joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400048e4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x14000491d
xor eax, eax
jmp 0x140004a2c
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140004946
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x140004946
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140004a2c
cmp qword [rcx + 0x80], 0
je 0x140004a2a
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140004981
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400049a2
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x140004a27
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400049f0
sub eax, 1
je 0x1400049f0
cmp eax, 2
jne 0x140004a2a
movsx ecx, byte [rbp - 0x30]
jmp 0x14000498e
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140004a1b
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x140004a2a
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400077d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140004e8c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004efb
cmp byte [rcx + 0x71], 0
je 0x140004efb
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004f50
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004f15
sub eax, 1
je 0x140004f19
cmp eax, 2
jne 0x140004f50
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400077d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004f47
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140004f50
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140004efd
xor al, al
jmp 0x140004efd
Function at 0x1400073f0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], ebx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbx + 0xb]
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, 0xc0000004
jmp 0x140007477
test rbx, rbx
je 0x14000744c
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x30]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, esi
je 0x140007436
test eax, eax
jns 0x1400074b8
test rbx, rbx
je 0x140007495
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400077d0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
test rbx, rbx
je 0x140007495
xor edi, edi
cmp dword [rbx], edi
jbe 0x140007484
and qword [rbp - 0x18], 0
xorps xmm0, xmm0
and qword [rbp - 0x10], 0
mov eax, edi
imul rsi, rax, 0x128
movups xmmword [rbp - 0x28], xmm0
movzx edx, word [rsi + rbx + 0x2e]
add rdx, 0x30
add rdx, rsi
add rdx, rbx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400074f0
lea rcx, [rbp - 0x28]
call fcn.140006060
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x140007510
mov rdx, qword [r14]
cmp qword [rbp - 0x10], 0x10
lea rcx, [rbp - 0x28]
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000756e
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14000755f
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000755a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075b6
call fcn.1400077f0
inc edi
cmp edi, dword [rbx]
jb 0x1400074c3
jmp 0x140007484
mov rdi, qword [rsi + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400075c2
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075bd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400075bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400077f0
mov rax, rdi
jmp 0x140007497
Function at 0x1400075cc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov r12, rcx
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400075f5
movsxd rcx, dword [rdx + 0x3c]
lea r13, [rdx + 0x18]
add r13, rcx
xor esi, esi
movzx eax, word [rcx + rdx + 0x14]
movzx r15d, word [rcx + rdx + 6]
add r13, rax
test r15d, r15d
je 0x140007658
lea rcx, [rsi + rsi*4]
mov r8, rbx
lea rdi, [rcx*8]
mov rdx, r12
add rdi, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007651
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x140007643
cmp rbx, rax
je 0x140007677
inc esi
cmp esi, r15d
jb 0x14000761e
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp dword [rdi + 0xc], 0
je 0x140007658
test r14, r14
je 0x140007688
mov eax, dword [rdi + 8]
mov dword [r14], eax
mov eax, dword [rdi + 0xc]
add rax, rbp
jmp 0x14000765a

Function at 0x140007fc8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400082a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400082ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400082ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400082ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400082ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400082ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400082f0
xor al, al
add rsp, 0x28
ret

Function at 0x14001de2b
Capabilities:
Delete file

Disassembly:
js 0x1400e348f
push r11
xor r8w, 0x2159
mov r8, qword [rsp + 0x18]
movabs r11, 0x7a5f312a3fdf4fed
add r11d, 0x2f783b48
js 0x140133aca
lea r11, [r11 + r11*8 + 0x4f333305]
mov r11b, 0x15
mov r11, qword [rsp]
call fcn.14014d9d0
push r8
mov qword [rsp + 0x10], 0x4a5bf395
call fcn.1400b7889
Function at 0x140020550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14002057c
xor al, al
jmp 0x1400206a0
movdqa xmm0, xmmword [0x140040ae0]
movdqa xmm1, xmmword [0x140040af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x140040b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x140040b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x140020692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400205f9
mov r11d, 2
jmp 0x14002061d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140020613
mov r11d, 1
jmp 0x14002061d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1400206b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14002065a
mov byte [rcx + 2], 0x3d
jmp 0x14002066a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x14002067c
mov byte [rcx], 0x3d
jmp 0x140020683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1400205e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x14002069b

Function at 0x14002a9c0
Capabilities:
Encode data using xor

Disassembly:
push r8
mov rsi, qword [rsp + 0x28]
pushfq
xor r11b, r11b
movabs r8, 0x60a1564129732759
je 0x14009f3bd

Function at 0x14002b843
Capabilities:
Delete file

Disassembly:
call fcn.1400ca52a
jmp fcn.1401ccc62
jl 0x14001de36
or byte [rsp + 0x28], 0x10
and dword [rsp + 0x28], 0x4de8646e
movzx rbp, word [rsp + 0x28]
not word [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
and word [rsp + 0x28], 0x22ab
setbe byte [rsp + 0x28]
call fcn.1401b2fde

Function at 0x1400393f0
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [0x14004c2b8]
call fcn.14018477a
fcmovne st(0), st(4)
int3
Function at 0x14011709a
Capabilities:
Encode data using xor

Disassembly:
movabs eax, dword [0x22008da35fa77075]
pop rbp
in eax, dx
xchg r11d, eax
scasq rax, qword [rdi]
invalid
call fcn.1401e6652
stc
movabs eax, dword [0x9f9788ff27c59788]
sub eax, 0xfd978035
out dx, al
jae 0x14011711a
in eax, dx
and ebp, dword [rax]
jne 0x14011711f
fcom qword [rsi]
loopne 0x140117046
xchg edi, eax
sub eax, 0x978f57d7
xchg dword [rbp + 0x79787d5], ecx
mov cl, 0x10
jge 0x140117133
jnp 0x140117056
push rdi
mov edx, dword [rdi - 0x7f73c621]
xchg edi, eax
call 0x1a88af4e0
movsd dword [rdi], dword [rsi]
jae 0x140117101
adc dword [rdi - 0x741126c5], 0xffffff97
movabs eax, dword [0x7ef3c7796878354b]
push 0x4e0820c8
pop rcx
fmulp st(0)
out 0xb9, eax
sti
invalid
adc byte [rbx - 0x36f71ba0], dl
or cl, cl
leave
in eax, dx
test ah, 0xd9
loop 0x140117105
jne 0x140117106
add al, 0xaf
je 0x1401170b9
int1
retf
sub byte [rbx - 0x4545ec1b], bh
inc dword [rax + 0x12]
hlt
mov edx, 0xf41240ff
jp 0x14011712e
invalid
scasb al, byte [rdi]
invalid
std
outsd dx, dword [rsi]
push rdx
jb 0x140117106
test al, 5
enter 0xffffffffffffcb2e, 0xffffffffffffffd5
sal ebx, 1
pop rbx
mov byte [rdi], 0x24
xor al, bh
xchg esp, eax
and edx, dword [rcx - 0x1d]
cmp cl, byte [rsi]
mov edi, 0xc1bc0be2
sbb bh, byte [rcx - 0x60]
fld qword [edi - 0x5c24d492]
div dword [rbx + 0x24]
xor dl, byte [rbp - 0x7472aefe]
cld
jl 0x140117138
adc al, 0xde
sbb al, 0x1f
and al, 0x72
test al, 0xd8
jo 0x140117193
push rsi
mov edi, 0x27605ca0
sub rsi, qword [rdx]
push rdi
xor eax, 0xe6b2e4fa
outsd dx, dword [rsi]
sahf
int3
invalid

Function at 0x14016bb76
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [rdi*8 + 0x31283055]
jge 0x14016114b
neg rsi
mov rdi, qword [rsp + 0x28]
jg fcn.140134f30
xor sil, byte [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
neg qword [rsp + 0x38]
mov byte [rsp + 0x38], 0x39
setne byte [rsp + 0x38]
sub dword [rsp + 0x38], 0x31641ca5
and byte [rsp + 0x38], 0xe7
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x1401b885d
Capabilities:
Delete file

Disassembly:
movzx r14, word [rsp]
test dword [rsp + 0x78], 0x70634f
call fcn.140022b25
xchg qword [rsp + rsi - 0x47bc718d], rbx
not r14d
bswap rsi
jbe 0x14009984c
mov rdx, qword [rsp + 0x28]
add sil, byte [rsp + 0x65]
not dword [rsp + 0x60]
jbe 0x140193515
push rbp
push rbp
movabs rbp, 0x711001324d2922e0
call fcn.14002114a

Function at 0x1401ccc20
Capabilities:
Delete file

Disassembly:
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + r9*2 - 0x70ac5800]
neg r9b
movabs r11, 0x51544add73ff5914
call fcn.1401e75b3

Function at 0x1401ccc3f
Capabilities:
Delete file

Disassembly:
movabs rdx, 0x355658657b401e47
call fcn.14002bf0b
Function at 0x1404a3171
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call rax
jmp 0x1408095e7
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.140842283
call rax
mov r11, rax
cmp spl, cl
clc
test rax, rax
jmp 0x1408094ce
call rax
mov r11, rax
cmp dx, r11w
clc
cmc
test rax, rax
je 0x140809418
cmp r11, rsi
jne 0x140809539
cmp byte [rsp + 0x180], dil
je 0x14080951f
lea rax, [rsp + 0x40]
sub dh, cl
sub rbp, rax
ror cl, cl
nop
movsx rax, r11w
not eax
lea rdx, [rsp + rdi + 0x40]
movsx eax, r8w
mov ecx, edi
lahf
cdqe
mov eax, 0x2393608c
rol eax, cl
cmc
add al, dil
jmp 0x1408094ec
xor eax, eax
jmp 0x1408095e7
jne 0x1407c6982
lea rcx, [rsp + 0x40]
mov al, 0x15
jmp 0x1408094e0
mov rax, qword [0x140382130]
jmp 0x1407c696e
xor al, byte [rdx + rbp]
jmp 0x1408094f4
mov byte [rdx], al
jmp 0x1408094fb
je 0x140809519
inc rdi
cmc
test ch, bl
cmp rdi, 0x104
jmp 0x140809513
jb 0x1407c69ac
lea rbp, [rsp + 0x40]
lahf
mov rdx, rbp
cwde
movsx rcx, dx
mov rcx, rsi
mov al, r14b
mov rax, qword [0x140382140]
jmp 0x1403d419b
cmp byte [rbx + 1], 0x23
movsxd rdx, r14d
cmovo edx, r8d
movzx dx, bpl
lea rdx, [rbx + 1]
jmp 0x140809552
jne 0x1408095c7
movzx edx, byte [rbx + 2]
jmp 0x140809561
add rbx, 2
test sil, 0x2e
jmp 0x14080956e
test dl, dl
jmp 0x140809575
je 0x1408095c4
nop
mov al, r8b
lea eax, [rdx - 0x30]
jmp 0x140809587
inc rbx
cmp al, 9
ja 0x1408095c4
movsx eax, dl
movzx edx, byte [rbx]
btc rcx, rsi
test spl, cl
movsx cx, r14b
lea ecx, [rdi + rdi*4]
add rdi, rdx
sbb dil, r10b
movsx di, dil
lea edi, [rax + rcx*2 - 0x30]
stc
test dl, dl
jmp 0x1408095be
jne 0x14080957f
movsxd rdx, edi
sub r8d, r8d
bswap cx
movzx ecx, r10w
mov rcx, r11
jmp 0x1408095d9
call fcn.14080900f
jmp 0x1408095e7
mov rbx, qword [rsp + 0x178]
and dil, 0xf7
cmp r15b, r11b
btr di, 0x7f
mov rdi, qword [rsp + 0x150]
cmp cl, r12b
add rsp, 0x158
movzx rsi, r12w
xchg si, si
pop rsi
movsx bp, r9b
pop rbp
jmp 0x140809620
ret

Function at 0x1407d21ca
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x18]
setno dil
cmovne rdi, qword [rsp + 0x28]
setge byte [rsp + 0x28]
and al, 0x28
mov r15, rdi
mov r15, qword [rsp + 8]
or word [rsp + 0x28], 0x6352
sub rdi, rdi
test qword [rsp + 0x28], 0xb7f7480
mov rdi, qword [rsp + 0x10]
mov word [rsp + 0x28], 0x4eb1
je 0x140439a6f
call fcn.14038f317
sub bl, dl
mov dword [rbx + 0x5f], ecx
push rsp
sbb eax, 0x340f4b8a
pop rcx
fimul dword [rcx + 0x1d545f4b]
mov cl, byte [rbx + 0xf]
xor al, 0x59
mov dword [rbx - 0x2e], ecx
pop rdx
mov cl, byte [r11 + 0xb]
jo 0x1407d2211
jg 0x1407d21dc
invalid
Function at 0x140001580
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov rbx, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [0x1400066a8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400016be
mov dword [rsp + 0x68], 0xc8
mov dword [rsp + 0x6c], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, str.path
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400016be
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Growtopia.exe
lea rcx, [rsp + 0x38]
call fcn.140003630
nop
mov r8, rax
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140004120
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400016a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004cd4
movdqa xmm0, xmmword [0x140006bb0]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], di
jmp 0x1400017e6
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, [0x1400066a8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400017c3
mov dword [rsp + 0x70], 0xc8
mov dword [rsp + 0x74], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
xor r8d, r8d
lea rdx, str.path
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400017c3
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Growtopia.exe
lea rcx, [rsp + 0x38]
call fcn.140003630
nop
mov r8, rax
lea rdx, [rbp + 0x120]
mov rcx, rbx
call fcn.140004120
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400016a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140006700]
mov rcx, rbx
call fcn.140003630
nop
mov dword [rsp + 0x30], 1
mov rax, rbx
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.140004c70
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400024a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400024c1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400024ee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400024f0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002549
test ecx, ecx
jle 0x140002529
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002549
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002549
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
in eax, 8
invalid
Function at 0x140002570
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002592
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400025a1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400025c4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400025c6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002602
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000269e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000263d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000267e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000269e
cmp rbx, rax
ja 0x140002650
test rbx, rbx
je 0x14000269e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
or al, 0x5b
sub cl, byte [rax]
lodsb al, byte [rsi]
invalid