joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005ed0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1401a80c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov eax, dword [0x14017d2b0]
lea r9, [rbp + 0x1f]
movups xmm0, xmmword [0x14017d290]
mov dword [rbp + 0x3f], eax
xor r8d, r8d
movups xmm1, xmmword [0x14017d2a0]
movzx eax, word [0x14017d2b4]
mov esi, 0xa0a0a0a1
movups xmmword [rbp + 0x1f], xmm0
mov word [rbp + 0x43], ax
movups xmmword [rbp + 0x2f], xmm1
mov eax, esi
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x31
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x140005f2f
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x1f]
and dword [rsp + 0x28], 0
mov ebx, 3
mov r8d, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140006076
mov ecx, dword [0x14017d1c0]
lea r9, [rbp + 7]
movups xmm0, xmmword [0x14017d1b0]
mov dword [rbp + 0x17], ecx
xor r8d, r8d
movzx ecx, word [0x14017d1c4]
movups xmmword [rbp + 7], xmm0
mov word [rbp + 0x1b], cx
mov eax, esi
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x31
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xb
jl 0x140005fb5
and qword [rsp + 0x30], 0
lea rcx, [rbp + 7]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006076
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x200
jne 0x140006076
mov ecx, eax
call fcn.140148f0c
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x47]
mov r8d, 0x200
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006064
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x47]
mov r8d, 0x200
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140148a70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
push rbp
mov rbp, rsp
sub rsp, 0x30
xor edx, edx
mov dword [rbp - 0x10], 0x30d02
mov ecx, edx
mov dword [rbp - 0xc], 0x140f090f
mov dword [rbp - 8], 0x4b55491c
mov word [rbp - 4], 0x53
mov byte [rbp - 2], 1
lea eax, [rcx + 0x60]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0xd
jb 0x1400060c8
lea rcx, [rbp - 0x10]
mov byte [rbp - 2], dl
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x30
pop rbp
jmp 0x140005ed0
Function at 0x14000609c
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1401a80c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov eax, dword [0x14017d2b0]
lea r9, [rbp + 0x1f]
movups xmm0, xmmword [0x14017d290]
mov dword [rbp + 0x3f], eax
xor r8d, r8d
movups xmm1, xmmword [0x14017d2a0]
movzx eax, word [0x14017d2b4]
mov esi, 0xa0a0a0a1
movups xmmword [rbp + 0x1f], xmm0
mov word [rbp + 0x43], ax
movups xmmword [rbp + 0x2f], xmm1
mov eax, esi
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x31
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x140005f2f
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x1f]
and dword [rsp + 0x28], 0
mov ebx, 3
mov r8d, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140006076
mov ecx, dword [0x14017d1c0]
lea r9, [rbp + 7]
movups xmm0, xmmword [0x14017d1b0]
mov dword [rbp + 0x17], ecx
xor r8d, r8d
movzx ecx, word [0x14017d1c4]
movups xmmword [rbp + 7], xmm0
mov word [rbp + 0x1b], cx
mov eax, esi
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x31
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xb
jl 0x140005fb5
and qword [rsp + 0x30], 0
lea rcx, [rbp + 7]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006076
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x200
jne 0x140006076
mov ecx, eax
call fcn.140148f0c
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x47]
mov r8d, 0x200
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006064
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x47]
mov r8d, 0x200
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140148a70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
push rbp
mov rbp, rsp
sub rsp, 0x30
xor edx, edx
mov dword [rbp - 0x10], 0x30d02
mov ecx, edx
mov dword [rbp - 0xc], 0x140f090f
mov dword [rbp - 8], 0x4b55491c
mov word [rbp - 4], 0x53
mov byte [rbp - 2], 1
lea eax, [rcx + 0x60]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0xd
jb 0x1400060c8
lea rcx, [rbp - 0x10]
mov byte [rbp - 2], dl
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x30
pop rbp
jmp 0x140005ed0
Function at 0x140006c14
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a80c0]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x10], 0
mov r10, qword [0x14027f2c8]
test r10, r10
jne 0x140006da8
mov rax, qword gs:[0x60]
xor ebx, ebx
mov edi, 0xdf6a51c
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rdx, r15
movups xmm0, xmmword [rdx + 0x58]
movd eax, xmm0
sub ax, 8
test ebx, ebx
je 0x140006cbf
psrldq xmm0, 8
mov r8d, 0x811c9dc5
movzx eax, ax
movq rcx, xmm0
shr rax, 1
lea r9, [rcx + rax*2]
jmp 0x140006cb1
movsx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x140006ca0
cmp r8d, ebx
jne 0x140006d88
mov r11, qword [rdx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov rax, qword [rax + r11 + 0x88]
mov r9d, eax
add r9, r11
shr rax, 0x20
cmp r9, r11
je 0x140006d88
mov r8d, dword [r9 + 0x18]
test r8d, r8d
je 0x140006d88
mov r12d, dword [r9 + 0x20]
dec r8d
mov esi, 0x811c9dc5
lea rcx, [r12 + r8*4]
mov r10d, dword [rcx + r11]
add r10, r11
jmp 0x140006d13
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x140006d08
cmp esi, edi
je 0x140006d28
test r8d, r8d
jne 0x140006cf3
jmp 0x140006d88
mov edx, dword [r9 + 0x24]
add rdx, r11
movzx r8d, word [rdx + r8*2]
mov edx, dword [r9 + 0x1c]
add rdx, r11
mov r10d, dword [rdx + r8*4]
add r10, r11
cmp r10, r9
jbe 0x140006da1
lea rcx, [rax + r9]
cmp r10, rcx
jae 0x140006da1
mov ebx, 0x811c9dc5
mov edi, ebx
jmp 0x140006d67
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc r10
mov al, byte [r10]
cmp al, 0x2e
jne 0x140006d59
jmp 0x140006d7b
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc r10
mov al, byte [r10]
test al, al
jne 0x140006d70
mov rdx, qword [r15]
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r15
je 0x140006d9e
cmp qword [rax + 0x30], 0
jne 0x140006c74
xor r10d, r10d
mov qword [0x14027f2c8], r10
movdqa xmm0, xmmword [0x14018ceb0]
xor ecx, ecx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x252e2534
mov dword [rbp - 0x1c], 0x282e3a36
mov word [rbp - 0x18], Ordinal_41
mov byte [rbp - 0x16], 1
lea eax, [rcx + 0x60]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x19
jb 0x140006dcf
lea rax, [rbp - 0x10]
mov byte [rbp - 0x16], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000002
call r10
test eax, eax
jne 0x140006e13
mov qword [0], 1
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140148a70
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400083e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, rcx
mov dword [rbp - 0x10], 0xc101305
xor edx, edx
mov dword [rbp - 0xc], 0x475c4516
mov word [rbp - 8], 0x100
lea eax, [rdx + 0x60]
xor byte [rbp + rdx - 0x10], al
inc rdx
cmp rdx, 8
jb 0x140008412
lea rdx, [rbp - 0x10]
mov byte [rbp - 7], 0
mov rcx, rbx
call fcn.140012e58
mov rdx, rdi
mov rcx, rbx
call fcn.140012e58
lea rdx, [0x140012fc8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400084c3
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1400084c3
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x1400084bf
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14000849f
cmp r11d, 0x2fa62ca8
je 0x1400084c8
test edx, edx
jne 0x140008482
mov rax, qword [rax]
jmp 0x14000845e
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r8
call rax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [0], 1
add rsp, 0x30
pop rbp
ret
Function at 0x140008504
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdx, qword [0x14027f2a8]
mov eax, dword [0x14027f388]
mov dword [0x14027f370], eax
test rdx, rdx
jne 0x140008687
mov rax, qword gs:[0x60]
xor ebx, ebx
mov esi, 0xf4d8b55
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rdx, r14
movups xmm0, xmmword [rdx + 0x58]
movd eax, xmm0
sub ax, 8
test ebx, ebx
je 0x1400085a1
psrldq xmm0, 8
mov r8d, 0x811c9dc5
movzx eax, ax
movq rcx, xmm0
shr rax, 1
lea r9, [rcx + rax*2]
jmp 0x140008593
movsx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x140008582
cmp r8d, ebx
jne 0x140008668
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov r9d, eax
add r9, r10
shr rax, 0x20
cmp r9, r10
je 0x140008668
mov r8d, dword [r9 + 0x18]
test r8d, r8d
je 0x140008668
mov r15d, dword [r9 + 0x20]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r15 + r8*4]
mov r11d, dword [rcx + r10]
add r11, r10
jmp 0x1400085f5
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
mov cl, byte [r11]
inc r11
test cl, cl
jne 0x1400085ea
cmp edi, esi
je 0x14000860a
test r8d, r8d
jne 0x1400085d5
jmp 0x140008668
mov edx, dword [r9 + 0x24]
add rdx, r10
movzx r8d, word [rdx + r8*2]
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov edx, dword [rdx + r8*4]
add rdx, r10
cmp rdx, r9
jbe 0x140008680
lea rcx, [rax + r9]
cmp rdx, rcx
jae 0x140008680
mov ebx, 0x811c9dc5
mov esi, ebx
jmp 0x140008649
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc rdx
mov al, byte [rdx]
cmp al, 0x2e
jne 0x14000863b
jmp 0x14000865c
movsx eax, al
xor eax, esi
imul esi, eax, 0x1000193
inc rdx
mov al, byte [rdx]
test al, al
jne 0x140008651
mov rdx, qword [r14]
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r14
je 0x14000867e
cmp qword [rax + 0x30], 0
jne 0x140008556
xor edx, edx
mov qword [0x14027f2a8], rdx
call rdx
mov ecx, dword [0x14027f370]
mov dword [0x14027f388], eax
test ecx, ecx
je 0x1400086de
sub eax, ecx
cmp eax, 0x1770
jbe 0x1400086de
mov dword [rsp + 0x40], 0x60f0834
xor ecx, ecx
mov word [rsp + 0x44], 0x100
lea eax, [rcx + 0x60]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 4
jb 0x1400086b3
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x45], 0
call fcn.1400083e0
mov qword [0], 1
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000b1f4
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14027f340]
test rax, rax
jne 0x14000b40e
xor r9d, r9d
mov dword [rsp + 0x28], r9d
mov r10d, 0xfaba0065
mov dword [rsp + 0x24], r10d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov r8, qword [rcx]
mov qword [rsp + 0x48], r8
mov r15, r8
mov qword [rsp + 0x50], r8
mov rax, r8
mov r12d, 0x811c9dc5
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x58], xmm0
movd eax, xmm0
sub ax, 8
mov word [rsp + 0x58], ax
test r9d, r9d
je 0x14000b2a6
mov rcx, qword [rsp + 0x60]
movzx eax, ax
shr rax, 1
lea r11, [rcx + rax*2]
mov edx, r12d
mov qword [rsp + 0x38], rcx
cmp rcx, r11
je 0x14000b29d
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
add rcx, 2
jmp 0x14000b282
cmp edx, r9d
jne 0x14000b3e6
mov rdi, qword [r8 + 0x30]
mov qword [rsp + 0x68], rdi
movsxd rax, dword [rdi + 0x3c]
mov rax, qword [rax + rdi + 0x88]
mov qword [rsp + 0xb8], rax
mov ebx, eax
add rbx, rdi
mov qword [rsp + 0x70], rbx
shr rax, 0x20
mov dword [rsp + 0x78], eax
cmp rbx, rdi
je 0x14000b3e6
mov r11d, dword [rbx + 0x18]
mov dword [rsp + 0x20], r11d
mov ecx, r11d
dec r11d
mov dword [rsp + 0x20], r11d
test ecx, ecx
je 0x14000b3e6
mov edx, dword [rbx + 0x20]
add rdx, rdi
mov edx, dword [rdx + r11*4]
add rdx, rdi
mov qword [rsp + 0x40], rdx
mov esi, r12d
movsx ecx, byte [rdx]
inc rdx
mov qword [rsp + 0x40], rdx
test cl, cl
jne 0x14000b3d9
cmp esi, r10d
jne 0x14000b3d4
mov edx, dword [rbx + 0x1c]
add rdx, rdi
mov ecx, dword [rbx + 0x24]
add rcx, rdi
movzx ecx, word [rcx + r11*2]
mov r8d, dword [rdx + rcx*4]
add r8, rdi
cmp r8, rbx
jbe 0x14000b404
lea rcx, [rbx + rax]
cmp r8, rcx
jae 0x14000b404
mov r9d, r12d
mov dword [rsp + 0xb0], r12d
mov r10d, r12d
mov dword [rsp + 0xb4], r12d
mov ecx, r12d
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x2e
je 0x14000b39a
movsx eax, byte [r8]
xor eax, ecx
imul r9d, eax, 0x1000193
mov ecx, r9d
mov dword [rsp + 0xb0], r9d
inc r8
jmp 0x14000b372
inc r8
mov qword [rsp + 0x30], r8
cmp byte [r8], 0
je 0x14000b3c0
movsx eax, byte [r8]
xor eax, r10d
imul r10d, eax, 0x1000193
mov dword [rsp + 0xb4], r10d
jmp 0x14000b39a
mov dword [rsp + 0x24], r10d
mov dword [rsp + 0x28], r9d
mov r8, qword [r15]
mov qword [rsp + 0x48], r8
jmp 0x14000b3e6
jmp 0x14000b2e7
xor ecx, esi
imul esi, ecx, 0x1000193
jmp 0x14000b30f
mov r8, qword [r8]
mov rax, r8
mov qword [rsp + 0x48], r8
cmp r8, r15
je 0x14000b401
cmp qword [r8 + 0x30], 0
jne 0x14000b255
xor r8d, r8d
mov qword [0x14027f340], r8
mov rax, r8
mov ecx, 0x13333337
call rax
jmp 0x14000b419
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000f8ac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000f8dc
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000f954
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14000f8f3
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000f8f5
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000f94e
test ecx, ecx
jle 0x14000f92e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000f94e
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000f94e
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14000f970
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000f990
xor eax, eax
jmp 0x14000fa79
cmp qword [rcx + 0x68], 0
je 0x14000f9a2
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14000fa79
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000f9b9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000f9bb
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000f9ed
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000fa73
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000fa24
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000fa4e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x14000fa73
cmp rdi, rbx
ja 0x14000fa2b
test rdi, rdi
je 0x14000fa73
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000fe58
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401a80c0]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x14000fe91
xor eax, eax
jmp 0x14000ffb1
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14000fecb
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x14000fecb
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x14000ffb1
cmp qword [rbx + 0x80], 0
je 0x14000ffaf
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000ff06
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000ff27
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x14000ffac
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000ff75
sub eax, 1
je 0x14000ff75
cmp eax, 2
jne 0x14000ffaf
movsx ecx, byte [rbp - 0x30]
jmp 0x14000ff13
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14000ffa0
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x14000ffaf
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140148a70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140011560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401a80c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400115cf
cmp byte [rcx + 0x71], 0
je 0x1400115cf
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140011624
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400115e9
sub eax, 1
je 0x1400115ed
cmp eax, 2
jne 0x140011624
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140148a70
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001161b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140011624
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400115d1
xor al, al
jmp 0x1400115d1