joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140161a80
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104
mov dword [rsp + 0x34], 0x200
call fcn.1401618f0
test eax, eax
jne 0x140161c7f
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x160], rdi
call fcn.140144bc0
xor esi, esi
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x40]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rsi
test eax, eax
je 0x140161b47
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov rcx, rdi
add rcx, rcx
call fcn.14010cd34
mov rbx, rax
test rax, rax
je 0x140161b8e
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140161bd3
mov rcx, rbx
call fcn.14010cdec
mov ebx, esi
jmp 0x140161bd3
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rcx, rbx
add rcx, rcx
call fcn.14010cd34
mov rdi, rax
test rax, rax
je 0x140161b8e
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
test eax, eax
jne 0x140161bc3
call fcn.14010cdec
mov eax, 0x200
mov rsi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x168
ret
call fcn.140144e10
mov rcx, rdi
mov rbx, rax
call fcn.14010cdec
test rbx, rbx
je 0x140161b8e
call fcn.140144bc0
test eax, eax
mov rax, rbx
je 0x140161c29
cmp word [rbx], 0
je 0x140161c05
nop word [rax + rax]
cmp word [rax], 0x5c
je 0x140161c02
add rax, 2
cmp word [rax], 0
jne 0x140161bf0
jmp 0x140161c05
mov word [rax], si
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x140161c64
cmp byte [rbx], 0
je 0x140161c42
nop
cmp byte [rax], 0x5c
je 0x140161c3f
inc rax
cmp byte [rax], 0
jne 0x140161c30
jmp 0x140161c42
mov byte [rax], 0
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov rcx, rbx
mov edi, eax
call fcn.14010cdec
test edi, edi
je 0x140161b8e
mov eax, dword [rsp + 0x34]
jmp 0x140161b93
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x168
ret
Function at 0x1401671d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
sub rsp, 0x30
mov rax, qword [rcx]
xor r13d, r13d
mov rsi, rdx
test dword [rax + 0x18], 0x4000000
mov rbp, rcx
mov ebx, r13d
je 0x140167351
mov r9, qword [rdx + 0x38]
test r9, r9
je 0x140167238
mov eax, dword [r9 + 0x28]
test eax, eax
jle 0x14016722f
lea rdx, [r9 + 0x40]
mov r8d, eax
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x14016721d
or eax, 0xffffffff
jmp 0x140167224
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 0x10
dec r8
jne 0x140167211
mov r9, qword [r9 + 8]
test r9, r9
jne 0x140167202
mov r10, qword [rsi]
mov r8, r10
test r10, r10
jne 0x140167248
mov r8d, r13d
jmp 0x140167262
cmp byte [r10], r13b
je 0x140167258
nop dword [rax]
inc r8
cmp byte [r8], r13b
jne 0x140167250
sub r8d, r10d
and r8d, 0x3fffffff
mov r11, qword [rsi + 0x78]
mov qword [rsp + 0x58], rdi
cmp qword [r11 + 0x60], r13
je 0x1401672be
mov edx, r8d
mov rdi, r10
mov r9d, r13d
test r8d, r8d
jle 0x1401672b3
mov qword [rsp + 0x60], r12
lea r12, [0x1402454a0]
nop dword [rax + rax]
movzx eax, byte [rdi]
dec edx
inc rdi
movzx ecx, byte [rax + r12]
lea eax, [r9*8]
xor ecx, eax
xor r9d, ecx
test edx, edx
jg 0x140167290
mov r12, qword [rsp + 0x60]
xor edx, edx
mov eax, r9d
div dword [r11 + 0x50]
jmp 0x1401672c1
mov edx, r13d
mov r9d, edx
lea rcx, [r11 + 0x50]
mov rdx, r10
call fcn.1401449e0
test rax, rax
je 0x14016733c
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x14016733c
nop
lea r9, [rsp + 0x50]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x20], r13
call fcn.140166ec0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140167333
mov eax, dword [rdx + 8]
test eax, eax
jle 0x140167333
mov rdx, qword [rdx + 0x10]
mov r8d, eax
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x140167321
or eax, 0xffffffff
jmp 0x140167328
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 4
dec r8
jne 0x140167315
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x1401672e0
mov eax, ebx
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rsi
pop rbp
ret
Function at 0x14016c3e0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor eax, eax
lea rcx, [0x1402c45a0]
mov qword [0x1402c45a0], rax
mov qword [0x1402c45a8], rax
mov qword [0x1402c45b0], rax
mov qword [0x1402c45b8], rax
mov qword [0x1402c45c0], rax
mov qword [0x1402c45c8], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.140191d70
test eax, eax
jne 0x14016c4d5
cmp dword [0x1402bc304], eax
mov qword [rsp + 0x20], rbx
jne 0x14016c43b
xor ebx, ebx
jmp 0x14016c457
mov ecx, 2
call qword [0x1402bc370]
mov rbx, rax
test rax, rax
je 0x14016c457
mov rcx, rax
call qword [0x1402bc380]
mov rcx, qword [0x1402c43a0]
lea r9, [0x1402bc710]
cmp rcx, r9
jne 0x14016c473
mov rcx, qword [0x1402bc720]
jmp 0x14016c4ad
test rcx, rcx
je 0x14016c4ad
cmp qword [rcx + 0x10], 0
lea rax, [rcx + 0x10]
mov rdx, rcx
je 0x14016c49c
mov r8, qword [rax]
cmp r8, r9
je 0x14016c49c
cmp qword [r8 + 0x10], 0
lea rax, [r8 + 0x10]
mov rdx, r8
jne 0x14016c486
cmp qword [rdx + 0x10], r9
jne 0x14016c4ad
mov rax, qword [0x1402bc720]
mov qword [rdx + 0x10], rax
mov qword [0x1402bc720], rcx
mov qword [0x1402c43a0], r9
test rbx, rbx
je 0x14016c4c9
mov rcx, rbx
call qword [0x1402bc390]
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140171220
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x38
movsxd rdi, edx
mov rbx, rcx
test edx, edx
js 0x140171262
mov rcx, qword [rcx + 0x10]
mov rax, rdi
shl rax, 5
mov rcx, qword [rax + rcx + 0x18]
call fcn.140166400
cmp edi, 1
je 0x140171434
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x38]
add rsp, 0x38
pop rdi
pop rbx
jmp fcn.140166400
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
call fcn.140149960
xor edi, edi
cmp dword [rbx + 8], edi
jle 0x1401712ae
xor esi, esi
nop dword [rax]
mov rax, qword [rbx + 0x10]
mov rcx, qword [rsi + rax + 0x18]
test rcx, rcx
je 0x1401712a3
call fcn.140166400
inc edi
add rsi, 0x20
cmp edi, dword [rbx + 8]
jl 0x140171290
and dword [rbx + 0x18], 0xfffffdff
mov rcx, rbx
call fcn.140150b30
xor esi, esi
cmp dword [rbx + 8], esi
jle 0x14017130b
xor ebp, ebp
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
mov rdi, qword [rax + rbp + 8]
test rdi, rdi
je 0x140171300
cmp byte [rdi + 0x11], 0
je 0x140171300
dec dword [rdi + 0x14]
jne 0x140171300
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x1401712fc
call qword [0x1402bc390]
mov byte [rdi + 0x12], 0
inc esi
add rbp, 0x20
cmp esi, dword [rbx + 8]
jl 0x1401712d0
mov ebp, 2
mov r12d, ebp
mov r13d, ebp
mov r14d, ebp
cmp dword [rbx + 8], ebp
jle 0x14017139b
mov qword [rsp + 0x20], r15
mov r15d, 0x40
mov edi, r15d
nop dword [rax]
mov rsi, qword [rbx + 0x10]
cmp qword [rdi + rsi + 8], 0
jne 0x140171352
mov rdx, qword [rdi + rsi]
mov rcx, rbx
call fcn.1401434c0
mov qword [rdi + rsi], 0
jmp 0x140171386
cmp r14, r13
jge 0x14017137d
mov rax, qword [rdi + rsi]
mov qword [r15 + rsi], rax
mov rax, qword [rdi + rsi + 8]
mov qword [r15 + rsi + 8], rax
mov rax, qword [rdi + rsi + 0x10]
mov qword [r15 + rsi + 0x10], rax
mov rax, qword [rdi + rsi + 0x18]
mov qword [r15 + rsi + 0x18], rax
inc ebp
inc r14
add r15, 0x20
inc r12d
inc r13
add rdi, 0x20
cmp r12d, dword [rbx + 8]
jl 0x140171330
mov r15, qword [rsp + 0x20]
mov eax, dword [rbx + 8]
movsxd rcx, ebp
xor edx, edx
sub eax, ebp
shl rcx, 5
add rcx, qword [rbx + 0x10]
movsxd r8, eax
shl r8, 5
call fcn.14010da60
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov dword [rbx + 8], ebp
cmp ebp, 2
mov rbp, qword [rsp + 0x50]
jg 0x140171434
mov rdx, qword [rbx + 0x10]
lea rdi, [rbx + 0x2d8]
cmp rdx, rdi
je 0x140171434
mov rax, qword [rdx]
mov rcx, rbx
mov qword [rdi], rax
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rdx + 0x18]
mov qword [rdi + 0x18], rax
mov rax, qword [rdx + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rdx + 0x28]
mov qword [rdi + 0x28], rax
mov rax, qword [rdx + 0x30]
mov qword [rdi + 0x30], rax
mov rax, qword [rdx + 0x38]
mov qword [rdi + 0x38], rax
call fcn.1401434c0
mov qword [rbx + 0x10], rdi
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x140171dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [rdx]
mov rbp, rdx
mov rsi, rcx
xor edi, edi
lea r12, [0x140000000]
nop dword [rax]
test rbx, rbx
je 0x140171e90
cmp byte [rbx], 0
mov r8, rbx
je 0x140171e1a
inc r8
cmp byte [r8], 0
jne 0x140171e11
sub r8d, ebx
and r8d, 0x3fffffff
cmp qword [rsi + 0x2b0], 0
je 0x140171e6d
xor eax, eax
mov r9d, r8d
mov r10, rbx
test r8d, r8d
jle 0x140171e63
nop dword [rax + rax]
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + r12 + 0x2454a0]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x140171e40
xor edx, edx
div dword [rsi + 0x2a0]
jmp 0x140171e6f
xor edx, edx
mov r9d, edx
lea rcx, [rsi + 0x2a0]
mov rdx, rbx
call fcn.1401449e0
test rax, rax
je 0x140171e8c
mov rdx, qword [rax + 0x10]
jmp 0x140171e94
xor edx, edx
jmp 0x140171e94
mov rdx, qword [rsi + 0x38]
test rdx, rdx
je 0x140171eae
movzx eax, byte [rdi + r12 + 0x245f04]
dec eax
cdqe
lea rcx, [rax + rax*4]
lea rdx, [rdx + rcx*8]
cmp qword [rdx + 0x18], 0
jne 0x140171ec9
inc rdi
cmp rdi, 3
jl 0x140171e00
mov eax, 1
jmp 0x140171ef2
mov rax, qword [rdx]
mov qword [rbp], rax
mov rax, qword [rdx + 8]
mov qword [rbp + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rbp + 0x10], rax
mov rax, qword [rdx + 0x18]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140181f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r15d, r15d
mov rbp, r8
mov r8, rcx
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x20], r15d
mov r14d, dword [rcx]
mov r13, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov edi, r15d
mov esi, r15d
mov r12d, r15d
test r14d, r14d
jle 0x14018212a
nop word [rax + rax]
cmp esi, dword [rbp + 8]
jg 0x14018211d
mov rbx, qword [r13]
cmp byte [rbx], 0x98
jne 0x14018211d
cmp dword [rbx + 0x30], r9d
jne 0x14018211d
mov rdx, rbx
mov rcx, r8
call fcn.14017b870
mov rdx, rax
test rax, rax
jne 0x140181ffc
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x38]
cmp qword [rbp], r15
je 0x140182033
cmp esi, dword [rbp + 8]
jge 0x140182033
mov rax, qword [rbp + 0x10]
mov r9d, dword [rax + r12*4]
mov rax, qword [rbp + 0x20]
cmp r9d, dword [rax + 8]
mov eax, 0xffffffff
cmove r9d, eax
mov rax, qword [rbp + 0x48]
movzx r10d, byte [rax + r12]
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + r12*8]
jmp 0x14018203d
mov r8, qword [rdx]
or r9d, 0xffffffff
mov r10d, r15d
movsx eax, word [rbx + 0x34]
cmp eax, r9d
jne 0x1401820e7
mov rdx, qword [rdx]
lea rbx, [0x1402454a0]
movzx eax, byte [rdx]
test al, al
je 0x14018207e
nop dword [rax + rax]
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x14018207e
movzx eax, byte [rdx + 1]
inc rdx
inc r8
test al, al
jne 0x140182060
movzx eax, byte [rdx]
movzx ecx, byte [rax + rbx]
movzx eax, byte [r8]
movzx eax, byte [rax + rbx]
cmp ecx, eax
jne 0x1401820e7
movzx eax, byte [r13 + 0x18]
movsxd rcx, dword [rsp + 0x98]
xor eax, r10d
cmp r12, rcx
jle 0x1401820b2
cmp eax, dword [rsp + 0x20]
jne 0x14018216e
jmp 0x1401820b6
mov dword [rsp + 0x20], eax
inc edi
add r13, 0x20
test r9d, r9d
jns 0x1401820f4
mov r9d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
mov r8d, edi
call fcn.14015d0b0
test eax, eax
jne 0x1401820f4
mov edi, r14d
jmp 0x1401820f4
movsxd rax, dword [rsp + 0x98]
cmp r12, rax
jge 0x140182110
mov r9d, dword [rsp + 0x88]
inc esi
inc r12
cmp edi, r14d
jge 0x14018211d
mov r8, qword [rsp + 0x70]
jmp 0x140181fc0
cmp esi, dword [rbp + 8]
jne 0x14018216e
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
cmp dword [rsp + 0x20], r15d
mov rax, qword [rsp + 0xa8]
setne r15b
mov dword [rax], r15d
cmp edi, r14d
jl 0x14018214a
mov eax, 1
jmp 0x140182170
cmp byte [rbp + 0x2c], 0
je 0x14018216e
cmp esi, dword [rbp + 8]
jne 0x14018216e
test dword [rsp + 0xa0], 0x80000
jne 0x14018216e
mov r8d, edi
call fcn.14015d0b0
test eax, eax
je 0x140182143
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401c3200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r10, r8
mov rbx, rdx
mov r11, rcx
test r10, r10
je 0x1401c3279
movzx eax, byte [r11]
inc eax
mov byte [r11], al
movzx r8d, al
movzx r9d, byte [r8 + r11 + 2]
movzx edx, byte [r11 + 1]
add edx, r9d
mov byte [r11 + 1], dl
movzx eax, dl
movzx ecx, byte [rax + r11 + 2]
mov byte [r8 + r11 + 2], cl
movzx eax, byte [r11 + 1]
mov byte [rax + r11 + 2], r9b
add cl, r9b
movzx eax, cl
movzx ecx, byte [rax + r11 + 2]
movzx eax, byte [rbx]
xor ecx, eax
mov byte [rbx], cl
inc rbx
mov qword [rsp + 0x48], rbx
dec r10
mov qword [rsp + 0x50], r10
jmp 0x1401c3218
add rsp, 0x30
pop rbx
ret
Function at 0x1401c3710
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea r10, [rsp]
mov r11, rcx
lea r8, [rcx + 0xa]
sub r10, rcx
mov r9d, 0x10
nop word [rax + rax]
movzx edx, byte [r8 - 2]
movzx eax, byte [r8 - 1]
movzx ecx, byte [r8 + 1]
shl eax, 0x10
shl edx, 0x18
add r8, 4
or edx, eax
movzx eax, byte [r8 - 4]
shl eax, 8
or ecx, eax
or ecx, edx
dec r9
mov dword [r10 + r8 - 0xe], ecx
jne 0x1401c3760
lea rdx, [rsp + 8]
lea r8d, [r9 + 0x40]
nop word [rax + rax]
mov ecx, dword [rdx + 0x2c]
add rdx, 4
xor ecx, dword [rdx + 0x14]
xor ecx, dword [rdx - 0xc]
xor ecx, dword [rdx - 4]
lea eax, [rcx + rcx]
shr ecx, 0x1f
or eax, ecx
dec r8
mov dword [rdx + 0x34], eax
jne 0x1401c37a0
mov r14d, dword [r11 + 0x4c]
mov r15d, dword [r11 + 0x50]
mov r8d, dword [r11 + 0x54]
mov edi, dword [r11 + 0x58]
mov r12d, dword [r11 + 0x5c]
mov ebp, SafeArrayGetElement
mov r13d, r14d
mov r9d, r15d
lea rbx, [rsp]
mov esi, ebp
nop word [rax + rax]
mov eax, r8d
mov edx, r9d
mov ecx, r13d
and eax, r9d
not edx
shl ecx, 5
and edx, edi
add rbx, 4
or edx, eax
mov eax, r13d
shr eax, 0x1b
or ecx, eax
add edx, ecx
add edx, dword [rbx - 4]
lea r10d, [rdx + r12 + 0x5a827999]
mov r12d, edi
mov edi, r8d
mov r8d, r9d
shr r9d, 2
shl r8d, 0x1e
or r8d, r9d
dec rsi
mov r9d, r13d
mov r13d, r10d
jne 0x1401c37f0
lea rdx, [rsp + 0x50]
mov rbx, rbp
nop word [rax + rax]
mov eax, r10d
shr r10d, 0x1b
mov ecx, edi
xor ecx, r8d
shl eax, 5
add rdx, 4
or eax, r10d
xor ecx, r9d
add eax, r12d
mov r12d, edi
mov edi, r8d
add ecx, eax
mov eax, dword [rdx - 4]
mov r8d, r9d
shr r9d, 2
shl r8d, 0x1e
lea r10d, [rcx + rax + 0x6ed9eba1]
or r8d, r9d
dec rbx
mov r9d, r13d
mov r13d, r10d
jne 0x1401c3850
lea rdx, [rsp + 0xa0]
mov rbx, rbp
nop word [rax + rax]
mov ecx, r8d
mov eax, r8d
add rdx, 4
or ecx, r9d
and eax, r9d
and ecx, edi
or ecx, eax
mov eax, r10d
shr r10d, 0x1b
shl eax, 5
or eax, r10d
add ecx, eax
add ecx, dword [rdx - 4]
lea r10d, [rcx + r12 - 0x70e44324]
mov r12d, edi
mov edi, r8d
mov r8d, r9d
shr r9d, 2
shl r8d, 0x1e
or r8d, r9d
dec rbx
mov r9d, r13d
mov r13d, r10d
jne 0x1401c38b0
lea rdx, [rsp + 0xf0]
nop word [rax + rax]
mov eax, r10d
shr r10d, 0x1b
mov ecx, edi
xor ecx, r8d
shl eax, 5
add rdx, 4
or eax, r10d
xor ecx, r9d
add eax, r12d
mov r12d, edi
mov edi, r8d
add ecx, eax
mov eax, dword [rdx - 4]
mov r8d, r9d
shr r9d, 2
shl r8d, 0x1e
lea r10d, [rcx + rax - 0x359d3e2a]
or r8d, r9d
dec rbp
mov r9d, r13d
mov r13d, r10d
jne 0x1401c3910
lea eax, [r14 + r10]
mov dword [r11 + 0x4c], eax
lea eax, [r15 + r9]
mov dword [r11 + 0x50], eax
mov eax, dword [r11 + 0x54]
add eax, r8d
mov dword [r11 + 0x54], eax
mov eax, dword [r11 + 0x58]
add eax, edi
mov dword [r11 + 0x58], eax
mov eax, dword [r11 + 0x5c]
add eax, r12d
mov dword [r11 + 0x5c], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14010d170
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401c39c0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov qword [rcx], rdi
lea r8d, [rdi + 0x40]
add rcx, 8
xor edx, edx
call fcn.14010da60
mov word [rbx + 0x48], di
xor eax, eax
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], rax
mov dword [rbx + 0x70], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002190
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400021b1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400021de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400021e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002239
test ecx, ecx
jle 0x140002219
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002239
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002239
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002260
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002282
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002291
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400022b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400022b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400022f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000238e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000232d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000236e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000238e
cmp rbx, rax
ja 0x140002340
test rbx, rbx
je 0x14000238e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al