joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140505995
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
rol rax, cl
btr ax, 0xe4
sub rsp, 0x60
mov rax, qword [0x1400fa040]
xor rbx, 0x21384ed4
bt rbx, 0x4e
xor rax, rsp
bsr ebx, r10d
mov qword [rsp + 0x58], rax
movzx ebx, r15w
cmp qword [rcx + 0x68], 0
movsx bx, dh
mov rbx, rcx
jmp 0x1405059db
je 0x140505abb
cmp byte [rcx + 0x72], 0
je 0x140505abb
mov rax, qword [rcx]
jmp 0x1405059f9
mov edi, 0xffff
movsx rdx, dx
movsx dx, r15b
mov edx, edi
mov edx, edi
jmp 0x140505a10
mov rax, qword [rax + 0x18]
jmp 0x140505a19
call qword [0x1400c2630]
cmp di, ax
jmp 0x140505a27
je 0x140505b69
mov rcx, qword [rbx + 0x68]
movzx dx, bpl
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
movsx ax, r13b
cwd
lea rdx, [rbx + 0x74]
movsxd rax, ebx
movzx r8, r11w
mov rax, r13
lea r9, [rsp + 0x58]
movzx eax, r14w
lahf
lea r8, [rsp + 0x38]
mov ax, r13w
movsx ax, sil
mov rax, qword [rcx]
jmp 0x140505a75
mov rax, qword [rax + 0x40]
jmp 0x140505a7e
call qword [0x1400c2630]
test eax, eax
jmp 0x140505a8b
je 0x140505ae3
sub eax, 1
jmp 0x140505a99
je 0x140505aee
cmp eax, 2
jmp 0x140505aa7
jne 0x140505b69
mov byte [rbx + 0x72], 0
or rcx, 0x45a4264a
sbb al, spl
mov al, 1
xadd cl, ch
mov rcx, qword [rsp + 0x58]
stc
test eax, 0x2b162cb1
xor rcx, rsp
call fcn.140509caf
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp 0x140505ae2
ret
mov byte [rbx + 0x72], 0
adc al, r11b
movzx ax, ch
mov rdi, qword [rsp + 0x30]
mov ax, r15w
sbb ah, 0x72
movsx ax, dl
lea rax, [rsp + 0x38]
clc
sub rdi, rax
jmp 0x140505b0c
je 0x140505b58
mov r9, qword [rbx + 0x80]
movsx dx, bh
movsxd r8, ecx
lea rcx, [rsp + 0x38]
movsx r8d, r15w
bswap r8w
cwd
mov r8, rdi
movsx rdx, r12w
movzx edx, bp
cqo
mov edx, 1
jmp 0x140505b45
call fcn.1400a1808
cmp rdi, rax
jmp 0x140505b52
jne 0x140505b69
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140505b64
jmp 0x140505ac0
sub al, al
jmp 0x140505b70
jmp 0x140505ac0
Function at 0x1401719b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401719bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401719cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401719b5
lea eax, [rcx + 1]
jmp 0x1401719db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401719ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401719d4
sub eax, 3
jb 0x140171a0e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140171a5d
sar eax, 1
movsxd rbp, eax
jb 0x140171a44
jmp 0x140171a1c
add ebx, ebx
jne 0x140171a1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140171a44
inc ecx
add ebx, ebx
jne 0x140171a2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140171a44
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140171a3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140171a2c
add ecx, 2
jmp 0x140171a49
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140171972
jmp 0x1401719bd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x115400
mov dl, 0x22
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140171aa9
cmp rsi, rcx
jae 0x140171ab1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140171a90
cmp al, 0x8f
ja 0x140171a90
cmp byte [rsi - 2], 0xf
je 0x140171a96
sub al, 0xe8
cmp al, 1
ja 0x140171a7a
cmp rsi, rcx
jae 0x140171ab1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140171a80
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140171ab1
lodsb al, byte [rsi]
jmp 0x140171a90
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x16e000]
mov eax, dword [rdi]
or eax, eax
je 0x140171b1a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x171000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140171abe
jns 0x140171af3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140171afd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140171b14
mov qword [rbx], rax
add rbx, 8
jmp 0x140171ade
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140171b72
sub rsp, 0xffffffffffffff80
jmp 0x140063fb4
Function at 0x1400075e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140007602
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000767c
mov rdi, r14
mov rcx, rbx
call fcn.1400093f0
test rax, rax
jle 0x140007654
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140028d70
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000766c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140007674
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140007616
sub r14, rdi
jmp 0x14000775f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140007693
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140007695
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400076c7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140028d70
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000775c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140007702
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000773d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400373cc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000775c
cmp rbp, rax
ja 0x140007710
test rbp, rbp
je 0x14000775c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400373cc
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14001fea0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140020044
cmp r9, 4
jb 0x14001feea
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14001fed0
xor r11d, r11d
test r9, r9
je 0x140020044
cmp r9, 8
jb 0x14002001e
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14001ff1c
cmp rdx, r8
jae 0x14002001e
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14001ff31
cmp rdx, r10
jae 0x14002001e
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x14001ffdb
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14001ff70
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x140020010
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x14001fff0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x140020044
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140020030
add rsp, 8
ret

Function at 0x140024f18
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140024f9c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140058f00]
cmp byte [rcx + rax], 0
je 0x140024f9c
dec r8
sub rdx, 1
jne 0x140024f82
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140027b08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140027b52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140027b52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140027b52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140027b52
cmp dword [rcx + 0x84], 0xe
jbe 0x140027b52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140027b54
xor al, al
add rsp, 0x28
ret

Function at 0x14003fb10
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003f900
Function at 0x1400445b4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400445e6
call fcn.140036cdc
mov dword [rax], 0x16
call fcn.140036580
jmp 0x140044705
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140044705
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140044705
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140044615
lock or dword [rcx + 0x14], 0x10
jmp 0x140044705
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140044629
call fcn.140045888
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14004277c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140045da0
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1400446f3
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1400446be
mov rcx, rsi
call fcn.14004277c
cmp eax, edi
je 0x1400446a9
mov rcx, rsi
call fcn.14004277c
cmp eax, 0xfffffffe
je 0x1400446a9
mov rcx, rsi
call fcn.14004277c
movsxd rbx, eax
lea r14, [0x14007a300]
mov rcx, rsi
sar rbx, 6
call fcn.14004277c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400446b0
lea rdx, [0x140075600]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400446be
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1400446e2
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1400446e2
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1400446e2
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140044708
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140045608
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140027570
sub rsp, rax
mov rax, qword [0x140075250]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14004277c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140045657
mov rax, rbp
jmp 0x14004575f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x7a300]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140046578
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x7a300]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14004575b
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004575b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140046578
test rax, rax
js 0x14004575b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14004575b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14004574d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14004574d
cmp byte [rcx], 0xd
jne 0x140045733
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140045742
cmp byte [rcx + 1], 0xa
jne 0x140045742
inc rcx
jmp 0x140045742
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x75650]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140045715
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14004575f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140026af0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400458f4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14007a300]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x140045952
cmp word [rdx], r12w
jne 0x140045952
or byte [rax + r8*8 + 0x38], cl
jmp 0x140045958
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x140045ab3
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140045a8e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140045991
mov rcx, r9
jmp 0x1400459b4
cmp r9, rdx
jae 0x1400459cb
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x140045975
jmp 0x140045ab3
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140045a88
cmp dword [rsp + 0x80], edi
je 0x140045a88
mov rdx, r14
lea r11, [0x14007a300]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140045a61
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140045a34
mov word [rbx], r12w
jmp 0x140045aaf
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140045a3d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x140045aaf
cmp word [rsp + 0x70], r12w
jne 0x140045a6e
cmp rbx, rsi
je 0x140045a2e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140046580
cmp word [rsp + 0x70], r12w
je 0x140045ab3
mov word [rbx], r13w
jmp 0x140045aaf
lea r11, [0x14007a300]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140045aab
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140045ab3
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004b3dc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14004b40c
xor eax, eax
jmp 0x14004b4cf
mov rbp, rbx
cmp word [rax], si
je 0x14004b431
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14004b418
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14004b414
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400469dc
movsxd r14, eax
test eax, eax
jne 0x14004b46f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14004b405
mov rcx, r14
call fcn.140046624
mov rdi, rax
test rax, rax
jne 0x14004b488
xor ecx, ecx
call fcn.140044134
jmp 0x14004b464
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400469dc
test eax, eax
jne 0x14004b4b9
mov rcx, rdi
call fcn.140044134
jmp 0x14004b4c3
xor ecx, ecx
call fcn.140044134
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140052a64
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140046580
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140046580
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140052bb4
cmp rax, 0xffffffffffffffff
je 0x140052bb4
xor edi, edi
test rbp, rbp
jle 0x140052b5f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140044720
mov rbx, rax
test rax, rax
jne 0x140052aec
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140052b55
mov edx, 0x8000
mov ecx, r14d
call fcn.14003fb8c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140043e24
cmp eax, 0xffffffff
je 0x140052b35
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140052afc
mov edx, r15d
mov ecx, r14d
call fcn.14003fb8c
jmp 0x140052b55
cmp byte [rsi + 0x38], dil
je 0x140052b4c
cmp dword [rsi + 0x34], 5
jne 0x140052b4c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140052b55
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140044134
jmp 0x140052bc8
jns 0x140052bc8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140046580
cmp rax, 0xffffffffffffffff
jne 0x140052b80
cmp byte [rsi + 0x30], dil
je 0x140052bc8
mov edi, dword [rsi + 0x2c]
jmp 0x140052bc8
mov ecx, r14d
call fcn.14004b9d4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140052bc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140052bc8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140052bc1
mov eax, dword [rsi + 0x2c]
jmp 0x140052bc6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140046580
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400015f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movabs r8, 0xf53e9eb1b253f8d
mov rdx, rcx
nop
mov rcx, rax
mov r9, r8
and ecx, 7
shl rcx, 3
shr r9, cl
xor byte [rdx + rax], r9b
add rax, 1
cmp rax, 0x13
jne 0x140001600
mov byte [rdx + 0x13], 0
ret

Function at 0x140001630
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movabs r8, 0xf53e9eb1b253f8d
mov rdx, rcx
nop
mov rcx, rax
mov r9, r8
and ecx, 7
shl rcx, 3
shr r9, cl
xor byte [rdx + rax], r9b
add rax, 1
cmp rax, 0x12
jne 0x140001640
mov byte [rdx + 0x12], 0
ret

Function at 0x140001670
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movabs r8, 0xf53e9eb1b253f8d
mov rdx, rcx
nop
mov rcx, rax
mov r9, r8
and ecx, 7
shl rcx, 3
shr r9, cl
xor byte [rdx + rax], r9b
add rax, 1
cmp rax, 0x16
jne 0x140001680
mov byte [rdx + 0x16], 0
ret

Function at 0x1400016f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movabs r8, 0xf53e9eb1b253f8d
mov rdx, rcx
nop
mov rcx, rax
mov r9, r8
and ecx, 7
shl rcx, 3
shr r9, cl
xor byte [rdx + rax], r9b
add rax, 1
cmp rax, 0x15
jne 0x140001700
mov byte [rdx + 0x15], 0
ret

Function at 0x140001730
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movabs r8, 0xf53e9eb1b253f8d
mov rdx, rcx
nop
mov rcx, rax
mov r9, r8
and ecx, 7
shl rcx, 3
shr r9, cl
xor byte [rdx + rax], r9b
add rax, 1
cmp rax, 0x17
jne 0x140001740
mov byte [rdx + 0x17], 0
ret

Function at 0x1400017b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
movabs r8, 0x36d5f5901777103
mov rdx, rcx
nop
mov rcx, rax
mov r9, r8
and ecx, 7
shl rcx, 3
shr r9, cl
xor word [rdx + rax*2], r9w
add rax, 1
cmp rax, 0x18
jne 0x1400017c0
mov byte [rdx + 0x30], 0
ret

Function at 0x1400038d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movdqa xmm0, xmmword [0x1403ef3b0]
movaps xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x1403ef3c0]
mov rsi, rcx
mov edi, edx
lea rcx, [0x140038c60]
mov byte [rsp + 0x40], 0xf9
movaps xmmword [rsp + 0x30], xmm0
call fcn.140013570
lea rcx, [0x140038c40]
mov rbp, rax
call fcn.140013570
cmp byte [rbp], 0
mov rbx, rax
jne 0x140003951
movdqa xmm1, xmmword [rsp + 0x20]
mov byte [rax + 0x21], 1
xor r8d, r8d
mov rdx, rax
movdqa xmm2, xmmword [rsp + 0x30]
mov byte [rax + 0x20], 0xf9
lea rcx, [0x1400262a0]
movups xmmword [rax], xmm1
movups xmmword [rax + 0x10], xmm2
mov byte [rbp], 1
call fcn.140012280
cmp byte [rbx + 0x21], 0
je 0x140003989
movabs r8, 0x2967333707df99f9
xor eax, eax
nop dword [rax + rax]
mov rcx, rax
mov rdx, r8
and ecx, 7
shl rcx, 3
shr rdx, cl
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140003968
mov byte [rbx + 0x21], 0
mov ebp, edi
lea rcx, [rbp + 1]
call sub.msvcrt.dll_malloc
mov byte [rax + rbp], 0
mov r8, rax
xor eax, eax
test edi, edi
je 0x1400039c2
nop dword [rax]
mov rdx, rax
and edx, 0x1f
movzx edx, byte [rbx + rdx]
xor dl, byte [rsi + rax]
mov byte [r8 + rax], dl
add rax, 1
cmp rbp, rax
jne 0x1400039a8
mov rax, r8
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret