joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002d47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14009c000
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r13, r9
mov rbx, r8
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r9
call fcn.140001983
mov r14d, 0xffffffff
test al, al
je 0x14009c184
nop word [rax + rax]
mov rdx, r13
mov rcx, rbx
call fcn.140001983
test al, al
je 0x14009c184
mov rax, rbx
mov rbp, qword [rbx + 0x18]
cmp rbp, 8
jb 0x14009c083
mov rax, qword [rbx]
mov r9, rdi
mov rsi, qword [rdi + 0x18]
cmp rsi, 8
jb 0x14009c093
mov r9, qword [rdi]
mov r11, qword [rbx + 0x10]
mov r10, qword [rdi + 0x10]
mov rcx, r10
cmp r11, r10
cmovb rcx, r11
test rcx, rcx
je 0x14009c0c9
sub r9, rax
nop dword [rax]
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14009c0d3
add rax, 2
sub rcx, 1
jne 0x14009c0b0
cmp r10, r11
jae 0x14009c0e2
mov eax, r14d
jmp 0x14009c0ea
mov eax, 1
cmp dx, r8w
cmovb eax, r14d
jmp 0x14009c0ea
xor eax, eax
cmp r10, r11
seta al
shr eax, 0x1f
test al, al
jne 0x14009c215
mov rax, rdi
cmp rsi, 8
jb 0x14009c101
mov rax, qword [rdi]
mov r9, rbx
cmp rbp, 8
jb 0x14009c10d
mov r9, qword [rbx]
mov rcx, r11
cmp r10, r11
cmovb rcx, r10
test rcx, rcx
je 0x14009c139
sub r9, rax
nop
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x14009c143
add rax, 2
sub rcx, 1
jne 0x14009c120
cmp r11, r10
jae 0x14009c152
mov eax, r14d
jmp 0x14009c15a
mov eax, 1
cmp dx, r8w
cmovb eax, r14d
jmp 0x14009c15a
xor eax, eax
cmp r11, r10
seta al
shr eax, 0x1f
test al, al
jne 0x14009c1d6
mov rcx, rdi
call fcn.1400033af
mov rcx, rbx
call fcn.1400033af
mov rdx, r15
mov rcx, rdi
call fcn.140001983
test al, al
jne 0x14009c060
mov rcx, qword [rdi + 0x20]
mov rdx, qword [r15 + 0x20]
cmp rcx, rdx
jne 0x14009c20f
mov rax, qword [r15 + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x14009c200
mov rax, qword [r13 + 0x20]
cmp qword [rbx + 0x20], rax
jne 0x14009c200
mov rax, qword [r13 + 0x28]
cmp qword [rbx + 0x28], rax
jne 0x14009c200
mov rcx, rdi
call fcn.140001325
nop
mov rcx, r15
call fcn.140001325
nop
mov rcx, rbx
call fcn.140001325
nop
mov rcx, r13
call fcn.140001325
xor eax, eax
jmp 0x14009c23b
mov rcx, rdi
call fcn.140001325
nop
mov rcx, r15
call fcn.140001325
nop
mov rcx, rbx
call fcn.140001325
nop
mov rcx, r13
call fcn.140001325
mov eax, 1
jmp 0x14009c23b
cmp rcx, rdx
jne 0x14009c20f
mov rax, qword [r15 + 0x28]
cmp qword [rdi + 0x28], rax
je 0x14009c215
mov r14d, 1
mov rcx, rdi
call fcn.140001325
nop
mov rcx, r15
call fcn.140001325
nop
mov rcx, rbx
call fcn.140001325
nop
mov rcx, r13
call fcn.140001325
mov eax, r14d
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001c17
add rsp, 0x50
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000324c
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400a0eb0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140119b18]
cmp ecx, 0xffffffff
je 0x1400a0f15
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a0f15
mov rcx, qword [rax + 0x28]
mov rax, rcx
mov rdx, qword [rcx + 8]
cmp byte [rdx + 0x19], 0
jne 0x1400a0f03
cmp qword [rdx + 0x20], rbx
jae 0x1400a0eec
mov rdx, qword [rdx + 0x10]
jmp 0x1400a0ef2
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1400a0ee0
cmp rax, rcx
je 0x1400a0f03
cmp rbx, qword [rax + 0x20]
jae 0x1400a0f06
mov rax, rcx
cmp rax, rcx
je 0x1400a0f15
add rax, 0x28
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140003b07
Capabilities:
Get common file path

Disassembly:
jmp 0x140094d60
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbp, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov r8d, esi
mov eax, 2
mul r8
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.140003b02
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x140094ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140094ddd
mov eax, esi
lea r8, str.boost::filesystem::current_path
mov rdx, rbp
mov ecx, eax
call fcn.1400963d0
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
nop
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140094e00
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140001f5f
nop
mov rcx, rbx
call fcn.140002d6a
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140003dc3
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1400a2760
jmp fcn.1400a2cd0

Function at 0x1400342c0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400342c0
sub rsp, 0x58
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x1400ccc50]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
call fcn.140002b8a
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140034347
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034342
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034342
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001785
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001c17
add rsp, 0x58
ret
Function at 0x140034380
Capabilities:
Write file on windows

Disassembly:
jmp 0x140034380
push rbx
push rbp
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rcx + 0x78]
mov r15, r8
mov r14, rdx
mov rbp, rcx
test rbx, rbx
jne 0x1400344bc
mov qword [rsp + 0x98], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x50], rdi
lea rdi, [rcx + 0x80]
cmp qword [rdi + 0x18], 8
mov rsi, qword [rdi + 0x10]
movdqu xmmword [rsp + 0x30], xmm0
jb 0x1400343db
mov rdi, qword [rdi]
lea rcx, [rsp + 0x20]
cmp rsi, 8
jae 0x1400343f9
movups xmm0, xmmword [rdi]
mov qword [rsp + 0x38], 7
movups xmmword [rsp + 0x20], xmm0
jmp 0x140034446
movabs rax, 0x7ffffffffffffffe
mov rbx, rsi
or rbx, 7
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
call fcn.14000187f
lea r8, [rsi*2 + 2]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 8
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov qword [rsp + 0x30], rsi
lea rdx, [0x1400d15a4]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfsopen]
mov rdx, qword [rsp + 0x38]
mov rbx, rax
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
cmp rdx, 8
jb 0x1400344b3
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400344ae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400344ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001785
mov qword [rbp + 0x78], rbx
test rbx, rbx
je 0x1400344d0
mov r9, rbx
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001c17
add rsp, 0x58
pop r15
pop r14
pop rbp
pop rbx
ret

Function at 0x140037460
Capabilities:
Write file on windows

Disassembly:
jmp 0x140037460
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003750c
cmp byte [rcx + 0x71], 0
je 0x14003750c
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400374cd
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400374d1
sub eax, 1
je 0x1400374d5
sub eax, 2
je 0x14003750c
xor al, al
jmp 0x14003750e
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140037503
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400374cd
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003750e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001c17
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14003a5c0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003a5c0
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003a5ed
xor eax, eax
jmp 0x14003a742
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14003a618
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14003a618
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14003a742
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14003a735
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14003a65b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003a686
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003a73a
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x14003a735
cmp eax, 1
jle 0x14003a6f5
cmp eax, 3
jne 0x14003a735
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003a73a
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14003a723
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14003a735
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x14003a73a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001c17
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14003c790
Capabilities:
Read file on windows

Disassembly:
jmp 0x14003c790
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14003c7c7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x14003c7e8
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003c7ea
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003c850
test ecx, ecx
jle 0x14003c81e
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003c850
cmp qword [rdi + 0x80], 0
je 0x14003c850
mov rcx, rdi
call fcn.140003fcb
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14003c8b0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003c8b0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14003c8e7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14003c908
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003c90a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003c963
test ecx, ecx
jle 0x14003c93e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003c963
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14003c963
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14005c200
Capabilities:
Get common file path

Disassembly:
jmp 0x14005c200
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rcx
mov qword [rbp - 0x31], rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
mov dword [rbp - 0x49], 1
mov qword [rbp - 0x41], r13
lea r9, [rbp - 0x41]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400e22b0]
call sub.SHELL32.dll_SHGetKnownFolderPath
movdqa xmm0, xmmword [0x1400d1c80]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r13w
mov rdx, qword [rbp - 0x41]
test rdx, rdx
je 0x14005c2be
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14005c2a0
lea rcx, [rbp - 9]
call fcn.140001f5f
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r14, [rbp - 9]
mov rsi, qword [rbp - 9]
mov r15, qword [rbp + 0xf]
cmp r15, 8
cmovae r14, rsi
mov r12, qword [rbp + 7]
cmp r12, 8
jae 0x14005c2ee
movups xmm6, xmmword [r14]
movups xmmword [rbp - 0x29], xmm6
mov qword [rbp - 0x11], 7
jmp 0x14005c332
mov rbx, r12
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x29]
call fcn.14000187f
mov qword [rbp - 0x29], rax
lea r8, [r12*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x11], rbx
movups xmm6, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], r12
lea rax, [rbp - 0x29]
cmp rdi, rax
je 0x14005c364
mov rcx, rdi
call fcn.140001325
movups xmmword [rdi], xmm6
movups xmm0, xmmword [rbp - 0x19]
movups xmmword [rdi + 0x10], xmm0
movdqa xmm1, xmmword [0x1400d1c80]
movdqu xmmword [rbp - 0x19], xmm1
mov word [rbp - 0x29], r13w
lea rcx, [rbp - 0x29]
call fcn.140001325
nop
cmp r15, 8
jb 0x14005c3ac
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005c3a4
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c3a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140001785
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001c17
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14005f910
Capabilities:
Get memory capacity

Disassembly:
jmp 0x14005f910
mov r11, rsp
sub rsp, 0x98
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rcx, [r11 - 0x58]
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14005f981
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140001c17
add rsp, 0x98
ret
lea rdx, str.GlobalMemoryStatusEx_failed
lea rcx, [rsp + 0x20]
call fcn.1400016b3
lea rdx, [0x140117a08]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1400815f0
Capabilities:
Terminate process

Disassembly:
jmp 0x1400815f0
sub rsp, 0x48
mov byte [rcx + 8], 1
mov edx, 0x101
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140081616
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14008161b
add rsp, 0x48
ret
lea rdx, str.TerminateProcess_failed
lea rcx, [rsp + 0x20]
call fcn.1400016b3
lea rdx, [0x140117a08]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140087cf0
Capabilities:
Read file on windows

Disassembly:
jmp 0x140087cf0
jmp 0x140087cdc
movsxd rax, dword [rcx - 4]
sub rcx, rax
jmp 0x1400025e0
sub rsp, 0x58
mov rcx, qword [rcx - 0x58]
lea r9, [rsp + 0x60]
mov eax, 0xffffffff
cmp r8, rax
cmovb eax, r8d
xor r8d, r8d
mov dword [rsp + 0x60], r8d
mov qword [rsp + 0x20], r8
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140087d2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x140087d37
mov eax, dword [rsp + 0x60]
add rsp, 0x58
ret
lea rdx, str.ReadFile_failed
lea rcx, [rsp + 0x30]
call fcn.1400016b3
lea rdx, [0x140117a08]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140087e00
Capabilities:
Write file on windows

Disassembly:
jmp 0x140087e00
jmp 0x140087dec
movsxd rax, dword [rcx - 4]
sub rcx, rax
jmp 0x140003292
sub rsp, 0x58
mov rcx, qword [rcx - 0x88]
lea r9, [rsp + 0x60]
mov eax, 0xffffffff
cmp r8, rax
cmovb eax, r8d
xor r8d, r8d
mov dword [rsp + 0x60], r8d
mov qword [rsp + 0x20], r8
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140087e3f
mov eax, dword [rsp + 0x60]
add rsp, 0x58
ret
lea rdx, str.WriteFile_failed
lea rcx, [rsp + 0x30]
call fcn.1400016b3
lea rdx, [0x140117a08]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14008b6e0
Capabilities:
Clear file content

Disassembly:
jmp 0x140087de0
jmp 0x14008b6e0
mov rcx, qword [rcx + 0x20]
jmp 0x140002e50
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14008b6f3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SetEndOfFile
lea rcx, [rsp + 0x20]
call fcn.140002cc5
lea rdx, [0x1401186e8]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140094d60
Capabilities:
Get common file path

Disassembly:
jmp 0x140094d60
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbp, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov r8d, esi
mov eax, 2
mul r8
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.140003b02
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x140094ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140094ddd
mov eax, esi
lea r8, str.boost::filesystem::current_path
mov rdx, rbp
mov ecx, eax
call fcn.1400963d0
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
nop
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140094e00
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140001f5f
nop
mov rcx, rbx
call fcn.140002d6a
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400975c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rdi, rcx
jb 0x1400975df
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14009760e
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140097450
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x140097622
mov dword [rsi], 0
call fcn.140002c2a
mov qword [rsi + 8], rax
bt ebx, 0xa
jae 0x140097669
mov rcx, rdi
call fcn.140096c60
test al, al
je 0x140097654
test bl, 0x10
mov eax, 4
mov ecx, VariantTimeToDosDateTime
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140097c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140097c10
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbp, rdx
mov dword [rsp + 0x20], esi
mov rdi, rcx
call fcn.140002c2a
cmp qword [rdi + 0x18], 8
mov rcx, rdi
mov qword [rsp + 0x28], rax
jb 0x140097c47
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140097c6e
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140097450
mov esi, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140097ca7
call fcn.140002c2a
bt ebx, 0xa
jae 0x140097c9e
mov rcx, rdi
call fcn.140096c60
test al, al
je 0x140097c97
test bl, 0x10
mov eax, VariantTimeToDosDateTime
mov ebx, 4
cmovne ebx, eax
jmp 0x140097ca7
mov ebx, 9
jmp 0x140097cab
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
je 0x140097cad
xor esi, esi
lea r9, str.boost::filesystem::remove
mov r8, rbp
mov rdx, rdi
mov ecx, esi
call fcn.1400962d0
test al, al
je 0x140097cc9
xor al, al
jmp 0x140097cd6
mov r8, rbp
mov edx, ebx
mov rcx, rdi
call fcn.140098240
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret