joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405640]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405650]
mov dword [rax], 1
mov rax, qword [0x00405660]
mov dword [rax], 1
mov rax, qword [0x00405630]
mov dword [rax], 1
mov rax, qword [0x00405520]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00405620]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004055e0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004054d0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401630
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push rbp
sub rsp, 0x1e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x170], rcx
mov dword [rbp + 0x178], edx
lea rax, [rbp - 0x50]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WSOCK32.dll_WSAStartup]
call rax
test eax, eax
setne al
test al, al
je 0x401681
lea rcx, str.Failed_to_initialize_Winsock
call sym.puts
mov eax, 0xffffffff
jmp 0x40175c
mov rcx, qword [rbp + 0x170]
mov rax, qword [sym.imp.WSOCK32.dll_gethostbyname]
call rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
jne 0x4016b5
mov rax, qword [sym.imp.WSOCK32.dll_WSACleanup]
call rax
mov eax, 0xffffffff
jmp 0x40175c
mov word [rbp - 0x60], 2
mov eax, dword [rbp + 0x178]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_htons]
call rax
mov word [rbp - 0x5e], ax
mov rax, qword [rbp + 0x158]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rbp - 0x5c], eax
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WSOCK32.dll_socket]
call rax
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0xffffffff
jne 0x40171e
mov rax, qword [sym.imp.WSOCK32.dll_WSACleanup]
call rax
mov eax, 0xffffffff
jmp 0x40175c
mov eax, dword [rbp + 0x154]
cdqe
lea rdx, [rbp - 0x60]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_connect]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x401756
mov rax, qword [sym.imp.WSOCK32.dll_WSACleanup]
call rax
mov eax, 0xffffffff
jmp 0x40175c
mov eax, dword [rbp + 0x154]
add rsp, 0x1e0
pop rbp
ret
Function at 0x40195f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 4], 0
mov eax, dword [rbp + 0x10]
cdqe
mov rdx, qword [rbp + 0x18]
mov r9d, 0
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_recv]
call rax
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x4019a2
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov eax, dword [rbp - 4]
cmp eax, dword [rbp + 0x20]
jge 0x401a11
mov eax, dword [rbp + 0x20]
sub eax, dword [rbp - 4]
mov ecx, eax
mov eax, dword [rbp - 4]
cdqe
mov rdx, qword [rbp + 0x18]
add rdx, rax
mov eax, dword [rbp + 0x10]
cdqe
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_send]
call rax
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0xffffffff
jne 0x401a09
mov eax, 0xffffffff
jmp 0x401a14
mov eax, dword [rbp - 8]
add dword [rbp - 4], eax
jmp 0x4019c3
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x402500
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00408624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x402688
mov rax, qword [0x00408628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40254c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4025d5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402530
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4026bd
mov rax, qword [0x00408628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4026a0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4025ce
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402630
add dword [0x00408624], 1
cmp edi, 8
jae 0x402603
test dil, 4
jne 0x402674
test edi, edi
je 0x4025f8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40268f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x4025f8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40261c
jmp 0x4025f8
add rsi, qword [0x00408628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4025ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x4025f8
xor esi, esi
jmp 0x402557
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x4025f8
mov rax, qword [0x00408628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x402e10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x402e64
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402e5b
test rsi, rsi
je 0x402e5b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402e40
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4030a0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4030b0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4030c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403101
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4030f8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x403103
add rax, 0x28
cmp rax, r9
jne 0x4030e4
xor eax, eax
ret

Function at 0x4031a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00405520]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40320d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40320d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40320d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403204
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40320f
add rax, 0x28
cmp rax, r9
jne 0x4031f0
xor eax, eax
add rsp, 0x28
ret

Function at 0x403310
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00405520]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x403330
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403328
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40338d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403384
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x403394
add rax, 0x28
cmp rax, r9
jne 0x403370
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x4033b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00405520]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x40341e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40341e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x40341e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40341e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x403415
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x403425
add rcx, 0x28
cmp rcx, rax
jne 0x403400
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x403438
jmp 0x40341e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x403446
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x40341e
test r9d, r9d
jg 0x403430
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x4036c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x415a4c
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r8, qword [0x0044a388]
mov esi, ecx
lea rdx, [0x00402af8]
lea rcx, [rsp + 0x40]
call fcn.0042dc7c
xor edx, edx
lea edi, [rax - 1]
mov cl, byte [rsp + rdx + 0x40]
inc rdx
test cl, cl
mov byte [rsp + rdx + 0x14f], cl
jne 0x415a88
mov rcx, qword [0x00444550]
cmp rcx, 0xffffffffffffffff
je 0x415aad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 0x30
movsxd rdi, edi
mov byte [rsp + rdi + 0x150], bl
inc bl
cmp dword [0x00440cac], 0
mov byte [rsp + rdi + 0x40], bl
je 0x415afa
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp eax, 1
je 0x415b47
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x415b47
lea rcx, [0x00402b00]
jmp 0x415b32
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 1
je 0x415b47
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x415b47
lea rcx, [0x00402b20]
lea r8, [rsp + 0x150]
lea rdx, [rsp + 0x40]
mov r9d, eax
call fcn.00415248
cmp bl, 0x33
jl 0x415ab2
xor r9d, r9d
mov qword [rsp + 0x30], 0
bts esi, 7
lea rcx, [rsp + 0x40]
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], esi
mov dword [0x0044a384], 0
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov qword [0x00444550], rax
jne 0x415bb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x40]
lea rcx, [0x00402b40]
mov r8d, eax
call fcn.00415248
mov eax, 0xffffffff
jmp 0x415bba
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.0042d850
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret

Function at 0x415e78
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
sub dword [rcx + 0x44], edx
add dword [rcx + 0x40], edx
cmp dword [rcx + 0x44], 0
mov edi, edx
mov rbx, rcx
jne 0x415e9c
call fcn.00415c8c
add rsp, 0x38
pop rdi
pop rbx
ret
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x00440cac]
add dword [rbx + 0x28], edi
mov r11, qword [rbx + 0x10]
neg eax
mov eax, dword [rbx + 0x40]
sbb r8, r8
lea rcx, [rbx + 0x18]
lea r9, [rsp + 0x58]
and r8, rcx
mov rcx, qword [rbx + 8]
lea rdx, [rax + rbx + 0x4c]
mov qword [rsp + 0x20], r8
mov r8d, dword [rbx + 0x44]
mov qword [rbx + 0x30], r11
mov dword [rbx + 0x2c], 0
mov dword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x415f09
mov edx, dword [rsp + 0x58]
mov rcx, rbx
test edx, edx
je 0x415e90
call fcn.00415e78
jmp 0x415e95
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x00440cac], 0
je 0x415f23
cmp eax, 0x3e5
je 0x415e95
mov edx, dword [rbx + 0x44]
lea rcx, [0x00402bf0]
mov r8d, eax
call fcn.00415248
mov ecx, 1
call fcn.0041530c
int3
Function at 0x415f48
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov edi, edx
mov edx, dword [0x00444574]
mov rbx, rcx
lea rcx, [fcn.00415f48]
call fcn.00415d04
mov rax, qword [0x00444550]
mov dword [rbx + 0x44], edi
cmp rax, 0xffffffffffffffff
jne 0x415fac
cmp dword [0x0044a398], 0
je 0x415f90
lea rdx, [rbx + 0x4c]
lea r8, [rbx + 0x44]
xor ecx, ecx
call fcn.0041f7ec
jmp 0x415f9d
lea rcx, [rbx + 0x4c]
lea rdx, [rbx + 0x44]
call fcn.00415494
mov rcx, rbx
call fcn.00415c8c
mov rax, qword [0x00444550]
mov edx, dword [0x0044a384]
cmp edx, dword [0x00444560]
jb 0x416019
test rax, rax
je 0x415fdc
cmp rax, 0xffffffffffffffff
je 0x415fdc
mov rcx, qword [0x0044a3b0]
jmp 0x415fd7
cmp qword [rcx + 8], rax
je 0x416019
mov rcx, qword [rcx]
test rcx, rcx
jne 0x415fce
mov eax, dword [0x00440cac]
neg eax
sbb ecx, ecx
and ecx, 0x40000000
call fcn.00415a4c
test eax, eax
je 0x41600c
lea rcx, [0x00402c10]
call fcn.00415248
mov ecx, 1
call fcn.0041530c
int3
mov rax, qword [0x00444550]
mov edx, dword [0x0044a384]
mov dword [rbx + 0x28], edx
add edx, edi
mov qword [rbx + 8], rax
lea rax, [fcn.00415e78]
mov dword [0x0044a384], edx
mov rcx, rbx
xor edx, edx
mov dword [rbx + 0x2c], 0
mov dword [rbx + 0x40], 0
mov qword [rbx + 0x38], rax
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.00415e78
Function at 0x41e748
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rdi
mov rax, rsp
sub rsp, 0x38
movsx r8d, word [0x004453e8]
mov word [rax + 0x18], cx
mov word [rax + 0x1a], dx
mov r9d, dword [rsp + 0x50]
sub r8d, ecx
mov ebx, ecx
mov rcx, qword [0x00440c48]
mov dword [rax + 0x20], r8d
lea rax, [rax + 0x20]
mov edi, edx
mov dl, 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov rcx, qword [0x00440c48]
mov word [rsp + 0x50], bx
mov word [rsp + 0x52], di
mov edx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x41e7b4
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsx edx, word [0x004453ea]
xor eax, eax
lea rdi, [0x0040bbd0]
lea rcx, [rax - 1]
repne scasb al, byte [rdi]
mov edi, dword [0x00440ca8]
not rcx
mov eax, edi
cmp edi, edx
lea rbx, [rcx - 1]
cmovg eax, edx
lea rcx, [0x0040bbcc]
mov dword [0x00440ca8], eax
call fcn.00431730
test edi, edi
jle 0x41e907
mov word [rsp + 0x30], 0
dec edi
movabs rax, 0x2020202020202020
mov qword [rsp + 0x38], rax
mov eax, 0x66666667
imul edi
mov r8d, edx
sar r8d, 2
mov eax, r8d
shr eax, 0x1f
add r8d, eax
mov al, r8b
shl al, 2
lea ecx, [rax + r8]
mov al, dil
add cl, cl
sub al, cl
add al, 0x30
cmp edi, 0xa
mov byte [rsp + 0x3a], al
jl 0x41e87c
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
add r8b, 0x30
mov byte [rsp + 0x39], r8b
cmp edi, 0x64
jl 0x41e8b3
mov eax, 0x51eb851f
imul edi
mov ecx, edx
sar ecx, 5
mov eax, ecx
shr eax, 0x1f
add ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
add cl, 0x30
mov byte [rsp + 0x38], cl
mov rcx, qword [0x00440c48]
lea eax, [rdi + 1]
mov word [rsp + 0x32], ax
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea edx, [rdi + 1]
mov ecx, 4
call fcn.0041e748
test edi, edi
jg 0x41e815
mov rcx, qword [0x00440c48]
mov word [rsp + 0x30], 0
mov word [rsp + 0x32], 0
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x34]
lea rdx, [0x0040bbd0]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.0042d850
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x41e968
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
test edx, edx
movsxd rdi, edx
movsxd rbx, ecx
jne 0x41e990
lea edx, [rbx + 1]
mov ecx, 5
call fcn.0041e748
xor edx, edx
mov ecx, ebx
call fcn.0041ede8
mov rcx, qword [0x00440c48]
lea eax, [rbx + 1]
mov word [rsp + 0x50], 5
mov word [rsp + 0x52], ax
mov edx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x00440c48]
lea rsi, [0x00400000]
mov rdx, qword [rsi + rdi*8 + 0x43f90]
lea r9, [rsp + 0x50]
mov r8d, 0xa
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov r11, rbx
imul r11, r11, 0xb0
mov dword [r11 + rsi + 0x45490], ebx
mov dword [r11 + rsi + 0x45494], edi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x41eae8
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
mov edx, 0x20
movsxd rsi, ecx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x40]
call fcn.00436350
mov edx, 0x2d
mov rcx, rbx
call fcn.0042e2d0
mov edx, 0x2d
lea rdi, [rax + 2]
mov rcx, rdi
call fcn.0042e2d0
mov ecx, dword [rbx]
dec rax
cmp ecx, dword [0x0040bc18]
jne 0x41eb5c
sub rax, rdi
lea rcx, [rsp + 0x40]
mov rdx, rdi
mov r8, rax
call fcn.0042ddd0
mov edx, dword [rbx]
lea r8, [0x00400000]
cmp edx, dword [r8 + 0xbc20]
jne 0x41eb7e
mov dl, byte [rbx + 4]
cmp dl, byte [r8 + 0xbc24]
jne 0x41eb7e
xor eax, eax
jmp 0x41eb83
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ebfd
mov edx, dword [rbx]
cmp edx, dword [r8 + 0xbc28]
jne 0x41eba2
mov dl, byte [rbx + 4]
cmp dl, byte [r8 + 0xbc2c]
jne 0x41eba2
xor eax, eax
jmp 0x41eba7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ebfd
mov edx, dword [rbx]
cmp edx, dword [r8 + 0xbc30]
jne 0x41ebc6
mov dl, byte [rbx + 4]
cmp dl, byte [r8 + 0xbc34]
jne 0x41ebc6
xor eax, eax
jmp 0x41ebcb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ebfd
mov edx, dword [rbx]
cmp edx, dword [r8 + 0xbc38]
jne 0x41ebea
mov dl, byte [rbx + 4]
cmp dl, byte [r8 + 0xbc3c]
jne 0x41ebea
xor eax, eax
jmp 0x41ebef
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ebfd
mov eax, dword [rbx]
cmp eax, dword [0x0040bc40]
jne 0x41ec0c
mov eax, dword [rbx]
lea rcx, [rsp + 0x40]
mov dword [rcx], eax
mov al, byte [rbx + 4]
mov byte [rcx + 4], al
mov cx, word [rbx]
cmp cx, word [r8 + 0xbc48]
jne 0x41ec29
mov cl, byte [rbx + 2]
cmp cl, byte [r8 + 0xbc4a]
jne 0x41ec29
xor eax, eax
jmp 0x41ec2e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41ec4c
movzx eax, word [r8 + 0xbc48]
lea rcx, [rsp + 0x41]
mov word [rcx], ax
mov al, byte [r8 + 0xbc4a]
mov byte [rcx + 2], al
lea rdx, [rsp + 0x40]
mov rcx, rsi
inc si
mov eax, dword [rdx]
mov word [rsp + 0x30], 0x21
mov word [rsp + 0x32], si
imul rcx, rcx, 0xb0
mov dword [rcx + r8 + 0x45520], eax
movzx eax, word [rdx + 4]
mov edx, dword [rsp + 0x30]
mov word [rcx + r8 + 0x45524], ax
mov rcx, qword [0x00440c48]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 6
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.0042d850
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x41ecdc
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor ebx, ebx
mov rdi, rdx
movsxd rsi, ecx
lea edx, [rbx + 0x20]
lea r8d, [rbx + 0x50]
lea rcx, [rsp + 0x40]
call fcn.00436350
mov r11b, byte [rdi]
cmp r11b, 0x30
jl 0x41ed3e
lea rcx, [rsp + 0x40]
mov rax, rdi
sub rcx, rdi
cmp r11b, 0x39
jg 0x41ed3e
mov byte [rcx + rax], r11b
inc rax
inc ebx
mov r11b, byte [rax]
cmp r11b, 0x30
jge 0x41ed26
lea eax, [rbx + 1]
cdqe
cmp byte [rax + rdi], 0x6b
jne 0x41ed4e
mov byte [rsp + rax + 0x40], 0x6b
mov rcx, qword [0x00440c48]
lea eax, [rsi + 1]
mov word [rsp + 0x30], 0x27
mov word [rsp + 0x32], ax
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 7
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x46], 0
mov eax, dword [rdx]
lea r8, [0x00445530]
mov rcx, rsi
imul rcx, rcx, 0xb0
mov dword [rcx + r8], eax
movzx eax, word [rdx + 4]
mov word [rcx + r8 + 4], ax
mov al, byte [rdx + 6]
mov byte [rcx + r8 + 6], al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.0042d850
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret

Function at 0x41ede8
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xa8
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0x90], rax
movsxd rsi, ecx
mov rcx, qword [0x00440c48]
mov rdi, rdx
lea eax, [rsi + 1]
mov word [rsp + 0x30], 0x2e
xor ebx, ebx
mov word [rsp + 0x32], ax
mov edx, dword [rsp + 0x30]
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea edx, [rbx + 0x20]
lea r8d, [rbx + 0x50]
lea rcx, [rsp + 0x40]
call fcn.00436350
test rdi, rdi
je 0x41ee9f
mov al, byte [rdi]
lea r9d, [rbx + 5]
cmp al, 0x30
jl 0x41ee72
mov rdx, rdi
cmp al, 0x39
jg 0x41ee6d
movsx eax, al
inc rdx
lea ecx, [rbp + rbp*4]
lea ebp, [rax + rcx*2 - 0x30]
mov al, byte [rdx]
inc ebx
cmp al, 0x30
jge 0x41ee53
cmp ebx, r9d
jg 0x41ee88
sub r9d, ebx
movsxd r8, ebx
mov rdx, rdi
movsxd rax, r9d
lea rcx, [rsp + rax + 0x40]
call fcn.0042ddd0
mov rax, rsi
lea rcx, [0x00445490]
imul rax, rax, 0xb0
add dword [rax + rcx + 0xc], ebp
jmp 0x41eecb
mov rax, rsi
lea rcx, [0x00445490]
imul rax, rax, 0xb0
mov r8d, dword [rax + rcx + 0xc]
test r8d, r8d
je 0x41eecb
lea rdx, [0x0040bc4c]
lea rcx, [rsp + 0x40]
call fcn.0042dc7c
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 6
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.0042d850
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret