joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d5f0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rdi, [0x1400ca640]
mov rbx, r8
lea r11, [0x1400a1368]
mov r9, rdi
sub r11, rdi
mov r10d, 0x104
nop word [rax + rax]
lea rax, [r10 + 0x7ffffefa]
test rax, rax
je 0x14000d644
movzx eax, word [r11 + r9]
test ax, ax
je 0x14000d644
mov word [r9], ax
add r9, 2
sub r10, 1
jne 0x14000d620
lea rax, [r9 - 2]
mov dword [rsp + 0x68], 0x208
test r10, r10
cmovne rax, r9
xor r8d, r8d
mov r9d, 0x20019
mov word [rax], r8w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d6ac
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000d6ba
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rdx, str._ProgramFiles_
mov rcx, rdi
call fcn.140042720
test rax, rax
jne 0x14000d6e2
lea rdx, str._SystemRoot_
mov rcx, rdi
call fcn.140042720
test rax, rax
je 0x14000d6a1
mov r8d, 0x104
lea rdx, [0x1400ca850]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
lea rax, [0x1400ca850]
add rsp, 0x40
pop rdi
ret

Function at 0x14000da30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov rsi, r9
mov rcx, r9
mov rbp, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
lea r14d, [rax*2 + 2]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000dab8
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x14000dabc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14000dac7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000e450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r12, r8
xor esi, esi
test r8, r8
je 0x14000e546
mov r15, rdx
mov r13, rcx
sub r13, rdx
nop dword [rax]
mov cl, 1
call fcn.14001036c
mov r14, rax
mov qword [rsp + 0x30], rax
mov cl, 1
call fcn.14001036c
mov rbp, rax
mov qword [rsp + 0x40], rax
movzx ebx, byte [r15 + r13]
lea rcx, [rsp + 0x28]
call fcn.1400035e0
mov r8, qword [rax]
movzx edx, bl
mov rcx, rax
call qword [r8 + 0x30]
movzx edi, al
movzx ebx, byte [r15]
lea rcx, [rsp + 0x38]
call fcn.1400035e0
mov r8, qword [rax]
movzx edx, bl
mov rcx, rax
call qword [r8 + 0x30]
cmp dil, al
sete bl
test rbp, rbp
je 0x14000e511
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x10]
test rax, rax
je 0x14000e511
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
test r14, r14
je 0x14000e533
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
test rax, rax
je 0x14000e533
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
test bl, bl
je 0x14000e560
inc rsi
inc r15
cmp rsi, r12
jb 0x14000e490
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov cl, 1
call fcn.14001036c
mov r14, rax
mov qword [rsp + 0x40], rax
mov cl, 1
call fcn.14001036c
mov r15, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
movzx ebx, byte [rsi + rax]
lea rcx, [rsp + 0x38]
call fcn.1400035e0
mov r8, qword [rax]
movzx edx, bl
mov rcx, rax
call qword [r8 + 0x30]
movzx edi, al
mov rax, qword [rsp + 0x98]
movzx ebx, byte [rsi + rax]
lea rcx, [rsp + 0x28]
call fcn.1400035e0
mov r8, qword [rax]
movzx edx, bl
mov rcx, rax
call qword [r8 + 0x30]
cmp dil, al
setl bl
test r15, r15
je 0x14000e5ef
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
test rax, rax
je 0x14000e5ef
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
test r14, r14
je 0x14000e611
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
test rax, rax
je 0x14000e611
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
movzx eax, bl
xor eax, 1
lea eax, [rax*2 - 1]
jmp 0x14000e548

Function at 0x14003f320
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x30], eax
call fcn.140066ad0
mov ebx, 2
lea r8, [rsp + 0x30]
mov r9d, ebx
mov rcx, qword [rax + 0x28]
lea edx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, dword [rsp + 0x30]
cmp ax, 0x30
je 0x14003f36e
cmp ax, 0x31
jne 0x14003f362
mov ebx, 1
jmp 0x14003f36e
xor ebx, ebx
cmp ax, 0x32
lea ecx, [rbx + 3]
cmove ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140076244
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140075fcc
Function at 0x14000f1c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000f1e5
cmp rax, rcx
je 0x14000f1eb
cmp rdx, 4
jae 0x14000f1ef
xor eax, eax
xor r8d, r8d
jmp 0x14000f280
pop rbp
jmp fcn.140002520
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400314a0]
movdqa xmm3, xmmword [0x1400314b0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000f210
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000f297
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000f280
pop rbp
ret

Function at 0x140013480
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14445a500]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400134f1
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14001351e
test eax, eax
js 0x1400134fd
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140013514
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x14445a560]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140012b80
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140012c40
mov ecx, 7
int 0x29
ud2
Function at 0x140024be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.1400182d0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x140024c1e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x140024c44
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.140024b00
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x140024c5d
lea rcx, [rbp - 8]
call fcn.140012c60
mov qword [rsi], rbx
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
invalid
je 0x140024c80
mov qword [rsi], r14
mov qword [rsi], rbx
test r14, r14
je 0x140024c50
mov rcx, qword [0x144464228]
xor edx, edx
mov r8, rdi
Function at 0x14002dde0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002de2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002de2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002de2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002de2a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002de2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002de2c
xor al, al
add rsp, 0x28
ret

Function at 0x14002f450
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rcx, [0x144457635]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x14002f4b0
mov rdi, rax
lea rdx, [0x144457656]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f4b0
mov rsi, rax
lea rdx, [0x144457664]
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f4b0
mov r14, rax
xor ebx, ebx
jmp 0x14002f532
lea rcx, [0x1444575f0]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x14002f598
mov rsi, rax
lea rdx, [0x1444575fa]
mov rcx, rax
mov ecx, eax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f598
mov rdi, rax
lea rdx, [0x14445760d]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f598
mov rbx, rax
lea rdx, [0x144457621]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14002f598
mov rsi, rax
lea rcx, [rbp - 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x14002f598
mov r14, qword [rbp - 0x20]
movzx eax, byte [0x1444642a0]
mov ecx, 0x18
call fcn.140029840
dec dword [rax - 0x7b]
invalid
je 0x14002f59d
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x144464168], rdi
je 0x14002f58a
mov rsi, rax
cmp qword [rdi], 0
je 0x14002f575
mov rcx, qword [rdi + 0x10]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x144464228]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rsi
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.14002f5f0
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rbx
mov ecx, 8
mov edx, 0x18
call fcn.14002e3c0
ud2
Function at 0x140004540
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140133080]
xor rax, rsp
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140004590
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x20], 0
jne 0x140004590
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f1580
add rsp, 0x38
ret
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f1580
add rsp, 0x38
ret
Function at 0x140004c60
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140133080]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor r15d, r15d
lea rcx, [rsp + 0x58]
call fcn.140004700
mov rsi, rax
lea r12, [0x140107c61]
lea r14, reloc.WLDAP32.dll_Ordinal_32
movzx ebx, byte [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140004d42
lea r8, [rcx + 1]
mov qword [rsi + 0x10], r8
mov rdi, rsi
cmp rdx, 0xf
jbe 0x140004ce8
mov rdi, qword [rsi]
cmp r12, rdi
jbe 0x140004d08
lea rax, [rdi + rcx]
cmp r14, rax
ja 0x140004d08
cmp rdi, r14
ja 0x140004d00
mov rbp, r15
jmp 0x140004d0d
mov rbp, rdi
sub rbp, r14
jmp 0x140004d0d
mov ebp, 1
lea rcx, [rdi + 1]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 1
sub r8, rbp
lea rdx, [r14 + 1]
add rdx, rbp
lea rcx, [rdi + rbp]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140004d67
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, bl
mov edx, 1
mov rcx, rsi
call fcn.140013f40
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsi + 0x10], r15
mov byte [rsi], 0
mov r8d, 1
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400093c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x88], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x38]
call fcn.1400092d0
nop
lea rcx, [rsp + 0x58]
call fcn.1400092d0
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 0xf
cmova rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x78]
call fcn.1400092d0
lea rcx, [rsp + 0x58]
call fcn.140004700
mov rsi, rax
jmp 0x140004cc0
Function at 0x140005c80
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
sub rsp, 0x38
lea r8, str.UniqueApplicationNameMutex
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140005cd2
lea rdx, str.__C_____Another_instance_is_already_running.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000c550
lea rdx, [0x14000c720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
add rsp, 0x38
ret
call fcn.140004540
test al, al
je 0x140005cf4
mov edx, 0x7d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140004a40
call fcn.140004e40
lea rdx, str._n_n_n_n__C_____authenticating_your_key_n_n_n_____C_____attempting_to_detect_roblox_window_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c550
call fcn.1400057a0
call fcn.140004540
test al, al
je 0x140005d3b
mov edx, 0x7d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str._n_WARNING__Pressing_enter_will_BLOW_UP_the_external___joke__just_deletes_it__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c550
lea rdx, [0x14000c720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
xor eax, eax
add rsp, 0x38
ret
Function at 0x140006220
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140006248
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000626e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140006270
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400062c9
test ecx, ecx
jle 0x1400062a9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400062c9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400062c9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400062f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140006312
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140006328
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140006344
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140006346
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140006382
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000641e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400063bd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400063fe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000641e
cmp rbx, rax
ja 0x1400063d0
test rbx, rbx
je 0x14000641e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140006850
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140133080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000687d
xor eax, eax
jmp 0x1400069e9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400068b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400068b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400069e9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400069dc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400068fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006925
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400069e1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006994
sub eax, 1
je 0x140006994
cmp eax, 2
jne 0x1400069dc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400069e1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400069c2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400069dc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400069e1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400f1580
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140008840
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140133080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140008913
cmp byte [rcx + 0x71], 0
je 0x140008913
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000890f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400088d4
sub eax, 1
je 0x1400088d8
cmp eax, 2
jne 0x14000890f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f1580
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140008906
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000890f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400088bc
xor al, al
jmp 0x1400088bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f1580
add rsp, 0x60
pop rbx
ret