joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001990
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140009a50]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400098d0]
mov ecx, ebx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x10], 0x9e95de96
movdqu xmmword [rbp - 0x20], xmm1
mov word [rbp - 0xc], 0x9f
mov byte [rbp - 0xa], 1
nop dword [rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x25
jb 0x1400019d0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xa], bl
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x140009a50]
mov rcx, rbx
movdqa xmm1, xmmword [0x140009af0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x10], 0x82899c
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xc], 1
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x23
jb 0x140001a20
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xc], bl
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x140009a50]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400096d0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x10], 1
movdqu xmmword [rbp - 0x20], xmm1
nop
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1f
jb 0x140001a60
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x10], bl
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x140009a50]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xbed3d3b2
mov dword [rbp - 0x1c], 0xc8aab4b5
mov dword [rbp - 0x18], 0x8c9082
mov byte [rbp - 0x14], 1
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x140001ab0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x14], bl
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x140009ac0]
movdqa xmm1, xmmword [0x1400098e0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x100
movdqu xmmword [rbp - 0x20], xmm1
nop dword [rax]
lea eax, [rbx - 0x31]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x20
jb 0x140001af0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xf], 0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140001b70
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp - 0x41], rcx
mov dword [rbp - 0x49], 0xf193e0
mov byte [rbp - 0x45], 1
xor edi, edi
mov ecx, edi
nop dword [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 3
jb 0x140001bb0
mov byte [rbp - 0x45], dil
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.1400061a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp - 0x29], 0x70
mov dword [rbp - 0x25], 0x40
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], rdi
mov dword [rbp - 0x41], 0xfcb5bdac
mov dword [rbp - 0x3d], 0xb0acb6
mov byte [rbp - 0x39], 1
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rbp + rcx - 0x41], al
inc rcx
cmp rcx, 7
jb 0x140001c20
lea rax, [rbp - 0x41]
mov qword [rbp - 0x11], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140001c45
mov rax, qword [rbx]
mov qword [rbp - 9], rax
mov qword [rbp - 1], rdi
mov dword [rbp + 7], edi
mov qword [rbp + 0xf], rdi
lea rcx, [rbp - 0x29]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001c71
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x3f]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x47]
mov rcx, qword [rbp + 0x3f]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x3f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140001cc0
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140001cbb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001cf0
mov rcx, r8
call fcn.1400076ac
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140007400
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140003660
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x140003683
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x140003670
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x1400036b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400036d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400036c0
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140004eb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x49], 0
je 0x140004ed3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x48
jb 0x140004ec0
mov byte [rcx + 0x49], 0
ret

Function at 0x140004ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x140004f03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x140004ef0
mov byte [rcx + 0x2a], 0
ret

Function at 0x140004f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x140004f33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x140004f20
mov byte [rcx + 0xf], 0
ret

Function at 0x140004f40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x140004f63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140004f50
mov byte [rcx + 0x10], 0
ret

Function at 0x140004f70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x140004f93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x140004f80
mov byte [rcx + 0x25], 0
ret

Function at 0x140004fa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x140004fc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x140004fb0
mov byte [rcx + 0x1e], 0
ret

Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x140004ff3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4f
jb 0x140004fe0
mov byte [rcx + 0x50], 0
ret

Function at 0x140005000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x31], 0
je 0x140005023
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x30
jb 0x140005010
mov byte [rcx + 0x31], 0
ret

Function at 0x140005030
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x140005053
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2e
jb 0x140005040
mov byte [rcx + 0x2f], 0
ret

Function at 0x140005060
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x140005083
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x140005070
mov byte [rcx + 0x2d], 0
ret

Function at 0x140005090
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
je 0x1400050b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x26
jb 0x1400050a0
mov byte [rcx + 0x27], 0
ret

Function at 0x1400050c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x33], 0
je 0x1400050e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x32
jb 0x1400050d0
mov byte [rcx + 0x33], 0
ret
Function at 0x1400050f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3f], 0
je 0x140005113
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3e
jb 0x140005100
mov byte [rcx + 0x3f], 0
ret

Function at 0x140005120
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x38], 0
je 0x140005143
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x37
jb 0x140005130
mov byte [rcx + 0x38], 0
ret

Function at 0x140005150
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x140005173
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x140005160
mov byte [rcx + 0x3b], 0
ret

Function at 0x140005180
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x37], 0
je 0x1400051a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x36
jb 0x140005190
mov byte [rcx + 0x37], 0
ret

Function at 0x1400051b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x1400051d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x35
jb 0x1400051c0
mov byte [rcx + 0x36], 0
ret

Function at 0x1400051e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140005203
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3d
jb 0x1400051f0
mov byte [rcx + 0x3e], 0
ret

Function at 0x140005210
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x73], 0
je 0x140005233
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x72
jb 0x140005220
mov byte [rcx + 0x73], 0
ret

Function at 0x140005240
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x72], 0
je 0x140005263
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x71
jb 0x140005250
mov byte [rcx + 0x72], 0
ret

Function at 0x140005270
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x140005293
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x140005280
mov byte [rcx + 0x2e], 0
ret

Function at 0x1400052a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x1400052c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x1400052b0
mov byte [rcx + 0x18], 0
ret

Function at 0x1400052d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x1400052f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x1400052e0
mov byte [rcx + 0x40], 0
ret

Function at 0x140005300
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x61], 0
je 0x140005323
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x60
jb 0x140005310
mov byte [rcx + 0x61], 0
ret
Function at 0x140005330
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140005353
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x140005340
mov byte [rcx + 0x11], 0
ret

Function at 0x140005360
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3a], 0
je 0x140005383
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x39
jb 0x140005370
mov byte [rcx + 0x3a], 0
ret

Function at 0x1400053a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1400053c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400053b0
mov byte [rcx + 8], 0
ret

Function at 0x1400053d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1400053f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1400053e0
mov byte [rcx + 4], 0
ret

Function at 0x140005400
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140005423
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140005410
mov byte [rcx + 0x1c], 0
ret

Function at 0x140005430
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
je 0x140005453
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x20
jb 0x140005440
mov byte [rcx + 0x21], 0
ret

Function at 0x140005460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
je 0x140005483
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x140005470
mov byte [rcx + 0x20], 0
ret

Function at 0x140005490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x1400054b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x1400054a0
mov byte [rcx + 0x26], 0
ret
Function at 0x1400057b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x1400057e0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140005808
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000580a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005863
test ecx, ecx
jle 0x140005843
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005863
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005863
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
inc dword [rcx]
test esi, esi
je 0x14001506c
add dword [rbp - 0x75fa8b0a], eax
adc byte [rax + 0x108a4616], cl
mov dl, byte [rax]
mov byte [rsi], dl
mov r10b, byte [rax]
mov dl, byte [rax]
movzx ebx, dl
test byte [rbx + 0xf0ca81], 4
je 0x140015087
inc dword [rcx]
test esi, esi
je 0x140015086
mov bl, byte [rax]
mov byte [rsi], bl
cmp dl, 0x20
cmp dl, 0x20
cmp dl, 0x20
je 0x140015095
test dl, dl
je 0x140015099
cmp dl, 9
jne 0x140015061
test dl, dl
jne 0x14001509c
jmp 0x1400150a4
test esi, esi
je 0x1400150a4
and byte [rsi - 1], 0
and dword [rbp + 0x18], 0
Function at 0x140005890
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400058b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400058c1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400058e4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400058e6
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140005920
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400059c7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14000595b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400059a1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400059e0
cmp rbx, rax
ja 0x140005970
mov r8, rdi
test rdi, rdi
je 0x1400059c7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x1400059ca
add edi, 4
mov dword [rbp + 0xc], edi
cmp byte [rax], 0x22
cmp byte [rdx], ah
jne 0x140015061
mov dl, byte [rax + 1]
cmp dl, 0x22
je 0x14001504f
test dl, dl
je 0x14001504f
movzx edx, dl
test byte [rdx + 0xf0ca81], 4
je 0x140015042
inc dword [rcx]
test esi, esi
je 0x140015042
mov dl, byte [rax]
mov byte [rsi], dl
inc dword [rcx]
inc dword [rcx]
test esi, esi
je 0x14001501d
mov dl, byte [rax]
mov byte [rsi], dl
jmp 0x14001501d
inc dword [rcx]
test esi, esi
je 0x140015059
and byte [rsi], 0
cmp byte [rax], 0x22
cmp byte [rdx], ah
cmp byte [rax], 0x22
cmp byte [rdx], ah
jne 0x1400150a4
jmp 0x1400150a4
Function at 0x140005de0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140005e0d
xor eax, eax
jmp 0x140005f62
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140005e38
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140005e38
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140005f62
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005f55
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140005e7b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005ea6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005f5a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005f15
sub eax, 1
je 0x140005f15
cmp eax, 2
jne 0x140005f55
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005f5a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005f43
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140005f55
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140005f5a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140007400
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400064e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400065b3
cmp byte [rcx + 0x71], 0
je 0x1400065b3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400065af
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006574
sub eax, 1
je 0x140006578
cmp eax, 2
jne 0x1400065af
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140007400
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400065a6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400065af
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000655c
xor al, al
jmp 0x14000655c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140007400
add rsp, 0x60
pop rbx
ret