joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140126118
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1401261ea
test rbx, rbx
je 0x1401261ea
test r9, r9
je 0x1401261ea
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401261e6
cmp dword [rsp + 0x48], 3
jne 0x1401261e6
test eax, eax
jne 0x1401261e6
cmp dword [rdi], eax
je 0x1401261e6
mov ecx, dword [rdi]
call fcn.1400d6048
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401261da
cmp dword [rsp + 0x48], 3
jne 0x1401261da
test eax, eax
jne 0x1401261da
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
call fcn.1400d6040
and qword [rbx], 0
xor eax, eax
jmp 0x1401261c5
call fcn.1400d9d50
int3

Function at 0x1401264c0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401264d1
xor eax, eax
jmp 0x1401264ff
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140126508
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140126519
xor eax, eax
jmp 0x14012653d
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14012dda0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x14012ddd1
call fcn.1400e169c
mov rdi, qword [rax + 0x18]
lea r8, [0x140305c40]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14012de3a
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14012de3a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14012de2d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.14012de58
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
jmp 0x14012de3c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14021b6dc
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.14028490c
test eax, eax
jne 0x14021b740
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.14006fbd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14021b752
jmp 0x14021b700
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1402691e0
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov eax, dword [rbp + 0x78]
mov qword [rbp + 0x80], rax
mov eax, 0
mov rdx, qword [rbp + 0x80]
mov ecx, 0x104
mov rbx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp + 0x1b0], ecx
mov rcx, rax
mov eax, dword [rbp + 0x1b0]
mov r8d, eax
call rbx
mov dword [rbp + 8], eax
mov rax, qword [rbp + 0x80]
mov rcx, rax
call fcn.140269070
mov dword [rbp + 0xc], eax
mov eax, dword [rbp + 0xc]
mov dword [rbp + 0x10], eax
mov eax, dword [rbp + 0x10]
movsxd rax, eax
imul rax, rax, 2
add rax, qword [rbp + 0x80]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x50]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov eax, dword [rax]
test eax, eax
je 0x14026933b
mov rax, qword [rbp + 0x80]
mov rdx, qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rax
call rdx
mov dword [rbp + 0x14], eax
mov eax, dword [rbp + 0x14]
mov byte [rbp], al
movzx eax, byte [rbp]
movzx eax, al
mov rdx, qword [rbp + 0x90]
movzx edx, byte [rdx]
movzx edx, dl
mov dh, 0xd2
Function at 0x140269780
Capabilities:
Terminate process

Disassembly:
mov rcx, rdx
mov rdx, qword [rbp + 0x1f8]
mov r8d, ebx
mov r9d, esi
call rax
mov qword [rbp + 0x188], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x50]
mov rax, qword [rax + 0x44]
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x50]
mov rax, qword [rax + 0x88]
mov qword [rbp + 0x198], rax
mov eax, dword [rbp + 0x190]
mov eax, eax
add rax, qword [rbp + 0x198]
mov qword [rbp + 0xc0], rax
mov eax, 4
add rax, qword [rbp + 0xc0]
mov eax, dword [rax]
mov dword [rbp + 0x38], eax
mov dword [rbp + 0x18], 8
mov eax, dword [rbp + 0x18]
cmp eax, 0x6000
jge 0x14026982e
mov eax, dword [rbp + 0x18]
movsxd rax, eax
add rax, qword [rbp + 0xc0]
mov edx, dword [rbp + 0x38]
add edx, dword [rax]
mov eax, dword [rbp + 0x18]
movsxd rax, eax
add rax, qword [rbp + 0xa8]
mov dword [rax], edx
mov eax, 4
add eax, dword [rbp + 0x18]
mov dword [rbp + 0x18], eax
jmp 0x1402697f6
mov rax, qword [rbp + 0x50]
mov eax, dword [rax + 0x90]
nop
add byte [rax], al
add byte [rcx + 0x8b84445], cl
add byte [rax], al
add byte [rax + 3], cl
test dword [rax - 0x75000000], ebp
push rbp
mov dword [rax], r10d
mov rax, qword [rbp + 0x50]
mov eax, dword [rax + 8]
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
add rax, qword [rbp + 0xa8]
mov edx, reloc.WS2_32.dll_inet_ntoa
add rdx, qword [rbp + 0xa8]
mov edx, dword [rdx]
add rax, rdx
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0x50]
mov eax, dword [rax + 8]
mov dword [rbp + 0x4c], eax
mov eax, dword [rbp + 0x4c]
add rax, qword [rbp + 0xa8]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov rdx, qword [rbp + 0xa8]
mov rcx, rdx
call rax
mov eax, 0
mov rdx, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, eax
call rdx

Function at 0x14027b365
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0

Function at 0x14027b368
Capabilities:
Terminate process

Disassembly:
sub byte [rax - 0x39], cl
and al, 0x20
add byte [rax], al
add byte [rax], al
mov rcx, qword [str._n_f__]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [str.InitOnceExecuteOnce]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x1403c400c]
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor r9d, r9d
call rax
test eax, eax
je 0x14027b3ac
add rsp, 0x28
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140285ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140285c24

Function at 0x14028ba6c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14028ba49
call fcn.14026f590
mov dword [rax], socket
call fcn.14026bae4
or eax, 0xffffffff
jmp 0x14028ba66
sub dword [rcx + 0x10], 1
jns 0x14028ba58
add rsp, 0x28
jmp fcn.14029190c
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14028ba28
Function at 0x14029190c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1402915c8
call fcn.14026f590
mov dword [rax], socket
call fcn.14026bae4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402915b0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1402915b0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1402915fa
lock or dword [rax + 0x14], 0x10
jmp 0x1402915b0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140291617
mov rcx, qword [rbp + 0x10]
call fcn.14029639c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140282bb8
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140291000
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14029166e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1402915b0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1402916da
mov rcx, qword [rbp + 0x10]
call fcn.140282bb8
cmp eax, 0xffffffff
je 0x1402916c1
mov rcx, qword [rbp + 0x10]
call fcn.140282bb8
cmp eax, 0xfffffffe
je 0x1402916c1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140282bb8
movsxd rdi, eax
lea rsi, [0x1403db6c0]
mov rcx, rbx
sar rdi, 6
call fcn.140282bb8
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1402916c8
lea rax, [0x1403c6830]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402916da
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140291710
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14029170c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14029170c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1402915b3
jmp 0x140291580
Function at 0x140291914
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14029177a
call fcn.14026f590
mov dword [rax], socket
call fcn.14026bae4
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14029175c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14029175c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1402917ac
lock or dword [rax + 0x14], 0x10
jmp 0x14029175c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402917c9
mov rcx, qword [rbp + 0x20]
call fcn.14029639c
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1402917de
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1402917e4
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140282bb8
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140291000
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x140291837
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x14029175c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1402918a3
mov rcx, qword [rbp + 0x20]
call fcn.140282bb8
cmp eax, 0xffffffff
je 0x14029188a
mov rcx, qword [rbp + 0x20]
call fcn.140282bb8
cmp eax, 0xfffffffe
je 0x14029188a
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140282bb8
movsxd rdi, eax
lea r15, [0x1403db6c0]
mov rcx, rbx
sar rdi, 6
call fcn.140282bb8
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x140291891
lea rax, [0x1403c6830]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402918a3
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1402918d9
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1402918d5
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1402918d5
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1402918f7
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x140291902
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x140291761
jmp 0x140291728
Function at 0x14029a820
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14029a833
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14029ae40
lea rdx, [0x1403bdab0]
lea rcx, [rsp + 0x20]
call fcn.140269104
int3

Function at 0x1402a50bc
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1403dbe88]
xor edx, edx
jmp fcn.14029a820

Function at 0x1402a5a40
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1403dbe88]
jmp fcn.14029a820

Function at 0x1402b16b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1402b176c]
mov r9, qword [r9 + 8]
jmp fcn.1402a2a74

Function at 0x1402b1744
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1402b177c]
mov r9, qword [r9 + 8]
jmp fcn.1402a2a74
Function at 0x140011800
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140011839
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140011927
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x1400118cf
cmp qword [rsp + 0x20], 0
jle 0x1400118cf
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140011879
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140016e30
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140011917
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140011917
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140011930
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140216080]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140011964
xor eax, eax
jmp 0x140011b60
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140011996
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140011b60
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140011a47
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140011b80
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140016e30
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140011b50
mov rcx, qword [rsp + 0x80]
call fcn.1400146e0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x140011afd
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140011af8
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140011b60
jmp 0x140011a73
cmp qword [rsp + 0x50], 0
jbe 0x140011b50
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14016f850
add rsp, 0x78
ret
Function at 0x1400147a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140216080]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x1400147dd
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400147e4
mov al, 1
jmp 0x14001493e
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140016d50
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140016d50
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.140016db0
movzx eax, al
test eax, eax
je 0x14001483b
xor al, al
jmp 0x14001493e
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400148ab
cmp dword [rsp + 0x30], 1
je 0x1400148b7
cmp dword [rsp + 0x30], 3
je 0x14001492c
jmp 0x14001493c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140014903
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140014903
xor al, al
jmp 0x14001493e
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001491d
mov dword [rsp + 0x34], 1
jmp 0x140014925
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14001493e
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001493e
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14016f850
add rsp, 0xa8
ret