joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017cb8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
xor edi, edi
mov rax, r15
lea rcx, [0x140035720]
and eax, 0x3f
mov r12, r15
sar r12, 6
mov rsi, rdx
lea r9d, [rdi + 0xa]
mov r14, r15
lea rbp, [rax + rax*8]
mov rax, qword [rcx + r12*8]
mov r10, qword [rax + rbp*8 + 0x28]
test r8, r8
je 0x140017d0e
cmp word [rdx], r9w
jne 0x140017d0e
or byte [rax + rbp*8 + 0x38], 4
jmp 0x140017d13
and byte [rax + rbp*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rax, rsi
mov rbx, rsi
cmp rsi, r8
jae 0x140017e92
mov r11d, 0xd
lea r13d, [r11 - 0xb]
movzx edx, word [rax]
cmp dx, 0x1a
je 0x140017e5d
lea rcx, [rax + 2]
cmp dx, r11w
jne 0x140017d5b
cmp rcx, r8
jae 0x140017d7b
cmp word [rcx], r9w
jne 0x140017d5b
add rax, 4
mov edx, r9d
jmp 0x140017d5e
mov rax, rcx
mov word [rbx], dx
mov r9, r13
mov rcx, rbx
mov r9d, 0xa
lea rbx, [rbx + r13]
cmp rax, r8
jb 0x140017d30
jmp 0x140017e92
lea r9, [rsp + 0x80]
mov word [rsp + 0x70], di
mov r8d, r13d
mov dword [rsp + 0x80], edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140017e56
cmp dword [rsp + 0x80], edi
je 0x140017e56
lea r9, [0x140035720]
mov rax, qword [r9 + r12*8]
test byte [rax + rbp*8 + 0x38], 0x48
mov ebp, 0xa
je 0x140017e30
movzx eax, word [rsp + 0x70]
cmp ax, bp
jne 0x140017de3
mov word [rbx], bp
jmp 0x140017e8f
mov word [rsp + 0x78], ax
mov rdx, r14
mov rax, r14
sar rdx, 6
and eax, 0x3f
mov word [rbx], 0xd
lea r8, [rax + rax*8]
mov rax, qword [r9 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, r13
jl 0x140017dfe
mov rax, r14
sar rax, 6
and r14d, 0x3f
mov rax, qword [r9 + rax*8]
lea rcx, [r14 + r14*8]
mov byte [rax + rcx*8 + 0x3c], bpl
jmp 0x140017e8f
cmp word [rsp + 0x70], bp
jne 0x140017e3c
cmp rbx, rsi
je 0x140017ddb
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400189d8
cmp word [rsp + 0x70], bp
je 0x140017e92
mov word [rbx], 0xd
jmp 0x140017e8f
mov rcx, r15
lea r9, [0x140035720]
and ecx, 0x3f
mov rax, r15
sar rax, 6
lea r8, [rcx + rcx*8]
mov rcx, qword [r9 + rax*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140017e8c
or al, r13b
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140017e92
mov word [rbx], dx
add rbx, r13
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b31c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001b34c
xor eax, eax
jmp 0x14001b40f
mov rbp, rbx
cmp word [rax], si
je 0x14001b371
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001b358
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001b354
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140019a0c
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x14001b3b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001b345
call fcn.1400156d0
mov rdi, rax
test rax, rax
jne 0x14001b3c8
xor ecx, ecx
call fcn.140013d30
jmp 0x14001b3a7
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140019a0c
test eax, eax
jne 0x14001b3f9
mov rcx, rdi
call fcn.140013d30
jmp 0x14001b403
xor ecx, ecx
call fcn.140013d30
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14001e36c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov dword [rsp + 0x30], esi
mov rbx, rcx
test rcx, rcx
je 0x14001e3df
cmp word [rcx], si
je 0x14001e3df
lea rdx, [0x140028688]
call fcn.14001fce0
test eax, eax
je 0x14001e3df
lea rdx, [0x1400286a0]
mov rcx, rbx
call fcn.14001fce0
test eax, eax
jne 0x14001e3d5
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14001e3fc
mov eax, dword [rsp + 0x30]
jmp 0x14001e40e
mov rcx, rbx
call fcn.140013bd0
jmp 0x14001e40e
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14001e400
xor eax, eax
jmp 0x14001e40e
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14001e40e
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e420
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ebp, edx
mov dword [rax + 8], ebx
mov edi, ecx
call fcn.1400141b8
mov ecx, edi
lea r9d, [rbx + 2]
and ecx, 0x3ff
lea r8, [rsp + 0x30]
bts ecx, 0xa
mov edx, 0x20000001
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14001e4c3
cmp edi, dword [rsp + 0x30]
je 0x14001e4bc
test ebp, ebp
je 0x14001e4bc
mov r9, qword [rsi + 0x98]
mov r8d, ebx
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jbe 0x14001e498
sub dx, 0x61
cmp dx, 0x19
ja 0x14001e4a4
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x14001e485
or rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], bx
jne 0x14001e4a8
cmp r8d, eax
setne bl
mov eax, ebx
jmp 0x14001e4c5
mov eax, 1
jmp 0x14001e4c5
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f7b0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000d2cc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001f83a
cmp byte [rbp - 0x21], r15b
je 0x14001f835
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14001f870
call fcn.140014680
test eax, eax
jne 0x14001f85c
cmp byte [rbp - 0x21], r15b
je 0x14001f854
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14001f870
cmp byte [rbp - 0x21], r15b
je 0x14001f86d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140010270
test eax, eax
jne 0x14001f910
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000d2cc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001f8af
cmp byte [rbp - 0x21], r15b
je 0x14001f8e4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001f8e4
call fcn.140014680
test eax, eax
jne 0x14001f8d0
cmp byte [rbp - 0x21], r15b
je 0x14001f8c9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001f8e4
cmp byte [rbp - 0x21], r15b
je 0x14001f8e1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140010270
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001f910
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001f913
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001f921
mov rcx, rdi
call fcn.140013d30
cmp byte [rbp + 0x3f], r15b
je 0x14001f930
mov rcx, qword [rbp + 0x27]
call fcn.140013d30
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400205c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400205e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400205e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x731b20
Capabilities:
Encode data using xor

Disassembly:
pop rdx
retf 0x7e10
adc dword [rax + reloc.oleaut32.dll_SysFreeString], 0xffffffb3
add dword [rbp + reloc.oleaut32.dll_SysFreeString], ecx
cqo
pop rsi
jmp 0xffffffff9bc967a3
pop rcx
jnp 0x731adb
and dword [rax], eax
js 0x731ad2
and ebp, dword [rsp + rax + 0x2c]
mov ebx, 0xedec94b
mov edi, 0x43bd002f
mul qword [r14 + 0xf3cfa6f]
lahf
invalid

Function at 0x735500
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x88b4e736
test eax, 0x3a11ffda
sbb byte [rax - 0x63], dh
nop
invalid
test edx, edi
jno 0x7354eb
Function at 0xfecb3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r14, 0xffffffffcce69b2d
jmp 0xfecef8
mov word [rsp], r11w
mov r9, 0xffffffffc908e31d
lea rsi, [rsp + 0x50]
push qword [rsp + 1]
jge 0xfecb70
xchg r15b, r12b
pop rcx
bswap r9
jmp 0xfecb75
jmp 0xfecc58
lea rsp, [rsp + 8]
not al
add r14d, ecx
jp 0xfecbc3
jnp 0xfecbad
mov edi, 0x3bc8a939
mov esi, 0xef881a98
sbb bh, dl
cli
jg 0xfecb81
mov bh, byte [rcx + 0x75]
ror byte [rbp - 0x24], cl
mov cl, r11b
mov dl, byte [rsp]
push bp
jmp 0xfecbf8
mov cl, r11b
mov dl, byte [rsp]
push bp
shr r10, 0x22
ror si, 0xe
bswap rbp
lea rsp, [rsp + 2]
jmp 0xfecc18
not cx
lea rbp, [r12 - 0x4b]
mov edx, r12d
lea rsp, [rsp + 3]
jmp 0xfecc2a
shr r10, 0x22
ror si, 0xe
jmp 0xfecbd4
not cx
lea rbp, [r12 - 0x4b]
mov edx, r12d
jmp 0xfecc40
neg al
lea r15, [rax + r15]
mov r14b, byte [rsp]
sub rsp, 4
jg 0xfecbde
jle 0xfecc02
lea rsp, [rsp + 1]
jmp 0xfeccf2
out 0x1d, eax
insb byte [rdi], dx
jg 0xfecc84
int1
invalid
lea rsp, [rsp + 3]
lea rsp, [rsp + 1]
call fcn.00feccc2
cmc
ja 0xfecc39
invalid
xchg r15b, r12b
pop rcx
bswap r9
jmp 0xfecb75
and ah, byte [rdi + 0x2ddebb2b]
retf
add bl, al
bswap rax
mov r14, 0xffffffffceb15d92
neg edx
jmp 0xfecd4e
sete sil
inc r13
mov r14, qword [rsp]
jmp 0xfecd17
lea r12, [r8*8]
bsr cx, r13w
jo 0xfecd38
mov r12d, r10d
jmp 0xfece26
mov r12d, r10d
rdtsc
mov r10w, 0xd340
mov rax, rdx
jmp 0xfecdb4
jbe 0xfecd06
sete sil
jmp 0xfecd0a
rcr r10d, 0xe
neg r14
setns al
setb bpl
call fcn.00fecd8b
rol r8b, 0
mov r15w, word [rsp]
xchg r12w, ax
xchg r12d, esi
xchg cx, si
jmp 0xfece03
jmp 0xfece5e
bswap rdx
xor r8b, 0xe4
not rbp
sub rsp, 0x16
jb 0xfecded
mov byte [rsp + 0x13], r12b
mov r9d, edx
bswap r12d
jmp 0xfeced8
rdtsc
mov r10w, 0xd340
mov rax, rdx
rcr r10d, 0xe
jmp 0xfecdb8
lea rsp, [rsp + 6]
rol r8b, 0
mov bpl, byte [rsp]
push cx
jle 0xfece88
btr r15, r10
mov rax, 0xffffffff8f0aee91
push rsp
jmp 0xfece8a
mov byte [rsp + 0x13], r12b
mov r9d, edx
bswap r12d
jmp 0xfece36
btr r15, r10
mov rax, 0xffffffff8f0aee91
push rsp
jmp 0xfecea0
jmp 0xfece6b
lea rsp, [rsp + 2]
jmp 0xfecea5
lea rsp, [rsp + 2]
lea rsp, [rsp + 0x18]
neg r8b
lea r9, [r10 + r10]
lea rbp, [rcx + r10]
jmp 0xfecebb
bsf r9, r14
jbe 0xfed4a0
push r9w
lea rsp, [rsp + 2]
jmp 0xfed36a
lea rsp, [rsp + 6]
jmp 0xfece3b
xchg rsi, r10
call fcn.00fecf13
cmp dword [rax + reloc.oleaut32.dll_SysFreeString], edi
adc dword [rbp + reloc.oleaut32.dll_SysFreeString], edx
test byte [rdi], dh
add r15, r14
jmp 0xfecee2
bswap r9
xchg edx, r12d
jmp 0xfec1b4
rcl r12b, 7
jmp 0xfecf32
shl r15, 2
shr dl, 3
ja 0xfecfa3
rcl r12b, 7
bswap r9
xchg edx, r12d
jmp 0xfec1b4
mov r15, r8
lea r10, [r13 + r13]
xchg r9b, sil
not si
mov eax, 0xf8584d7a
jmp 0xfecfdb
push r9w
lea rsp, [rsp + 2]
jmp 0xfed36a
Function at 0x2fc4dd6e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4de0e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc502108]
test eax, eax
je 0x2fc4de17a
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc502110]
mov qword [rbp - 8], rax
jmp 0x2fc4de15e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4de152
cmp qword [rbp - 0x10], 0
je 0x2fc4de152
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4de118
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4de17b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4de280
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4de2a8
mov eax, 0
jmp 0x2fc4de2f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4de2d1
mov eax, 0
jmp 0x2fc4de2f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4de2f1
mov eax, 0
jmp 0x2fc4de2f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4de2fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4de37a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4de371
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4de371
mov rax, qword [rbp - 8]
jmp 0x2fc4de38f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4de344
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800412b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800412d8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800412fe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180041300
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180041359
test ecx, ecx
jle 0x180041339
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180041359
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180041359
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180041380
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800413a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1800413b8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800413d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800413d6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180041412
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800414ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18004144d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18004148e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800414ae
cmp rbx, rax
ja 0x180041460
test rbx, rbx
je 0x1800414ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180041910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800f7280]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18004193d
xor eax, eax
jmp 0x180041aa9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180041977
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180041977
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180041aa9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180041a9c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800419ba
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800419e5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180041aa1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180041a54
sub eax, 1
je 0x180041a54
cmp eax, 2
jne 0x180041a9c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180041aa1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180041a82
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180041a9c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180041aa1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800a2000
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180042e10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800f7280]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180042ee3
cmp byte [rcx + 0x71], 0
je 0x180042ee3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180042edf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180042ea4
sub eax, 1
je 0x180042ea8
cmp eax, 2
jne 0x180042edf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800a2000
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180042ed6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180042edf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180042e8c
xor al, al
jmp 0x180042e8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800a2000
add rsp, 0x60
pop rbx
ret