joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e6c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1400e10c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor ebx, ebx
mov eax, dword [rcx + rax]
cmp dword [0x1400e29c8], eax
jle 0x14002e7d1
lea rcx, [0x1400e29c8]
call fcn.1400aca20
cmp dword [0x1400e29c8], 0xffffffff
jne 0x14002e7d1
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
lea ecx, [rbx + 0x20]
call fcn.1400acf7c
mov qword [rbp + 7], rax
mov qword [rbp + 0x17], reloc.WS2_32.dll_select
mov qword [rbp + Ordinal_33], 0x1f
movups xmm0, xmmword [str.MmUnmapLockedPages]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ce858]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], bl
lea r8, [rbp + 7]
mov rdx, qword [0x1400e2568]
mov rcx, rdi
call fcn.14002ecf0
mov qword [0x1400e2a90], rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14002e7c5
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e7bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002e7bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac900
nop
lea rcx, [0x1400e29c8]
call fcn.1400ac9b4
mov r8, qword [0x1400e2a90]
test r8, r8
jne 0x14002e8a9
mov dword [rbp - 0x49], 0x3bd23ba9
mov dword [rbp - 0x45], 0x3bd53ba9
mov dword [rbp - 0x41], 0x3b963bb0
mov dword [rbp - 0x3d], 0x3b953b91
mov dword [rbp - 0x39], 0x3b9f3b9f
mov dword [rbp - 0x35], 0x3b893bdc
mov dword [rbp - 0x31], 0x3bdf3b91
mov dword [rbp - 0x2d], 0x3c683c66
mov dword [rbp - 0x29], 0x3c673c6c
mov dword [rbp - 0x25], 0x3c483c24
mov dword [rbp - 0x21], 0x3c523c6b
mov dword [rbp - 0x1d], 0x3c643c66
mov dword [rbp - 0x19], 0x3c7b3c6b
mov dword [rbp - 0x15], 0x3c623c40
mov dword [rbp - 0x11], 0x3c643c6d
mov dword [rbp - 0xd], 0x3c753c75
mov dword [rbp - 9], 0x3c723c42
mov dword [rbp - 5], 0x3c703c73
mov dword [rbp - 1], 0x3c65
mov byte [rbp + 3], 1
mov ecx, 0x3bf2
nop
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x49], ax
inc rbx
cmp rbx, 0x25
jb 0x14002e870
mov byte [rbp + 3], 0
lea rdx, [rbp - 0x49]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400355d0
lea rdx, [0x1400357b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14002e8bd
mov qword [rsp + 0x20], r14
mov r9, rsi
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.140036ba0
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400ac810
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14002e8e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1400e10c0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rdi, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor ebx, ebx
mov eax, dword [rcx + rax]
cmp dword [0x1400e299c], eax
jle 0x14002e9ef
lea rcx, [0x1400e299c]
call fcn.1400aca20
cmp dword [0x1400e299c], 0xffffffff
jne 0x14002e9ef
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], reloc.WS2_32.dll_ntohs
lea ecx, [rbx + 0x20]
call fcn.1400acf7c
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x27], reloc.WS2_32.dll_select
mov qword [rbp + 0x2f], Ordinal_33
movups xmm0, xmmword [str.MmFreePagesFromMdl]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ce870]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], bl
lea r8, [rbp + 0x17]
mov rdx, qword [0x1400e2568]
mov rcx, rdi
call fcn.14002ecf0
mov qword [0x1400e2a68], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x14002e9e3
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002e9dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002e9dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac900
nop
lea rcx, [0x1400e299c]
call fcn.1400ac9b4
mov r8, qword [0x1400e2a68]
test r8, r8
jne 0x14002eac9
mov dword [rbp - 0x39], 0x3bd23ba9
mov dword [rbp - 0x35], 0x3bd53ba9
mov dword [rbp - 0x31], 0x3b963bb0
mov dword [rbp - 0x2d], 0x3b953b91
mov dword [rbp - 0x29], 0x3b9f3b9f
mov dword [rbp - 0x25], 0x3b893bdc
mov dword [rbp - 0x21], 0x3bdf3b91
mov dword [rbp - 0x1d], 0x3c683c66
mov dword [rbp - 0x19], 0x3c673c6c
mov dword [rbp - 0x15], 0x3c483c24
mov dword [rbp - 0x11], 0x3c413c6b
mov dword [rbp - 0xd], 0x3c6c3c7a
mov dword [rbp - 9], 0x3c5b3c6f
mov dword [rbp - 5], 0x3c6a3c6d
mov dword [rbp - 1], 0x3c7c3c6b
mov dword [rbp + 3], 0x3c633c56
mov dword [rbp + 7], 0x3c7e3c7d
mov dword [rbp + 0xb], 0x3c713c59
mov dword [rbp + 0xf], 0x3c7a
mov byte [rbp + 0x13], 1
mov ecx, 0x3bf2
nop dword [rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x25
jb 0x14002ea90
mov byte [rbp + 0x13], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400355d0
lea rdx, [0x1400357b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14002ead8
mov r9, rsi
lea rdx, [rbp + 0x37]
mov rcx, rdi
call fcn.140037230
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400ac810
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002eb00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x14002ecc5
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400e2a48], eax
jle 0x14002ebf7
lea rcx, [0x1400e2a48]
call fcn.1400aca20
cmp dword [0x1400e2a48], 0xffffffff
jne 0x14002ebf7
xorps xmm0, xmm0
movups xmmword [rbp + 0x37], xmm0
mov qword [rbp + 0x47], 0xa
mov qword [rbp + 0x4f], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.ExFreePool]
movsd qword [rbp + 0x37], xmm0
movzx eax, word [0x1400ce880]
mov word [rbp + 0x3f], ax
mov byte [rbp + 0x41], 0
lea r8, [rbp + 0x37]
mov rdx, qword [0x1400e2568]
mov rcx, rdi
call fcn.14002ecf0
mov qword [0x1400e2a10], rax
mov rdx, qword [rbp + 0x4f]
cmp rdx, 0xf
jbe 0x14002ebeb
inc rdx
mov rcx, qword [rbp + 0x37]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ebe5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002ebe5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac900
nop
lea rcx, [0x1400e2a48]
call fcn.1400ac9b4
mov r8, qword [0x1400e2a10]
test r8, r8
jne 0x14002ecc9
mov dword [rbp - 0x19], 0x3bd23ba9
mov dword [rbp - 0x15], 0x3bd53ba9
mov dword [rbp - 0x11], 0x3b963bb0
mov dword [rbp - 0xd], 0x3b953b91
mov dword [rbp - 9], 0x3b9f3b9f
mov dword [rbp - 5], 0x3b893bdc
mov dword [rbp - 1], 0x3bdf3b91
mov dword [rbp + 3], 0x3c683c66
mov dword [rbp + 7], 0x3c673c6c
mov dword [rbp + 0xb], 0x3c403c24
mov dword [rbp + 0xf], 0x3c463c7e
mov dword [rbp + 0x13], 0x3c653c64
mov dword [rbp + 0x17], 0x3c683c65
mov dword [rbp + 0x1b], 0x3c793c6d
mov dword [rbp + 0x1f], 0x3c5f3c6b
mov dword [rbp + 0x23], 0x3c7e3c7f
mov dword [rbp + 0x27], 0x3c7e
xor eax, eax
mov byte [rbp + 0x2b], 1
mov edx, 0x3bf2
nop dword [rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x19], cx
inc rax
cmp rax, 0x21
jb 0x14002ec90
mov byte [rbp + 0x2b], 0
lea rdx, [rbp - 0x19]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400355d0
lea rdx, [0x1400357b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14002ecd6
mov r9, rbx
xor edx, edx
mov rcx, rdi
call fcn.1400378b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14002fa50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14002fc45
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor ebx, ebx
mov eax, dword [rcx + rax]
cmp dword [0x1400e2a60], eax
jle 0x14002fb62
lea rcx, [0x1400e2a60]
call fcn.1400aca20
cmp dword [0x1400e2a60], 0xffffffff
jne 0x14002fb62
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], reloc.WS2_32.dll_ntohs
lea ecx, [rbx + 0x20]
call fcn.1400acf7c
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x37], reloc.WS2_32.dll_setsockopt
mov qword [rbp + 0x3f], Ordinal_33
movups xmm0, xmmword [str.ExReleaseResourceLite]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400ce8b8]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400ce8bc]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], bl
lea r8, [rbp + 0x27]
mov rdx, qword [0x1400e2568]
mov rcx, rsi
call fcn.14002ecf0
mov qword [0x1400e29e8], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14002fb56
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fb50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002fb50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac900
nop
lea rcx, [0x1400e2a60]
call fcn.1400ac9b4
mov r8, qword [0x1400e29e8]
test r8, r8
jne 0x14002fc49
mov dword [rbp - 0x39], 0x3bd23ba9
mov dword [rbp - 0x35], 0x3bd53ba9
mov dword [rbp - 0x31], 0x3b963bb0
mov dword [rbp - 0x2d], 0x3b953b91
mov dword [rbp - 0x29], 0x3b9f3b9f
mov dword [rbp - 0x25], 0x3b893bdc
mov dword [rbp - 0x21], 0x3bdf3b91
mov dword [rbp - 0x1d], 0x3c683c66
mov dword [rbp - 0x19], 0x3c673c6c
mov dword [rbp - 0x15], 0x3c403c24
mov dword [rbp - 0x11], 0x3c553c7e
mov dword [rbp - 0xd], 0x3c653c6d
mov dword [rbp - 9], 0x3c6a3c6f
mov dword [rbp - 5], 0x3c683c7f
mov dword [rbp - 1], 0x3c6a3c5c
mov dword [rbp + 3], 0x3c7e3c63
mov dword [rbp + 7], 0x3c613c67
mov dword [rbp + 0xb], 0x3c703c77
mov dword [rbp + 0xf], 0x3c7e3c5a
mov dword [rbp + 0x13], 0x3c7c3c6c
mov word [rbp + 0x17], bx
mov byte [rbp + 0x19], 1
mov ecx, 0x3bf2
nop dword [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x28
jb 0x14002fc10
mov byte [rbp + 0x19], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400355d0
lea rdx, [0x1400357b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14002fc56
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.1400385a0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140033c60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x140033c85
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x3a
jb 0x140033c70
mov byte [rcx + 0x76], 0
ret

Function at 0x140033c90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
je 0x140033cb5
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x35
jb 0x140033ca0
mov byte [rcx + 0x6c], 0
ret

Function at 0x140033cc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x74], 0
je 0x140033ce5
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x39
jb 0x140033cd0
mov byte [rcx + 0x74], 0
ret

Function at 0x140033cf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
je 0x140033d15
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x36
jb 0x140033d00
mov byte [rcx + 0x6e], 0
ret

Function at 0x140033d20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x140033d45
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x23
jb 0x140033d30
mov byte [rcx + 0x48], 0
ret

Function at 0x140033d50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x66], 0
je 0x140033d75
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x32
jb 0x140033d60
mov byte [rcx + 0x66], 0
ret

Function at 0x140034110
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140034138
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14003415e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140034160
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400341b9
test ecx, ecx
jle 0x140034199
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400341b9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400341b9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1400341e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140034202
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140034218
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140034234
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140034236
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140034272
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003430e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400342ad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400342ee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14003430e
cmp rbx, rax
ja 0x1400342c0
test rbx, rbx
je 0x14003430e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140034780
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400e10c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400347ad
xor eax, eax
jmp 0x140034919
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400347e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400347e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140034919
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14003490c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003482a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140034855
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140034911
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400348c4
sub eax, 1
je 0x1400348c4
cmp eax, 2
jne 0x14003490c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140034911
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400348f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14003490c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140034911
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ac810
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140034af0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140034b15
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x140034b00
mov byte [rcx + 0x4a], 0
ret

Function at 0x140034b20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x140034b45
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x140034b30
mov byte [rcx + 0x50], 0
ret
Function at 0x140034b50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140034b75
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x140034b60
mov byte [rcx + 0x3e], 0
ret

Function at 0x140034b80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x140034ba5
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1a
jb 0x140034b90
mov byte [rcx + 0x36], 0
ret

Function at 0x140034bb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x140034bd5
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x140034bc0
mov byte [rcx + 0x4c], 0
ret

Function at 0x140034be0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x140034c05
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x22
jb 0x140034bf0
mov byte [rcx + 0x46], 0
ret

Function at 0x140034c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140034c35
xor eax, eax
mov r8d, 0x3bf2
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x140034c20
mov byte [rcx + 0x58], 0
ret

Function at 0x1400351b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400e10c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140035283
cmp byte [rcx + 0x71], 0
je 0x140035283
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14003527f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140035244
sub eax, 1
je 0x140035248
cmp eax, 2
jne 0x14003527f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ac810
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140035276
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003527f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003522c
xor al, al
jmp 0x14003522c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ac810
add rsp, 0x60
pop rbx
ret