joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400021b2
Capabilities:
Write file on windows

Disassembly:
jmp 0x140010760
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140001f73
cmp dword [rdi + 0x40], 0
je 0x14001081c
mov rdx, qword [rdi + 0x48]
mov ecx, 0x80
mov qword [rsp + 0x30], rbx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
xor ecx, ecx
cmp byte [rdi + 0x50], cl
setne cl
inc ecx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov ebx, dword [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 8
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 0x10
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
sar ebx, 0x18
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
movsxd r8, dword [rdi + 0x40]
mov edx, 1
mov r9, qword [rdi + 0x48]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [rdi + 0x44], 0
mov rbx, qword [rsp + 0x30]
jge 0x140010815
mov dword [rdi + 0x44], 0
mov qword [rdi + 0x38], 0
mov dword [rdi + 0x40], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1400022c5
Capabilities:
Parse pe header

Disassembly:
jmp 0x14004f650
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004f69a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004f69a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004f69a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004f69a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004f69a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004f69c
xor al, al
add rsp, 0x28
ret
Function at 0x1400104f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400104f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rdx, dword [rcx + 0x14]
mov rbx, rcx
cmp edx, dword [rcx + 0x10]
jl 0x140010514
call fcn.1400028d3
mov esi, eax
jmp 0x140010522
mov rax, qword [rcx + 8]
movzx esi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rcx + 0x14], eax
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x14001055f
nop
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x140010545
mov rcx, rbx
call fcn.1400028d3
mov esi, eax
jmp 0x140010553
mov rax, qword [rbx + 8]
movzx esi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x140010530
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x140010574
mov rcx, rbx
call fcn.1400028d3
mov edi, eax
jmp 0x140010582
mov rax, qword [rbx + 8]
movzx edi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x1400105bf
nop
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x1400105a5
mov rcx, rbx
call fcn.1400028d3
mov edi, eax
jmp 0x1400105b3
mov rax, qword [rbx + 8]
movzx edi, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x140010590
test edi, edi
jns 0x1400105d8
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9d, dword [rbx + 0x34]
mov rdx, qword [str.q__a_]
movsxd rax, esi
mov rsi, qword [rsp + 0x38]
movzx ecx, byte [rax + rdx]
shl cl, 4
movzx r8d, cl
movsxd rax, edi
movzx ecx, byte [rax + rdx]
or r8d, ecx
lea eax, [r8 + r9]
sar r9d, 8
imul ecx, eax, 0x3193
mov eax, 0x58bf
sub eax, ecx
movzx eax, ax
mov dword [rbx + 0x34], eax
mov rbx, qword [rsp + 0x30]
movzx eax, r9b
xor eax, r8d
add rsp, 0x20
pop rdi
ret
Function at 0x140010760
Capabilities:
Write file on windows

Disassembly:
jmp 0x140010760
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140001f73
cmp dword [rdi + 0x40], 0
je 0x14001081c
mov rdx, qword [rdi + 0x48]
mov ecx, 0x80
mov qword [rsp + 0x30], rbx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
xor ecx, ecx
cmp byte [rdi + 0x50], cl
setne cl
inc ecx
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov ebx, dword [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 8
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
mov eax, ebx
sar eax, 0x10
movzx ecx, al
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
mov rdx, qword [rdi + 0x48]
sar ebx, 0x18
movzx ecx, bl
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_fputc]
movsxd r8, dword [rdi + 0x40]
mov edx, 1
mov r9, qword [rdi + 0x48]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [rdi + 0x44], 0
mov rbx, qword [rsp + 0x30]
jge 0x140010815
mov dword [rdi + 0x44], 0
mov qword [rdi + 0x38], 0
mov dword [rdi + 0x40], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140010980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140010980
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
jge 0x1400109b3
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
test ebp, ebp
jg 0x1400109c9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov eax, dword [rcx + 0x28]
mov qword [rsp + 0x38], rdi
xor edi, edi
test eax, eax
js 0x1400109f0
inc rsi
mov byte [rdx], al
mov edi, 1
mov dword [rcx + 0x28], 0xffffffff
cmp ebp, edi
jle 0x140010a8d
cmp byte [rbx + 0x30], 0
jne 0x140010a19
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x140010a09
mov rcx, rbx
call fcn.1400028d3
jmp 0x140010a78
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + rdx]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
jmp 0x140010a7a
cmp byte [rbx + 0x31], 0
je 0x140010a70
movsxd rdx, dword [rbx + 0x14]
cmp edx, dword [rbx + 0x10]
jl 0x140010a34
mov rcx, rbx
call fcn.1400028d3
mov ecx, eax
jmp 0x140010a42
mov rax, qword [rbx + 8]
movzx ecx, byte [rax + rdx]
lea eax, [rdx + 1]
mov dword [rbx + 0x14], eax
test ecx, ecx
js 0x140010a8d
mov r8d, dword [rbx + 0x34]
movzx edx, cl
lea eax, [rdx + r8]
sar r8d, 8
imul ecx, eax, 0x3193
mov eax, 0x58bf
sub eax, ecx
movzx ecx, r8b
movzx eax, ax
xor ecx, edx
mov dword [rbx + 0x34], eax
jmp 0x140010a7a
mov rcx, rbx
call fcn.140001721
mov ecx, eax
test ecx, ecx
js 0x140010a8d
mov byte [rsi], cl
inc edi
inc rsi
cmp edi, ebp
jl 0x1400109f0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x140010af0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140010af0
push rbx
sub rsp, 0x20
movsxd r9, dword [rcx + 0x18]
mov rbx, rcx
test r9d, r9d
js 0x140010b0e
cmp dword [rcx + 0x1c], 0
jge 0x140010b0e
mov eax, dword [rcx + 0x10]
mov dword [rcx + 0x1c], eax
cmp r9d, dword [rcx + 0x1c]
jge 0x140010b5a
mov r10, r9
nop word [rax + rax]
mov edx, dword [rbx + 0x20]
lea r10, [r10 + 1]
mov r8, qword [rbx + 8]
inc r9d
sar edx, 8
xor dl, byte [r8 + r10 - 1]
movzx eax, dl
add eax, dword [rbx + 0x20]
imul ecx, eax, 0x3193
mov eax, 0x58bf
sub eax, ecx
movzx eax, ax
mov dword [rbx + 0x20], eax
mov byte [r8 + r10 - 1], dl
cmp r9d, dword [rbx + 0x1c]
jl 0x140010b20
mov rax, qword [rbx]
mov rcx, rbx
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 8]
call qword [rax + 0x18]
movzx eax, byte [rbx + 0x14]
neg al
mov dword [rbx + 0x10], 0
mov dword [rbx + 0x1c], 0xffffffff
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rbx + 0x18], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x140010bc0
Capabilities:
Read file on windows

Disassembly:
jmp 0x140010bc0
sub rsp, 0x28
mov r9, qword [rcx + 0x38]
mov rax, rdx
mov rcx, rax
movsxd r8, r8d
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
mov ecx, 0xffffffff
cmovne ecx, eax
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140010c00
Capabilities:
Read file on windows

Disassembly:
jmp 0x140010c00
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x44]
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test eax, eax
jne 0x140010c99
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp eax, 0x80
jne 0x140010c9b
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp eax, 3
je 0x140010c9b
lea ecx, [rax - 1]
cmp ecx, 2
ja 0x140010c9b
mov rcx, qword [rdi + 0x38]
cmp eax, 2
sete al
mov byte [rdi + 0x40], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [rdi + 0x38]
mov dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [rdi + 0x38]
shl eax, 8
or dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [rdi + 0x38]
shl eax, 0x10
or dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
shl eax, 0x18
or eax, dword [rdi + 0x44]
mov dword [rdi + 0x44], eax
je 0x140010c24
test eax, eax
jns 0x140010ca2
mov eax, 0xffffffff
jmp 0x140010cc1
mov r9, qword [rdi + 0x38]
cmp esi, eax
mov edx, 1
mov rcx, rbp
cmovg esi, eax
sub eax, esi
movsxd r8, esi
mov dword [rdi + 0x44], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140011040
Capabilities:
Write file on windows

Disassembly:
jmp 0x140011040
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x14], 0
mov rdi, rdx
movsxd rsi, r8d
mov rbx, rcx
je 0x1400110e8
test r8d, r8d
je 0x1400110fd
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rsp + 0x38], r14
lea r14, str.0123456789ABCDEF
nop
movzx eax, byte [rdi]
mov rdx, qword [rbx + 0x38]
shr rax, 4
movsx ecx, byte [rax + r14]
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_putc]
movzx eax, byte [rdi]
mov rdx, qword [rbx + 0x38]
and eax, 0xf
movsx ecx, byte [rax + r14]
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_putc]
inc dword [rbx + 0x40]
cmp dword [rbx + 0x40], 0x27
jne 0x1400110c6
mov rdx, qword [rbx + 0x38]
mov ecx, 0xa
call qword [sym.imp.MiKTeX231000_utf8wrap.dll_miktex_utf8_putc]
mov dword [rbx + 0x40], ebp
inc rdi
sub esi, 1
jne 0x140011080
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x38]
mov r8, rsi
mov rcx, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140027870
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140027870
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x20]
mov rdi, rcx
test ebx, ebx
js 0x1400278d3
add rcx, 8
call fcn.1400026da
xor r9d, r9d
mov r8, rax
cmp dword [rdi + 0x10], r9d
jle 0x1400278cc
nop dword [rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, ebx
inc r9d
sar ecx, 8
xor cl, dl
lea eax, [rbx + rdx]
mov byte [r8 - 1], cl
imul ecx, eax, 0x3193
mov ebx, 0x58bf
sub ebx, ecx
cmp r9d, dword [rdi + 0x10]
jl 0x1400278a0
mov dword [rdi + 0x20], 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400344c0
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400344c0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x8c0
mov rax, qword [0x140071548]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_tmpfile]
mov rdi, rax
test rax, rax
je 0x1400346c7
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001d84
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 8]
call fcn.140002202
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
lea rdx, [rsp + 0x80]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.FontDirectory__
mov rcx, rsi
call fcn.140002504
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rax]
mov r8d, dword [rdx - 4]
mov rcx, rsi
call fcn.140002504
mov r8d, 8
lea rdx, str._known_n
mov rcx, rsi
call fcn.140002504
mov r8d, 1
lea rdx, [0x140062ee4]
mov rcx, rsi
call fcn.140002504
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rax]
mov r8d, dword [rdx - 4]
mov rcx, rsi
call fcn.140002504
mov r8d, 0x31
lea rdx, str._findfont_dup__UniqueID_known_dup__UniqueID_get
mov rcx, rsi
call fcn.140002504
mov edx, dword [rbx + 0x10]
mov rcx, rsi
call fcn.1400021c1
mov rbx, rax
mov r8d, 0x59
lea rdx, str._eq_exch__FontType_get_1_eq_andpop_falseifelse__nsave_userdict_fbufstr_512_string_put_n
mov rcx, rax
call fcn.140002504
mov eax, dword [rsp + 0x94]
cdq
and edx, 0x1ff
add edx, eax
sar edx, 9
mov rcx, rbx
call fcn.1400021c1
mov rbx, rax
mov r8d, 0x86
lea rdx, str.currentfile_fbufstr_readstringpopclear_currentfile_nclosefile_fontdownload_unexpectedEOF_.error_cvx_execifelserepeat_ncurrentfile
mov rcx, rax
call fcn.140002504
mov edx, dword [rsp + 0x94]
and edx, 0x800001ff
jge 0x140034639
dec edx
or edx, 0xfffffe00
inc edx
mov rcx, rbx
call fcn.1400021c1
mov r8d, 0x74
lea rdx, str._string_readstringpopclear_currentfile_nclosefile_fontdownload_unexpectedEOF_.error_cvx_execifelse_nrestoreifif_n
mov rcx, rax
call fcn.140002504
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov r9, rdi
mov edx, 1
mov r8d, 0x800
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jle 0x1400346b3
nop
mov r8d, eax
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.140002504
mov r9, rdi
mov edx, 1
mov r8d, 0x800
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jg 0x140034680
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
lea rcx, [rsp + 0x30]
call fcn.14000159b
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.140001d25
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140034790
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140034790
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
mov rbx, rdx
mov qword [rsp + 0x38], rsi
mov rsi, rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov r14d, dword [rcx + 0x30]
jl 0x1400347be
add rcx, 0x20
call fcn.14000245f
mov rdi, qword [rsi + 0x28]
lea rax, [0x14007342c]
mov qword [rsp + 0x30], rbp
cmp qword [rsi + 8], rax
jne 0x14003481c
mov r8d, 4
lea rdx, str.dup
mov rcx, rbx
call fcn.140002504
mov edx, dword [rsi + 0x10]
mov rcx, rbx
call fcn.1400021c1
mov rbp, rax
cmp dword [rax + 0x10], 0x400
jl 0x140034808
mov rcx, rax
call fcn.140002662
movsxd rdx, dword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov byte [rdx + rcx], 0x20
mov rcx, rbp
inc dword [rbp + 0x10]
jmp 0x14003486f
cmp dword [rbx + 0x10], 0x400
jl 0x14003482d
mov rcx, rbx
call fcn.140002662
movsxd rcx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rcx + rax], 0x2f
mov rcx, rbx
inc dword [rbx + 0x10]
mov rdx, qword [rsi + 8]
mov r8d, dword [rdx - 4]
call fcn.140002504
cmp dword [rbx + 0x10], 0x400
jl 0x14003485d
mov rcx, rbx
call fcn.140002662
movsxd rcx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rcx + rax], 0x20
mov rcx, rbx
inc dword [rbx + 0x10]
mov edx, dword [rbx + 0x30]
add edx, r14d
call fcn.1400021c1
mov rdx, qword [rbx + 0x28]
mov rcx, rax
mov r8d, dword [rdx - 4]
call fcn.140002504
mov eax, dword [rbx + 0x30]
test eax, eax
jns 0x1400348a4
mov r8d, r14d
mov rdx, rdi
mov rcx, rbx
call fcn.140002504
jmp 0x140034944
add eax, r14d
movsxd rcx, eax
call fcn.140001bb8
xor r9d, r9d
mov rbp, rax
mov r8, rax
mov edx, 0x10ea
cmp dword [rbx + 0x30], r9d
jle 0x1400348f6
nop dword [rax]
nop word [rax + rax]
mov ecx, edx
inc r9d
shr ecx, 8
mov byte [r8], cl
inc r8
movzx eax, cl
add eax, edx
mov edx, 0x58bf
imul ecx, eax, 0x3193
sub edx, ecx
cmp r9d, dword [rbx + 0x30]
jl 0x1400348d0
test r14d, r14d
jle 0x14003492a
sub r8, rdi
mov r9, r14
mov eax, edx
lea rdi, [rdi + 1]
shr eax, 8
xor al, byte [rdi - 1]
mov byte [r8 + rdi - 1], al
movzx eax, al
add eax, edx
mov edx, 0x58bf
imul ecx, eax, 0x3193
sub edx, ecx
sub r9, 1
jne 0x140034901
mov r8d, dword [rbx + 0x30]
mov rdx, rbp
add r8d, r14d
mov rcx, rbx
call fcn.140002504
mov rcx, rbp
call fcn.140001d1b
mov rdx, qword [rsi + 0x18]
mov rcx, rbx
mov r8d, dword [rdx - 4]
call fcn.140002504
cmp dword [rbx + 0x10], 0x400
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
jl 0x140034979
mov rcx, rbx
call fcn.140002662
movsxd rcx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov byte [rcx + rax], 0xa
inc dword [rbx + 0x10]
add rsp, 0x20
pop rbx
ret
Function at 0x1400431b0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400431b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rsi, rdx
mov r14, rcx
lea r15, [0x140063dc8]
mov qword [rbp + 0xf], r15
xor ebx, ebx
mov dword [rbp + 0x17], ebx
mov qword [rbp + 0x1f], rbx
mov rdx, qword [rdx]
movsxd r8, dword [rsi + 8]
add r8, rdx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea r9, [0x14005b520]
mov rcx, rsi
call fcn.140001f78
mov rdi, rax
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], rbx
mov rdx, qword [r14 + 0x18]
lea r12, [0x140063dc9]
lea rcx, [rbp - 0x19]
cmp rdx, r12
je 0x140043240
mov r8d, dword [r14 + 0x20]
call fcn.140001e8d
jmp 0x140043245
call fcn.1400020d1
mov r8b, 1
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x27]
call fcn.1400023fb
nop
mov rdx, qword [rax]
lea rcx, [rbp - 0x19]
cmp rdx, r12
je 0x14004326d
mov r8d, dword [rax + 8]
call fcn.140001e8d
jmp 0x140043272
call fcn.1400020d1
mov rcx, qword [rsi]
movsxd r8, dword [rsi + 8]
add r8, rcx
cmp rdi, r8
jae 0x1400432ae
cmp rdi, rcx
jb 0x1400432ae
mov rbx, qword [rsi + 0x10]
mov qword [rbp - 9], rdi
sub r8d, edi
mov dword [rbp - 1], r8d
mov qword [rbp + 7], rbx
test rbx, rbx
je 0x1400432bf
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
mov rbx, qword [rbp + 7]
mov r8d, dword [rbp - 1]
jmp 0x1400432bf
mov qword [rbp - 9], r15
mov r8d, ebx
mov dword [rbp - 1], ebx
mov qword [rbp + 7], rbx
mov rdi, r15
lea rcx, [rbp - 0x19]
cmp rdi, r12
je 0x1400432d2
mov rdx, rdi
call fcn.140001e8d
jmp 0x1400432d7
call fcn.1400020d1
mov eax, dword [rbp - 0x11]
cmp eax, dword [rbp - 0xd]
jl 0x1400432f2
mov edx, eax
lea rcx, [rbp - 0x19]
call fcn.1400024a5
test rax, rax
je 0x140043300
mov eax, dword [rbp - 0x11]
movsxd rcx, eax
mov rax, qword [rbp - 0x19]
mov byte [rcx + rax], 0xa
inc dword [rbp - 0x11]
test rbx, rbx
je 0x140043318
mov eax, dword [rbx]
sub eax, 1
mov rcx, qword [rbp + 7]
mov dword [rcx], eax
jne 0x140043318
call fcn.1400018d4
nop
mov rax, qword [rbp + 0x37]
test rax, rax
je 0x140043338
mov ecx, dword [rax]
sub ecx, 1
mov rax, qword [rbp + 0x37]
mov dword [rax], ecx
jne 0x140043338
mov rcx, qword [rbp + 0x37]
call fcn.1400018d4
nop
movsxd r8, dword [rbp - 0x11]
mov r9, qword [r14 + 0x10]
mov edx, 1
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
nop
cmp dword [rbp - 0xd], 0
jle 0x140043364
mov rcx, qword [rbp - 0x19]
add rcx, 0xfffffffffffffff4
call fcn.140001d1b
nop
mov rax, qword [rbp + 0x1f]
test rax, rax
je 0x140043384
mov ecx, dword [rax]
sub ecx, 1
mov rax, qword [rbp + 0x1f]
mov dword [rax], ecx
jne 0x140043384
mov rcx, qword [rbp + 0x1f]
call fcn.1400018d4
nop
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14004f650
Capabilities:
Parse pe header

Disassembly:
jmp 0x14004f650
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004f69a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004f69a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004f69a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004f69a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004f69a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004f69c
xor al, al
add rsp, 0x28
ret
Function at 0x140002952
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140002971
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001a4e8

Function at 0x1400055bb
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.14001a4e8

Function at 0x1400055fa
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x140b060f0], 0
jne 0x140005612
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400055bb
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.140005534
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x140b060f0]
test rbx, rbx
je 0x140005643
test byte [rbx + 7], 0x40
jne 0x140005643
mov rcx, rbx
call fcn.1400039df
lea rcx, [0x140020320]
call fcn.140015130
cmp byte [rax], 0
je 0x14000567b
lea rcx, [0x140020220]
mov byte [rax], 0
call fcn.140015130
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140003f44
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140005cf2
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r12, [0x140b060c0]
xor ebx, ebx
lea r14, [0x140020320]
lea r13, [rsp + 0x20]
mov rsi, rcx
mov rdi, rdx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rdi
mov ecx, 1
jl 0x140005d78
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14002139b]
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
call fcn.14001a4e8
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rbp
xor r8d, r8d
mov rdx, r13
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140005bcb
mov rcx, r14
call fcn.140015130
cmp byte [rax], 0
jne 0x140005daa
inc rbx
jmp 0x140005d2b
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret