joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fa8a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4faadb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call fcn.004d27c0
xorps xmm15, xmm15
mov r14, qword [0x006942f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4fa9ea
nop dword [rax]
cmp rdx, 0x40
ja 0x4faacd
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4fa959
mov rax, rdx
mov rcx, rsi
nop
call fcn.00470180
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4fa9c1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004faf00
xorps xmm15, xmm15
mov r14, qword [0x006942f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4faac2
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4fa9f7
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4faa75
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004faf00
xorps xmm15, xmm15
mov r14, qword [0x006942f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4faab8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4faab4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.00470180
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.0046f8a0
mov rax, rdx
mov ecx, 0x40
call fcn.0046f8a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046d500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004fa8a0
Function at 0x14011aa91
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401e82d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14068af5d]
call fcn.1401213a0
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1401e8328
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1401e843a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1401e83d3
cmp qword [rbp + 0x28], 0
jle 0x1401e83d3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1401e8371
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140120bf8
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x1401e8429
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1401e8429
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14011b374
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401ae770
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14068a5ec]
call fcn.1401213a0
nop
mov qword [rbp + 8], 0
jmp 0x1401ae7af
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401ae805
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401ae7a4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14011cdd7
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14013d000
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068a118]
call fcn.1401213a0
nop
xor eax, eax
test eax, eax
je 0x14013d03b
movsx eax, byte [rbp + 0xf8]
or eax, 0x20
mov dword [rbp + 0xc0], eax
jmp 0x14013d048
movsx eax, byte [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xf0]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x14011df7a
Capabilities:
Terminate process

Disassembly:
jmp 0x1403501c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14011e876
Capabilities:
Write file on windows

Disassembly:
jmp 0x140217360
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068b2d8]
call fcn.1401213a0
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14011e8fd
Capabilities:
Get geographical location

Disassembly:
jmp 0x14034b690
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14034b6cd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140121355
add rsp, 0x58
ret
Function at 0x14011ec13
Capabilities:
Read file on windows

Disassembly:
jmp 0x1402172e0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068b2d8]
call fcn.1401213a0
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14011ec3b
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1402191f0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x14068b2d8]
call fcn.1401213a0
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1403841d0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x140219336
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x14021928a
mov dword [rbp + 0x160], 1
jmp 0x140219294
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x140219331
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x14021930b
cmp qword [rbp + 0x198], 2
jb 0x14021930b
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14021930b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14021930b
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140219255
jmp 0x1402193d0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1402193d0
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1402193a7
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1402193a7
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1402193a7
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140219336
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14011eea2
Capabilities:
Parse pe header

Disassembly:
jmp 0x140351ad0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140351af0
xor al, al
jmp 0x140351b71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140351b03
xor al, al
jmp 0x140351b71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140351b2d
xor al, al
jmp 0x140351b71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140351b41
xor al, al
jmp 0x140351b71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140351b53
xor al, al
jmp 0x140351b71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140351b6f
xor al, al
jmp 0x140351b71
mov al, 1
add rsp, 0x38
ret
Function at 0x14011fc71
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14032b170
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14068bb4f]
call fcn.1401213a0
nop
mov ecx, dword [0x14065f78c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14032b264
movzx eax, byte [0x14066655c]
test eax, eax
jne 0x14032b262
mov byte [0x14066655c], 1
mov rax, qword [rbp + 0xf0]
movzx eax, byte [rax + 0x1c]
test eax, eax
jne 0x14032b1db
mov dword [rbp + 0xc0], 1
jmp 0x14032b1e5
mov dword [rbp + 0xc0], 0
mov rax, qword [rbp + 0xf0]
movzx ecx, byte [rbp + 0xc0]
mov byte [rax + 0x1c], cl
mov rax, qword [rbp + 0xf0]
movzx eax, byte [rax + 0x1c]
test eax, eax
je 0x14032b234
mov r8d, 0x80000a8
mov edx, 0xffffffec
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetWindowLongW]
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
jmp 0x14032b262
mov r8d, 0x80800a8
mov edx, 0xffffffec
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SetWindowLongW]
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
jmp 0x14032b26b
mov byte [0x14066655c], 0
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140120ac2
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1402190d0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x14068b2d8]
call fcn.1401213a0
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1403841d0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x140219150
mov dword [rbp + 0x120], 1
jmp 0x14021915a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1402191a3
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14021911b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x14012121a
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401db160
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x14065e100]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x14068af5d]
call fcn.1401213a0
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x1401db1c7
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1401db1ce
mov al, 1
jmp 0x1401db33e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14011beb4
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14011beb4
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.14011fa78
movzx eax, al
test eax, eax
je 0x1401db231
xor al, al
jmp 0x1401db33e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x1401db2a4
cmp dword [rbp + 0x160], 1
je 0x1401db2af
cmp dword [rbp + 0x160], 3
je 0x1401db32d
jmp 0x1401db33c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1401db2ff
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1401db2ff
xor al, al
jmp 0x1401db33e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1401db31a
mov dword [rbp + 0x154], 1
jmp 0x1401db324
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x1401db33e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1401db33e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140381b40]
call fcn.14011ff4b
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14011d6a6
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140138920
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065e100]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068a16d]
call fcn.1401213a0
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014a800
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013d310
nop
lea rax, [0x1401375d0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014e960
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1401389fc
lea rcx, [rbp + 8]
call fcn.14014fc10
nop
jmp 0x140138a15
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011b8fb
nop
lea rcx, [rbp + 8]
call fcn.140143290
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036b2a0]
call fcn.14011ff4b
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011d6a6
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140138aa0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065e100]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068a16d]
call fcn.1401213a0
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014a840
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013d3e0
nop
lea rax, [0x1401376e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014e9b0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140138b7c
lea rcx, [rbp + 8]
call fcn.14014fc70
nop
jmp 0x140138b95
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011b8fb
nop
lea rcx, [rbp + 8]
call fcn.140143320
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036b320]
call fcn.14011ff4b
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011d6a6
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140138c20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065e100]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068a16d]
call fcn.1401213a0
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014a880
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013d4b0
nop
lea rax, [0x1401377f0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014ea00
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140138cfc
lea rcx, [rbp + 8]
call fcn.14014fcd0
nop
jmp 0x140138d15
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011b8fb
nop
lea rcx, [rbp + 8]
call fcn.1401433b0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036b3a0]
call fcn.14011ff4b
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011d6a6
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140138da0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14065e100]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14068a16d]
call fcn.1401213a0
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14014a8c0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013d580
nop
lea rax, [0x140137900]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14014ea50
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140138e7c
lea rcx, [rbp + 8]
call fcn.14014fd30
nop
jmp 0x140138e95
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14011b8fb
nop
lea rcx, [rbp + 8]
call fcn.140143440
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14036b420]
call fcn.14011ff4b
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.14011d6a6
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret