joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011ab59
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov r10w, r9w
rcr r10, 0x77
mov qword [rax + 8], rbx
shr bx, cl
mov qword [rax + 0x10], rsi
sub bl, dh
movsx bx, bl
adc bx, ax
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
cmp dword [rcx + 0x10], 0
movsxd rbx, edx
mov rbx, r8
movzx r10w, cl
mov r10, rdx
jmp 0x18011ab97
je 0x18011ad37
movsxd r9, dword [rcx + 0x10]
rcl ah, cl
shr dil, 0x51
xchg rdi, rdi
lea r14, [0x180000000]
adc rcx, r11
mov rdi, qword [rdx + 8]
rcl ch, 0x91
lahf
rcr al, 0xb7
xor esi, esi
lea r9, [r9 + rdi]
xchg ah, ch
or edx, 0xffffffff
rcr rcx, cl
rcl cx, 0x25
sub r8d, r8d
and rax, 0x223c1b3f
movzx ecx, byte [r9]
rol ax, cl
cmp r13b, 0xfe
and ecx, 0xf
sub r11b, 0x59
inc rax
movsx rax, byte [rcx + r14 + 0x6c8a0]
cmp edx, 0x61685594
cmc
not r11b
mov cl, byte [rcx + r14 + 0x6c8b0]
rcr r11b, 0xff
sub r9, rax
stc
shl r11w, 0x34
mov r11d, dword [r9 - 4]
test si, r12w
stc
shr r11d, cl
test r11d, r11d
jmp 0x18011ac2c
je 0x18011ad37
mov rax, qword [r10 + 0x10]
movsx r10w, r11b
xor ecx, 0x19611f28
mov r10d, dword [rax]
bts cx, ax
movzx ecx, byte [r9]
and ecx, 0xf
movzx eax, sp
shr eax, 0x85
shld rax, rbp, 5
movsx rax, byte [rcx + r14 + 0x6c8a0]
stc
mov cl, byte [rcx + r14 + 0x6c8b0]
cmp r11, 0x1ff424d1
sub r9, rax
mov eax, dword [r9 - 4]
stc
cmp bx, 0x39e1
test bl, 0x9f
shr eax, cl
cmp r9w, r15w
jmp 0x18011ac8e
add esi, eax
sub ah, 0xdb
btc rax, r14
movsxd rax, r11d
mov eax, esi
test r13w, 0x584c
add rax, r10
stc
add rax, rdi
jmp 0x18011acae
cmp rbx, rax
jmp 0x18011acb6
jb 0x18011ad1d
movzx ecx, byte [r9]
cwd
inc r8d
and ecx, 0xf
add edx, r9d
movsx rax, byte [rcx + r14 + 0x6c8a0]
sar dh, 0x22
shl dh, cl
cqo
mov cl, byte [rcx + r14 + 0x6c8b0]
rol dh, cl
cqo
cmovs rdx, r11
sub r9, rax
sub dh, 0x97
sbb dl, ch
mov edx, dword [r9 - 4]
cmp bp, 0x28c2
test sp, 0x19a8
shr edx, cl
jmp 0x18011ad08
dec edx
cmp r12b, 0x21
cmc
cmp r8d, r11d
jmp 0x18011ad17
jb 0x18011ac48
test r8d, r8d
jmp 0x18011ad25
je 0x18011ad37
mov eax, edx
jmp 0x18011ad32
jmp 0x18011ad44
or eax, 0xffffffff
cmovs bx, r12w
movsx r14w, r8b
mov rbx, qword [rsp + 8]
jmp 0x18011ad56
mov rsi, qword [rsp + 0x10]
movzx edi, sp
movsxd rdi, ebx
movzx r14w, dl
mov rdi, qword [rsp + 0x18]
movzx r14w, bl
cmova r14d, r10d
mov r14, qword [rsp + 0x20]
jmp 0x18011ad7e
ret
Function at 0x18011fbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
bts bp, sp
inc rbp
mov qword [rsp + 0x20], rsi
bswap bp
push rdi
bt ebp, edx
shrd bp, r15w, 4
push r12
rcr bpl, 0xb3
push r13
rol rbp, 0xe
push r14
xchg r13d, ebp
push r15
sub rsp, 0x20
neg r13d
movzx r13w, sil
mov rbp, rdx
bts r13, r14
clc
rcr r13b, 0
mov r13, rcx
cmc
test rdx, rdx
je 0x18011fdc1
sub r15b, r15b
cmp dil, 0x35
clc
cmp r10, r15
sub esi, esi
cmp dword [rdx], esi
jmp 0x18011fc2f
jle 0x18011fd5e
call fcn.1801195b4
mov rdx, rax
movzx r12w, r10b
bswap r12d
mov r12b, r9b
mov rax, qword [r13 + 0x30]
movsx r12w, r8b
neg r12w
movsxd r12, dword [rax + 0xc]
cmp r15b, 8
add r12, 4
jmp 0x18011fc69
add r12, rdx
jmp 0x18011fc71
call fcn.1801195b4
mov rdx, rax
bts eax, esp
mov cx, 0x3e32
mov rax, qword [r13 + 0x30]
xor r14b, 0x55
sar r14d, 0x1c
movsxd rcx, dword [rax + 0xc]
or r14b, r11b
sar r14d, 0x77
btc r14d, r10d
mov r14d, dword [rdx + rcx]
test r14d, r14d
jmp 0x18011fca7
jle 0x18011fd4d
movsxd rax, esi
jmp 0x18011fcb5
lea rax, [rax + rax*4]
mov qword [rsp + 0x58], rax
jmp 0x18011fcc3
call fcn.1801195b4
mov rbx, qword [r13 + 0x30]
neg dil
bt edi, 0x36
mov rdi, rax
or ah, ah
not rax
movsxd rax, dword [r12]
stc
add rdi, rax
jmp 0x18011fce8
call fcn.18011959d
mov rdx, qword [rsp + 0x58]
bsf r8d, r13d
mov r8b, 0x73
inc r8b
mov r8, rbx
rcl cl, 0xe5
xchg cx, cx
movsxd rcx, dword [rbp + 4]
clc
lea rax, [rax + rdx*4]
mov rdx, rdi
add rcx, rax
jmp 0x18011fd19
call fcn.18011d898
test eax, eax
jmp 0x18011fd25
jne 0x18011fd45
dec r14d
add r12, 4
test r14d, r14d
jmp 0x18011fd3a
jg 0x18011fcc3
jmp 0x18011fd4d
mov r15b, 1
jmp 0x18011fd4d
inc esi
clc
cmp esi, dword [rbp]
jmp 0x18011fd58
jl 0x18011fc35
mov rbx, qword [rsp + 0x50]
xadd r13b, r12b
mov al, r15b
xadd r12w, si
shrd r15w, r11w, 0xb4
mov rbp, qword [rsp + 0x60]
rcl r12d, cl
shr r14b, cl
mov rsi, qword [rsp + 0x68]
dec r14w
add rsp, 0x20
mov di, 0x24c3
movzx r13d, r12w
movsx rdi, r9w
pop r15
movsx r14, r9w
movzx r14w, r13b
pop r14
not dil
xchg r13b, r12b
pop r13
pop r12
movsxd rdi, r11d
mov dil, spl
movsx edi, r9w
pop rdi
jmp 0x18011fdc0
ret
call fcn.1801240aa
int3

Function at 0x18012062d
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
cqo
sub rsp, 0x20
mov rbx, rcx
cmp r12b, sil
jmp 0x180120644
lea r9, [0x18006d8b0]
btc edx, r9d
xor ecx, ecx
lea r8, [0x18006d8a8]
mov dl, al
cwd
movsx dx, bl
lea rdx, [0x18006c420]
jmp 0x18012066c
call fcn.180120385
test rax, rax
je 0x180120699
mov rcx, rbx
bswap bx
add rsp, 0x20
mov bx, bp
movsx ebx, ax
not bh
pop rbx
jmp 0x180120692
jmp qword [0x18006c288]
add rsp, 0x20
pop rbx
jmp 0x1801206a3
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x180120738
Capabilities:
Get thread local storage value

Disassembly:
push rbx
setle bl
sub rsp, 0x20
cdq
movzx rbx, r11w
movsx bx, r10b
mov ebx, ecx
cwd
sets r8b
xchg r8b, r9b
lea r9, [0x18006d8c0]
movsx dx, spl
mov ecx, 2
movzx r8d, ax
bswap r8w
lea r8, [0x18006d8b8]
cwd
lea rdx, [0x18006c438]
jmp 0x180120784
call fcn.180120385
mov ecx, ebx
test bl, sil
clc
test rax, rax
je 0x1801207a9
add rsp, 0x20
pop rbx
jmp 0x1801207a2
push qword [0x18006c288]
ret
add rsp, 0x20
movsx ebx, r8w
movzx rbx, si
pop rbx
jmp 0x1801207bb
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1801207c2
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
movzx bx, r10b
bsf edi, ecx
shl r9w, 0xa8
sub rsp, 0x20
movsx rdi, sp
mov rbx, rdx
movsxd rdx, r12d
lea r9, [0x18006d8c8]
movzx dx, r14b
mov edi, ecx
lea rdx, [0x18006c448]
movzx ecx, r8w
cmovns r8, r12
mov ecx, 3
xchg r8b, r8b
movzx r8, r11w
lea r8, [0x18006d8c0]
jmp 0x180120818
call fcn.180120385
mov rdx, rbx
mov ecx, edi
stc
cmp bpl, sil
test dil, r8b
test rax, rax
jmp 0x180120831
je 0x180120842
call qword [0x18006c288]
jmp 0x180120848
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
cmc
ror dil, 0xb2
xor di, r9w
add rsp, 0x20
mov dil, 0x98
movsxd rdi, eax
pop rdi
jmp 0x180120866
ret
Function at 0x18012775c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bts rbx, rsp
push rdi
sub rsp, 0x20
mov rbx, rcx
bt r8w, di
rcl r8w, 0xcf
shrd r8d, r9d, 0x42
sub edx, edx
clc
movzx r8w, bpl
add rcx, 0x18
movsx r8w, sil
bswap r8
mov r8d, 0x101
call fcn.18011a3e0
xor edx, edx
movsx rax, r11w
movzx rdi, r14w
cdqe
lea rdi, [rbx + 0xc]
mov ah, 0x7c
movzx eax, dx
movsxd r9, r11d
movzx r8w, dil
xchg cx, r8w
lea r9, [0x1800791e0]
mov qword [rbx + 4], rdx
mov cl, dl
mov r8, rbx
sete ch
mov qword [rbx + 0x220], rdx
bswap rcx
cmovp cx, r14w
mov cx, r10w
lea ecx, [rdx + 6]
rep stosw word [rdi], ax
sal al, 0x31
lea rax, [0x1800791f8]
sub dil, 0xc9
xadd cx, cx
rcr dil, cl
mov edi, edx
sar ch, cl
movzx ecx, bx
bsf rcx, r9
sub r8, rax
dec cl
not al
lea rcx, [rdi + r9]
inc rdi
mov al, byte [rcx + 0x18]
clc
test bpl, 0x38
mov byte [r8 + rcx + 0x30], al
test ah, 0x4c
jmp 0x18012782f
cmp rdi, 0x101
jmp 0x18012783b
jl 0x180127810
lea rax, [0x1800792f9]
sbb rcx, r15
ror cl, 0x2f
sub rbx, rax
cmovo ecx, r9d
movsx cx, r9b
lea rcx, [rdx + r9]
dec al
inc rdx
sub al, r8b
xor al, 0x6b
mov al, byte [rcx + 0x119]
cmp r9b, r10b
test r11b, r8b
mov byte [rbx + rcx + 0x232], al
cmp rdx, 0x100
jmp 0x180127887
jl 0x18012785a
mov rbx, qword [rsp + 0x30]
not dil
add rsp, 0x20
pop rdi
jmp 0x18012789f
ret
Function at 0x180128ad3
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r14, 0x673c4c0a
mov qword [rax + 8], rbx
jmp 0x180128af0
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
jmp 0x180128afd
mov qword [rax + 0x20], rdi
test r12b, 0x44
push r14
cmp r15b, bl
sub rsp, 0x40
jmp 0x180128b13
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
test cx, 0x4019
jmp 0x180128b2a
test rax, rax
jmp 0x180128b32
jne 0x180128b44
xor eax, eax
jmp 0x180128b3f
jmp 0x180128cfc
mov rbp, rbx
clc
cmp word [rax], si
jmp 0x180128b50
je 0x180128b99
or rax, 0xffffffffffffffff
jmp 0x180128b5f
inc rax
stc
test bpl, 0x9d
cmp word [rbp + rax*2], si
jne 0x180128b5f
lea rbp, [rbp + rax*2]
clc
test spl, r10b
test r11, 0x59b867b9
add rbp, 2
clc
test r10, rbp
cmp word [rbp], si
jmp 0x180128b93
jne 0x180128b56
mov qword [rsp + 0x38], rsi
ror r9w, cl
inc r9d
sub rbp, rbx
movsxd r9, r13d
cmp r10b, sil
test r13, 0x676570a2
mov qword [rsp + 0x30], rsi
mov r9b, sil
add rbp, 2
rol r9b, 0xd0
sbb r8d, 0x5d845627
shld r9d, r10d, 0x60
sar rbp, 1
and r9w, 0x4681
mov r8, rbx
shrd r9w, sp, 0xfe
movsx r9w, r9b
mov r9d, ebp
jmp 0x180128bf0
mov dword [rsp + 0x28], esi
jmp 0x180128bff
sub edx, edx
cmp r15b, 0xd5
mov qword [rsp + 0x20], rsi
test eax, 0x6d14577d
jmp 0x180128c14
sub ecx, ecx
call fcn.1801288d7
movsxd r14, eax
test eax, eax
jmp 0x180128c25
jne 0x180128c39
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180128b38
mov rcx, r14
jmp 0x180128c41
call fcn.180125468
mov rdi, rax
test rax, rax
jmp 0x180128c51
jne 0x180128c68
xor ecx, ecx
jmp 0x180128c5e
call fcn.1801257ac
jmp 0x180128c2b
mov qword [rsp + 0x38], rsi
shld r8, r13, 0xad
xchg r9, r8
adc r9w, 0x2c82
mov r9d, ebp
rcl r8d, 0x48
movsx r8, ax
mov qword [rsp + 0x30], rsi
test r8b, 0xec
bts r8, r14
mov r8, rbx
jmp 0x180128c9b
mov dword [rsp + 0x28], r14d
stc
sub edx, edx
cmp al, dil
test al, r15b
xor ecx, ecx
mov qword [rsp + 0x20], rdi
jmp 0x180128cb5
call fcn.1801288d7
test eax, eax
jmp 0x180128cc1
jne 0x180128cd4
mov rcx, rdi
call fcn.1801257ac
jmp 0x180128ce3
sub ecx, ecx
jmp 0x180128cdb
call fcn.1801257ac
mov rsi, rdi
mov rcx, rbx
jmp 0x180128ceb
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
bt r14d, 0x6a
neg r14d
mov rbx, qword [rsp + 0x50]
ror dil, 0x81
sub sil, al
shl r14, 0x90
mov rbp, qword [rsp + 0x58]
and dil, 0x10
sal dil, 0x50
btc r14, r14
mov rsi, qword [rsp + 0x60]
xor edi, 0x4e5c2858
btc r14d, 0xc3
mov rdi, qword [rsp + 0x68]
or r14, rax
add rsp, 0x40
mov r14, 0x72522e34
pop r14
jmp 0x180128d47
ret
Function at 0x1801297d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
shld ecx, ebx, 2
mov qword [rax + 8], rbx
test r15b, r13b
mov qword [rax + 0x10], rbp
movzx rcx, ax
mov qword [rax + 0x18], rsi
not rcx
rcr ch, 0xa7
mov qword [rax + 0x20], rdi
add rcx, rdx
push r14
sbb cl, sil
sal rcx, cl
sub rsp, 0x90
lea rcx, [rax - 0x78]
jmp 0x180129814
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
sub r14d, r14d
cmc
cmp word [rsp + 0x62], r14w
jmp 0x180129829
je 0x180129972
mov rax, qword [rsp + 0x68]
jmp 0x18012983d
test rax, rax
jmp 0x180129845
je 0x180129972
movsxd rbx, dword [rax]
lea rsi, [rax + 4]
mov edi, 0x2000
movsx cx, spl
add rbx, rsi
test spl, 0xf5
sbb rcx, rcx
movsx ecx, r13w
cmp dword [rax], edi
cmovl edi, dword [rax]
movzx ecx, r11w
not ch
mov ecx, edi
jmp 0x18012987c
call fcn.18012e108
cmp edi, dword [0x18007bf50]
jmp 0x18012988c
cmovg edi, dword [0x18007bf50]
test edi, edi
jmp 0x18012989a
je 0x180129972
mov ebp, r14d
cmp r13b, 0x8d
cmc
cmp qword [rbx], 0xffffffffffffffff
jmp 0x1801298b1
je 0x180129949
cmp qword [rbx], 0xfffffffffffffffe
je 0x180129949
test byte [rsi], 1
je 0x180129949
test byte [rsi], 8
jne 0x1801298e9
mov rcx, qword [rbx]
jmp 0x1801298db
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x180129949
mov rax, rbp
bsf dx, r15w
cqo
lea r8, [0x18007bb50]
xor cl, ah
sub cl, r8b
shl rdx, 0xdc
mov rcx, rbp
sar rcx, 6
btr edx, ebp
and eax, 0x3f
inc dh
cmovge edx, edx
cqo
mov rcx, qword [r8 + rcx*8]
cmovle edx, r10d
lea rdx, [rax + rax*8]
movsx rax, ax
mov rax, qword [rbx]
jmp 0x18012992f
mov qword [rcx + rdx*8 + 0x28], rax
jmp 0x180129939
mov al, byte [rsi]
jmp 0x180129940
mov byte [rcx + rdx*8 + 0x38], al
jmp 0x180129949
inc rbp
jmp 0x180129951
inc rsi
test ebx, 0x1ebd416d
clc
add rbx, 8
clc
test r14b, cl
sub rdi, 1
jmp 0x18012996c
jne 0x1801298a8
lea r11, [rsp + 0x90]
movsx r14d, r12w
movzx edi, si
mov rbx, qword [r11 + 0x10]
movsx esi, bx
cmova r14, r11
seto dil
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movsx di, r11b
mov rdi, qword [r11 + 0x28]
mov r14d, r9d
movsxd r14, r9d
sets r14b
mov rsp, r11
movzx r14d, r9w
setns r14b
movzx r14, dx
pop r14
jmp 0x1801299c1
ret
Function at 0x18012ef9d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cdqe
setg al
movsxd rax, r14d
mov qword [rsp + 0x18], rbp
cwde
push rsi
push rdi
push r14
movsx eax, r13w
movzx rax, sp
movsxd rax, r11d
mov eax, 0x1450
jmp 0x18012efca
call fcn.18013285b
sub rsp, rax
mov rax, qword [0x180079010]
btr di, 0x85
cmovne rbp, rbx
xor rax, rsp
ror r10w, 0x90
ror r10w, cl
mov qword [rsp + 0x1440], rax
movsxd r10, edx
and dl, dil
mov rdi, rcx
mov rax, r10
sub ecx, r9d
shl dl, 0x6a
inc r14d
mov ebp, r9d
stc
sar rax, 6
mov r14b, 0xda
movzx si, r15b
lea rcx, [0x18007bb50]
movzx rdx, sp
and r10d, 0x3f
btr r14d, 0xbc
xor r14b, r15b
cmc
lea rbp, [rbp + r8]
mov rsi, r8
movsx r14d, ax
rol r14d, 0xf8
sal dh, cl
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
btc r14d, 0x90
sub r14w, 0x494c
sal r14w, 0x7e
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
test spl, 0xe9
mov dword [rdi + 8], eax
test rbx, r8
cmp dx, 0x2126
cmp r8, rbp
jmp 0x18012f07e
jae 0x18012f17a
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x18012f091
jae 0x18012f0ed
mov al, byte [rsi]
jmp 0x18012f09e
inc rsi
cmp al, 0xa
jmp 0x18012f0a8
jne 0x18012f0c1
inc dword [rdi + 8]
jmp 0x18012f0b6
mov byte [rbx], 0xd
jmp 0x18012f0be
inc rbx
mov byte [rbx], al
cdqe
bswap ax
movsx eax, si
inc rbx
neg eax
movsx rax, ax
or al, r10b
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x18012f0e7
jb 0x18012f089
and qword [rsp + 0x20], 0
cmp r9b, r11b
bt r9w, 9
lea rax, [rsp + 0x40]
movsx cx, r15b
bswap r8d
sub ebx, eax
lea r9, [rsp + 0x30]
not cl
jmp 0x18012f119
mov r8d, ebx
movzx ecx, r11w
not dl
seto dh
lea rdx, [rsp + 0x40]
bswap cx
mov rcx, r14
jmp 0x18012f135
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x18012f142
je 0x18012f172
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test r15b, cl
cmp eax, ebx
jmp 0x18012f159
jb 0x18012f17a
cmp rsi, rbp
jmp 0x18012f167
jb 0x18012f084
jmp 0x18012f17a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
sal ecx, cl
adc ch, 0x12
mov rcx, qword [rsp + 0x1440]
test r14b, r15b
cmc
xor rcx, rsp
jmp 0x18012f196
call fcn.180115f01
lea r11, [rsp + 0x1450]
jmp 0x18012f1ac
mov rbx, qword [r11 + 0x20]
bswap di
cmove bp, di
movzx si, r14b
mov rbp, qword [r11 + 0x30]
bswap di
movsx esi, r10w
mov rsp, r11
not r14b
xchg dil, dil
pop r14
movsx esi, r14w
pop rdi
cmovg rsi, r14
pop rsi
jmp 0x18012f1e1
ret
Function at 0x18012f1e2
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx rax, r8w
cbw
mov qword [rsp + 0x18], rbp
cmovge rax, rcx
mov ah, 0x8d
push rsi
push rdi
mov ax, r11w
push r14
movzx rax, r14w
mov eax, 0x1450
call fcn.18013285b
sub rsp, rax
rcl rsi, cl
cbw
mov rax, qword [0x180079010]
test dx, 0x725c
xor rax, rsp
cmp r10d, 0x70a1698e
adc r14b, r14b
add r14b, 0xd4
mov qword [rsp + 0x1440], rax
test dil, 0x17
movsxd r10, edx
mov rdi, rcx
movzx rbp, dx
shld dx, dx, 0xbc
mov rax, r10
cmc
mov ebp, r9d
sar rax, 6
lea rcx, [0x18007bb50]
and r10d, 0x3f
lea rbp, [rbp + r8]
xor sil, al
rcr sil, cl
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
cmp r8b, dl
xor eax, eax
cmp r14b, bl
cmc
test r14b, dil
mov qword [rdi], rax
cmp r8w, bx
test r10b, dl
mov dword [rdi + 8], eax
test sil, r10b
test cl, 0xe3
stc
cmp r8, rbp
jmp 0x18012f2a8
jae 0x18012f3af
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x18012f2bb
jae 0x18012f31e
movzx eax, word [rsi]
cmp bpl, dl
add rsi, 2
cmc
cmp ax, 0xa
jmp 0x18012f2d5
jne 0x18012f2fa
add dword [rdi + 8], 2
mov ecx, 0xd
jmp 0x18012f2e9
mov word [rbx], cx
jmp 0x18012f2f5
add rbx, 2
clc
mov word [rbx], ax
add rbx, 2
inc ah
rcr al, cl
lea rax, [rsp + 0x143e]
test r14b, r9b
cmp rbx, rax
jmp 0x18012f318
jb 0x18012f2b3
and qword [rsp + 0x20], 0
bts ax, bx
lea rax, [rsp + 0x40]
cmc
sub r8, 0x7ac54dcb
sal r8w, cl
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
test sil, 0xd5
lea rdx, [rsp + 0x40]
cmp r12b, r12b
sal r8d, 0xb9
add ebx, ebx
bswap r8w
movzx r8w, r8b
mov rcx, r14
cmovle r8w, cx
movsx r8w, r11b
mov r8w, 0x7214
mov r8d, ebx
jmp 0x18012f379
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18012f3a7
mov eax, dword [rsp + 0x30]
stc
add dword [rdi + 4], eax
test eax, esp
cmp eax, ebx
jb 0x18012f3af
cmp rsi, rbp
jb 0x18012f2ae
jmp 0x18012f3af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
shr rcx, 0x8f
cmovne ecx, ebx
and ecx, 0x85e07a1
mov rcx, qword [rsp + 0x1440]
cmc
test r8b, 0x42
xor rcx, rsp
jmp 0x18012f3d4
call fcn.180115f01
lea r11, [rsp + 0x1450]
mov r14b, 0xf3
movzx rdi, r9w
movsx r14, r11w
mov rbx, qword [r11 + 0x20]
not r14b
mov rbp, qword [r11 + 0x30]
movsx esi, sp
mov rsp, r11
movsx r14d, sp
pop r14
movsx si, r14b
mov sil, r10b
pop rdi
movzx si, r8b
pop rsi
jmp 0x18012f417
ret
Function at 0x140002330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140002367
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140002388
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000238a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400023e3
test ecx, ecx
jle 0x1400023c3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400023e3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400023e3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140002410
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002432
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002448
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002464
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002466
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x1400024a0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002547
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400024db
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140002521
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140002560
cmp rbx, rax
ja 0x1400024f0
mov r8, rdi
test rdi, rdi
je 0x140002547
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14000254a
Function at 0x140002960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000298d
xor eax, eax
jmp 0x140002ae2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400029b8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400029b8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140002ae2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002ad5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400029fb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002a26
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ada
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002a95
sub eax, 1
je 0x140002a95
cmp eax, 2
jne 0x140002ad5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ada
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002ac3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002ad5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140002ada
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003fa0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret