joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.180025c30
test rax, rax
je 0x1800267f8
lea rdx, [rsp + 0x20]
mov word [rsp + 0x25], 0x6957
mov rcx, rax
mov dword [rsp + 0x20], 0x6e697242
mov dword [rsp + 0x27], 0x776f646e
mov dword [rsp + 0x2d], 0x706f54
mov byte [rsp + 0x24], 0x67
mov word [rsp + 0x2b], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180026810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.180025c30
test rax, rax
je 0x180026876
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2b], 0x776f646e
mov rcx, rax
mov dword [rsp + 0x25], 0x65766974
mov dword [rsp + 0x20], 0x41746553
mov word [rsp + 0x29], 0x6957
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x24], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180026890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.180025c30
test rax, rax
je 0x180026907
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x65726f46
mov rcx, rax
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180026920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.180025c30
test rax, rax
je 0x180026983
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x69577465
mov rcx, rax
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
Function at 0x1800271f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x31], 0x6e6f69
mov word [rsp + 0x2b], 0x6c61
mov word [rsp + 0x26], 0x6972
mov word [rsp + 0x23], 0x6576
mov word [rsp + 0x20], 0x654c
mov word [rsp + 0x28], 0x6974
mov byte [rsp + 0x25], 0x43
mov dword [rsp + 0x2d], 0x74636553
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x2a], 0x63
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180024dd6
lea rcx, [0x180063a30]
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
jmp 0x180024d60
Function at 0x140001000
Capabilities:
Parse pe header

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [0x1400a8028]
mov dword [rax], 1
mov rax, qword [0x1400a8030]
mov dword [rax], 1
mov rax, qword [0x1400a8038]
mov dword [rax], 1
mov rcx, qword [0x1400a8008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x14000108b
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14000108b
add rcx, rdx
movzx edx, word [rcx + 0x18]
cmp edx, 0x20b
je 0x140001073
cmp edx, 0x10b
jne 0x14000108b
cmp dword [rcx + 0x74], 0xf
jb 0x14000108b
add rcx, 0xe8
jmp 0x140001083
cmp dword [rcx + 0x84], 0xf
jb 0x14000108b
add rcx, 0xf8
xor eax, eax
cmp dword [rcx], 0
setne al
mov rcx, qword [0x1400a8020]
cmp dword [rcx], 1
mov dword [0x1400d4464], eax
mov ecx, 2
sbb ecx, 0
call sym._set_app_type
mov rax, qword [0x1400a8088]
mov esi, dword [rax]
call sym.__p__fmode
mov dword [rax], esi
mov rax, qword [0x1400a8078]
mov esi, dword [rax]
call sym.__p__commode
mov dword [rax], esi
call dbg._setargv
mov rax, qword [section..rdata]
cmp dword [rax], 1
jne 0x1400010e5
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x140001160
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x1400a8048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
je 0x1400011b9
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
jne 0x1400011a0
mov rdi, qword [0x1400a8050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x1400011d3
mov ecx, 0x1f
call dbg._amsg_exit
jmp 0x1400011fa
cmp dword [rdi], 0
je 0x1400011e1
mov byte [0x1400d4480], 1
jmp 0x1400011fa
mov dword [rdi], 1
mov rcx, qword [0x1400a8068]
mov rdx, qword [0x1400a8070]
call sym._initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x14000121a
mov rcx, qword [0x1400a8058]
mov rdx, qword [0x1400a8060]
call sym._initterm
mov dword [rdi], 2
test bl, bl
je 0x140001223
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x1400a8010]
mov rax, qword [rax]
test rax, rax
je 0x140001242
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call qword [0x1400b91b0]
call dbg._pei386_runtime_relocator
lea rcx, [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x1400a8040]
mov qword [rcx], rax
lea rcx, [dbg.__mingw_invalidParameterHandler]
call sym._set_invalid_parameter_handler
call dbg._fpreset
movsxd rdi, dword [0x1400d446c]
lea rcx, [rdi*8 + 8]
call sym.malloc
mov rsi, rax
test rdi, rdi
jle 0x1400012d4
mov r14d, edi
mov r15, qword [0x1400d4470]
xor r12d, r12d
nop dword [rax + rax]
mov rdi, qword [r15 + r12*8]
mov rcx, rdi
call sym.strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sym.malloc
mov qword [rsi + r12*8], rax
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call sym.memcpy
inc r12
cmp r14, r12
jne 0x1400012a0
jmp 0x1400012d7
xor r14d, r14d
mov qword [rsi + r14*8], 0
mov qword [0x1400d4470], rsi
call dbg.__main
mov r8, qword [0x1400d4478]
mov rax, qword [0x1400a8018]
mov rax, qword [rax]
mov qword [rax], r8
mov ecx, dword [0x1400d446c]
mov rdx, qword [0x1400d4470]
call sym.main
mov dword [0x1400d4484], eax
cmp dword [0x1400d4464], 0
je 0x140001342
cmp byte [0x1400d4480], 0
jne 0x140001334
call sym._cexit
mov eax, dword [0x1400d4484]
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, eax
call sym.exit
int3
Function at 0x140001c40
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x1a8
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ecx, ecx
mov dword [rsp + 0x38], ecx
call rax
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x30], rdx
mov r8d, 0x104
call rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x88]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ne180100ILi0EEEPKc
mov r8d, dword [rsp + 0x38]
lea rdx, str.C:_A_Za_z0_9__7__.exe_
lea rcx, [rsp + 0x48]
call method.std::__1::basic_regex_char__std::__1::regex_traits_char___.basic_regex_abi:ne180100__char_const__std::__1::regex_constants::syntax_option_type_
jmp 0x140001ca2
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x48]
xor r8d, r8d
call sym._ZNSt3__111regex_matchB8ne180100INS_11char_traitsIcEENS_9allocatorIcEEcNS_12regex_traitsIcEEEEbRKNS_12basic_stringIT1_T_T0_EER
mov byte [rsp + 0x2f], al
jmp 0x140001cc0
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140001cd1
jmp 0x140001d0b
mov ecx, 1
call sym.exit
mov rcx, rax
mov eax, edx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x3c], eax
jmp 0x140001d3a
call sym.run__
jmp 0x140001d15
jmp 0x140001d1a
lea rcx, [rsp + 0x48]
call method.std::__1::basic_regex_char__std::__1::regex_traits_char___.basic_regex__
lea rcx, [rsp + 0x88]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.basic_string__
nop
add rsp, 0x1a8
ret
lea rcx, [rsp + 0x88]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.basic_string__
mov rcx, qword [rsp + 0x40]
call sym._Unwind_Resume
int3

Function at 0x140001d60
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
call dbg.__main
mov dword [rbp - 4], 0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [rbp - 6], ax
movzx eax, word [rbp - 6]
and eax, 0x3ff
cmp eax, 4
jne 0x140001d9c
call sym.Checkvb__
jmp 0x140001da6
mov ecx, 1
call sym.exit
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x1400426d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
cmp qword [rcx + 0x78], 0
je 0x1400428e8
mov rsi, rcx
test byte [rcx + 0x9c], 0x10
jne 0x14004271f
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
mov rax, qword [rsi + 0x60]
cmp rax, 9
jb 0x14004276a
cmp byte [rsi + 0xa2], 0
je 0x14004277e
mov r12, qword [rsi + 0x40]
jmp 0x140042786
mov r12, qword [rsi + 0x28]
mov r15, qword [rsi + 0x38]
mov r9, qword [rsi + 0x30]
cmp edx, 0xffffffff
je 0x1400427ac
test r9, r9
jne 0x14004274b
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x43]
mov qword [rsi + 0x30], r9
mov qword [rsi + 0x28], r9
mov qword [rsi + 0x38], rax
mov byte [r9], dl
mov r8, qword [rsi + 0x28]
mov r9, qword [rsi + 0x30]
inc r9
mov qword [rsi + 0x30], r9
mov rdi, r9
sub rdi, r8
jne 0x1400427b7
jmp 0x1400427f9
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x38], 0
xor r15d, r15d
xor r12d, r12d
jmp 0x140042799
mov r12, qword [rsi + 0x68]
mov rax, qword [rsi + 0x70]
lea r15, [r12 + rax]
dec r15
mov qword [rsi + 0x30], r12
mov qword [rsi + 0x28], r12
mov qword [rsi + 0x38], r15
mov dword [rsi + 0x9c], 0x10
mov r9, qword [rsi + 0x30]
cmp edx, 0xffffffff
jne 0x140042730
mov r8, r12
mov rdi, r9
sub rdi, r8
je 0x1400427f9
mov dword [rsp + 0x44], edx
cmp byte [rsi + 0xa2], 0
je 0x140042806
mov r9, qword [rsi + 0x78]
mov edx, 1
mov rcx, r8
mov r8, rdi
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, rdi
jne 0x1400428ed
mov qword [rsi + 0x30], r12
mov qword [rsi + 0x28], r12
mov qword [rsi + 0x38], r15
mov edx, dword [rsp + 0x44]
xor eax, eax
cmp edx, 0xffffffff
cmovne eax, edx
jmp 0x1400428ed
mov rax, qword [rsi + 0x40]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsi + 0x80]
test rcx, rcx
je 0x1400428c2
lea rdi, [rsi + 0x88]
lea r13, [rsp + 0x50]
lea rbp, [rsp + 0x48]
mov rdx, qword [rsi + 0x40]
mov r10, qword [rsi + 0x60]
add r10, rdx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbp
mov rdx, rdi
call qword [0x1400b91b0]
mov rcx, qword [rsi + 0x28]
cmp qword [rsp + 0x48], rcx
je 0x1400428e8
mov ebx, eax
cmp eax, 3
je 0x1400428c7
cmp ebx, 1
ja 0x1400428e8
mov r14, qword [rsp + 0x50]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sym.fwrite
cmp rax, r14
jne 0x1400428e8
cmp ebx, 1
jne 0x1400427e9
mov r8, qword [rsp + 0x48]
mov r9, qword [rsi + 0x30]
mov qword [rsi + 0x28], r8
mov qword [rsi + 0x38], r9
mov rcx, qword [rsi + 0x80]
test rcx, rcx
jne 0x140042830
call method.std::__1.__throw_bad_cast_abi:ne180100___
mov rdi, qword [rsi + 0x30]
mov r9, qword [rsi + 0x78]
sub rdi, rcx
mov edx, 1
mov r8, rdi
call sym.fwrite
cmp rax, rdi
je 0x1400427e9
mov eax, 0xffffffff
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140042bb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
xor eax, eax
cmp qword [rcx + 0x78], 0
je 0x140042d06
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x140042d8f
mov edx, dword [rsi + 0x9c]
test dl, 0x10
jne 0x140042c15
test dl, 8
je 0x140042d06
mov rax, qword [rsi + 0x90]
mov qword [rsp + 0x28], rax
cmp byte [rsi + 0xa2], 0
je 0x140042cbb
mov rdi, qword [rsi + 0x20]
sub rdi, qword [rsi + 0x18]
jmp 0x140042ce8
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x140042c44
mov rax, qword [rsi]
mov rax, qword [rax + 0x68]
mov rcx, rsi
mov edx, 0xffffffff
call qword [0x1400b91b0]
mov ecx, eax
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x140042d06
lea rdi, [rsi + 0x88]
lea r15, [rsp + 0x28]
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [0x1400b91b0]
mov ebx, eax
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sym.fwrite
cmp rax, r14
jne 0x140042d01
cmp ebx, 1
je 0x140042c50
cmp ebx, 2
je 0x140042d01
mov rcx, qword [rsi + 0x78]
call sym.fflush
mov ecx, eax
mov eax, 0
test ecx, ecx
jne 0x140042d01
jmp 0x140042d06
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [0x1400b91b0]
mov r9, qword [rsi + 0x48]
mov rdi, qword [rsi + 0x50]
sub rdi, r9
test eax, eax
jle 0x140042d4b
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rdi, rcx
xor ebx, ebx
mov rcx, qword [rsi + 0x78]
neg edi
mov edx, edi
mov r8d, 1
call sym.fseek
test eax, eax
je 0x140042d12
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test bl, bl
je 0x140042d22
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x88], rax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x9c], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
xor eax, eax
jmp 0x140042d06
mov rdx, qword [rsi + 0x18]
cmp rdx, qword [rsi + 0x20]
je 0x140042ce8
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rdx, qword [rsi + 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x28]
call qword [0x1400b91b0]
mov eax, eax
add rdi, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rdi, rax
mov bl, 1
jmp 0x140042cea
call method.std::__1.__throw_bad_cast_abi:ne180100___
int3
Function at 0x140044900
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rdi, [rsp + 0x38]
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
nop
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], r15
mov r8, rbx
mov r9, rdi
call qword [0x1400b91b0]
mov ebp, eax
mov r14, qword [rsp + 0x28]
sub r14, rbx
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r14
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, r14
jne 0x140044986
cmp ebp, 1
je 0x140044920
cmp ebp, 2
je 0x140044986
mov rcx, qword [rsi + 0x40]
call sym.fflush
mov ecx, eax
xor eax, eax
neg ecx
sbb eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400449a0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov r14, rcx
cmp byte [rcx + 0x58], 0
je 0x1400449d5
mov r9, qword [r14 + 0x40]
mov edx, 1
mov rcx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.fwrite
xor ebx, ebx
test rsi, rsi
jle 0x140044a04
nop dword [rax]
movzx edx, byte [rdi + rbx]
mov rax, qword [r14]
mov rax, qword [rax + 0x68]
mov rcx, r14
call qword [0x1400b91b0]
cmp eax, 0xffffffff
je 0x140044a04
inc rbx
cmp rsi, rbx
jne 0x1400449e0
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140044a20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp edx, 0xffffffff
je 0x140044a74
mov esi, edx
mov rdi, rcx
mov byte [rsp + 0x4f], sil
cmp byte [rcx + 0x58], 0
je 0x140044a7b
mov r9, qword [rdi + 0x40]
mov byte [rsp + 0x50], sil
lea rcx, [rsp + 0x50]
mov edx, 1
mov r8d, 1
call sym.fwrite
cmp rax, 1
mov eax, 0xffffffff
cmovne esi, eax
jmp 0x140044b33
xor esi, esi
jmp 0x140044b33
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
lea r15, [rsp + 0x4f]
lea r12, [rsp + 0x58]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x58]
nop dword [rax]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, r15
lea r9, [rsp + 0x50]
call qword [0x1400b91b0]
cmp qword [rsp + 0x58], r15
je 0x140044b2e
mov ebp, eax
cmp eax, 3
je 0x140044b11
cmp ebp, 1
ja 0x140044b2e
mov r15, qword [rsp + 0x60]
sub r15, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r15
call sym.fwrite
cmp rax, r15
jne 0x140044b2e
mov r15, qword [rsp + 0x58]
cmp ebp, 1
je 0x140044aa0
jmp 0x140044b33
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, r15
call sym.fwrite
cmp rax, 1
je 0x140044b33
mov esi, 0xffffffff
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140044f50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rdi, [rsp + 0x38]
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
nop
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], r15
mov r8, rbx
mov r9, rdi
call qword [0x1400b91b0]
mov ebp, eax
mov r14, qword [rsp + 0x28]
sub r14, rbx
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r14
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, r14
jne 0x140044fd6
cmp ebp, 1
je 0x140044f70
cmp ebp, 2
je 0x140044fd6
mov rcx, qword [rsi + 0x40]
call sym.fflush
mov ecx, eax
xor eax, eax
neg ecx
sbb eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140045050
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp dx, 0xffff
je 0x140045094
mov esi, edx
mov rdi, rcx
mov word [rsp + 0x4e], dx
cmp byte [rcx + 0x58], 0
je 0x14004509b
mov rdx, qword [rdi + 0x40]
mov ecx, esi
call sym.fputwc
cmp ax, 0xffff
mov eax, 0xffff
cmovne eax, esi
mov esi, eax
jmp 0x140045152
xor esi, esi
jmp 0x140045152
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x58], rbx
lea r15, [rsp + 0x4e]
lea r12, [rsp + 0x68]
lea r13, [rsp + 0x58]
lea r14, [rsp + 0x50]
nop dword [rax]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, r15
lea r9, [rsp + 0x50]
call qword [0x1400b91b0]
cmp qword [rsp + 0x50], r15
je 0x14004514e
mov ebp, eax
cmp eax, 3
je 0x140045131
cmp ebp, 1
ja 0x14004514e
mov r15, qword [rsp + 0x58]
sub r15, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r15
call sym.fwrite
cmp rax, r15
jne 0x14004514e
mov r15, qword [rsp + 0x50]
cmp ebp, 1
je 0x1400450c0
jmp 0x140045152
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, r15
call sym.fwrite
cmp rax, 1
je 0x140045152
mov si, 0xffff
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140045330
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, r8
je 0x140045358
movabs rcx, 0xf000000000000000
mov r9, r8
sub r9, rdx
dec r8
cmp r8, rdx
jne 0x14004535b
xor r8d, r8d
test r9b, 1
jne 0x1400453be
jmp 0x1400453d5
xor eax, eax
ret
mov r8, r9
and r8, 0xfffffffffffffffe
xor eax, eax
nop word cs:[rax + rax]
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rax, r10
shr rax, 0x38
and eax, 0xfffffff0
xor rax, r10
shl rax, 4
movsx r10, byte [rdx + 1]
add r10, rax
mov r11, r10
and r11, rcx
mov rax, r11
shr rax, 0x38
or rax, r11
xor rax, r10
add rdx, 2
add r8, 0xfffffffffffffffe
jne 0x140045370
mov r8, rax
shl r8, 4
test r9b, 1
je 0x1400453d5
movsx rax, byte [rdx]
add r8, rax
and rcx, r8
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r8
ret
Function at 0x140045540
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140045587
movabs rcx, 0xf000000000000000
nop word cs:[rax + rax]
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x140045560
ret

Function at 0x14007d950
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sym.__acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sym.fwrite
mov ecx, 2
call sym.__acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call dbg.vfprintf
call sym.abort
int3

Function at 0x14007f2c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sym.fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call dbg.vfprintf
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sym.fputc
call sym.abort
int3

Function at 0x14007fb30
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
call sym.logAPIs
test al, al
je 0x14007fb83
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0llx__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call dbg.fprintf
mov ecx, 2
call r14
mov rcx, rax
call sym.fflush
mov rcx, rbx
mov edx, edi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.__unw_set_reg

Function at 0x14007fc10
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call sym.logAPIs
test al, al
je 0x14007fc58
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call dbg.fprintf
mov ecx, 2
call rbx
mov rcx, rax
call sym.fflush
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.__unw_set_reg