r11 + 0x30]
jmp case.0x14007b3b5.9
lea rsi, [r11 + 0x10]
jmp case.0x14007b3b5.9
lea rsi, [r11 + 0x48]
jmp case.0x14007b3b5.9
lea rsi, [r11 + 0x78]
jmp case.0x14007b3b5.9
lea rsi, [r11 + 0x20]
mov rax, qword [rbx + 0x90]
mov qword [rsi], rax
mov qword [rbx + 0x90], r11
and byte [r11 + 9], 0xc7
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
cmp cl, 6
jne 0x14007b3ff
xor al, 2
mov byte [r11 + 9], al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14007da30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x14007db47
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x140000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x14007da9a.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x14007da9a.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x14007da9a.8
cdqe
movzx eax, byte [rdi + rax + 0x7db5c]
mov ecx, dword [rdi + rax*4 + 0x7db48]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x14007da9a.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x14007dabd
and dl, 0xc7
jmp 0x14007dac3
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x14007da9a.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x14007da9a.8
mov rcx, rbx
call fcn.14007aac0
jmp case.0x14007da9a.8
cmp word [r10 + 0xa], 0
jne case.0x14007da9a.5
mov rax, qword [r10 + 0x18]
test rax, rax
je 0x14007db07
test byte [rax + 9], 0x18
je 0x14007db07
mov rdx, rax
mov rcx, rbx
call fcn.14007aac0
movzx edx, byte [r10 + 9]
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x14007da9a.8
mov rcx, r10
call fcn.14007a970
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x14007da53
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140087240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r12, rdx
mov rbx, rcx
call fcn.1401b3718
xor edi, edi
lea r13, [0x140215ff0]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x14008729f
nop
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x140087290
mov qword [rsp + 0x58], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x1400872b6
mov r15d, ebp
jmp 0x1400872bf
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x1400873f7
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x1400873f7
movsd xmm2, qword [0x140259bf8]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x14008730a
test r11d, r11d
jne 0x14008735f
mov r11d, ebp
inc rdx
jmp 0x1400872f0
test byte [r8 + r13 + 1], 0x10
je 0x14008735f
test r10d, r10d
jne 0x140087321
cmp r8b, 0x30
jne 0x140087321
inc esi
jmp 0x140087352
inc r10d
cmp r10d, 0x1e
jg 0x14008734f
test byte [rcx + r13 + 1], 2
je 0x140087337
add ecx, 0xffffffd0
jmp 0x14008733d
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x140087352
inc r9d
test r11d, r11d
je 0x14008735a
dec r9d
inc rdx
jmp 0x1400872f0
lea eax, [rsi + r10]
test eax, eax
je 0x1400873f7
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x1400873de
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x140087390
mov eax, 2
jmp 0x14008739e
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x1400873f7
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x1400873b0
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x1400873ea
xorps xmm1, xmmword [0x140259da0]
mov edx, r9d
movaps xmm0, xmm1
call fcn.1401ba470
jmp 0x1400873fa
xorps xmm0, xmm0
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140087570
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.140087420
mov r9, rax
test rax, rax
je 0x1400875c9
mov r8, qword [rsp + 0x20]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x14008774a
lea rdx, str..xXnN
mov rcx, rbx
call fcn.1401bacd0
test rax, rax
je 0x140087600
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x140087748
cmp edi, 0x78
jne 0x140087602
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140087240
jmp 0x14008760f
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401ba36c
mov rcx, qword [rsp + 0x20]
lea rbp, [0x140215ff0]
cmp rcx, rbx
je 0x140087655
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
je 0x140087642
nop word [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x140087630
xor r9d, r9d
cmp byte [rcx], r9b
cmove r9, rcx
test r9, r9
jne 0x140087734
mov edx, 0x2e
mov rcx, rbx
call fcn.1401a86b4
mov rsi, rax
test rax, rax
je 0x140087748
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140087675
cmp rcx, 0xc8
ja 0x140087748
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400876a0
call fcn.1401b3718
sub rsi, rbx
lea rdx, [rsp + 0x20]
mov rcx, qword [rax]
movzx eax, byte [rcx]
lea rcx, [rsp + 0x30]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x1400876d6
call fcn.140087240
jmp 0x1400876db
call fcn.1401ba36c
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x140087748
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
je 0x140087712
nop dword [rax]
nop dword [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x140087700
xor r9d, r9d
cmp byte [rcx], r9b
cmove r9, rcx
test r9, r9
je 0x140087748
lea rcx, [rsp + 0x30]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x140087748
mov al, 0x13
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x14008774a
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140185380
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14009ce60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x450
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov rbx, rdx
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0x400
mov qword [rax], rdx
mov byte [rax + 8], 2
add qword [rcx + 0x10], 0x10
nop word [rax + rax]
mov edx, 0x400
lea rcx, [rsp + 0x20]
mov r8d, 0xffffffff
call fcn.140074a00
mov r9, rbx
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call fcn.1401b538c
mov rdi, qword [rsp + 0x30]
add rdi, rax
mov qword [rsp + 0x30], rdi
cmp rax, 0x400
je 0x14009cec0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x480], rsi
test rdi, rdi
jne 0x14009cf2b
lea rdx, [0x140206c9b]
mov rcx, rbx
call fcn.1400788d0
mov rsi, rax
jmp 0x14009cf80
cmp rdi, 0x28
ja 0x14009cf4b
lfence
mov rdx, qword [rsp + 0x20]
mov r8, rdi
mov rcx, qword [rsp + 0x38]
call fcn.140078650
mov rsi, rax
jmp 0x14009cf80
movabs rax, 0x7fffffffffffffdf
cmp rdi, rax
jae 0x14009d032
lfence
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
call fcn.1400785e0
mov r8, rdi
mov rdx, rbp
mov rsi, rax
lea rcx, [rax + 0x18]
call fcn.1401a9040
mov rcx, qword [rbx + 0x10]
mov qword [rcx], rsi
movzx eax, byte [rsi + 8]
or al, 0x40
mov byte [rcx + 8], al
add qword [rbx + 0x10], 0x10
mov rax, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jle 0x14009cfb0
mov rcx, rbx
call fcn.14007ee10
mov rdx, qword [rbx + 0x10]
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x14009cfd7
xor r9d, r9d
add rdx, 0xffffffffffffffe0
mov rcx, rbx
lea r8d, [r9 - 1]
call fcn.1400766a0
mov rax, qword [rbx + 0x10]
mov byte [rax - 0x18], 0
mov edx, 0xfffffffe
mov rcx, rbx
lea r8d, [rdx + 1]
call fcn.1400709f0
mov rdi, qword [rbx + 0x10]
sub rdi, 0x10
cmp qword [rbx + 0x40], rdi
jb 0x14009d00b
lfence
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
lea r8d, [r9 - 1]
call fcn.1400766a0
mov rsi, qword [rsp + 0x480]
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140185380
add rsp, 0x450
pop rdi
pop rbp
pop rbx
ret
mov rcx, rbx
call fcn.14007f0a0
int3
Function at 0x14009d040
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rbx, rdx
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], 0x400
mov rdi, r8
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rax], rdx
mov rdx, rdi
mov byte [rax + 8], 2
add qword [rcx + 0x10], 0x10
lea r8d, [rbp - 1]
lea rcx, [rsp + 0x20]
call fcn.140074a00
mov r9, rbx
lea edx, [rbp + 1]
mov r8, rdi
mov rcx, rax
call fcn.1401b538c
mov rsi, qword [rsp + 0x30]
mov r14, rax
mov rbx, qword [rsp + 0x38]
add rsi, rax
mov r15, qword [rsp + 0x20]
mov qword [rsp + 0x30], rsi
jne 0x14009d0f1
lea rdx, [0x140206c9b]
mov rcx, rbx
call fcn.1400788d0
mov rdi, rax
jmp 0x14009d146
cmp rsi, 0x28
ja 0x14009d111
lfence
mov rdx, qword [rsp + 0x20]
mov r8, rsi
mov rcx, qword [rsp + 0x38]
call fcn.140078650
mov rdi, rax
jmp 0x14009d146
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x14009d200
lfence
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call fcn.1400785e0
mov r8, rsi
mov rdx, r15
mov rdi, rax
lea rcx, [rax + 0x18]
call fcn.1401a9040
mov rcx, qword [rbx + 0x10]
mov qword [rcx], rdi
movzx eax, byte [rdi + 8]
or al, 0x40
mov byte [rcx + 8], al
mov rax, qword [rbx + 0x18]
add qword [rbx + 0x10], 0x10
cmp qword [rax + 0x18], rbp
jle 0x14009d16d
mov rcx, rbx
call fcn.14007ee10
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x14009d198
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
sub rdx, 0x20
mov rcx, rbx
lea r8d, [r9 - 1]
call fcn.1400766a0
mov rax, qword [rbx + 0x10]
mov byte [rax - 0x18], bpl
mov edx, 0xfffffffe
mov rcx, rbx
lea r8d, [rdx + 1]
call fcn.1400709f0
mov rdi, qword [rbx + 0x10]
sub rdi, 0x10
cmp qword [rbx + 0x40], rdi
jb 0x14009d1cc
lfence
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
lea r8d, [r9 - 1]
call fcn.1400766a0
test r14, r14
mov qword [rbx + 0x10], rdi
setne bpl
mov eax, ebp
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0x498]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.14007f0a0
int3
Function at 0x1400b5280
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r11, rcx
mov rax, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x1400b52b6
mov r11, qword [rcx]
lea rdx, [r11 + rax*2]
mov rcx, r11
call fcn.140009a00
cmp rax, rdx
je 0x1400b52df
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400b52d6
cmp cx, 0x2f
jne 0x1400b52df
add rax, 2
cmp rax, rdx
jne 0x1400b52c7
sub rax, r11
sar rax, 1
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov r8, rax
mov rdx, r11
lea rcx, [rsp + 0x40]
call fcn.14000b550
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000fcc0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400b5383
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b537e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b547a
call fcn.1401853a0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x40]
call fcn.140010b20
test ebx, ebx
je 0x1400b53ae
cmp qword [rbp], 0xc800000
jb 0x1400b53cf
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140185380
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
lfence
mov r8d, 0x1e
lea rdx, str.mb_free_space_to_run_correctly
lea rcx, [rbp - 0x20]
call fcn.140032a50
mov rdi, rax
mov edx, 0xc8
lea rcx, [rbp - 0x40]
call fcn.1400b3250
mov rbx, rax
mov r8d, 0x41
lea rdx, str.You_dont_have_enough_space_on_disk._This_process_needs_at_least
lea rcx, [rbp - 0x60]
call fcn.140032a50
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14002f410
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14002f410
nop
lea rcx, [rbp - 0x80]
call fcn.14000ff30
nop
lea rcx, [rbp - 0x60]
call fcn.14000ff30
nop
lea rcx, [rbp - 0x40]
call fcn.14000ff30
nop
lea rcx, [rbp - 0x20]
call fcn.14000ff30
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.140008a60
lea rdx, [0x14028fd98]
lea rcx, [rsp + 0x68]
call fcn.1401a8f20
nop
call fcn.1401b3c00
int3