joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800248d0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800248e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800248ea
xor eax, eax
test eax, eax
je 0x1800248fa
mov ecx, eax
call fcn.18001e274
or eax, 0xffffffff
jmp 0x1800248fc
xor eax, eax
add rsp, 0x28
ret

Function at 0x180024904
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18002491a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18002491c
xor eax, eax
test eax, eax
je 0x18002492c
mov ecx, eax
call fcn.18001e274
or eax, 0xffffffff
jmp 0x18002492e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001e18
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140001e7c
lea r8, [r9 + 8]
mov r11d, 0x7fffffff
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r11d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140001e3c
mov ecx, dword [r9]
jmp 0x140001f59
cmp ecx, 0x4e0
jb 0x140001f59
lea r10, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [r10]
mov r11d, 0x7fffffff
mov eax, edi
mov r8, r10
add r10, 4
mov edi, dword [r10]
mov edx, edi
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x140001e9d
lea r10, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [r10]
mov eax, edi
mov r8, r10
mov edx, eax
add r10, 4
mov edi, dword [r10]
xor edx, edi
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x140001ee7
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rsi, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x140003dec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003e36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003e36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003e36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003e36
cmp dword [rcx + 0x84], 0xe
jbe 0x140003e36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003e38
xor al, al
add rsp, 0x28
ret
Function at 0x140008f9c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000900b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000900b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000900b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000900b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000900b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000900b
cmp dword [rcx + 0xf8], 0
je 0x14000900b
mov ecx, ebx
call fcn.1400090bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140008e98
nop
cmp dword [rbp + 0x20], 0
je 0x140009059
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140009064
int3
xor r8d, r8d
xor edx, edx
jmp 0x140008f9c

Function at 0x1400091a0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000900b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000900b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000900b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000900b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000900b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000900b
cmp dword [rcx + 0xf8], 0
je 0x14000900b
mov ecx, ebx
call fcn.1400090bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140008e98
nop
cmp dword [rbp + 0x20], 0
je 0x140009059
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140009064
int3
xor r8d, r8d
xor edx, edx
jmp 0x140008f9c
Function at 0x1400092e4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14000931b
call fcn.14000b34c
mov dword [rax], 0x16
call fcn.140009958
xor eax, eax
jmp 0x1400093a9
mov rdx, r9
mov rcx, r8
call fcn.140009280
mov rbx, rax
test rax, rax
je 0x1400093a6
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400091ac]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140009393
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000b2c0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000937a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140009389
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14000b3e4
jmp 0x1400093a6
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400093a3
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14000f47c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000f4ac
xor eax, eax
jmp 0x14000f56f
mov rbp, rbx
cmp word [rax], si
je 0x14000f4d1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000f4b8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000f4b4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000f39c
movsxd r14, eax
test eax, eax
jne 0x14000f50f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000f4a5
mov rcx, r14
call fcn.14000dae8
mov rdi, rax
test rax, rax
jne 0x14000f528
xor ecx, ecx
call fcn.14000b3e4
jmp 0x14000f504
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000f39c
test eax, eax
jne 0x14000f559
mov rcx, rdi
call fcn.14000b3e4
jmp 0x14000f563
xor ecx, ecx
call fcn.14000b3e4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14000f58c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000f613
mov rsi, rbx
cmp word [rax], bp
je 0x14000f5d2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000f5bc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000f5b8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000dae8
mov rdi, rax
test rax, rax
je 0x14000f600
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140014fb0
mov rbp, rdi
xor ecx, ecx
call fcn.14000b3e4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140014c20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014c48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014c48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140010268
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140010245
call fcn.14000d6cc
mov dword [rax], 0x16
call fcn.14000d5ac
or eax, 0xffffffff
jmp 0x140010262
sub dword [rcx + 0x10], 1
jns 0x140010254
add rsp, 0x28
jmp 0x1400155ec
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140010224
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14001548c
call fcn.14000d6cc
mov dword [rax], 0x16
call fcn.14000d5ac
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140015474
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140015474
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400154be
lock or dword [rax + 0x14], 0x10
jmp 0x140015474
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400154db
mov rcx, qword [rbp + 0x10]
call fcn.1400155f4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000fec0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400170bc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140015532
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140015474
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14001559e
mov rcx, qword [rbp + 0x10]
call fcn.14000fec0
cmp eax, 0xffffffff
je 0x140015585
mov rcx, qword [rbp + 0x10]
call fcn.14000fec0
cmp eax, 0xfffffffe
je 0x140015585
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000fec0
movsxd rdi, eax
lea rsi, [0x14006fc70]
mov rcx, rbx
sar rdi, 6
call fcn.14000fec0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14001558c
lea rax, [0x14006eeb0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001559e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400155d4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400155d0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400155d0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140015477
jmp 0x140015444
Function at 0x14001063c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140010410
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010410
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010410
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010410
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010410
cmp dword [rcx + 0x84], 0xe
jbe 0x140010410
cmp dword [rcx + 0xf8], esi
je 0x140010410
mov ecx, r14d
call fcn.140010558
mov ecx, 2
call fcn.14000cf24
nop
cmp byte [0x1400700b0], 0
jne 0x1400104da
mov r15d, 1
mov eax, r15d
xchg dword [0x1400700a0], eax
test ebx, ebx
jne 0x140010483
mov rdi, qword [0x14006f790]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400700a8]
cmp rcx, rax
je 0x14001047a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140018594]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140070118]
jmp 0x14001048f
cmp ebx, r15d
jne 0x140010495
lea rcx, [0x140070130]
call fcn.140015ae4
nop
test ebx, ebx
jne 0x1400104ac
lea rdx, [0x140021310]
lea rcx, [0x1400212f0]
call fcn.140015658
lea rdx, [0x140021320]
lea rcx, [0x140021318]
call fcn.140015658
movzx eax, byte [0x1400700b0]
test esi, esi
cmove eax, r15d
mov byte [0x1400700b0], al
jmp 0x1400104da
mov ecx, 2
call fcn.14000cf78
test esi, esi
jne 0x1400104f1
mov ecx, r14d
call fcn.14001050c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400103a0
Function at 0x1400028f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002911
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000293e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002940
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002999
test ecx, ecx
jle 0x140002979
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002999
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002999
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
mov esi, 0xc9c9c900
add ah, dl
invalid
Function at 0x1400029c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400029e2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400029f1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002a14
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002a16
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002a52
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002aee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002a8d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002ace
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002aee
cmp rbx, rax
ja 0x140002aa0
test rbx, rbx
je 0x140002aee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], cl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
add byte [rax], al
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rdx + 0x42], al
add byte [rbp + 0x4d], cl
add byte [r9 + 0x59], r11b
pop rcx
add byte [rsp + riz*2 + 0x64], ah
add byte [rdi + 0x6f], ch
outsd dx, dword [rsi]
add byte [rdx + 0x7a], bh
jp 0x14000e8e0
xchg byte [rsi - 0x6363ff7a], al
pushfq
add byte [rdi - 0x4cff5859], ah
mov bl, 0xb3
add byte [rsi - 0x36ff4142], bh
mov esi, 0xc9c9c900
Function at 0x140003420
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400034f3
cmp byte [rcx + 0x71], 0
je 0x1400034f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400034ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400034b4
sub eax, 1
je 0x1400034b8
cmp eax, 2
jne 0x1400034ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004350
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400034e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400034ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000349c
xor al, al
jmp 0x14000349c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004350
add rsp, 0x60
pop rbx
ret

Function at 0x140004d0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004d56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004d56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004d56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004d56
cmp dword [rcx + 0x84], 0xe
jbe 0x140004d56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004d58
xor al, al
add rsp, 0x28
ret

Function at 0x140002a5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002aa6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002aa6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002aa6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002aa6
cmp dword [rcx + 0x84], 0xe
jbe 0x140002aa6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002aa8
xor al, al
add rsp, 0x28
ret
Function at 0x180946108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18094628f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180946139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18094611f
add dl, dl
jne 0x180946146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809461a6
xor eax, eax
add dl, dl
jne 0x180946155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18094625d
add dl, dl
jne 0x180946166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180946173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180946180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18094618d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18094619a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18094612e
mov eax, 1
add dl, dl
jne 0x1809461b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809461c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809461ab
sub eax, ebx
mov ebx, 1
jne 0x1809461fc
mov ecx, 1
add dl, dl
jne 0x1809461de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1809461eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809461d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18094612e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180946218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180946225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18094620d
cmp eax, 0x7d00
jae 0x18094624b
cmp eax, 0x500
jb 0x180946246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18094612e
cmp eax, 0x7f
ja 0x18094624e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18094612e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180946282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18094612e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20