joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bd98c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400bda13
mov rsi, rbx
cmp word [rax], bp
je 0x1400bd9d2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400bd9bc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400bd9b8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400b2ef8
mov rdi, rax
test rax, rax
je 0x1400bda00
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400c27d0
mov rbp, rdi
xor ecx, ecx
call fcn.1400b2cb8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c1c80
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400b7ab8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400b7ab8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400c1dd0
cmp rax, 0xffffffffffffffff
je 0x1400c1dd0
xor edi, edi
test rbp, rbp
jle 0x1400c1d7b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400b46fc
mov rbx, rax
test rax, rax
jne 0x1400c1d08
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400c1d71
mov edx, 0x8000
mov ecx, r14d
call fcn.1400b1db8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400b6208
cmp eax, 0xffffffff
je 0x1400c1d51
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400c1d18
mov edx, r15d
mov ecx, r14d
call fcn.1400b1db8
jmp 0x1400c1d71
cmp byte [rsi + 0x38], dil
je 0x1400c1d68
cmp dword [rsi + 0x34], 5
jne 0x1400c1d68
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayDestroy
cmp byte [rsi + 0x30], dil
je 0x1400c1d71
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400b2cb8
jmp 0x1400c1de4
jns 0x1400c1de4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400b7ab8
cmp rax, 0xffffffffffffffff
jne 0x1400c1d9c
cmp byte [rsi + 0x30], dil
je 0x1400c1de4
mov edi, dword [rsi + 0x2c]
jmp 0x1400c1de4
mov ecx, r14d
call fcn.1400bdfd8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400c1de4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, SafeArrayDestroy
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayDestroy
jmp 0x1400c1de4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400c1ddd
mov eax, dword [rsi + 0x2c]
jmp 0x1400c1de2
mov eax, SafeArrayUnaccessData
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400b7ab8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400c2300
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c2328
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400c2328
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000fef0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000ff00]
mov dword [rax], 1
mov rax, qword [0x14000ff10]
mov dword [rax], 1
mov rax, qword [0x14000fe80]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14000fee0]
mov dword [0x14001300c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14000ffc0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14000ffa0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x14000fe30]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140003f80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140003f98
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140003fa0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140003fb0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx r8d, word [rcx + 6]
movzx eax, word [rcx + 0x14]
test r8w, r8w
lea rax, [rcx + rax + 0x18]
je 0x140003ffd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rdx, r8
mov rcx, r8
jb 0x140003ff4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140003fff
add rax, 0x28
cmp rax, r9
jne 0x140003fe0
xor eax, eax
ret

Function at 0x140004000
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140004090
mov rdx, qword [0x14000fe80]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000407e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000407e
cmp word [rax + 0x18], 0x20b
jne 0x14000407e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140004090
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140004069
add rbx, 0x28
cmp rbx, rdi
je 0x140004090
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140004060
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400040a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000fe80]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400040c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400040c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400040c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000411d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140004114
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400040c0
add rax, 0x28
cmp rax, r9
jne 0x140004100
xor eax, eax
ret

Function at 0x140004120
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000fe80]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000413f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140004148
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000413f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140004160
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14000fe80]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140004180
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140004188
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140004180
movzx r8d, word [rdx + 6]
movzx eax, word [rdx + 0x14]
test r8w, r8w
lea rax, [rdx + rax + 0x18]
je 0x1400041d0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400041c7
test rcx, rcx
je 0x140004180
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400041b8
xor eax, eax
ret

Function at 0x1400041e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000fe80]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400041ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140004208
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140004220
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000fe80]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140004240
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140004248
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140004240
movzx r9d, word [r8 + 6]
sub rcx, rdx
movzx edx, word [r8 + 0x14]
test r9w, r9w
lea rdx, [r8 + rdx + 0x18]
je 0x140004240
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140004294
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400042a0
add rdx, 0x28
cmp r9, rdx
jne 0x140004280
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400042b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14000fe80]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400042d2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400042e0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400042d2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400042d2
movzx r10d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
test r10w, r10w
lea rdx, [r8 + rdx + 0x18]
je 0x1400042d2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov r8, r9
jb 0x140004335
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140004348
add rdx, 0x28
cmp rdx, r10
jne 0x140004320
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140004357
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140004367
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000433e
test ecx, ecx
jg 0x140004350
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14000b740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rcx
mov eax, 0xffffffff
test rdx, rdx
je 0x14000b77f
lea r11, [0x140024230]
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [r10]
lea r10, [r10 + 1]
mov r8d, eax
shr eax, 8
xor r9, r8
movzx ecx, r9b
xor eax, dword [r11 + rcx*4]
sub rdx, 1
jne 0x14000b760
not eax
ret

Function at 0x14000b7a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test r8, r8
je 0x14000b7ce
lea r10, [0x140024230]
nop dword [rax]
movzx r9d, byte [rdx]
lea rdx, [rdx + 1]
mov eax, ecx
shr ecx, 8
xor r9, rax
movzx eax, r9b
xor ecx, dword [r10 + rax*4]
sub r8, 1
jne 0x14000b7b0
mov eax, ecx
ret
Function at 0x14000c9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x140024760]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x14000cb1c
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x14000cb10
cmp dword [r10 + r8*4], ecx
jle 0x14000cb2b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x14000cb22
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x14000cb52
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14000cb95
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x14000cb91
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x14000cb95
mov al, 1
jmp 0x14000cb97
xor al, al
test al, al
lea rdx, [0x140024720]
movzx eax, al
lea r10, [0x140024740]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x14000cbf1
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x14000cbe0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x140010530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x140010579
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x14001058f
mov r10b, 1
jmp 0x140010598
cmp cl, 0x2d
jne 0x1400105a1
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x140010582
lea rbx, [0x140000000]
test edx, edx
jne 0x1400105f6
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x14001062e
cmp r8d, 1
jbe 0x1400105e1
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x1400105e1
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0x253b0], 0x10
jae 0x1400105e1
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x14001062e
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0x253b0], 8
jae 0x14001062e
mov edi, 8
jmp 0x14001062e
mov edi, edx
cmp edx, 0x10
jne 0x14001062e
cmp byte [rax], 0x30
jne 0x14001062e
cmp r8d, 1
jbe 0x14001062e
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x140010616
cmp cl, 0x58
jne 0x14001062e
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0x253b0], 0x10
jae 0x14001062e
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0x254b0]
mov rbx, r9
test r8d, r8d
je 0x140010697
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x14001068d
movzx esi, byte [rcx + r13 + 0x253b0]
cmp esi, edi
jae 0x14001068d
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x14001067e
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x140010684
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x140010651
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x1400106ba
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x1400106c3
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x1400106e6
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x140010733
cmp byte [rax], r9b
je 0x140010733
test r8d, r8d
je 0x140010733
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14001070d
cmp cl, 9
jne 0x140010720
inc rax
add r8d, 0xffffffff
jne 0x140010700
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x140010716
test cl, cl
je 0x140010716
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x140019c50
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], r9
mov r9d, edx
mov rdx, rcx
lea rcx, str._n__Assertion_Failed___nExpression:__s_nLocation__:__s__d___s_n
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x38
ret

Function at 0x140019c70
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x128
mov r9, r8
lea rcx, [rsp + 0x20]
mov r8, rdx
mov edx, 0xff
call sym.VBoxNetAdp.sys_RTStrPrintfV
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x11f], 0
lea rcx, [0x1400225bc]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x128
ret

Function at 0x140019cf0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x70
xor esi, esi
mov qword [r11 - 0x48], rcx
mov dword [rsp + 0x40], 0x30
lea rax, [0x140019cb0]
mov qword [r11 - 0x30], rsi
lea r8, [r11 - 0x38]
mov dword [rsp + 0x58], 0x200
lea rcx, [r11 + 0x18]
mov rdi, rdx
mov qword [r11 - 0x28], rsi
xorps xmm0, xmm0
mov qword [r11 - 0x50], rax
xor r9d, r9d
mov qword [r11 + 0x18], rsi
mov edx, 0x1fffff
mov qword [r11 - 0x58], rsi
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
js 0x140019da3
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test eax, eax
js 0x140019da3
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, qword [rsp + 0x98]
mov qword [rdi], rax
mov ecx, ebx
call sym.VBoxNetAdp.sys_RTErrConvertFromNtStatus
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400c5290]
mov dword [rax], 1
mov rax, qword [0x1400c52a0]
mov dword [rax], 1
mov rax, qword [0x1400c52b0]
mov dword [rax], 1
mov rax, qword [0x1400c5280]
mov dword [rax], 1
mov rax, qword [0x1400c5120]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140007e76
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call sym.nimErrorFlag_6
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp + 0x20]
je 0x140007ee4
mov rcx, qword [rbp + 0x10]
call sym.checkErr__stdZsyncio_u162
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jmp 0x140007ee5
nop
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret

Function at 0x140009363
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.strlen
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0
mov rdx, qword [rbp - 8]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x14], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0x14], eax
nop
add rsp, 0x40
pop rbp
ret
Function at 0x1400134bf
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140016a79
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, [0x1400afb58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_7
call sym.nimErrorFlag_7
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xb38
lea rax, [0x1400d4180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0x12
lea rax, [0x1400b02e0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0x13
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x140016bd1
mov qword [rbp - 0x50], 0xb39
lea rax, [0x1400afb58]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x140016b3d
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x140016b56
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x140016c62
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x70]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u8981
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x140016c61
mov qword [rbp - 0x50], 0xd
lea rax, [0x1400b02e0]
mov qword [rbp - 0x48], rax
add qword [rbp - 8], 1
jmp 0x140016b0b
nop
mov qword [rbp - 0x50], 0xb54
lea rax, [0x1400afb58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x1400afb49]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xb55
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xb59
lea rax, [0x1400d4180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140016c62
nop
call sym.popFrame_7
nop
add rsp, 0x90
pop rbp
ret