joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402742e8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14025cb68
xor ebx, ebx
cmp qword [0x140444b88], rbx
mov rdi, rax
jne 0x1402743fb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1402744d2
lea rdx, [0x14035c3a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402744d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14035c390]
mov rcx, rsi
mov qword [0x140444b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140444b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140444b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140444ba8], rax
test rax, rax
je 0x1402743f2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140444ba0], rax
jmp 0x140274402
mov rax, qword [0x140444ba0]
jmp 0x140274409
mov rax, qword [0x140444ba0]
mov r11, qword [0x140444ba8]
cmp rax, rdi
je 0x140274470
cmp r11, rdi
je 0x140274470
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140444ba8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140274470
test rax, rax
je 0x140274470
call rsi
test rax, rax
je 0x14027446a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14027446a
test byte [rsp + 0x40], 1
jne 0x140274470
bts ebp, 0x15
jmp 0x1402744b0
mov rcx, qword [0x140444b90]
cmp rcx, rdi
je 0x1402744b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1402744b0
call rax
mov rbx, rax
test rax, rax
je 0x1402744b0
mov rcx, qword [0x140444b98]
cmp rcx, rdi
je 0x1402744b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1402744b0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140444b88]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1402744d2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1402744d4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140282570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
xor r12d, r12d
mov edi, r12d
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov rax, qword [r9 + 0x18]
mov r8, qword [r9 + 0x20]
cmp r8, qword [rax + 0x20]
jne 0x1402825d4
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x1402825d0
cmp qword [rax], r12
jne 0x1402825d4
mov dl, 1
jmp 0x1402825d6
xor dl, dl
mov rax, qword [rbx + 0x28]
mov rcx, qword [rax + 0x20]
cmp qword [rbx + 0x30], rcx
jne 0x1402825f6
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x1402825f2
cmp qword [rax], r12
jne 0x1402825f6
mov al, 1
jmp 0x1402825f8
xor al, al
test dl, dl
je 0x140282604
test al, al
jne 0x14028270c
xor al, dl
jne 0x140282621
mov rax, qword [rbx + 0x38]
cmp qword [r9 + 0x28], rax
jne 0x140282621
cmp r8, qword [rbx + 0x30]
sete al
test al, al
jne 0x14028270c
mov rax, qword [r9 + 8]
mov edx, dword [rax]
cmp dword [r9 + 0x10], edx
jne 0x140282715
mov rcx, r9
call fcn.14027f6f0
movzx ecx, word [rax]
lea r8d, [rcx - 0x30]
sub cx, 0x30
cmp cx, 7
ja 0x14028270c
mov eax, dword [0x140444bc8]
test al, 1
jne 0x14028266b
or eax, 1
mov dword [0x140444bc8], eax
mov cl, 0x7f
mov byte [0x140444bc5], cl
jmp 0x140282672
movzx ecx, byte [0x140444bc5]
test al, 2
jne 0x140282693
or eax, 2
mov dword [0x140444bc8], eax
movsx eax, cl
cdq
and edx, 7
add eax, edx
sar eax, 3
mov byte [0x140444bc4], al
jmp 0x14028269a
movzx eax, byte [0x140444bc4]
movzx edx, byte [rbp]
cmp dl, al
jg 0x140282708
shl dl, 3
mov byte [rbp], dl
movsx ecx, byte [0x140444bc5]
movsx eax, r8b
sub ecx, eax
movsx eax, dl
cmp eax, ecx
jg 0x140282708
add dl, r8b
mov byte [rbp], dl
inc rdi
mov rcx, qword [rbx + 8]
mov rax, qword [rcx + 8]
mov edx, dword [rax]
cmp dword [rcx + 0x10], edx
jne 0x1402826e7
call fcn.1402801b0
inc qword [rsi]
cmp rdi, 3
jae 0x14028270c
jmp 0x1402825b0
lea rcx, [rsp + 0x28]
call fcn.140251abc
lea r11, vtable.boost::spirit::classic::multi_pass_policies::illegal_backtracking.0
mov qword [rsp + 0x28], r11
lea rcx, [rsp + 0x28]
call fcn.14027e5e0
nop
xor al, al
jmp 0x140282736
cmp rdi, 1
setae al
jmp 0x140282736
lea rcx, [rsp + 0x28]
call fcn.140251abc
lea r11, vtable.boost::spirit::classic::multi_pass_policies::illegal_backtracking.0
mov qword [rsp + 0x28], r11
lea rcx, [rsp + 0x28]
call fcn.14027e5e0
nop
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x14028ace0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
sub rsp, 0x70
mov rcx, qword [rdx]
xor ebx, ebx
mov r15, r8
mov r14, r9
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x8000080
xor r13b, r13b
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14028ae59
mov qword [rsp + 0xa0], rbp
xor edx, edx
mov rcx, rax
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebp, eax
mov dword [rsp + 0xa8], ebx
call fcn.140218cbc
lea r9, [rsp + 0xa8]
mov r8d, 0x400
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov r12, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14028adcb
nop dword [rax + rax]
mov ecx, dword [rsp + 0xa8]
test ecx, ecx
je 0x14028adcb
cmp ebx, ebp
ja 0x14028adcb
add rdi, rcx
add ebx, ecx
lea r9, [rsp + 0xa8]
mov r8d, 0x400
mov rcx, rsi
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14028ad90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x14028ae49
lea rcx, [rsp + 0x40]
call fcn.1401a76a0
lea rcx, [rsp + 0x40]
mov r8d, ebx
mov rdx, r12
call fcn.1401a78c0
mov eax, dword [rsp + 0x64]
lea ecx, [rax + 1]
mov dword [r14], eax
call fcn.140218cbc
xor edx, edx
mov qword [r15], rax
mov r8d, dword [r14]
mov rcx, rax
inc r8d
call fcn.1402577d0
mov ebx, dword [r14]
lea rcx, [rsp + 0x40]
call fcn.1401a7730
mov rcx, qword [r15]
mov r8d, ebx
mov rdx, rax
call fcn.140250b70
lea rcx, [rsp + 0x40]
mov r13b, 1
call fcn.1401a76e0
mov rcx, r12
call fcn.1402512b0
mov r12, qword [rsp + 0xb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r13b
add rsp, 0x70
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
Function at 0x14028b6e0
Capabilities:
Prepare http request
Receive http response

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12, r9
mov rsi, r8
mov rbx, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [rdx]
lea rdx, str.POST
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x14028b7ad
mov qword [rbp + 7], 0xf
mov qword [rbp - 1], r13
mov byte [rbp - 0x11], r13b
lea r8d, [r13 + 0x23]
lea rdx, str.Cant_create_request_to_the_server.
lea rcx, [rbp - 0x11]
call fcn.1400243d0
nop
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rax, qword [rbp - 0x11]
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 0x39], r11
mov dword [rbp - 0x21], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 0x39]
call fcn.1402510b4
nop
mov eax, r13d
mov dword [rbp - 0x41], eax
mov rdi, r13
test rsi, rsi
je 0x14028b7ce
mov rax, qword [rsi]
lea rdx, [rbp - 0x41]
mov rcx, rsi
call qword [rax + 0x10]
mov rdi, rax
mov eax, dword [rbp - 0x41]
mov rcx, qword [r12]
mov r8d, dword [rcx - 0x10]
mov rdx, r13
test r8d, r8d
cmovne rdx, rcx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9, rdi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x14028b865
mov qword [rbp + 7], 0xf
mov qword [rbp - 1], r13
mov byte [rbp - 0x11], r13b
lea r8d, [rax + 0x21]
lea rdx, str.Cant_send_request_to_the_server.
lea rcx, [rbp - 0x11]
call fcn.1400243d0
nop
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rax, qword [rbp - 0x11]
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 0x39], r11
mov dword [rbp - 0x21], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 0x39]
call fcn.1402510b4
nop
xor edx, edx
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x14028b8dc
mov qword [rbp + 7], 0xf
mov qword [rbp - 1], r13
mov byte [rbp - 0x11], r13b
lea r8d, [rax + 0x24]
lea rdx, str.Cant_receive_request_to_the_server.
lea rcx, [rbp - 0x11]
call fcn.1400243d0
nop
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rax, qword [rbp - 0x11]
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 0x39], r11
mov dword [rbp - 0x21], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 0x39]
call fcn.1402510b4
nop
mov eax, dword [rbp - 0x41]
mov dword [rbp - 0x49], eax
mov rax, qword [rbx]
lea r9, [rbp - 0x49]
mov r8, rdi
xor edx, edx
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0xb8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140005c90
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x140005cd6
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.14016cd8c
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x140005dcf
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14016cd8c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x140005d40
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14013c060
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x140005e1c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140005e1c
call fcn.14016cca4
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x140005e00
mov rcx, r14
call fcn.14016cca4
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x140005c90
Function at 0x140005e40
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x140005cd6
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.14016cd8c
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x140005dcf
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14016cd8c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x140005d40
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14013c060
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x140005e1c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140005e1c
call fcn.14016cca4
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x140005e00
mov rcx, r14
call fcn.14016cca4
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x140005c90
Function at 0x14000d1a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14021f740]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000d273
cmp byte [rcx + 0x71], 0
je 0x14000d273
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000d26f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000d234
sub eax, 1
je 0x14000d238
cmp eax, 2
jne 0x14000d26f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016cd40
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000d266
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000d26f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000d21c
xor al, al
jmp 0x14000d21c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016cd40
add rsp, 0x60
pop rbx
ret
Function at 0x14000f3b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14021f740]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14000f3dd
xor eax, eax
jmp 0x14000f546
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000f41d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000f41d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14000f53e
cmp qword [rdi + 0x80], 0
je 0x14000f539
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14000f457
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14000f482
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000f53e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000f4f1
sub eax, 1
je 0x14000f4f1
cmp eax, 2
jne 0x14000f539
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000f53e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14000f51f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000f539
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14000f53e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14016cd40
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140010530
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140010561
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14001057f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1400105c9
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140010641
mov rcx, rbp
call fcn.14000d2c0
cmp rbx, 0xfff
jbe 0x140010621
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140010662
cmp rbx, rax
ja 0x1400105f0
test rdi, rdi
je 0x140010641
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x140010644
Function at 0x140010670
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140010698
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14001070c
test rax, rax
jle 0x1400106ec
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14001070c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001070c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret

Function at 0x14001e4c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x40], 1
mov rdi, rdx
mov r8d, dword [rcx + 0x48]
mov r9, rdx
mov edx, dword [rcx + 0x44]
mov rbx, rcx
je 0x14001e4ef
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400185c0
call fcn.1400185c0
xor eax, eax
cmp dword [rbx + 0x48], eax
jbe 0x14001e50b
nop dword [rax + rax]
xor byte [rax + rdi], 0x80
inc eax
cmp eax, dword [rbx + 0x48]
jb 0x14001e500
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret