joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x1400021ba
xor al, al
jmp 0x140002374
cmp qword [0x14001dc40], 0
jne 0x140002369
mov eax, 0xa
mov dword [rbp - 0x60], eax
mov dword [rbp - 0x5c], 0x390c310d
mov dword [rbp - 0x58], 0x201e2829
mov dword [rbp - 0x54], 0x523d3f
xor r14d, r14d
mov edx, r14d
test eax, eax
je 0x140002207
nop
mov eax, edx
lea rcx, [rbp - 0x5c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x60]
cmp edx, eax
jb 0x1400021f0
mov byte [rbp + rax - 0x5c], r14b
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
lea rax, [rbp - 0x5c]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140002230
lea rdx, [rbp - 0x5c]
lea rcx, [rbp - 0x28]
call fcn.140002e50
nop
mov eax, 0xc
mov dword [rbp - 0x60], eax
movdqa xmm0, xmmword [str._8__46T]
movdqu xmmword [rbp - 0x5c], xmm0
mov edx, r14d
test eax, eax
je 0x140002287
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x5c]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x60]
cmp edx, eax
jb 0x140002270
mov byte [rbp + rax - 0x5c], 0
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
lea rax, [rbp - 0x5c]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400022a4
mov r8, rbx
lea rdx, [rbp - 0x5c]
lea rcx, [rbp - 0x48]
call fcn.140002e50
nop
lea rcx, [rbp - 0x48]
call fcn.14000b1e0
mov rdx, rax
lea r8, [rbp - 0x28]
mov rcx, rsi
call fcn.140002390
mov qword [0x14001dc40], rax
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000231b
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002316
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002316
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc74
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140002369
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002364
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002364
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc74
mov r9, rdi
mov rcx, rsi
call fcn.140003aa0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140002900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14001dc50]
test rax, rax
je 0x14000293a
cmp byte [0x14001dc30], 0
jne 0x140002b24
mov eax, 0x24
mov dword [rbp - 0x21], eax
movdqa xmm0, xmmword [0x140017870]
movdqu xmmword [rbp - 0x1d], xmm0
movdqa xmm1, xmmword [str.9_3908]
movdqu xmmword [rbp - 0xd], xmm1
mov dword [rbp + 3], 0x505001c
mov byte [rbp + 7], 0x6c
xor ecx, ecx
mov word [rbp + 8], cx
mov byte [rbp + 0xa], cl
xor r15d, r15d
mov edx, r15d
test eax, eax
je 0x140002997
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x1d]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x21]
cmp edx, eax
jb 0x140002980
mov byte [rbp + rax - 0x1d], r15b
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], 0
lea rax, [rbp - 0x1d]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400029c0
lea rdx, [rbp - 0x1d]
lea rcx, [rbp + 0xf]
call fcn.140002e50
nop
mov eax, 0xe
mov dword [rbp - 0x59], eax
movdqa xmm0, xmmword [str.___x_:___V]
movdqu xmmword [rbp - 0x55], xmm0
mov edx, r15d
test eax, eax
je 0x140002a17
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x55]
add rcx, rax
lea eax, [rdx + 0x48]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x59]
cmp edx, eax
jb 0x140002a00
mov byte [rbp + rax - 0x55], 0
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], 0
lea rax, [rbp - 0x55]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002a34
mov r8, rbx
lea rdx, [rbp - 0x55]
lea rcx, [rbp - 0x41]
call fcn.140002e50
nop
lea rcx, [rbp - 0x41]
call fcn.14000b1e0
mov rdx, rax
lea r8, [rbp + 0xf]
mov rcx, rsi
call fcn.140002390
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x140002aa7
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002aa2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc74
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140002af5
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002af0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002af0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc74
test rbx, rbx
je 0x140002b40
mov qword [0x14001dc50], rbx
mov r9d, 0xc
mov r8, rbx
lea rdx, [0x14001dc30]
mov rcx, rsi
call fcn.140001ad0
test al, al
je 0x140002b40
mov rax, qword [0x14001dc50]
mov qword [r14], rax
movsd xmm0, qword [0x14001dc30]
movsd qword [rdi], xmm0
mov eax, dword [0x14001dc38]
mov dword [rdi + 8], eax
mov al, 1
jmp 0x140002b42
xor al, al
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002b60
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor edx, edx
lea r9, [rbp + 0xf]
mov rsi, rcx
xor r15d, r15d
xor r8d, r8d
mov dword [rbp + 0xf], r15d
mov edi, r15d
lea ecx, [rdx + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140002bf6
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0xf]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0xf]
lea r9, [rbp + 0xf]
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140002bb0
test eax, eax
jns 0x140002c12
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
jmp 0x140002ca7
mov qword [rsp + 0xb8], rbx
mov ebx, r15d
mov qword [rsp + 0xc0], r14
mov r14, r15
cmp qword [rdi], rbx
jbe 0x140002ccb
mov rax, r15
nop dword [rax]
nop dword [rax + rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [rdi + rax*8 + 0x10]
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmm0, xmmword [rdi + rax*8 + 0x20]
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm0, xmmword [rbp - 0x29]
mov ecx, eax
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140002c7b
cmp qword [rbp - 9], rsi
je 0x140002cc7
inc ebx
mov eax, ebx
cmp rax, qword [rdi]
jb 0x140002c40
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000c8d0
mov rsi, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop rdi
pop rbp
ret
mov r14, qword [rbp - 0x19]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x140002c95
lea r8, [r14 + 8]
mov qword [rbp + 0x1f], r15
mov r9d, 8
lea rdx, [rbp + 0x1f]
mov rcx, rsi
call fcn.140001ad0
test al, al
je 0x140002c95
mov r8, qword [rbp + 0x1f]
lea rdx, [rbp + 0x27]
add r8, 8
mov qword [rbp + 0x27], r15
mov r9d, 8
mov rcx, rsi
call fcn.140001ad0
test al, al
je 0x140002c95
mov r8, qword [rbp + 0x27]
lea rdx, [rbp + 0x17]
add r8, 0x28
mov qword [rbp + 0x17], r15
mov r9d, 8
mov rcx, rsi
call fcn.140001ad0
test al, al
je 0x140002c95
mov r8, qword [rbp + 0x17]
lea rdx, [rbp + 0x2f]
xorps xmm0, xmm0
add r8, 0x58
mov r9d, 0x10
mov rcx, rsi
movups xmmword [rbp + 0x2f], xmm0
call fcn.140001ad0
test al, al
je 0x140002c95
mov rdx, qword [rbp + 0x17]
lea r8, [rbp + 0x2f]
add rdx, 0x58
mov word [rbp + 0x2f], r15w
mov r9d, 0x10
mov rcx, rsi
call fcn.140001ad0
test al, al
je 0x140002c95
mov al, 1
jmp 0x140002c97
Function at 0x140005970
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rcx, str.wmic_diskdrive_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call fcn.14000c9e8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call fcn.1400050d0
call fcn.140001210
mov rsi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400059fa
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400173c0]
call fcn.140003060
lea rdx, [0x140003230]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbp, qword [0x14001dc68]
xor eax, eax
mov rdi, qword [0x14001dc70]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
movdqu xmmword [rsp + 0x20], xmm0
cmp rbp, rdi
je 0x140005a95
sub rdi, rbp
cmp rdi, 0x1000
jb 0x140005a58
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140005b11
call fcn.14000c9e8
mov rcx, rax
test rax, rax
je 0x140005a51
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005a65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je 0x140005a65
mov rcx, rdi
call fcn.14000c9e8
mov qword [rsp + 0x58], rbx
mov r8, rdi
lea rbx, [rax + rdi]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov qword [rsp + 0x28], rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x28], rbx
mov rbx, qword [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140007340
test rax, rax
jne 0x140005ad2
mov rcx, rsi
call fcn.1400015f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400173c4]
call fcn.140003060
lea rdx, [0x140003230]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call fcn.1400015f0
lea rcx, str.wmic_diskdrive_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbp, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.140001140
int3
Function at 0x140008c30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140008d51
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140008d51
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x140008ca8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x140008d5e
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140008d3f
mov r8d, eax
cmp r8, rbp
jae 0x140008d3f
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x140008d3f
lea rax, [r8 + rsi]
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r9 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x140008d17
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x140008d2e
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140009290
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
mov rdx, qword [rsp + 0x50]
test eax, eax
jne 0x140008cc1
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x140008d5e
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c8d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000b1e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000b279
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000b230
test eax, eax
js 0x14000b345
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x14000b345
nop dword [rax]
mov ebp, edi
imul rax, rbp, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 0xf
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14000b2c2
lea rcx, [rsp + 0x28]
call fcn.140002e50
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14000b2e3
mov rdx, qword [rsi]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000b37b
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000b33b
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b336
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b3cc
call fcn.14000cc74
inc edi
cmp edi, dword [rbx]
jb 0x14000b290
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000c8d0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
imul rax, rbp, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000b3d8
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b3d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b3d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc74
mov rax, rdi
jmp 0x14000b358
Function at 0x14000b6d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14000b707
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14000b728
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000b72a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000b783
test ecx, ecx
jle 0x14000b763
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000b783
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000b783
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000b7b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000b7d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000b7e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b804
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b806
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x14000b840
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000b8e7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14000b87b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14000b8c1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14000b900
cmp rbx, rax
ja 0x14000b890
mov r8, rdi
test rdi, rdi
je 0x14000b8e7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14000b8ea
Function at 0x14000bd00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000bd2d
xor eax, eax
jmp 0x14000be82
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14000bd58
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14000bd58
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000be82
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000be75
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000bd9b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000bdc6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000be7a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000be35
sub eax, 1
je 0x14000be35
cmp eax, 2
jne 0x14000be75
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000be7a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000be63
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000be75
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000be7a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000c8d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000bfd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000c0a3
cmp byte [rcx + 0x71], 0
je 0x14000c0a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000c09f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000c064
sub eax, 1
je 0x14000c068
cmp eax, 2
jne 0x14000c09f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c8d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000c096
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000c09f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000c04c
xor al, al
jmp 0x14000c04c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c8d0
add rsp, 0x60
pop rbx
ret