joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f1860
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rsi, qword [0x14022c040]
mov byte [0x140263368], 1
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
xor eax, eax
mov rbx, rcx
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400f18d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.cannot_enable_large_OS_page_support__error__lu_n
call fcn.1400ed990
mov rax, qword [rsp + 0x68]
sub rax, qword [rsi]
jne 0x1400f19a0
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
xor ecx, ecx
lea r8, [rsp + 0x54]
lea rdi, [rsp + 0x50]
lea rdx, str.SeLockMemoryPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x1400f1908
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400f18a8
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x50], 1
mov r8, rdi
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400f1950
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400f18a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
test eax, eax
jne 0x1400f1980
test rbx, rbx
je 0x1400f1980
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov rcx, qword [rsp + 0x48]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400f18bc
mov dword [rsp + 0x3c], edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x3c]
test edx, edx
je 0x1400f18bc
jmp 0x1400f18b0
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
Function at 0x1400f19b0
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
lea rcx, [0x1401e6040]
jmp 0x1400f19b0
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, qword [0x14022c040]
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
xor eax, eax
mov eax, 0x100
mov byte [rcx + 0x1a], 1
mov rbx, rcx
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1400f19f1
mov qword [rbx], rax
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400f19fd
mov qword [rbx + 0x10], rax
mov rbp, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.kernelbase.dll
call rbp
mov rsi, rax
test rax, rax
je 0x1400f1a42
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAlloc2FromApp
mov rcx, rax
call r12
mov qword [0x1402633a8], rax
test rax, rax
je 0x1400f1b40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.ntdll.dll
call rbp
mov rsi, rax
test rax, rax
je 0x1400f1a73
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemoryEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov qword [0x1402633a0], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.kernel32.dll
call rbp
mov rsi, rax
test rax, rax
je 0x1400f1ae0
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumberEx
mov rcx, rax
call rbp
lea rdx, str.GetNumaProcessorNodeEx
mov rcx, rsi
mov qword [0x140263398], rax
call rbp
lea rdx, str.GetNumaNodeProcessorMaskEx
mov rcx, rsi
mov qword [0x140263390], rax
call rbp
mov rcx, rsi
lea rdx, str.GetNumaProcessorNode
mov qword [0x140263388], rax
call rbp
mov rcx, rsi
mov qword [0x140263380], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 6
call fcn.1400ed770
test al, al
jne 0x1400f1b18
mov ecx, 7
call fcn.1400ed770
test al, al
jne 0x1400f1b18
mov rax, qword [rsp + 0x58]
sub rax, qword [rdi]
jne 0x1400f1b59
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp byte [0x140263368], 0
jne 0x1400f1b30
lea rcx, [rbx + 8]
call fcn.1400f1860
jmp 0x1400f1afc
call fcn.1400edf60
jmp 0x1400f1afc
lea rdx, str.VirtualAlloc2
mov rcx, rsi
call r12
mov qword [0x1402633a8], rax
jmp 0x1400f1a39
call fcn.1401d96b0
nop
nop

Function at 0x1400f1df0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp r8b, 1
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
sbb eax, eax
and eax, 3
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, eax
xor eax, eax
test edx, edx
je 0x1400f1e40
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbx]
jne 0x1400f1e48
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400f1e2e
call fcn.1401d96b0
nop
nop
Function at 0x1400f1e50
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rdi, qword [0x14022c040]
mov rbp, qword [rsp + 0xf0]
mov rax, qword [rdi]
mov qword [rsp + 0x88], rax
xor eax, eax
cmp byte [0x140263368], 0
mov byte [r9], 1
mov r12, rcx
mov r13, rdx
mov ebx, r8d
jne 0x1400f1fc0
xor ecx, ecx
call fcn.1400f1860
mov rsi, qword [0x1402633a0]
pxor xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
test rsi, rsi
je 0x1400f1f63
cmp byte [0x1401e6068], 0
je 0x1400f1f63
mov byte [rsp + 0x50], 5
mov r14d, 1
mov qword [rsp + 0x58], 0x10
test ebx, ebx
js 0x1400f1ef5
mov byte [rsp + 0x60], 2
mov r14d, 2
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x30], r14d
mov r9d, 0x20003000
mov rcx, rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x20], 4
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rax
call rsi
mov edx, eax
test eax, eax
jne 0x1400f1f50
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400f1f50
mov qword [rbp], rax
jmp 0x1400f1f94
lea rcx, str.unable_to_allocate_using_huge__1GiB__pages__trying_large__2MiB__pages_instead__status_0x_lx__n
mov byte [0x1401e6068], 0
call fcn.1400ed990
mov rsi, qword [0x1402633a8]
test ebx, ebx
js 0x1400f1f73
test rsi, rsi
jne 0x1400f1fd0
mov r9d, 4
mov r8d, 0x20003000
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp], rax
test rax, rax
je 0x1400f2013
mov rax, qword [rsp + 0x88]
sub rax, qword [rdi]
jne 0x1400f2038
xor eax, eax
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.1400edf60
jmp 0x1400f1e9e
mov byte [rsp + 0x50], 2
mov dword [rsp + 0x58], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 1
mov r8, r13
mov rdx, r12
mov rcx, rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov r9d, 0x20003000
mov qword [rsp + 0x28], rax
call rsi
mov qword [rbp], rax
test rax, rax
jne 0x1400f1f94
mov rax, qword [rsp + 0x88]
sub rax, qword [rdi]
jne 0x1400f2038
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.1401d96b0
nop
nop
Function at 0x1400f2040
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [0x140263398]
test rax, rax
je 0x1400f20b0
cmp qword [0x140263390], 0
je 0x1400f20b0
lea rsi, [rsp + 0x24]
mov rcx, rsi
call rax
xor eax, eax
mov rcx, rsi
lea rdx, [rsp + 0x22]
mov word [rsp + 0x22], ax
xor esi, esi
call qword [0x140263390]
test eax, eax
je 0x1400f2095
movzx esi, word [rsp + 0x22]
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x1400f20e0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rsi
ret
xor esi, esi
cmp qword [0x140263380], 0
je 0x1400f2095
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov byte [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
movzx ecx, al
call qword [0x140263380]
test eax, eax
je 0x1400f2095
movzx esi, byte [rsp + 0x24]
jmp 0x1400f2095
call fcn.1401d96b0
nop
nop word cs:[rax + rax]

Function at 0x1400f20f0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, qword [0x14022c040]
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov ecx, dword [rsp + 0x24]
test ecx, ecx
je 0x1400f21b0
mov rsi, qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea rdi, [rsp + 0x28]
lea rbx, [rsp + 0x30]
jmp 0x1400f2163
movzx ecx, cx
mov rdx, rbx
call rax
test eax, eax
je 0x1400f2154
cmp qword [rsp + 0x30], 0
jne 0x1400f2190
mov eax, dword [rsp + 0x24]
lea ecx, [rax - 1]
mov dword [rsp + 0x24], ecx
test ecx, ecx
je 0x1400f21b0
mov rax, qword [0x140263388]
test rax, rax
jne 0x1400f2140
movzx ecx, cl
mov rdx, rdi
call rsi
test eax, eax
je 0x1400f2154
cmp qword [rsp + 0x28], 0
je 0x1400f2154
nop word cs:[rax + rax]
nop
mov eax, dword [rsp + 0x24]
add rax, 1
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rbp]
jne 0x1400f21b4
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
jmp 0x1400f2194
call fcn.1401d96b0
nop
nop word [rax + rax]

Function at 0x1400f21c0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [0x14022c040]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [0x140263358]
mov rbx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400f2210
mov rax, rbx
cqo
idiv rcx
mov rbx, rax
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x1400f225f
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r8, qword [rsp + 0x30]
movabs rax, 0x20c49ba5e353f7cf
imul r8
sar r8, 0x3f
mov rcx, rdx
sar rcx, 7
sub rcx, r8
je 0x1400f2258
mov rax, rbx
cqo
idiv rcx
mov rbx, rax
mov qword [0x140263358], rcx
jmp 0x1400f21fc
mov ecx, 1
jmp 0x1400f2248
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
Function at 0x1400f2270
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rsi, qword [0x14022c040]
mov rbp, qword [rsi]
mov qword [rsp + 0x98], rbp
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rcx
call rbp
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, rax
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov rdi, qword [0x140263378]
movabs rcx, 0x346dc5d63886594b
mov rax, rcx
mul qword [rsp + 0x30]
mov rax, rcx
shr rdx, 0xb
mov qword [rbx + 8], rdx
mul qword [rsp + 0x38]
shr rdx, 0xb
mov qword [rbx + 0x10], rdx
test rdi, rdi
je 0x1400f2370
mov qword [rsp + 0x90], 0
pxor xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call rbp
lea rdx, [rsp + 0x50]
mov r8d, 0x48
mov rcx, rax
call rdi
movdqu xmm0, xmmword [rsp + 0x58]
mov eax, dword [rsp + 0x54]
movdqu xmm1, xmmword [rsp + 0x88]
shufpd xmm0, xmm0, 1
mov qword [rbx + 0x38], rax
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm1
mov rax, qword [rsp + 0x98]
sub rax, qword [rsi]
jne 0x1400f23e2
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, qword [0x140263378]
test rax, rax
je 0x1400f23a3
lea rdx, str.GetProcessMemoryInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140263378], rax
mov rdi, rax
mov qword [rsp + 0x90], 0
pxor xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
test rdi, rdi
jne 0x1400f2318
pxor xmm1, xmm1
xor eax, eax
movdqa xmm0, xmm1
jmp 0x1400f2342
call fcn.1401d96b0
nop
nop dword [rax + rax]
Function at 0x1400f23f0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rdi, rcx
call fcn.1400ec9f0
mov ebx, eax
test al, al
jne 0x1400f2439
cmp qword [0x1401e6060], 0xffffffffffffffff
je 0x1400f2490
mov rcx, rdi
call fcn.1400edb90
mov edx, 0xfffffffd
mov r8, rax
lea rax, [rax - 1]
cmp rdx, rax
jae 0x1400f2450
mov rax, qword [rsp + 0x48]
sub rax, qword [rsi]
jne 0x1400f250b
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp byte [0x140263350], 0
mov dword [rsp + 0x30], 0
mov rcx, qword [0x1401e6060]
jne 0x1400f24d0
cmp rcx, 0xffffffffffffffff
je 0x1400f24f0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400f2439
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x1401e6060], rax
cmp rax, 0xffffffffffffffff
je 0x1400f24bb
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
setne bl
mov byte [0x140263350], bl
jmp 0x1400f2420
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x1400f2439
mov ecx, 2
call qword [fcn.1401de8b0]
mov rcx, rdi
mov rdx, rax
call fcn.1401deb18
jmp 0x1400f2439
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400f2520
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
mov byte [rdx], 0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test rdx, rdx
setne al
cmp rdx, rbx
setb dl
and eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400f5b10
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
pxor xmm1, xmm1
pxor xmm0, xmm0
cvtsi2sd xmm1, qword [0x14028b520]
ucomisd xmm1, xmm0
jp 0x1400f5b2e
je 0x1400f5b40
add rsp, 0x20
pop rbx
jmp fcn.1400f21c0
call fcn.1400f21c0
mov rbx, rax
call fcn.1400f21c0
sub rax, rbx
mov qword [0x14028b520], rax
add rsp, 0x20
pop rbx
jmp fcn.1400f21c0
Function at 0x1400f78e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [0x14022c040]
mov qword [rsp + 0x60], r8
mov ebx, ecx
mov rdi, rdx
mov qword [rsp + 0x68], r9
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rcx
mov ecx, ebx
call fcn.1400f7830
test eax, eax
je 0x1400f793d
shl rbx, 4
lea rax, str.addEmbeddedRepo
xor edx, edx
add rax, rbx
lea r9, [rsp + 0x60]
mov ecx, dword [rax + 8]
mov r8, qword [rax]
mov qword [rsp + 0x20], r9
test ecx, ecx
mov rcx, rdi
sete dl
call fcn.1400f75e0
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x1400f794f
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call fcn.1401d96b0
nop
nop word cs:[rax + rax]

Function at 0x1400fb280
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbx
mov r11, r8
mov r10, rdx
shr r11, 2
test r11d, r11d
jle 0x1400fb2e3
lea eax, [r11 - 1]
lea r9, [rdx + rax*4 + 4]
nop dword [rax]
movsx eax, byte [rdx + 1]
movsx ebx, byte [rdx + 2]
add rdx, 4
shl ebx, 0x10
shl eax, 8
or eax, ebx
movsx ebx, byte [rdx - 4]
or eax, ebx
movsx ebx, byte [rdx - 1]
shl ebx, 0x18
or eax, ebx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ecx
rol eax, 0xd
lea ecx, [rax + rax*4 - 0x19ab949c]
cmp rdx, r9
jne 0x1400fb2a0
mov rax, r8
movsxd r11, r11d
and eax, 3
lea r9, [r10 + r11*4]
cmp rax, 2
je 0x1400fb360
cmp rax, 3
je 0x1400fb348
cmp rax, 1
jne 0x1400fb31b
xor edx, edx
movsx eax, byte [r9]
xor eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor ecx, eax
xor ecx, r8d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
pop rbx
ret
movsx eax, byte [r9 + 2]
shl eax, 0x10
movsx edx, byte [r9 + 1]
shl edx, 8
xor edx, eax
jmp 0x1400fb304
xor eax, eax
jmp 0x1400fb350

Function at 0x1400fb5f0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbx
mov r11, r8
mov r10, rdx
shr r11, 2
test r11d, r11d
jle 0x1400fb653
lea eax, [r11 - 1]
lea r9, [rdx + rax*4 + 4]
nop dword [rax]
movzx eax, byte [rdx + 1]
movzx ebx, byte [rdx + 2]
add rdx, 4
shl ebx, 0x10
shl eax, 8
or eax, ebx
movzx ebx, byte [rdx - 4]
or eax, ebx
movzx ebx, byte [rdx - 1]
shl ebx, 0x18
or eax, ebx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ecx
rol eax, 0xd
lea ecx, [rax + rax*4 - 0x19ab949c]
cmp r9, rdx
jne 0x1400fb610
mov rax, r8
movsxd r11, r11d
and eax, 3
lea r9, [r10 + r11*4]
cmp rax, 2
je 0x1400fb6d0
cmp rax, 3
je 0x1400fb6b8
cmp rax, 1
jne 0x1400fb68b
xor edx, edx
movzx eax, byte [r9]
xor eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor ecx, eax
xor ecx, r8d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
pop rbx
ret
movzx eax, byte [r9 + 2]
shl eax, 0x10
movzx edx, byte [r9 + 1]
shl edx, 8
xor edx, eax
jmp 0x1400fb674
xor eax, eax
jmp 0x1400fb6c0
Function at 0x140106ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, qword [0x14022c040]
mov r13, qword [rsp + 0xb0]
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
mov eax, r8d
mov r12, rcx
mov rbx, rdx
mov rcx, qword [rsp + 0xb8]
mov esi, r8d
mov rdi, r9
and eax, 0xf000
cmp eax, 0xe000
je 0x140107008
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
xor rax, qword [0x14020c8a0]
xor rdx, qword [0x14020c8a8]
or rax, rdx
je 0x140106fb0
test r13, r13
je 0x140107060
call fcn.14012c2d0
movzx r9d, si
mov r8d, 1
mov rdx, rbx
mov r14, rax
mov rcx, rax
call fcn.14012c350
lea r9, [rsp + 0x30]
mov r8, r14
mov rdx, r13
mov rcx, r12
call fcn.140131cb0
mov rcx, r14
mov dword [rdi], eax
call fcn.14012c320
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rbp]
jne 0x14010709f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
xor rax, qword [0x14020c8b0]
xor rdx, qword [0x14020c8b8]
or rax, rdx
jne 0x140106f47
mov dword [r9], 0
mov rax, qword [rsp + 0x48]
sub rax, qword [rbp]
jne 0x14010709f
mov edx, 1
mov ecx, 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.1400bd320
mov rax, qword [0x14022c910]
mov rcx, rdx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
call fcn.140029ec0
mov rcx, rbx
lea rdx, [0x14020c649]
mov r8, rax
call fcn.14008fc00
mov rax, qword [rsp + 0x38]
xor edx, edx
mov rcx, rbx
mov dword [rdi], eax
call fcn.14008e600
jmp 0x140106f8f
mov r9, rdi
lea r8, [rsp + 0x2c]
mov rdx, rbx
mov rcx, r12
call fcn.1400344d0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401070a4
cmp dword [rsp + 0x2c], 3
je 0x140106f8f
mov rcx, rbx
call fcn.140029ec0
lea rcx, str.object__s_is_not_a_blob_
mov rdx, rax
call fcn.1400b6950
call fcn.1401d96b0
mov rcx, rbx
call fcn.140029ec0
lea rcx, [0x14020c637]
mov rbx, rax
mov rax, qword [str.PF__]
cmp dword [rax], 0
je 0x1401070ca
call fcn.1401d81b8
mov rcx, rax
mov rdx, rbx
call fcn.1400b6950
nop
nop word cs:[rax + rax]
nop
Function at 0x140109b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [r8 + 0x6d4]
test eax, 0x301
jne 0x140109b50
test al, 0x10
jne 0x140109b38
ret
mov r9, r8
mov r8d, 1
jmp fcn.140107910
jmp fcn.140106b80
Function at 0x140119200
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, qword [0x14022c040]
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
xor eax, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov esi, eax
test eax, eax
je 0x1401192a0
cmp eax, 3
jne 0x1401192aa
lea rsi, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x30], 0
mov rdx, rsi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
test eax, eax
je 0x1401192c8
or dword [rsp + 0x44], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x1401192c8
xor eax, eax
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rdi]
jne 0x1401192f7
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401192e9
mov r9d, esi
lea r8, str.unsupported_file_type:__lu
mov edx, 0x1d
lea rcx, str.compat_nonblock.c
call fcn.1400b6d50
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x140119287
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 9
jmp 0x1401192e2
call fcn.1401d96b0
nop
nop
nop
nop

Function at 0x140119300
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov ecx, 0xfffffff6
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x33]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140119378
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14011936c
movzx eax, byte [rsp + 0x33]
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbx]
jne 0x14011937f
add rsp, 0x40
pop rbx
ret
lea rcx, str.Unexpected_0_read
call fcn.1400b6bf0
mov eax, 0xffffffff
jmp 0x14011935c
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
add r8, 0x10
mov rcx, rdx
test r9, r9
mov rdx, r9
cmove rdx, r8
add rcx, 0x10
jmp sub.msvcrt.dll_strcmp

Function at 0x1401193b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r8d, 0xac
lea rdx, [0x14020e2c2]
lea rcx, [0x14020e2cd]
call qword [sym.imp.msvcrt.dll__assert]
nop
nop
Function at 0x1401193d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rsi, qword [0x14022c040]
mov edx, dword [0x1401e6768]
mov rax, qword [rsi]
mov qword [rsp + 0xa8], rax
xor eax, eax
test edx, edx
je 0x1401194b0
lea rdi, [rsp + 0x28]
mov ecx, 0xf
cmp qword [0x1401e6748], 0
rep stosq qword [rdi], rax
mov rax, qword [0x14022c410]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rax
jne 0x140119448
mov rax, qword [rsp + 0xa8]
sub rax, qword [rsi]
jne 0x140119522
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdi, [rsp + 0x20]
lea rdx, str.stty
mov rcx, rdi
lea rbp, [0x1401e6740]
call fcn.1400944f0
cmp qword [0x1401e6748], 0
je 0x140119493
xor ebx, ebx
nop
mov rax, rbx
mov rcx, rdi
add rbx, 1
shl rax, 4
add rax, qword [rbp]
mov rdx, qword [rax]
call fcn.1400944f0
cmp rbx, qword [0x1401e6748]
jb 0x140119470
mov rcx, rdi
call fcn.1400821c0
xor edx, edx
mov rcx, rbp
call fcn.1400936c0
jmp 0x140119425
call fcn.14008baf0
mov rcx, qword [0x1401e6720]
cmp rcx, 0xffffffffffffffff
je 0x140119425
mov edx, dword [0x14028b73c]
mov rdi, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call rdi
mov rcx, qword [0x1401e6720]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov edx, dword [0x14028b738]
test edx, edx
je 0x140119507
mov rcx, qword [0x1401e6718]
cmp rcx, 0xffffffffffffffff
je 0x140119527
call rdi
mov rcx, qword [0x1401e6718]
call rbx
mov qword [0x1401e6718], 0xffffffffffffffff
mov qword [0x1401e6720], 0xffffffffffffffff
jmp 0x140119425
call fcn.1401d96b0
mov r8d, 0x11c
lea rdx, str.compat_terminal.c
lea rcx, str.hconout___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
nop
nop word cs:[rax + rax]
nop dword [rax]
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1401193d0
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400d2380