joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140999cde
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x18], r8b
test esi, 0x24eb1507
push rbp
adc bp, r8w
push rsi
sub rsp, 0x158
xor si, 0x2ddb
sub bp, r11w
movsx rbp, r15w
mov rbp, rdx
add sil, sil
btc si, si
mov rsi, rcx
cmp r9b, spl
test al, 0xff
test rcx, rcx
jmp 0x140999d1d
je 0x140999d44
test rdx, rdx
jmp 0x140999d2b
je 0x140999d44
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x140999d3e
je 0x140999d61
sub eax, eax
test r12d, 0x45890d08
add rsp, 0x158
pop rsi
jmp 0x140999d5a
pop rbp
jmp 0x140999d60
ret
movsxd rax, dword [rcx + 0x3c]
cmp r12b, r10b
stc
cmc
cmp dword [rax + rcx], 0x4550
jmp 0x140999d76
jne 0x140999d44
mov r9d, dword [rax + rcx + 0x88]
cmc
test di, ax
mov dword [rsp + 0x24], r9d
cmp r13, r15
test r9d, r9d
jmp 0x140999d98
je 0x140999d44
mov r10d, dword [rax + rcx + 0x8c]
shld rdx, r12, 0xd7
lea rdx, [rcx + r9]
mov qword [rsp + 0x178], rbx
jmp 0x140999dbc
mov qword [rsp + 0x150], rdi
cmp r10d, r14d
or r8d, 0xffffffff
jmp 0x140999dd1
sub edi, edi
clc
stc
mov dword [rsp + 0x170], r10d
jmp 0x140999de6
mov qword [rsp + 0x28], rdx
cmp rbp, 0xffff
jmp 0x140999df7
ja 0x140999e10
mov r8d, ebp
cmc
stc
sub r8d, dword [rdx + 0x10]
jmp 0x140999e0b
jmp 0x140999ffb
mov eax, dword [rdx + 0x18]
cmp bpl, dil
test eax, eax
jmp 0x140999e1d
je 0x140999ffb
mov r10d, dword [rdx + 0x20]
movsxd rcx, ecx
movsx ecx, r8w
dec eax
mov ecx, edi
clc
cmc
jmp 0x140999e39
add r10, rsi
stc
cmp r13b, 0x4c
cmc
mov dword [rsp + 0x20], ecx
cmp r10b, 0x34
clc
mov dword [rsp + 0x188], eax
stc
mov qword [rsp + 0x30], r10
cmp ebp, esp
test bpl, r12b
test eax, eax
jmp 0x140999e64
js 0x140999fed
lea ebx, [rax + rcx]
rdtsc
shld r9w, sp, 0x2a
mov r11, rdi
movzx ax, dil
sar ebx, 1
xor rdx, r11
or eax, 0x1e0952a8
cqo
mov eax, ebx
sar rax, 0xe4
cwd
rcl r8b, 0x92
movzx eax, byte [rsp + 0x180]
movsxd rdx, r13d
mov r8d, dword [r10 + rbx*4]
rol r10b, cl
bsr r9, rbx
mov r10, rbp
btr rdx, 0xe1
lea r8, [r8 + rsi]
and r9, 0x36f6bda
cdq
seto r9b
sub r10, r8
mov dl, 0x82
nop
movsx r9d, r9w
movzx edx, byte [r10 + r8]
movsxd r9, r10d
movzx r9, bx
dec r9w
movzx r9d, byte [r8]
inc r8
test al, al
jmp 0x140999eeb
je 0x140999f2a
mov ecx, r11d
movsx ax, r11b
movsxd rax, r15d
mov eax, 0x36df1d23
clc
cmc
rol eax, cl
add al, r11b
clc
cmp rbp, 0x1f612160
xor dl, al
inc al
movzx eax, byte [rsp + 0x180]
jmp 0x140999f21
inc r11
jmp 0x140999f2a
test dl, dl
je 0x140999f40
cmp dl, r9b
jmp 0x140999f3a
je 0x140999ecd
cmp dl, r9b
jmp 0x140999f48
jb 0x140999f6e
jbe 0x140999fa7
mov eax, dword [rsp + 0x188]
mov cx, si
movsx rcx, ax
lea ecx, [rbx + 1]
mov dword [rsp + 0x20], ecx
jmp 0x140999f8b
mov ecx, dword [rsp + 0x20]
movzx rax, cx
cwde
movzx eax, bx
lea eax, [rbx - 1]
test edx, 0x7872095
stc
mov dword [rsp + 0x188], eax
cmp ecx, eax
jmp 0x140999f92
jg 0x140999fc6
mov r10, qword [rsp + 0x30]
jmp 0x140999fa2
jmp 0x140999e6a
mov rax, qword [rsp + 0x28]
or r8d, 0xffffffff
adc r10b, 0x17
movzx edx, sp
bsf r9w, r12w
Function at 0x14000b340
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x58], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rcx], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rbx, [r14 - 1]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
test eax, eax
js 0x14000b4a5
lea rax, [rsp + 0x60]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b3d5
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.14000cfa0
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14000c6b0
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14000b43e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b502
call fcn.140012e74
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x14000b486
lea rbp, [rcx + 0xb]
mov qword [rdi + 0x10], rbp
mov rsi, rdi
cmp rdx, 8
jb 0x14000b466
mov rsi, qword [rdi]
lea rcx, [rsi + rcx*2]
mov r8d, 0x16
lea rdx, str.Microsoft_
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbp*2], r14w
jmp 0x14000b50e
mov qword [rsp + 0x20], 0xb
lea r9, str.Microsoft_
mov edx, 0xb
mov rcx, rdi
call fcn.14000dbb0
jmp 0x14000b50e
mov r8d, 2
lea rdx, [0x140017620]
lea rcx, [rsp + 0x38]
call fcn.14000cfa0
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14000c6b0
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14000b50e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b509
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012e74
lea r9, [0x1400254b0]
inc rbx
cmp word [r9 + rbx*2], 0
jne 0x14000b515
mov rcx, qword [rdi + 0x10]
mov r8, qword [rdi + 0x18]
mov rax, r8
sub rax, rcx
cmp rbx, rax
ja 0x14000b55e
lea rbp, [rcx + rbx]
mov qword [rdi + 0x10], rbp
mov rsi, rdi
cmp r8, 8
jb 0x14000b547
mov rsi, qword [rdi]
lea r8, [rbx + rbx]
lea rcx, [rsi + rcx*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbp*2], r14w
jmp 0x14000b56e
mov qword [rsp + 0x20], rbx
mov rdx, rbx
mov rcx, rdi
call fcn.14000dbb0
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140012940
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000d720
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13b0]
mov eax, 0x14b0
call fcn.1400138d0
sub rsp, rax
mov r14d, edx
mov r15, rcx
mov rsi, qword [rbp + 0x1408]
xor r12d, r12d
mov word [rbp + 0x3b0], r12w
mov byte [rbp - 0x50], r12b
mov ebx, dword [rbp + 0x1410]
mov ecx, ebx
call fcn.1400017d0
mov edi, eax
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x24], ebx
mov ecx, 1
lock xadd dword [0x1400258b0], ecx
inc ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
lea rax, str.C:Users_reverse_source_reposwebviewpackagesMicrosoft.Windows.ImplementationLibrary.1.0.191107.2includewil_resource.h
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x5c], edi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], r15
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xorps xmm1, xmm1
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x70], xmm1
mov rax, qword [0x140025440]
test rax, rax
je 0x14000d7f1
call rax
mov qword [rbp - 0x68], rax
jmp 0x14000d7f5
mov qword [rbp - 0x68], r12
mov rax, qword [0x1400253f8]
test rax, rax
je 0x14000d812
mov r8d, 0x400
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1400253e8]
test rax, rax
je 0x14000d825
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140025418]
test rax, rax
je 0x14000d838
lea rcx, [rsp + 0x20]
call rax
mov eax, dword [rsp + 0x24]
mov ecx, 0x8000ffff
test eax, eax
cmovns eax, ecx
mov dword [rsp + 0x24], eax
cmp byte [0x1400253b8], r12b
jne 0x14000d89b
mov rax, qword [0x1400253a8]
test rax, rax
je 0x14000d867
call rax
movzx r12d, al
jmp 0x14000d873
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000d89b
mov rax, qword [0x1400253c0]
test rax, rax
je 0x14000d8f1
cmp byte [0x1400253d8], r12b
jne 0x14000d8f1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x14000d8f1
mov rax, qword [0x1400253c0]
test rax, rax
je 0x14000d8c4
cmp byte [0x1400253d8], 0
jne 0x14000d8c4
mov r8d, 0x800
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3b0], 0
jne 0x14000d8e4
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3b0]
call fcn.140001410
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x1400253c8], 0
je 0x14000d909
mov rax, qword [0x140025408]
test rax, rax
je 0x14000d909
call rax
nop
lea rcx, [rsp + 0x20]
call fcn.140002a60
int3
Function at 0x14000d920
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000de30
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.1400138d0
sub rsp, rax
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rbp + 0x13b0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1428]
xor r12d, r12d
mov word [rbp + 0x3b0], r12w
mov byte [rbp - 0x50], r12b
mov ecx, dword [rbp + 0x1430]
call fcn.140001790
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], ecx
lock xadd dword [0x1400258b0], edx
inc edx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r15
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xorps xmm1, xmm1
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x70], xmm1
mov rax, qword [0x140025440]
test rax, rax
je 0x14000deff
call rax
mov qword [rbp - 0x68], rax
jmp 0x14000df03
mov qword [rbp - 0x68], r12
mov rax, qword [0x1400253f8]
test rax, rax
je 0x14000df20
mov r8d, 0x400
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1400253e8]
test rax, rax
je 0x14000df33
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140025418]
test rax, rax
je 0x14000df46
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x24], r12d
jge 0x14000e031
cmp byte [0x1400253b8], r12b
jne 0x14000dfa2
mov rax, qword [0x1400253a8]
test rax, rax
je 0x14000df6e
call rax
movzx r12d, al
jmp 0x14000df7a
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000dfa2
mov rax, qword [0x1400253c0]
test rax, rax
je 0x14000dff8
cmp byte [0x1400253d8], r12b
jne 0x14000dff8
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x14000dff8
mov rax, qword [0x1400253c0]
test rax, rax
je 0x14000dfcb
cmp byte [0x1400253d8], 0
jne 0x14000dfcb
mov r8d, 0x800
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3b0], 0
jne 0x14000dfeb
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3b0]
call fcn.140001410
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x1400253c8], 0
je 0x14000e010
mov rax, qword [0x140025408]
test rax, rax
je 0x14000e010
call rax
nop
mov rcx, qword [rbp + 0x13b0]
xor rcx, rsp
call fcn.140012940
add rsp, 0x14c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140002c70
nop
int3
Function at 0x14000de30
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000de30
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.1400138d0
sub rsp, rax
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rbp + 0x13b0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1428]
xor r12d, r12d
mov word [rbp + 0x3b0], r12w
mov byte [rbp - 0x50], r12b
mov ecx, dword [rbp + 0x1430]
call fcn.140001790
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], ecx
lock xadd dword [0x1400258b0], edx
inc edx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r15
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xorps xmm1, xmm1
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x70], xmm1
mov rax, qword [0x140025440]
test rax, rax
je 0x14000deff
call rax
mov qword [rbp - 0x68], rax
jmp 0x14000df03
mov qword [rbp - 0x68], r12
mov rax, qword [0x1400253f8]
test rax, rax
je 0x14000df20
mov r8d, 0x400
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1400253e8]
test rax, rax
je 0x14000df33
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140025418]
test rax, rax
je 0x14000df46
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x24], r12d
jge 0x14000e031
cmp byte [0x1400253b8], r12b
jne 0x14000dfa2
mov rax, qword [0x1400253a8]
test rax, rax
je 0x14000df6e
call rax
movzx r12d, al
jmp 0x14000df7a
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000dfa2
mov rax, qword [0x1400253c0]
test rax, rax
je 0x14000dff8
cmp byte [0x1400253d8], r12b
jne 0x14000dff8
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x14000dff8
mov rax, qword [0x1400253c0]
test rax, rax
je 0x14000dfcb
cmp byte [0x1400253d8], 0
jne 0x14000dfcb
mov r8d, 0x800
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3b0], 0
jne 0x14000dfeb
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3b0]
call fcn.140001410
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x1400253c8], 0
je 0x14000e010
mov rax, qword [0x140025408]
test rax, rax
je 0x14000e010
call rax
nop
mov rcx, qword [rbp + 0x13b0]
xor rcx, rsp
call fcn.140012940
add rsp, 0x14c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140002c70
nop
int3
Function at 0x14000faf0
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rdx
movzx edx, cx
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
xor ecx, ecx
test rax, rax
jne 0x14000fb50
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Failed_to_find_resource._Resource_ID_might_be_wrong.
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
xor ecx, ecx
test eax, eax
jne 0x14000fb81
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Resource_size_is_zero_or_negative.
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000fbb1
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Failed_to_load_resource
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x14000fbe4
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Failed_to_lock_resource
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400115e0
nop
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x38]
call fcn.1400119f0
test rax, rax
jne 0x14000fc43
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.14000fc80
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140012940
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140010d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140010d90
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140010db8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140010dba
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140010e13
test ecx, ecx
jle 0x140010df3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140010e13
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140010e13
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140010e40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140010e62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140010e71
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140010e94
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140010e96
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140010ed0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140010f77
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140010f0b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140010f51
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140010f90
cmp rbx, rax
ja 0x140010f20
mov r8, rdi
test rdi, rdi
je 0x140010f77
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x140010f7a
pxor xmm8, xmm0
Function at 0x140011390
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400113bd
xor eax, eax
jmp 0x140011512
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400113e8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400113e8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140011512
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140011505
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001142b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140011456
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001150a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400114c5
sub eax, 1
je 0x1400114c5
cmp eax, 2
jne 0x140011505
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001150a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400114f3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140011505
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001150a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140012940
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140011900
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400119d3
cmp byte [rcx + 0x71], 0
je 0x1400119d3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400119cf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140011994
sub eax, 1
je 0x140011998
cmp eax, 2
jne 0x1400119cf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140012940
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400119c6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400119cf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001197c
xor al, al
jmp 0x14001197c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140012940
add rsp, 0x60
pop rbx
ret