joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x13e0
call fcn.140136100
sub rsp, rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea ecx, [rdi + 0x20]
call fcn.140135608
mov rbp, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], reloc.WS2_32.dll_setsockopt
mov qword [rsp + 0x40], Ordinal_32
movups xmm0, xmmword [str.000123456789MSIABCDEF]
movups xmmword [rax], xmm0
mov ecx, dword [0x1401745a8]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1401745ac]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], dil
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x18], rsi
mov byte [rbx], dil
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edi
mov dword [rsp + rdi*4 + 0x54], eax
inc rdi
cmp rdi, 0x270
jb 0x140047d50
mov dword [rsp + 0x50], 0x270
nop word [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.1400682b0
mov ecx, eax
imul rax, rcx, 0x15
cmp eax, 3
ja 0x140047daa
lea rcx, [rsp + 0x50]
call fcn.1400682b0
mov ecx, eax
imul rax, rcx, 0x15
cmp eax, 4
jb 0x140047d95
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rbp]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140047de2
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140047dd7
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140047dea
mov rcx, rbx
call fcn.140066770
sub rsi, 1
jne 0x140047d80
lea edx, [rsi + 0x20]
mov rcx, rbp
call fcn.140135884
mov rax, rbx
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140047e20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 3]
mov rax, qword gs:[0x58]
mov r12, qword [rax]
mov esi, 0x13a8
mov eax, dword [rsi + r12]
mov r13d, 0x13c0
test al, 1
jne 0x140047eb9
or eax, 1
mov dword [rsi + r12], eax
mov ebx, r13d
add rbx, r12
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea edx, [rbp + 1]
lea r8, [rbx + 8]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x140047e91
mov dword [rbx], 0x270
mov eax, dword [rsi + r12]
mov r15d, 0x2748
test al, 2
jne 0x140047edb
or eax, 2
mov dword [rsi + r12], eax
mov qword [r12 + r15], rbp
mov qword [r12 + r15 + 8], 0x3d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
mov rdx, r14
mov rcx, rdi
call fcn.140063510
mov ebx, r13d
add rbx, r12
mov qword [rsp + 0x78], rbx
lea r13, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop word [rax + rax]
dec r14
mov rbp, qword [r15 + r12]
mov rdx, qword [r15 + r12 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x140047f52
mov rcx, rbx
call fcn.1400682b0
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.1400682b0
mov eax, eax
or rsi, rax
jmp 0x140047f62
inc rdx
lea rcx, [rsp + 0x78]
call fcn.140067d50
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r13]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140047f97
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x140047f8c
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140047f9f
mov rcx, rdi
call fcn.140066770
test r14, r14
jne 0x140047f20
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140047fd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x2758
mov eax, dword [r15 + rsi]
mov r12d, reloc.WLDAP32.dll_Ordinal_32
test al, 1
jne 0x140048068
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea edx, [rbp + 1]
lea r8, [rbx + 8]
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x140048040
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ebx, 0x13b0
test al, 2
jne 0x140048089
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rbx], rbp
mov qword [rsi + rbx + 8], 9
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
mov rdx, r14
mov rcx, rdi
call fcn.140063510
test r14, r14
je 0x140048156
lea r15, [rsi + rbx]
mov ebx, r12d
add rbx, rsi
mov qword [rsp + 0x68], rbx
lea r12, str.0123456789
dec r14
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x140048100
mov rcx, rbx
call fcn.1400682b0
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.1400682b0
mov eax, eax
or rsi, rax
jmp 0x140048110
inc rdx
lea rcx, [rsp + 0x68]
call fcn.140067d50
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140048145
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14004813a
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14004814d
mov rcx, rdi
call fcn.140066770
test r14, r14
jne 0x1400480d0
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400576e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push r15
mov eax, 0x13d8
call fcn.140136100
sub rsp, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x140057710
mov r15, qword [0x1403794e8]
xor esi, esi
mov rax, qword [0x1403794f0]
sub rax, r15
mov dword [rsp + 0x20], 0x270
sar rax, 3
test rax, rax
je 0x140057978
movss xmm4, dword [0x1401798c0]
xorps xmm5, xmm5
mov qword [rsp + 0x13f0], rbx
mov ebx, esi
mov qword [rsp + 0x13f8], rbp
mov qword [rsp + 0x1400], rdi
mov rdi, qword [0x140379500]
mov qword [rsp + 0x13d0], r12
mov r12, qword [0x140379a90]
mov qword [rsp + 0x13c8], r13
mov r13, qword [0x1403793f0]
mov qword [rsp + 0x13c0], r14
mov r14d, esi
movaps xmmword [rsp + 0x13b0], xmm6
movsd xmm6, qword [0x140179540]
nop dword [rax]
movss xmm1, dword [rdi + rbx]
xorps xmm2, xmm2
mov ebp, dword [r12 + r14]
movss xmm0, dword [r15 + rbx]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, xmm6
cvtsi2ss xmm2, ebp
addsd xmm1, xmm0
movss xmm0, dword [r15 + rbx + 4]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm3, xmm1
movss dword [r15 + rbx], xmm3
movss xmm1, dword [rdi + rbx + 4]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm6
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movaps xmm1, xmm3
subss xmm1, xmm2
movss dword [r15 + rbx + 4], xmm0
comiss xmm5, xmm1
ja 0x140057839
mov rax, qword [r13 + 0x4038]
addss xmm2, xmm3
comiss xmm2, dword [rax + 0x30]
ja 0x140057839
movss xmm2, dword [rdi + rbx + 4]
jmp 0x140057893
movss xmm0, dword [rdi + rbx]
lea rcx, [rsp + 0x20]
xorps xmm0, xmm4
movss dword [rdi + rbx], xmm0
call fcn.1400682b0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x77
ja 0x140057878
nop
lea rcx, [rsp + 0x20]
call fcn.1400682b0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x78
jb 0x140057860
shr rax, 0x20
and eax, 1
lea eax, [rax*2 - 1]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
movss dword [rdi + rbx + 4], xmm2
movss xmm3, dword [r15 + rbx + 4]
movd xmm0, ebp
movaps xmm1, xmm3
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
comiss xmm5, xmm1
ja 0x1400578c5
mov rax, qword [r13 + 0x4038]
movd xmm0, ebp
cvtdq2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, dword [rax + 0x34]
jbe 0x140057918
xorps xmm2, xmm4
lea rcx, [rsp + 0x20]
movss dword [rdi + rbx + 4], xmm2
call fcn.1400682b0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x77
ja 0x1400578fe
lea rcx, [rsp + 0x20]
call fcn.1400682b0
mov ecx, eax
imul rax, rcx, 0x169
cmp eax, 0x78
jb 0x1400578e6
shr rax, 0x20
and eax, 1
lea eax, [rax*2 - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + rbx], xmm0
mov rcx, qword [0x1403794f0]
inc esi
sub rcx, qword [0x1403794e8]
add rbx, 8
sar rcx, 3
add r14, 4
movsxd rax, esi
cmp rax, rcx
jb 0x1400577c0
movaps xmm6, xmmword [rsp + 0x13b0]
mov r14, qword [rsp + 0x13c0]
mov r13, qword [rsp + 0x13c8]
mov r12, qword [rsp + 0x13d0]
mov rdi, qword [rsp + 0x1400]
mov rbp, qword [rsp + 0x13f8]
mov rbx, qword [rsp + 0x13f0]
add rsp, 0x13d8
pop r15
pop rsi
ret
Function at 0x140058d10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
mov ecx, 8
call fcn.140135608
lea rcx, [0x140058db0]
mov qword [rax], rcx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140042200]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140058d8f
cmp dword [rsp + 0x38], 0
je 0x140058d83
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140058d83
add rsp, 0x58
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140061130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x140061153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x71]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x12
jb 0x140061140
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x140061160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140061183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x71]
xor byte [rcx + rax], dl
inc rax
cmp rax, 3
jb 0x140061170
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x1400613e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [reloc.WS2_32.dll_accept], al
lea rdx, str.2H_
je 0x140061416
nop word [rax + rax]
lea ecx, [rax + 0x71]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x22
jb 0x140061400
mov byte [reloc.WS2_32.dll_accept], 0
lea r9, [rsp + 0x48]
mov rcx, rbx
lea r8, [0x140370362]
call fcn.1400656e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061440
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [reloc.WS2_32.dll_accept], al
lea rdx, [0x14021f100]
je 0x140061476
nop word [rax + rax]
lea ecx, [rax + 0x71]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1f
jb 0x140061460
mov byte [reloc.WS2_32.dll_accept], 0
lea r9, [rsp + 0x48]
mov rcx, rbx
lea r8, [0x14021f11f]
call fcn.1400656e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400614a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [reloc.WS2_32.dll_accept], al
lea rdx, [0x1403777a8]
je 0x1400614d6
nop word [rax + rax]
lea ecx, [rax + 0x71]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x18
jb 0x1400614c0
mov byte [reloc.WS2_32.dll_accept], 0
lea r9, [rsp + 0x48]
mov rcx, rbx
lea r8, [0x1403777c0]
call fcn.1400656e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061500
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [reloc.WS2_32.dll_accept], al
lea rdx, [0x1403774f0]
je 0x140061536
nop word [rax + rax]
lea ecx, [rax + 0x71]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x17
jb 0x140061520
mov byte [reloc.WS2_32.dll_accept], 0
lea r9, [rsp + 0x48]
mov rcx, rbx
lea r8, [0x140377507]
call fcn.1400656e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061560
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [reloc.WS2_32.dll_accept], al
lea rdx, str.2H__
je 0x140061596
nop word [rax + rax]
lea ecx, [rax + 0x71]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x19
jb 0x140061580
mov byte [reloc.WS2_32.dll_accept], 0
lea r9, [rsp + 0x48]
mov rcx, rbx
lea r8, [0x1403780b9]
call fcn.1400656e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400615c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [reloc.WS2_32.dll_accept], al
lea rdx, [0x1401ae270]
je 0x1400615f6
nop word [rax + rax]
lea ecx, [rax + 0x71]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x1e
jb 0x1400615e0
mov byte [reloc.WS2_32.dll_accept], 0
lea r9, [rsp + 0x48]
mov rcx, rbx
lea r8, [0x1401ae28e]
call fcn.1400656e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140061620
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 9], al
je 0x140061653
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x71]
xor byte [rdx + rax], cl
inc rax
cmp rax, 8
jb 0x140061640
mov byte [rdx + 9], 0
lea r8, [rdx + 8]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400656e0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140062870
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140062891
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400628be
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400628c0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140062919
test ecx, ecx
jle 0x1400628f9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140062919
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140062919
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
xlatb
in al, dx
pop rbp
rcr dword [rbp - 0x3d907062], 0xd
invalid
Function at 0x140062940
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140062971
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140062988
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400629ab
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400629ad
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400629e9
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140062a7e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140062a24
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140062a5e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140062a7e
cmp rbx, rax
ja 0x140062a30
test rbx, rbx
je 0x140062a7e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
invalid
Function at 0x140062ec0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140062ee4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140062f27
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140062f27
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140063058
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140062f6a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140062f95
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14006305d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14006300a
sub eax, 1
je 0x14006300a
cmp eax, 2
jne 0x140063058
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14006305d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14006303b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140063058
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14006305d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140064010
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400640d9
cmp byte [rcx + 0x71], 0
je 0x1400640d9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400640cc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140064088
sub eax, 1
je 0x14006408c
cmp eax, 2
jne 0x1400640cc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400640ba
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400640cc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x140065170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x120
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
xor ebx, ebx
lea rcx, [rsp + 0x30]
call fcn.140066d20
nop
cmp byte [rdi + 0xc], bl
je 0x1400651c3
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x71]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0xb
jb 0x1400651b0
mov byte [rdi + 0xc], 0
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140064c40
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x1400651de
mov rsi, qword [rsi]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400678a0
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.140063f60
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.140062250
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, rbp
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret