joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dfad0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 0x30]
mov qword [rsp + 0xc0], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1400dfc7c
cmp dword [rsi + 0x2c], eax
je 0x1400dfb41
mov dword [rsp + 0x30], 2
lea rax, str.0_e_
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400dfc66
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
jmp 0x1400dfc4a
mov dword [rsi + 0x2c], 1
mov rcx, rsi
call fcn.1400e0210
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
xor r14d, r14d
mov qword [rsp + 0x80], r14
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400dfb88
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax]
mov qword [rsp + 0x80], rax
mov ecx, 0x48
call fcn.140163924
mov rdi, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x1400dfbd5
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
lea rbp, [rdi + 8]
mov qword [rsp + 0xd8], rbp
mov qword [rbp + 0x38], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400dfbd3
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax]
mov qword [rbp + 0x38], rax
jmp 0x1400dfbd8
mov rdi, r14
mov qword [rsp + 0xd0], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x1400cedb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400dfc6c
cmp dword [rsi + 0xd0], 0
jne 0x1400dfc5f
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rsi + 0xc8], xmm1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400dfc4a
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, rbx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.14016372d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x14010c4c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14010c6a3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14009c330
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx]
cmp rdx, rdi
je 0x14010c668
mov qword [rsp + 0x30], rbp
mov rcx, rdx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rbx
xor r9, rax
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rdi
jne 0x14010c5dc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14010c657
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x14010c619
mov r10, qword [rax]
cmp r10, rcx
je 0x14010c613
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14010c657
mov r8, rax
cmp r10, rax
je 0x14010c633
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x14010c67d
cmp r10, rax
jne 0x14010c621
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
jne 0x14010c560
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14010c657
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14012fd30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.14012e010
test al, al
jne 0x14012fee8
mov dword [rbp - 0x61], edi
mov qword [rbp - 0x59], rsi
xor esi, esi
mov dword [rbp + 0x67], esi
mov qword [rbp + 7], rsi
mov qword [rsp + 0x30], rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 1]
lea rdx, [rbp - 0x61]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x14012fdae
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x14012ff0f
mov rcx, qword [rbx]
call fcn.14012ddf0
mov qword [rbp + 0xf], rax
mov byte [rbp + 0x17], sil
lea rax, [rbp - 0x11]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx]
call fcn.14012ddf0
lea rdx, [rax + 0x70]
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_ba592e99b77cc87b7eb140194ef6b88a___void___.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rbx
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x19], rcx
lea rcx, [rbp - 0x51]
call fcn.14012ff50
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14012fe0b
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rbx]
call fcn.14012db00
mov rcx, qword [rbx]
call fcn.14012ddf0
lea rdi, [rax + 0x70]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14012fe38
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], rsi
mov qword [rbx + 0x10], rsi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
cmp eax, 1
je 0x14012fe6e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e3
jne 0x14012feab
jmp 0x14012fe84
mov eax, dword [rbp + 0x7f]
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14012e740
lea rdx, [0x1401fba98]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.1401317b0
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSAGetOverlappedResult_failed_
lea rcx, [rbp + 0x1f]
call fcn.140004710
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.14000e400
lea rdx, [0x1401faff0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x79]
call fcn.14012e740
lea rdx, [0x1401fba98]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1401317b0
nop
mov r8, rax
lea rdx, str.TcpConnection::read__WSARecv_failed_
lea rcx, [rbp - 0x51]
call fcn.140004710
nop
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.14000e400
lea rdx, [0x1401faff0]
lea rcx, [rbp - 0x79]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140130630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140163e60
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.14012e010
test al, al
jne 0x1401307f6
movdqa xmm0, xmmword [0x1401ba4c0]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x140130698
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1401307b6
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x1401306cf
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1401306c3
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x1401306f0
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x140130730
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x140130756
call fcn.1400c2fd0
jmp 0x14013075e
mov rdx, rbx
call fcn.1400c2680
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x14013077a
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x140130770
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.140131150
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1401317b0
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.140004710
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000e400
lea rdx, [0x1401faff0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.14012e740
lea rdx, [0x1401fba98]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14013ce70
Capabilities:
Create thread

Disassembly:
add rcx, 0x50
jmp fcn.14013cc10
Function at 0x14014a0e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14014a114
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14014a100
ret
Function at 0x14014d4a0
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0xc8
jmp fcn.14014d1a0
Function at 0x140159990
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x140018700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140018737
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140018758
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001875a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400187b3
test ecx, ecx
jle 0x14001878e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400187b3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400187b3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400187e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140018817
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x140018838
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001883a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400188a0
test ecx, ecx
jle 0x14001886e
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400188a0
cmp qword [rdi + 0x80], 0
je 0x1400188a0
mov rcx, rdi
call fcn.140019e20
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140018ce0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14018a028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140018d0d
xor eax, eax
jmp 0x140018e62
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140018d38
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140018d38
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140018e62
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140018e55
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140018d7b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140018da6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140018e5a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x140018e55
cmp eax, 1
jle 0x140018e15
cmp eax, 3
jne 0x140018e55
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140018e5a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140018e43
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140018e55
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140018e5a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008f1d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140019e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14018a028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140019efc
cmp byte [rcx + 0x71], 0
je 0x140019efc
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140019ebd
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140019ec1
sub eax, 1
je 0x140019ec5
sub eax, 2
je 0x140019efc
xor al, al
jmp 0x140019efe
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140019ef3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140019ebd
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140019efe
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008f1d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140027290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r8, qword [rdx]
xor ebx, ebx
mov qword [rsp + 0x40], rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
test r8, r8
je 0x140027306
mov r8, qword [r8 + 0x38]
test r8, r8
je 0x140027306
lea r9, str.r:id
nop dword [rax + rax]
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x1400273ca
mov rax, rbx
movzx ecx, byte [r9 + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x1400273ca
cmp rax, 5
jne 0x1400272e0
test r8, r8
je 0x140027306
mov rdx, qword [r8 + 0x10]
test rdx, rdx
jne 0x14002730d
lea rdx, [0x140167dc1]
mov qword [rsp + 0x30], rbx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], bl
inc r8
cmp byte [rdx + r8], bl
jne 0x140027326
lea rcx, [rsp + 0x20]
call fcn.140019b10
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r13, qword [rsp + 0x20]
cmp r8, 0x10
mov r14, qword [rsp + 0x30]
movabs rcx, 0xcbf29ce484222325
mov rdi, qword [rsi + 0x1c8]
cmovae rdx, r13
test r14, r14
je 0x140027393
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
inc rbx
xor rcx, rax
imul rcx, r9
cmp rbx, r14
jb 0x140027380
mov rax, qword [rsi + 0x1f0]
and rax, rcx
mov rcx, qword [rsi + 0x1d8]
mov rbx, rax
add rbx, rbx
add rax, rax
mov rbx, qword [rcx + rbx*8]
mov r15, qword [rcx + rax*8]
lea r12, [rcx + rax*8]
nop dword [rax]
cmp r15, rdi
jne 0x1400273dc
mov rax, rdi
jmp 0x1400273e4
mov r8, qword [r8 + 0x20]
test r8, r8
jne 0x1400272d0
jmp 0x140027306
mov rax, qword [r12 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140027454
mov rbp, qword [rbx + 0x28]
lea rdx, [rsp + 0x20]
cmp r8, 0x10
lea rcx, [rbx + 0x10]
cmovae rdx, r13
cmp rbp, 0x10
jb 0x140027408
mov rcx, qword [rbx + 0x10]
mov rsi, qword [rbx + 0x20]
cmp rsi, r14
jne 0x140027422
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140027427
mov r8, qword [rsp + 0x38]
mov rbx, qword [rbx]
jmp 0x1400273c0
lea rdx, [rbx + 0x10]
cmp rbp, 0x10
jb 0x140027434
mov rdx, qword [rdx]
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, r13
cmp r14, rsi
jne 0x140027454
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140027457
mov rbx, rdi
lea rcx, [rsp + 0x20]
call fcn.140019a20
cmp rbx, rdi
je 0x140027475
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.140026d40
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret