joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c160
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401fece8], eax
jg 0x14000c2e7
mov rax, qword [0x1401fecd8]
sub rax, qword [0x1401fecd0]
cmp rax, 0x20
jae 0x14000c2be
xor ebp, ebp
mov dword [rsp + 0x40], ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x14000c2be
mov ebx, ebp
cmp dword [rsp + 0x40], ebp
jle 0x14000c2b5
mov rdi, rax
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000c212
lea rcx, [rsp + 0x20]
call fcn.14000ba80
nop
mov rdx, qword [0x1401fecd8]
cmp rdx, qword [0x1401fece0]
je 0x14000c25d
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x20], bp
add qword [0x1401fecd8], 0x20
jmp 0x14000c26c
lea r8, [rsp + 0x20]
call fcn.14000c370
mov rax, qword [rsp + 0x38]
cmp rax, 8
jb 0x14000c2a5
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c2a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c31d
call fcn.140017444
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jl 0x14000c1f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [0x1401fecd0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140016d70
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rcx, [0x1401fece8]
call fcn.1400170a8
cmp dword [0x1401fece8], 0xffffffff
jne 0x14000c1a3
lea rcx, [0x14003a110]
call fcn.14001742c
lea rcx, [0x1401fece8]
call fcn.140017048
jmp 0x14000c1a3
call fcn.140028d9c
int3
Function at 0x1400105d0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
mov rdi, rcx
xor eax, eax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], 0xf
mov byte [rsp + 0x70], al
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], al
jne 0x140010616
lea rcx, [rsp + 0x70]
call fcn.14000cf80
nop
call fcn.14000b700
mov rbp, rax
lea rcx, str.UpdateUserData__:_Response__
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [rdi + 8]
cmp ecx, 0xb
je 0x140010674
cmp ecx, 0xd
jne 0x140010773
cmp dword [rdi + 0xc], 4
jne 0x140010773
mov qword [rsp + 0x30], rbx
lea rax, str.strData_:__S
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1d2
lea r9, str.ServiceLayer::UpdateUserData
lea r8, str.C:BITDIRAVRETAILqhav_sourceupgradeupguilibinterface.cpp
mov edx, 2
mov rcx, rbp
call fcn.14000a8e0
lea rax, str.start
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1d3
lea r9, str.ServiceLayer::UpdateUserData
lea r8, str.C:BITDIRAVRETAILqhav_sourceupgradeupguilibinterface.cpp
mov edx, 2
mov rcx, rbp
call fcn.14000a8e0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000dbc0
mov rbx, rax
lea rdx, [0x14017f7f8]
lea rcx, [rsp + 0x50]
call fcn.14000de40
nop
mov r9, rbx
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 8]
call fcn.14000e2e0
nop
call fcn.14000bf00
lea rcx, [rsp + 0x40]
call qword [rax + 0x410]
nop
call fcn.14000bf00
lea rcx, [rsp + 0x50]
call qword [rax + 0x410]
nop
call fcn.14000bf00
lea rcx, [rsp + 0x60]
call qword [rax + 0x410]
nop
lea rax, str.exit
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1d5
lea r9, str.ServiceLayer::UpdateUserData
lea r8, str.C:BITDIRAVRETAILqhav_sourceupgradeupguilibinterface.cpp
mov edx, 2
mov rcx, rbp
call fcn.14000a8e0
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x1400107af
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400107d2
call fcn.140017444
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140016d70
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call fcn.140028d9c
int3
Function at 0x140011b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140011bf5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140011bf5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140011be5
nop
cmp rbx, rcx
jae 0x140011bf5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140011bd0
cmp rbx, rcx
jae 0x140011bf5
cmp word [rbx], 0
je 0x140011bf5
mov rax, rbx
jmp 0x140011bf7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400142b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, qword [rdx + 0x10]
xor edi, edi
mov r14, rdx
test rbx, rbx
je 0x140014303
mov rax, rbx
cmp word [rbx], di
je 0x1400142f9
nop dword [rax + rax]
add rax, 2
cmp word [rax], di
jne 0x1400142f0
sub rax, rbx
sar rax, 1
mov esi, eax
jmp 0x140014309
mov rbx, rdi
mov rsi, rdi
lea rdx, str.res:
mov qword [rsp + 0x290], rbp
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.1400154c0
test eax, eax
js 0x1400144a4
mov rsi, qword [0x140194a60]
add rbx, 8
je 0x14001455c
cmp word [rbx], di
je 0x14001455c
mov r8d, 4
lea rdx, [0x140188fd0]
mov rcx, rbx
call fcn.140029ad8
test eax, eax
jne 0x14001436b
add rbx, 8
mov r8d, 2
lea rdx, [0x140188fdc]
mov rcx, rbx
call fcn.140029ad8
test eax, eax
jne 0x140014388
add rbx, 4
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x20a
call fcn.140019870
mov r9d, 0x104
lea rcx, [rsp + 0x50]
mov r8, rbx
lea edx, [r9 + 1]
call fcn.140029b04
mov edx, 0x2e
lea rcx, [rsp + 0x50]
call fcn.140018dd4
mov rbx, rax
test rax, rax
je 0x1400143fa
mov word [rax], di
add rbx, 2
je 0x1400143fa
lea rdx, str.HTML
mov rcx, rbx
call fcn.14001d3f4
test eax, eax
je 0x1400143fa
lea rdx, [0x140188ff8]
mov rcx, rbx
call fcn.14001d3f4
mov r8, rbx
test eax, eax
jne 0x140014400
mov r8d, 0x17
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14001455c
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001455c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14001455c
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x14001455c
mov rbx, qword [r14 + 0x10]
mov rdi, qword [r14 + 8]
call fcn.14000bf00
mov r9d, esi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x18]
xor eax, eax
mov rbp, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140016d70
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret
lea rdx, str.this:__app_
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rsi
call fcn.1400154c0
test eax, eax
js 0x140014476
call fcn.1400119b0
mov qword [rsp + 0x30], rdi
mov rsi, rax
mov dword [rsp + 0x40], edi
add rbx, 0x16
je 0x1400144f8
mov rcx, rbx
cmp word [rbx], di
je 0x1400144eb
add rcx, 2
cmp word [rcx], di
jne 0x1400144e2
sub rcx, rbx
mov rdi, rbx
sar rcx, 1
mov eax, ecx
jmp 0x1400144fb
mov rax, rdi
lea rdx, [0x140188fc8]
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call fcn.1400154c0
test eax, eax
js 0x14001451e
add rbx, 4
call fcn.14000bf00
mov rcx, qword [rsi]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rdx, rbx
call qword [rax + 0x510]
mov esi, dword [rsp + 0x40]
test rsi, rsi
je 0x14001455c
mov rbx, qword [r14 + 0x10]
mov rdi, qword [r14 + 8]
call fcn.14000bf00
mov r8, qword [rsp + 0x30]
mov r9d, esi
jmp 0x14001446d
mov eax, 1
jmp 0x140014478
Function at 0x140029128
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140028f87
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028f87
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028f87
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140028f87
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140028f87
cmp dword [rcx + 0x84], 0xe
jbe 0x140028f87
cmp dword [rcx + 0xf8], 0
je 0x140028f87
mov ecx, ebx
call fcn.140029044
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140028e14
nop
cmp dword [rbp + 0x20], 0
je 0x140028fd5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140028fe0
int3
xor r8d, r8d
xor edx, edx
jmp 0x140028f18
Function at 0x140030490
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140030517
mov rsi, rbx
cmp word [rax], bp
je 0x1400304d6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400304c0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400304bc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14002bd60
mov rdi, rax
test rax, rax
je 0x140030504
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400191c0
mov rbp, rdi
xor ecx, ecx
call fcn.14002b918
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140f6ab30
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f6ab3a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f6ab63
pop rbp
sub rbp, 0x33
sub rbp, 0xf6ab30
sub rsp, 0x20
jmp 0x140f6ab82
mov rax, 0xf6ab30
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffbf0a246d
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f6aba1
jmp 0x140f6abb8
and eax, 0xe4e684e4
push rcx
insd dword [rdi], dx
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0x6c65acec
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0xaa25846c
lodsd eax, dword [rsi]
insd dword [rdi], dx
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0x6d45afaa
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0x6c258f9a
lodsb al, byte [rsi]
out 0xec, al
invalid
Function at 0x14045feef
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0xffffffffac331108
mov qword [rsp], r11
lea r9, [0x14044d828]
push 0x6a2dd821
movzx r11d, byte [rax]
xor r11d, edx
and r11d, 0xff
mov r11d, dword [r9 + r11*4]
dec word [rsp + 1]
shr edx, 8
inc qword [rsp]
xor edx, r11d
shr dword [rsp + 2], 0xcb
inc rax
xor edx, 0x80b3aa90
dec r10
lea rsp, [rsp + 8]
jne 0x14045ff02
pop r11
jmp 0x1404739e6
Function at 0x140002b50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1400f7534], 0
lea rdi, [0x1400f7530]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002c28
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140002b80
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x140002c5e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140002c40
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x140002c9f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140002c83
cmp byte [r8], r9b
jne 0x140002c83
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x140002c70
not eax
pop rdi
ret
Function at 0x140002e80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x140002e99
mov qword [r8], 0
lea rdx, [0x140052bf0]
call fcn.140002cb0
mov rbx, rax
test rax, rax
jne 0x140002eb8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
xor edx, edx
mov r8d, 2
mov qword [rsp + 0x38], rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002f7a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002f7a
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002f7a
mov rax, qword [0x1400f6920]
mov rbp, rsi
test rax, rax
je 0x140002f17
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002f7a
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x140002f67
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400f6920]
test rax, rax
je 0x140002f5c
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002f83
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140002f75
mov qword [rdi], rbp
mov rax, rsi
jmp 0x140002f85
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400133e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1400f6920]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2eec], esi
test rcx, rcx
je 0x1400134fa
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2ef0]
mov dword [rdi + 0x2eec], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001343a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.1400144a0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001344e
mov edx, 8
mov rcx, rbx
call fcn.1400144a0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2f00], esi
jle 0x14001349a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2f08]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2f00]
jl 0x140013470
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x1400134a9
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2ef8]
lea rdx, [0x140052bf4]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400f6918]
mov rcx, r15
cmovne rdi, rax
call fcn.140002cb0
mov rbx, rax
test rax, rax
je 0x1400134f5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001f2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001f499
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001f376
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001ec50
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001e260
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001f367
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140014090
mov dword [rbx + 0x80], 0
jmp 0x14001f485
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001d140
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002ec90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14002ecb8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14002ecde
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002ece0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14002ed39
test ecx, ecx
jle 0x14002ed19
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14002ed39
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002ed39
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14002ed60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14002ed91
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14002edaf
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002edcb
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002edcd
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002ee09
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14002ee9e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14002ee44
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14002ee7e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14002ee9e
cmp rbx, rax
ja 0x14002ee50
test rbx, rbx
je 0x14002ee9e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret