joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e230
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
cmp edx, 1
jne 0x18000e33b
cmp qword [0x180016028], rbx
jne 0x18000e33b
lea rdx, str.SDL3.dll
lea rcx, [rsp + 0x68]
call fcn.180003f10
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x18000e2d4
mov ecx, 0x5a4d
mov rax, r8
cmp word [r8], cx
cmovne rax, rbx
test rax, rax
je 0x18000e2d4
movsxd rcx, dword [rax + 0x3c]
add rcx, r8
cmp dword [rcx], 0x4550
cmovne rcx, rbx
test rcx, rcx
je 0x18000e2d4
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rcx, [rcx + rcx*4]
lea rdx, [rax + rcx*8]
cmp rax, rdx
je 0x18000e2d4
test dword [rax + 0x24], 0x20000000
je 0x18000e2cb
cmp dword [rax], 0x7865742e
jne 0x18000e2cb
cmp byte [rax + 4], 0x74
je 0x18000e35c
add rax, 0x28
cmp rax, rdx
jne 0x18000e2b0
mov rcx, rbx
mov rdx, rbx
mov qword [rsp + 0x28], 0xf4240
lea rax, [0x1800165a8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rcx
lea rcx, [0x180016030]
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.180002bd0
mov qword [0x180016028], rax
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18000e33b
mov rcx, qword [rdx]
mov qword [rax + 0x10], rcx
lea rax, [0x18000f0c3]
mov qword [rdx], rax
lea rdx, [0x18000e514]
lea rcx, section..text
mov rax, rdx
sub rax, rcx
cmp rdx, rcx
cmovb rax, rbx
add rsp, 0x40
pop rbx
ret
mov ecx, dword [rax + 0xc]
mov edx, dword [rax + 8]
add rcx, r8
jmp 0x18000e2da
Function at 0x140868058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408681df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140868089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14086806f
add dl, dl
jne 0x140868096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408680f6
xor eax, eax
add dl, dl
jne 0x1408680a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408681ad
add dl, dl
jne 0x1408680b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408680c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408680d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408680dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408680ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14086807e
mov eax, 1
add dl, dl
jne 0x140868106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140868113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408680fb
sub eax, ebx
mov ebx, 1
jne 0x14086814c
mov ecx, 1
add dl, dl
jne 0x14086812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14086813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140868123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140868168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140868175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14086815d
cmp eax, 0x7d00
jae 0x14086819b
cmp eax, 0x500
jb 0x140868196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086807e
cmp eax, 0x7f
ja 0x14086819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408681d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14086807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14012a135
Capabilities:
Hash data using fnv

Disassembly:
retfq 0x343b
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r14
je 0x14012a075
jne 0x14012a075
call rcx
div rbx
jbe 0x1401299fb
lea edx, [rcx - 0xc3d9]
call rax
cmp r8, rdx
mov r15d, 0x8dbd3e0
test r11, rbp
bswap r12
movabs rbp, 0x4c82e0000000b6e9
js 0x14012a19e
jmp 0x14012a130
cmp r9d, 0xc3d4f5e8
cpuid
and r12d, 0x84826ccc
jmp 0x14012a093
add rcx, r11
movzx eax, byte [rcx]
inc rcx
test al, al
jmp 0x14012a0fe
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14012a107
jmp 0x14012a199
mov r11, qword [r10 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
mov r10d, dword [rbx + r11 + 0x20]
nop dword [rax + rax]
jmp 0x14012a0e9
mov r9d, r8d
mov edx, 0x1530fc6f
lea rax, [r10 + r9*4]
mov ecx, dword [rax + r11]
jmp 0x14012a0a1
je 0x14012a1a5
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
jmp 0x14012a0b1
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rbx
sub rsp, 8
nop
push 0x307a1904
mov qword [rsp], rdi
jmp 0x14012a03d
sub rsp, 8
push r15
push rdi
lea rbp, [rsp - 0x2a8]
sub rsp, 0x3a8
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r8d, r15d
jne 0x14012a187
je 0x14012a187
int3
jmp 0x14012a1ad
cmp edx, 0x204a7b32
je 0x14012a1d6
and byte [rdi], cl
test byte [rcx], dh
add byte [rax], al
add byte [rcx - 1], al
shr cl, 0x3c
invalid
inc r8d
jmp 0x14012a0e9
xchg r10, rbx
mov rbx, qword [rax + 0x18]
xchg rbx, r10
mov rax, qword [r10 + 0x10]
xchg rcx, r10
mov rcx, qword [rax]
xchg r10, rcx
jmp 0x14012a0ca
jmp 0x14012a113
mov rax, qword gs:[0x60]
mov r8d, r15d
mov ecx, dword [rbx + r11 + 0x24]
add rcx, r11
jne 0x14012a22a
je 0x14012a22a
syscall
ror edi, 0x88
div r8
rol esi, 0x4a
div rdi
lea r11d, [rbp + 0x2135]
jmp 0x14012abd7
jmp 0x14012a349
xchg r15, r9
mov r15, qword [rcx + 0x30]
mov rcx, qword [rax + 0x18]
add rdi, r11
xchg r9, rax
mov r9, qword [rcx + 0x10]
xchg r9, rax
mov rcx, qword [rax]
jmp 0x14012a23f
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + r11 + 0x1c]
add rcx, r11
mov edi, dword [rcx + rdx*4]
jmp 0x14012a2e2
Function at 0x1400060d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400ab0c0]
xor rax, rsp
mov qword [rbp + 0x20], rax
lea rdx, str.Add_MpPreference__ExclusionPath_C:
lea rcx, [rbp - 0x78]
call fcn.14000c8b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
mov dword [rbp + 0x14], eax
mov dword [rbp - 0x50], 0x68
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rdx, str.powershell.exe
lea rcx, [rsp + 0x68]
call fcn.14000c8b0
nop
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str._ExecutionPolicy_Bypass__Command
lea rcx, [rsp + 0x68]
call fcn.14000c820
mov r8d, 1
lea rdx, [0x140099cf4]
lea rcx, [rsp + 0x68]
call fcn.14000c820
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
lea rcx, [rsp + 0x68]
call fcn.14000c820
mov r8d, 1
lea rdx, [0x140099cf4]
lea rcx, [rsp + 0x68]
call fcn.14000c820
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140006215
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x140006259
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006254
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400865e4
movdqa xmm0, xmmword [0x14009bf50]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], bx
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x1400062af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400062aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400865e4
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140086270
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rbp
ret
Function at 0x140008bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x1400ab0c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp byte [0x14009bd57], 0
mov r9, rdx
movups xmm0, xmmword [0x14009bd40]
mov rbx, rcx
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x28], xmm0
movsd xmm0, qword [0x14009bd50]
movsd qword [rsp + 0x38], xmm0
je 0x140008dcf
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140008d99
movdqa xmm0, xmmword [0x14009c010]
lea rcx, [rsp + 0x2c]
movdqa xmm5, xmmword [0x14009bf70]
xor edx, edx
movdqa xmm4, xmmword [0x14009c030]
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0xb0], xmm6
movdqa xmm6, xmmword [0x14009bf90]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14009bff0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14009bff0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edx, 0x18
jl 0x140008c90
movaps xmm6, xmmword [rsp + 0xb0]
jmp 0x140008dcf
lea r8, [rsp + 0x28]
xor ecx, ecx
mov eax, 0x4d4873ed
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x35
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0x18
jl 0x140008da0
lea r8, [rsp + 0x28]
mov edx, 0x50
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140008e06
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140010fe0
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140086270
add rsp, 0xc0
pop rbx
ret
Function at 0x14000ab10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x46
call fcn.1400865ec
movzx r10d, byte [rbx]
lea rdx, [rbx + 4]
mov r8, rax
mov rcx, rax
sub r8, rbx
mov r9d, 3
nop word [rax + rax]
movzx eax, byte [rbx + 2]
xor al, byte [rdx]
lea rdx, [rdx + 0x17]
xor al, r10b
mov byte [rdx + r8 - 0x1b], al
movzx eax, byte [rdx - 0x17]
xor al, byte [rdx - 0x16]
mov byte [rdx + r8 - 0x1a], al
movzx eax, byte [rdx - 0x15]
xor al, byte [rdx - 0x16]
mov byte [rdx + r8 - 0x19], al
movzx eax, byte [rdx - 0x14]
xor al, byte [rdx - 0x15]
mov byte [rdx + r8 - 0x18], al
movzx eax, byte [rdx - 0x13]
xor al, byte [rdx - 0x14]
mov byte [rdx + r8 - 0x17], al
movzx eax, byte [rdx - 0x13]
xor al, byte [rdx - 0x12]
mov byte [rdx + r8 - 0x16], al
movzx eax, byte [rdx - 0x12]
xor al, byte [rdx - 0x11]
mov byte [rdx + r8 - 0x15], al
movzx eax, byte [rdx - 0x11]
xor al, byte [rdx - 0x10]
mov byte [rdx + r8 - 0x14], al
movzx eax, byte [rdx - 0x10]
xor al, byte [rdx - 0xf]
mov byte [rdx + r8 - 0x13], al
movzx eax, byte [rdx - 0xf]
xor al, byte [rdx - 0xe]
mov byte [rdx + r8 - 0x12], al
movzx eax, byte [rdx - 0xe]
xor al, byte [rdx - 0xd]
mov byte [rdx + r8 - 0x11], al
movzx eax, byte [rdx - 0xd]
xor al, byte [rdx - 0xc]
mov byte [rdx + r8 - 0x10], al
movzx eax, byte [rdx - 0xc]
xor al, byte [rdx - 0xb]
mov byte [rdx + r8 - 0xf], al
movzx eax, byte [rdx - 0xb]
xor al, byte [rdx - 0xa]
mov byte [rdx + r8 - 0xe], al
movzx eax, byte [rdx - 0xa]
xor al, byte [rdx - 9]
mov byte [rdx + r8 - 0xd], al
movzx eax, byte [rdx - 9]
xor al, byte [rdx - 8]
mov byte [rdx + r8 - 0xc], al
movzx eax, byte [rdx - 8]
xor al, byte [rdx - 7]
mov byte [rdx + r8 - 0xb], al
movzx eax, byte [rdx - 7]
xor al, byte [rdx - 6]
mov byte [rdx + r8 - 0xa], al
movzx eax, byte [rdx - 6]
xor al, byte [rdx - 5]
mov byte [rdx + r8 - 9], al
movzx eax, byte [rdx - 5]
xor al, byte [rdx - 4]
mov byte [rdx + r8 - 8], al
movzx eax, byte [rdx - 4]
xor al, byte [rdx - 3]
mov byte [rdx + r8 - 7], al
movzx eax, byte [rdx - 3]
xor al, byte [rdx - 2]
mov byte [rdx + r8 - 6], al
movzx eax, byte [rdx - 2]
xor al, byte [rdx - 1]
mov byte [rdx + r8 - 5], al
movzx r10d, byte [rdx - 1]
xor r10b, byte [rbx + 2]
sub r9, 1
jne 0x14000ab40
mov byte [rcx + 0x45], r9b
mov rax, rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14000ac80
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
mov dword [rcx], 0x350098
sub r10, rdx
lea r8, [rdx + 1]
mov edx, 3
mov r9, rcx
mov r11b, 0x98
mov al, 0x35
nop dword [rax]
xor al, byte [r8 - 1]
lea r8, [r8 + 0x17]
xor al, r11b
mov byte [r8 + r10 - 0x14], al
xor al, byte [r8 - 0x17]
mov byte [r8 + r10 - 0x13], al
xor al, byte [r8 - 0x16]
mov byte [r8 + r10 - 0x12], al
xor al, byte [r8 - 0x15]
mov byte [r8 + r10 - 0x11], al
xor al, byte [r8 - 0x14]
mov byte [r8 + r10 - 0x10], al
xor al, byte [r8 - 0x13]
mov byte [r8 + r10 - 0xf], al
xor al, byte [r8 - 0x12]
mov byte [r8 + r10 - 0xe], al
xor al, byte [r8 - 0x11]
mov byte [r8 + r10 - 0xd], al
xor al, byte [r8 - 0x10]
mov byte [r8 + r10 - 0xc], al
xor al, byte [r8 - 0xf]
mov byte [r8 + r10 - 0xb], al
xor al, byte [r8 - 0xe]
mov byte [r8 + r10 - 0xa], al
xor al, byte [r8 - 0xd]
mov byte [r8 + r10 - 9], al
xor al, byte [r8 - 0xc]
mov byte [r8 + r10 - 8], al
xor al, byte [r8 - 0xb]
mov byte [r8 + r10 - 7], al
xor al, byte [r8 - 0xa]
mov byte [r8 + r10 - 6], al
xor al, byte [r8 - 9]
mov byte [r8 + r10 - 5], al
xor al, byte [r8 - 8]
mov byte [r8 + r10 - 4], al
xor al, byte [r8 - 7]
mov byte [r8 + r10 - 3], al
xor al, byte [r8 - 6]
mov byte [r8 + r10 - 2], al
xor al, byte [r8 - 5]
mov byte [r8 + r10 - 1], al
xor al, byte [r8 - 4]
mov byte [r8 + r10], al
xor al, byte [r8 - 3]
mov byte [r8 + r10 + 1], al
xor al, byte [r8 - 2]
movzx ecx, al
mov byte [r8 + r10 + 2], al
movzx eax, byte [r9 + 2]
movzx r11d, al
xor r11b, cl
sub rdx, 1
jne 0x14000aca0
mov byte [r9 + 0x49], dl
mov rax, r9
ret
Function at 0x14000b1d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x3f
call fcn.1400865ec
movzx r10d, byte [rbx]
lea rdx, [rbx + 4]
mov r8, rax
mov rcx, rax
sub r8, rbx
mov r9d, 2
nop word [rax + rax]
movzx eax, byte [rbx + 2]
xor al, byte [rdx]
xor al, r10b
mov byte [rdx + r8 - 4], al
movzx eax, byte [rdx]
xor al, byte [rdx + 1]
mov byte [rdx + r8 - 3], al
movzx eax, byte [rdx + 2]
xor al, byte [rdx + 1]
mov byte [rdx + r8 - 2], al
movzx eax, byte [rdx + 3]
xor al, byte [rdx + 2]
mov byte [rdx + r8 - 1], al
movzx eax, byte [rdx + 4]
xor al, byte [rdx + 3]
mov byte [rdx + r8], al
movzx eax, byte [rdx + 4]
xor al, byte [rdx + 5]
mov byte [rdx + r8 + 1], al
movzx eax, byte [rdx + 6]
xor al, byte [rdx + 5]
mov byte [rdx + r8 + 2], al
movzx eax, byte [rdx + 6]
xor al, byte [rdx + 7]
mov byte [rdx + r8 + 3], al
movzx eax, byte [rdx + 7]
xor al, byte [rdx + 8]
mov byte [rdx + r8 + 4], al
movzx eax, byte [rdx + 8]
xor al, byte [rdx + 9]
mov byte [rdx + r8 + 5], al
movzx eax, byte [rdx + 9]
xor al, byte [rdx + 0xa]
mov byte [rdx + r8 + 6], al
movzx eax, byte [rdx + 0xa]
xor al, byte [rdx + 0xb]
mov byte [rdx + r8 + 7], al
movzx eax, byte [rdx + 0xb]
xor al, byte [rdx + 0xc]
mov byte [rdx + r8 + 8], al
movzx eax, byte [rdx + 0xc]
xor al, byte [rdx + 0xd]
mov byte [rdx + r8 + 9], al
movzx eax, byte [rdx + 0xd]
xor al, byte [rdx + 0xe]
mov byte [rdx + r8 + 0xa], al
movzx eax, byte [rdx + 0xe]
xor al, byte [rdx + 0xf]
mov byte [rdx + r8 + 0xb], al
movzx eax, byte [rdx + 0xf]
xor al, byte [rdx + 0x10]
mov byte [rdx + r8 + 0xc], al
movzx eax, byte [rdx + 0x10]
xor al, byte [rdx + 0x11]
mov byte [rdx + r8 + 0xd], al
movzx eax, byte [rdx + 0x11]
xor al, byte [rdx + 0x12]
mov byte [rdx + r8 + 0xe], al
movzx eax, byte [rdx + 0x12]
xor al, byte [rdx + 0x13]
mov byte [rdx + r8 + 0xf], al
movzx eax, byte [rdx + 0x13]
xor al, byte [rdx + 0x14]
mov byte [rdx + r8 + 0x10], al
movzx eax, byte [rdx + 0x14]
xor al, byte [rdx + 0x15]
mov byte [rdx + r8 + 0x11], al
movzx eax, byte [rdx + 0x15]
xor al, byte [rdx + 0x16]
mov byte [rdx + r8 + 0x12], al
movzx eax, byte [rdx + 0x16]
xor al, byte [rdx + 0x17]
mov byte [rdx + r8 + 0x13], al
movzx eax, byte [rdx + 0x17]
xor al, byte [rdx + 0x18]
mov byte [rdx + r8 + 0x14], al
movzx eax, byte [rdx + 0x18]
xor al, byte [rdx + 0x19]
mov byte [rdx + r8 + 0x15], al
movzx eax, byte [rdx + 0x19]
xor al, byte [rdx + 0x1a]
mov byte [rdx + r8 + 0x16], al
movzx eax, byte [rdx + 0x1a]
xor al, byte [rdx + 0x1b]
mov byte [rdx + r8 + 0x17], al
movzx eax, byte [rdx + 0x1b]
xor al, byte [rdx + 0x1c]
mov byte [rdx + r8 + 0x18], al
movzx eax, byte [rdx + 0x1c]
xor al, byte [rdx + 0x1d]
mov byte [rdx + r8 + 0x19], al
movzx eax, byte [rdx + 0x1d]
xor al, byte [rdx + 0x1e]
mov byte [rdx + r8 + 0x1a], al
movzx r10d, byte [rdx + 0x1e]
lea rdx, [rdx + 0x1f]
xor r10b, byte [rbx + 2]
sub r9, 1
jne 0x14000b200
mov byte [rcx + 0x3e], r9b
mov rax, rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14000b730
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000b758
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000b77e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000b780
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000b7d9
test ecx, ecx
jle 0x14000b7b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000b7d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000b7d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14000b800
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000b822
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000b838
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b854
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b856
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b892
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000b92e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000b8cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000b90e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000b92e
cmp rbx, rax
ja 0x14000b8e0
test rbx, rbx
je 0x14000b92e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14000bda0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ab0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000bdcd
xor eax, eax
jmp 0x14000bf39
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000be07
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000be07
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000bf39
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000bf2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000be4a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000be75
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000bf31
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000bee4
sub eax, 1
je 0x14000bee4
cmp eax, 2
jne 0x14000bf2c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000bf31
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000bf12
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000bf2c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000bf31
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140086270
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret