joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x780]
sub rsp, 0x880
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rbp + 0x770], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, [0x140072fe0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003e3c
mov dword [rsp + 0x40], 0x3ff
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.CurrentBuild
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x140003d20
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140006570
nop
lea rcx, [rsp + 0x48]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
cmovae rcx, r8
mov rax, qword [rsp + 0x58]
lea rsi, [rcx + rax*2]
lea rdi, [rsp + 0x48]
cmovae rdi, r8
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov rax, rsi
sub rax, rdi
sar rax, 1
cmp rax, 0xf
jbe 0x140003d9d
mov rdx, rax
mov rcx, rbx
call fcn.140006a30
mov qword [rbx + 0x10], r14
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x30], rbx
cmp rdi, rsi
je 0x140003dfb
nop word [rax + rax]
movzx r9d, byte [rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140003de0
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140003dd5
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140003de8
mov rcx, rbx
call fcn.1400068d0
add rdi, 2
cmp rdi, rsi
jne 0x140003db0
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003e39
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140003e31
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14004c11c
mov rax, rbx
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.14004be70
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400073c0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, r8d
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rbx, rcx
lea r8, [rsp + 0x48]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400074a8
mov rax, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x54], rax
mov r9d, reloc.WS2_32.dll_recv
lea rax, [rsp + 0x30]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x38]
mov dword [rsp + 0x5c], 0
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400074a8
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x38], 1
test edi, edi
je 0x14000746e
or dword [rsp + 0x44], 2
jmp 0x140007473
and dword [rsp + 0x44], 0xfffffffd
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], 0
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400074a8
mov al, 1
jmp 0x1400074aa
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004be70
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x1400074d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str._s___error__n
mov rcx, rax
call fcn.140007370
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], 0
mov r9d, ebx
mov r8d, eax
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
xor edx, edx
mov ecx, 0x1100
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ebx, eax
test eax, eax
je 0x14000757d
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov rcx, rax
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004be70
add rsp, 0x60
pop rbx
ret
Function at 0x14000f780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov r9d, edx
and r10d, 7
je 0x14000f80d
cmp edx, r10d
jge 0x14000f7fe
mov r9d, dword [rcx + 0x14]
mov eax, 1
mov ecx, edx
mov r8d, edx
shl eax, cl
cmp r9d, eax
jae 0x14000f7f7
mov r11, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r11
jb 0x14000f7c2
xor cl, cl
jmp 0x14000f7cb
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r8 + 8]
mov ecx, r8d
mov dword [rbx + 0x10], edx
shl eax, cl
or r9d, eax
mov dword [rbx + 0x14], r9d
cmp edx, 0x18
jg 0x14000f7fe
mov ecx, edx
mov eax, 1
shl eax, cl
mov r8d, edx
cmp r9d, eax
jb 0x14000f7b6
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov ecx, r10d
shr dword [rbx + 0x14], cl
sub edx, r10d
mov dword [rbx + 0x10], edx
mov r9d, edx
xor r10d, r10d
test edx, edx
jle 0x14000f842
mov ecx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rbx + 0x14]
lea edx, [r9 - 8]
shr ecx, 8
inc r10d
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], ecx
mov r9d, edx
test edx, edx
jg 0x14000f820
mov dword [rbx + 0x10], edx
jns 0x14000f868
mov rax, qword gs:[0x58]
mov edx, 0x20
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r10d
cmp rcx, 4
jge 0x14000f897
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14000f881
xor dl, dl
jmp 0x14000f88a
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14000f878
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14000f844
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14000f901
mov rax, qword gs:[0x58]
mov edx, 0x20
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14000f91b
mov rcx, rbx
call fcn.14000ec20
test eax, eax
je 0x14000f8f4
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14001b860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
mov byte [rcx], 1
xor edi, edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov dword [rcx + 0x28], edi
mov byte [rcx + 0x2c], dil
mov dword [rbp - 0x60], 0xb7b3be9c
mov dword [rbp - 0x5c], 0xf9b1bbbd
mov word [rbp - 0x58], 0xf6
mov byte [rbp - 0x56], 1
add rcx, 0x30
mov qword [rbp - 0x18], rcx
mov edx, edi
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x30]
xor byte [rbp + rdx - 0x60], al
inc rdx
cmp rdx, 9
jb 0x14001b8c0
mov byte [rbp - 0x56], dil
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], recv
mov byte [rcx], dil
mov r8d, 9
lea rdx, [rbp - 0x60]
call fcn.1400021e0
nop
movdqa xmm0, xmmword [0x140074830]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x9f878b
mov byte [rbp - 0x1c], 1
lea rcx, [rbx + 0x50]
mov qword [rbp - 0x18], rcx
mov rdx, rdi
nop dword [rax]
lea eax, [rdx - 0x26]
xor byte [rbp + rdx - 0x30], al
inc rdx
cmp rdx, 0x13
jb 0x14001b920
mov byte [rbp - 0x1c], 0
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], recv
mov byte [rcx], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, [rbp - 0x30]
call fcn.1400021e0
nop
movdqa xmm0, xmmword [0x140074880]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x84988a8e
mov dword [rbp - 0x3c], 0xde8880
mov byte [rbp - 0x38], 1
lea rcx, [rbx + 0x70]
mov qword [rbp - 0x18], rcx
mov rdx, rdi
lea eax, [rdx - 0x26]
xor byte [rbp + rdx - 0x50], al
inc rdx
cmp rdx, 0x17
jb 0x14001b980
mov byte [rbp - 0x38], 0
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], recv
mov byte [rcx], 0
mov r8d, reloc.WS2_32.dll_socket
lea rdx, [rbp - 0x50]
call fcn.1400021e0
mov qword [rbx + 0x90], rdi
mov qword [rbx + 0x98], rdi
mov qword [rbx + 0xa0], rdi
mov dword [rbx + 0xa8], edi
lea rcx, [rbx + 0xac]
xor edx, edx
mov r8d, 0xf0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x14036e540]
movaps xmm0, xmmword [0x1400746b0]
movups xmmword [rcx + 0x1630], xmm0
movaps xmm1, xmmword [0x1400746d0]
movups xmmword [rcx + 0x16c0], xmm1
movaps xmm0, xmmword [0x140074610]
movups xmmword [rcx + 0x1660], xmm0
movaps xmm1, xmmword [0x1400746e0]
movups xmmword [rcx + 0x1680], xmm1
movaps xmm0, xmmword [0x1400747a0]
movups xmmword [rcx + 0x1760], xmm0
movaps xmm1, xmmword [0x140074780]
movups xmmword [rcx + 0x17b0], xmm1
movaps xmm0, xmm1
movups xmmword [rcx + 0x1790], xmm1
mov dword [rcx + 0x156c], edi
mov dword [rcx + 0x15a0], 0x40000000
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001e9f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x50]
call fcn.14001f450
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14001ea52
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002850
cmp byte [rbx + 5], 0
je 0x14001ea83
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x26]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 4
jb 0x14001ea70
mov byte [rbx + 5], 0
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140002480
nop
mov qword [rdi], 0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
mov dword [rsp + 0x20], 4
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rcx, qword [rbp - 0x38]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14001eae9
mov rax, qword [rbp - 0x68]
mov r8, qword [rax]
test r8, r8
je 0x14001eae9
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x40]
cmovb r8, qword [rbp - 0x40]
sub r8, rdx
jmp 0x14001eb1b
test cl, 4
jne 0x14001eb11
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
test rcx, rcx
je 0x14001eb11
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x58]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x14001eb1b
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14001eb29
mov rcx, rdi
call fcn.1400021e0
nop
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rdx + 0x50], rax
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rsp + rdx + 0x4c], r8d
lea rcx, [rsp + 0x58]
call fcn.140006160
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, rdi
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14004be70
mov rbx, qword [rsp + 0x188]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f790
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14001f7f1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14001f7b0
mov ecx, dword [r10]
jmp 0x14001f8da
cmp ecx, 0x4e0
jb 0x14001f8da
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001f810
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001f860
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14001ffc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14001fff0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140020018
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002001a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140020073
test ecx, ecx
jle 0x140020053
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140020073
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140020073
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
push rbx
sub rsp, 0x70
mov rax, qword [0x140132500]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx r8d, byte [rcx]
add dword [rbx - 0x3f7bba26], ecx
Function at 0x1400200a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400200c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400200d1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400200f4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400200f6
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140020130
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400201d7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14002016b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400201b1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400201f0
cmp rbx, rax
ja 0x140020180
mov r8, rdi
test rdi, rdi
je 0x1400201d7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x1400201da
movups xmm0, xmmword [0x1401253d4]
comiss xmm0, xmm5
jbe case.0x140006209.13
comiss xmm2, xmm3
movaps xmm1, xmm3
subss xmm1, xmm2
mulss xmm1, xmm5
jbe 0x1400cca25
movsd xmm0, qword [reloc.XINPUT1_4.dll_Ordinal_2]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm1
addss xmm0, xmm2
movaps xmm2, xmm0
jmp 0x1400cc9cb
movsd xmm0, qword [0x1401253e8]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm1
addss xmm0, xmm2
movaps xmm2, xmm0
jmp 0x1400cc9cb
Function at 0x1400205f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002061d
xor eax, eax
jmp 0x140020772
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140020648
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140020648
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140020772
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140020765
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14002068b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400206b6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002076a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140020725
sub eax, 1
je 0x140020725
cmp eax, 2
jne 0x140020765
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002076a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140020753
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140020765
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14002076a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004be70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400208c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140020993
cmp byte [rcx + 0x71], 0
je 0x140020993
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14002098f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140020954
sub eax, 1
je 0x140020958
cmp eax, 2
jne 0x14002098f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004be70
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140020986
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002098f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14002093c
xor al, al
jmp 0x14002093c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004be70
add rsp, 0x60
pop rbx
ret

Function at 0x1400223d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14002242d
lea rbx, [0x14006f090]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140022414
cmp r10, 2
jb 0x140022414
cmp byte [r9], r8b
jne 0x140022414
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400223f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14002246f
lea rbx, [0x14006f090]
cmp r8b, 0x23
jne 0x140022453
cmp byte [r9], r8b
jne 0x140022453
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140022440
mov rbx, qword [rsp + 8]
not eax
ret