joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400de400
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 0x20
cmp rdx, 0x18
jb 0x1400de445
nop dword [rax]
nop word [rax + rax]
add rbx, rbx
mov r8, rbx
mov rax, rbx
shr r8, 2
sub rax, r8
cmp rdx, rax
jae 0x1400de430
mov rsi, rbx
shl rsi, 4
mov rcx, rsi
call qword [0x140470258]
mov rdi, rax
test rax, rax
je 0x1400de544
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
xor r11d, r11d
cmp qword [r14 + 8], r11
jbe 0x1400de52d
xor esi, esi
mov qword [rsp + 0x30], rbp
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14]
mov r10, qword [rsi + rax]
test r10, r10
je 0x1400de517
mov rbp, qword [rsi + rax + 8]
lea r9, [rbx - 1]
mov eax, r10d
shr eax, 0x10
xor eax, r10d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
mov edx, eax
shr rdx, 0x10
xor rdx, rcx
and rdx, r9
xor ecx, ecx
nop word [rax + rax]
mov rax, rdx
shl rax, 4
add rax, rdi
mov r8, qword [rax]
cmp r8, r10
je 0x1400de50a
test r8, r8
je 0x1400de50a
inc rdx
add rdx, rcx
inc rcx
and rdx, r9
cmp rcx, r9
jbe 0x1400de4e0
xor eax, eax
cmp qword [rax], 0
jne 0x1400de513
mov qword [rax], r10
mov qword [rax + 8], rbp
inc r11
add rsi, 0x10
cmp r11, qword [r14 + 8]
jb 0x1400de490
mov rbp, qword [rsp + 0x30]
mov rcx, qword [r14]
test rcx, rcx
je 0x1400de53b
call qword [0x140470260]
mov qword [r14 + 8], rbx
mov al, 1
mov qword [r14], rdi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400e9510
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x1400e95d6
cmp byte [rcx], 0
je 0x1400e95d6
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400e95d6
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1400e95d6
mov qword [rsp + 0x30], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov rdx, rbx
mov qword [rsp + 0x40], rsi
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400e9562
inc rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
nop dword [rax + rax]
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x1400e9590
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400e9f00
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400e9e90]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x1400eaa10
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x90
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400eaa72
cmp dword [rsp + 0x24], 6
sete al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010a310
add rsp, 0xd8
ret
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010a310
add rsp, 0xd8
ret

Function at 0x1400eaa90
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x90
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400eaaf2
cmp dword [rsp + 0x24], 6
setae al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010a310
add rsp, 0xd8
ret
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010a310
add rsp, 0xd8
ret
Function at 0x1400eaba0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea rdx, str.free_memory:_physical:
mov rcx, rbx
call fcn.14001b4d0
mov rcx, rax
xorps xmm1, xmm1
mov rax, qword [rsp + 0x30]
cvtsi2sd xmm1, rax
test rax, rax
jns 0x1400eabf7
addsd xmm1, qword [0x1403a8d60]
mulsd xmm1, qword [0x1402b4378]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___double____ptr64]
mov rcx, rax
lea rdx, [0x1402b428c]
call fcn.14001b4d0
lea rdx, str.paging_file:
mov rcx, rbx
call fcn.14001b4d0
mov rcx, rax
xorps xmm1, xmm1
mov rax, qword [rsp + 0x40]
cvtsi2sd xmm1, rax
test rax, rax
jns 0x1400eac40
addsd xmm1, qword [0x1403a8d60]
mulsd xmm1, qword [0x1402b4378]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___double____ptr64]
mov rcx, rax
lea rdx, [0x1402b428c]
call fcn.14001b4d0
lea rdx, str.virtual:
mov rcx, rbx
call fcn.14001b4d0
mov rcx, rax
xorps xmm1, xmm1
mov rax, qword [rsp + 0x50]
cvtsi2sd xmm1, rax
test rax, rax
jns 0x1400eac89
addsd xmm1, qword [0x1403a8d60]
mulsd xmm1, qword [0x1402b4378]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___double____ptr64]
mov rcx, rax
lea rdx, str._MB_
call fcn.14001b4d0
lea rdx, [0x14001b6b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010a310
add rsp, 0x70
pop rbx
ret
Function at 0x1400eacd0
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x680
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x670], rax
xor esi, esi
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATsosk
mov rcx, 0xffffffff80000002
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
jne 0x1400ead8c
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x44], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.StartExe
mov dword [rsp + 0x40], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
jne 0x1400ead71
cmp dword [rsp + 0x40], 2
je 0x1400ead7a
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ead95
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ead95
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
mov ebx, eax
test ebx, ebx
jne 0x1400eae0c
mov r8d, 0x104
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
cmp eax, 0x102
jbe 0x1400eadd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edi, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
mov ebx, eax
test eax, eax
jne 0x1400eae0c
mov dword [rsp + 0x28], 0xa
lea r8, [rsp + 0x160]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test rax, rax
jne 0x1400eae39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edi, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
mov ebx, eax
test eax, eax
je 0x1400eae3b
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x270]
mov dword [rsp + 0x28], 0x400
xor r9d, r9d
mov r8d, edi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, ebx
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.14010a310
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400eb820
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], 0x40
mov rdi, rcx
lea rcx, [rsp + 0x20]
movzx ebx, dl
test dl, dl
je 0x1400eb862
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r8, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
jmp 0x1400eb872
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
movsd xmm3, qword [0x1403a8d60]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x1400eb88b
addsd xmm1, xmm3
movsd xmm2, qword [0x1403a8bd8]
xorps xmm0, xmm0
mulsd xmm1, xmm2
cvtsi2sd xmm0, r8
test r8, r8
jns 0x1400eb8a8
addsd xmm0, xmm3
divsd xmm1, xmm0
minsd xmm1, xmm2
test bl, bl
je 0x1400eb8e1
movsd xmm3, qword [0x1403a8ba0]
comisd xmm3, xmm1
jbe 0x1400eb8ce
cvttsd2si eax, xmm1
movd xmm3, eax
cvtdq2pd xmm3, xmm3
subsd xmm1, xmm3
movaps xmm0, xmm2
subsd xmm0, xmm3
divsd xmm1, xmm0
mulsd xmm1, xmm2
subsd xmm2, xmm1
xor eax, eax
movsd qword [rdi], xmm2
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010a310
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x1400eb910
Capabilities:
Get memory capacity

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov qword [rbx], rax
mov qword [rdi], r9
mov rax, qword [rbx]
sub rax, r9
mov qword [rsi], rax
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010a310
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400eb980
Capabilities:
Get memory capacity

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov qword [rbx], rax
mov qword [rdi], r9
mov rax, qword [rbx]
sub rax, r9
mov qword [rsi], rax
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010a310
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f3290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400f333c
cmp byte [rcx + 0x71], 0
je 0x1400f333c
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, 0xffffffff
je 0x1400f32fd
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400f3301
sub eax, 1
je 0x1400f3305
sub eax, 2
je 0x1400f333c
xor al, al
jmp 0x1400f333e
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400f3333
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400f32fd
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400f333e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010a310
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400f3c50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400f3c7d
xor eax, eax
jmp 0x1400f3dd2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400f3ca8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400f3ca8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400f3dd2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400f3dc5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400f3ceb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400f3d16
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400f3dca
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x1400f3dc5
cmp eax, 1
jle 0x1400f3d85
cmp eax, 3
jne 0x1400f3dc5
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400f3dca
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400f3db3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400f3dc5
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x1400f3dca
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010a310
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400f4aa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rdi, r8
mov r14, rdx
mov rbx, rcx
je 0x1400f4ad7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov rbp, rdi
mov qword [rsp + 0x38], rsi
mov rdx, qword [rax]
test rdx, rdx
je 0x1400f4af8
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400f4afa
xor ecx, ecx
movsxd rsi, ecx
test rdi, rdi
jle 0x1400f4b8b
test ecx, ecx
jle 0x1400f4b32
cmp rdi, rsi
mov rcx, r14
cmovl rsi, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x50]
add r14, rsi
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
test rdi, rdi
jle 0x1400f4b8b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x1400f4b8b
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400f4b77
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
mov rsi, qword [rsp + 0x38]
sub rbp, rdi
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400f4bb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400f4be7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400f4c08
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400f4c0a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400f4c63
test ecx, ecx
jle 0x1400f4c3e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400f4c63
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400f4c63
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400fe5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov ebx, dword [rcx + 0x14]
mov rsi, rcx
call fcn.1400fe430
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.1400fe430
mov r8, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [r8]
movsxd rdx, dword [rax + 4]
cmp dword [rdx + r8 + 0x10], 0
jne 0x1400fe75b
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
cmp ebx, 2
mov qword [rsp + 0x20], r15
lea r14, [rsp + 0x40]
setne al
lea r15, [rsp + 0x40]
add r14, rax
xor rax, 1
add r15, rax
movzx edi, byte [r14]
movzx eax, byte [r15]
shl edi, 8
or edi, eax
lea eax, [rdi - 0xdc00]
cmp eax, 0x3ff
ja 0x1400fe670
lea rcx, [rsi + 0x18]
mov edx, 0xfffd
call fcn.1400fe4c0
jmp 0x1400fe74c
lea eax, [rdi - 0xd800]
mov qword [rsp + 0x48], rbp
cmp eax, 0x3ff
ja 0x1400fe73c
mov rcx, rsi
call fcn.1400fe430
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.1400fe430
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
cmp dword [rcx + rdx + 0x10], 0
jne 0x1400fe762
movzx eax, byte [r15]
movzx ebx, byte [r14]
shl ebx, 8
or ebx, eax
lea eax, [rbx - 0xdc00]
cmp eax, 0x3ff
jbe 0x1400fe725
lea rbp, [rsi + 0x18]
mov edx, 0xfffd
mov rcx, rbp
call fcn.1400fe4c0
lea eax, [rbx - 0xd800]
cmp eax, 0x7ff
ja 0x1400fe720
mov rcx, rsi
mov edi, ebx
call fcn.1400fe430
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.1400fe430
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
cmp dword [rcx + rdx + 0x10], 0
je 0x1400fe6b3
mov edx, 0xfffd
mov rcx, rbp
jmp 0x1400fe742
mov rcx, rbp
jmp 0x1400fe740
and edi, 0x3ff
and ebx, 0x3ff
shl edi, 0xa
or edi, ebx
add edi, 0x10000
lea rcx, [rsi + 0x18]
mov edx, edi
call fcn.1400fe4c0
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
lea rbp, [rsi + 0x18]
mov edx, 0xfffd
mov rcx, rbp
jmp 0x1400fe742
Function at 0x14010f7a0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14010f7df
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14010f809
test rbx, rbx
je 0x14010f805
mov dword [rbx], 0
mov byte [rbx + 4], 0
lea rdi, [0x1403a7b48]
mov qword [rbx + 8], rdi
mov al, 1
jmp 0x14010f86c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x24], 0
lea rdi, [0x1403a7b48]
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140111800
cmp dword [rax], 3
jne 0x14010f857
test rbx, rbx
je 0x14010f86a
mov dword [rbx], 0
mov byte [rbx + 4], 0
mov qword [rbx + 8], rdi
jmp 0x14010f86a
test rbx, rbx
je 0x14010f890
mov r8, rdi
mov edx, r14d
mov rcx, rbx
call fcn.14010f730
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010a310
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r14
pop rdi
pop rsi
ret
lea rdx, str.boostWaves1_70_0::filesystem::create_directory
lea rcx, [rsp + 0x48]
call fcn.140004fa0
nop
call fcn.1400adc90
mov r8, rax
mov edx, r14d
lea rcx, [rsp + 0x38]
call fcn.1400adca0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x20]
mov r8, rsi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14010f2b0
lea rdx, [0x140456450]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401110d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rsi, rcx
jb 0x1401110ef
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14011111e
mov r8, rdi
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.140110fa0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rdi, rdi
je 0x140111138
lea rax, [0x1403a7b48]
mov dword [rdi], 0
mov qword [rdi + 8], rax
mov byte [rdi + 4], 0
bt ebx, 0xa
jae 0x14011117f
mov rcx, rsi
call fcn.140110bc0
test al, al
je 0x14011116a
test bl, 0x10
mov eax, 4
mov ecx, reloc.WS2_32.dll_inet_addr
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401111a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor esi, esi
lea rax, [0x1403a7b48]
cmp qword [rcx + 0x18], 8
mov rbp, rdx
mov rdi, rcx
mov dword [rsp + 0x20], esi
mov byte [rsp + 0x24], sil
mov qword [rsp + 0x28], rax
jb 0x1401111db
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140111202
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140110fa0
mov esi, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140111236
bt ebx, 0xa
jae 0x14011122d
mov rcx, rdi
call fcn.140110bc0
test al, al
je 0x140111226
test bl, 0x10
mov eax, reloc.WS2_32.dll_inet_addr
mov ebx, 4
cmovne ebx, eax
jmp 0x140111236
mov ebx, 9
jmp 0x14011123a
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
je 0x14011123c
xor esi, esi
lea r9, str.boostWaves1_70_0::filesystem::remove
mov r8, rbp
mov rdx, rdi
mov ecx, esi
call fcn.140110a40
test al, al
je 0x140111258
xor al, al
jmp 0x140111265
mov r8, rbp
mov edx, ebx
mov rcx, rdi
call fcn.1401114d0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret