joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800728f0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800a6040]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x1800aa500], 0
lea rax, str.libOSMesa.dll
lea rcx, str.OSMesa.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
je 0x180072945
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180064310
add rsp, 0x48
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
nop dword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1800aa500], rax
mov rcx, rax
test rax, rax
jne 0x180072975
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x180072950
mov rbx, qword [rsp + 0x40]
test rcx, rcx
jne 0x1800729a4
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.180068790
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180064310
add rsp, 0x48
ret
lea rdx, str.OSMesaCreateContextExt
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800aa500]
lea rdx, str.OSMesaCreateContextAttribs
mov qword [0x1800aa508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800aa500]
lea rdx, str.OSMesaDestroyContext
mov qword [0x1800aa510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800aa500]
lea rdx, str.OSMesaMakeCurrent
mov qword [0x1800aa518], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800aa500]
lea rdx, str.OSMesaGetColorBuffer
mov qword [0x1800aa520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800aa500]
lea rdx, str.OSMesaGetDepthBuffer
mov qword [0x1800aa528], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800aa500]
lea rdx, str.OSMesaGetProcAddress
mov qword [0x1800aa530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1800aa508], 0
mov qword [0x1800aa538], rax
je 0x180072a95
cmp qword [0x1800aa518], 0
je 0x180072a95
cmp qword [0x1800aa520], 0
je 0x180072a95
cmp qword [0x1800aa528], 0
je 0x180072a95
cmp qword [0x1800aa530], 0
je 0x180072a95
test rax, rax
jne 0x18007292e
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.180068790
mov rcx, qword [0x1800aa500]
test rcx, rcx
je 0x180072ac3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1800aa500], 0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180064310
add rsp, 0x48
ret
Function at 0x141b71058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141b711df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b71089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b7106f
add dl, dl
jne 0x141b71096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b710f6
xor eax, eax
add dl, dl
jne 0x141b710a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b711ad
add dl, dl
jne 0x141b710b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b710c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b710d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b710dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b710ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b7107e
mov eax, 1
add dl, dl
jne 0x141b71106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b71113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b710fb
sub eax, ebx
mov ebx, 1
jne 0x141b7114c
mov ecx, 1
add dl, dl
jne 0x141b7112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b7113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b71123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b7107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b71168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b71175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b7115d
cmp eax, 0x7d00
jae 0x141b7119b
cmp eax, 0x500
jb 0x141b71196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b7107e
cmp eax, 0x7f
ja 0x141b7119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b7107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b711d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b7107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1400018fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001948
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001940
cmp dword [rcx + 0x3c], edx
jl 0x140001940
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001940
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001948
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140003890
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x140003930
jmp 0x14000391f
jae 0x1400039f0
cmp r8, 0x201
jae 0x140003930
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003988
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000395f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400191a0
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400039b1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140003a58
mov r8d, r14d
cmp r15, r8
jne 0x140003910
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003a85
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000391f
jmp 0x140003930
cmp rsi, r8
jb 0x140003a9f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140005840
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140003a41
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140001170
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140003a29
jmp 0x140003a41
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140019bb0
jmp 0x140003ab4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001a000
ud2
Function at 0x1400099b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001cf50]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400099f4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140009a5a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140009a91
test eax, eax
js 0x140009a6b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140009a84
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140005580
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140001bb0
mov ecx, 7
int 0x29
ud2
Function at 0x140017600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001767a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140017670
cmp r11, r10
ja 0x140017711
cmp r10, rdx
ja 0x140017723
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140017672
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140017650
jmp 0x1400176e7
ja 0x14001767a
mov r11, r10
cmp rax, r8
jne 0x140017622
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400176eb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400176c0
mov r8, r10
sub ecx, r9d
jns 0x1400176de
jmp 0x1400176ed
cmp r10, rdx
je 0x1400176f9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400176ed
xor al, 1
cmp r8, rdx
jne 0x1400176a0
jmp 0x1400176ed
xor eax, eax
jmp 0x1400176ed
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14001edbb]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140019bb0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001a080
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001a000
int3

Function at 0x140018c20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140018c6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018c6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018c6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018c6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140018c6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140018c6c
xor al, al
add rsp, 0x28
ret
Function at 0x14063f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14063f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14063f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14063f06f
add dl, dl
jne 0x14063f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14063f0f6
xor eax, eax
add dl, dl
jne 0x14063f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14063f1ad
add dl, dl
jne 0x14063f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14063f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14063f07e
mov eax, 1
add dl, dl
jne 0x14063f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14063f0fb
sub eax, ebx
mov ebx, 1
jne 0x14063f14c
mov ecx, 1
add dl, dl
jne 0x14063f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14063f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14063f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14063f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14063f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14063f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14063f15d
cmp eax, 0x7d00
jae 0x14063f19b
cmp eax, 0x500
jb 0x14063f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14063f07e
cmp eax, 0x7f
ja 0x14063f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14063f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14063f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14063f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140015090
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14012f680]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140015163
cmp byte [rcx + 0x71], 0
je 0x140015163
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14001515f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140015124
sub eax, 1
je 0x140015128
cmp eax, 2
jne 0x14001515f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400df060
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140015156
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001515f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001510c
xor al, al
jmp 0x14001510c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400df060
add rsp, 0x60
pop rbx
ret
Function at 0x14001b960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14012f680]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14001b98d
xor eax, eax
jmp 0x14001baf6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14001b9cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14001b9cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14001baee
cmp qword [rdi + 0x80], 0
je 0x14001bae9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14001ba07
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14001ba32
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14001baee
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001baa1
sub eax, 1
je 0x14001baa1
cmp eax, 2
jne 0x14001bae9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14001baee
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14001bacf
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14001bae9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14001baee
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400df060
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001efa0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14001efc2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14001efd8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x14001f022
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x14001f091
mov rcx, rbp
call fcn.1400164b0
cmp rbx, 0xfff
jbe 0x14001f071
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14001f0aa
cmp rbx, rax
ja 0x14001f040
test rdi, rdi
je 0x14001f091
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x14001f094
Function at 0x14001f0b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14001f0d8
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14001f14c
test rax, rax
jle 0x14001f12c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14001f14c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001f14c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret