joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ffb50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1800ffb84
mov ecx, esi
lea eax, [rcx - 0x15]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1800ffb70
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1800ffbb9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.18000eb90
nop
cmp byte [rbx + 0x14], 0
je 0x1800ffbe3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x15]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0x13
jb 0x1800ffbd0
mov byte [rbx + 0x14], 0
lea rax, [rbx + 0x13]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1800ffc18
mov r8d, 0x13
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000eb90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.1800c5e20
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800ffc71
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ffc6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ffc6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180112394
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800ffcb1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ffcac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ffcac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180112394
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800ffcc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1800ffcf4
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1800ffce0
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1800ffd29
mov r8d, 0xb
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.18000eb90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800ffd37
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18006def0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800ffdae
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ffda9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ffda9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180112394
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800ffdc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1800ffdf4
mov ecx, esi
lea eax, [rcx - 0x15]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1800ffde0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1800ffe29
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.18000eb90
nop
cmp byte [rbx + 0xd], 0
je 0x1800ffe53
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x15]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x1800ffe40
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1800ffe88
mov r8d, 0xc
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000eb90
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.1800c5e20
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800ffee1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ffedb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ffedb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180112394
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800fff21
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800fff1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800fff1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180112394
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x180106ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x180106bc8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x180106bb0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x180106bd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x180106bf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x180106be0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x180106c00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x180106c23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x15]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x180106c10
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x1801103c0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x180110578
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x180110438
cmp eax, 0x40
jae 0x180110422
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x180110410
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.1801106c0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x180110440
lea rsi, [rbx + 0x2c]
jae 0x180110452
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x180110440
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.1801106c0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180110590
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x180110c90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rbx
push rdi
sub rsp, 0xe0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x18016b440]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov eax, dword [0x18016b414]
mov rbx, r8
shr eax, 5
mov rdi, rcx
test al, 1
je 0x180110dde
cmp rbx, 0x100
jb 0x180110dde
movdqa xmm6, xmmword [0x18011b440]
and ebx, 0x1f
vmovdqu ymm5, ymmword [0x18011b480]
vmovdqu ymm7, ymmword [0x18011b4a0]
movsx eax, r9b
vpxor xmm8, xmm8, xmm8
vmovd xmm0, eax
movsx eax, byte [rsp + 0x120]
vpbroadcastb ymm3, xmm0
vmovdqu ymmword [rbp + 0x40], ymm3
vmovd xmm0, eax
lea rax, [r8 + rcx]
vpbroadcastb ymm4, xmm0
vmovdqu ymmword [rbp + 0x20], ymm4
add rcx, rbx
nop dword [rax]
nop dword [rax + rax]
vmovd xmm0, dword [rdx]
sub rax, 0x20
vpshufb xmm0, xmm0, xmm6
add rdx, 4
vpermd ymm1, ymm5, ymm0
vpand ymm2, ymm7, ymm1
vpcmpeqb ymm0, ymm8, ymm2
vpblendvb ymm1, ymm4, ymm3, ymm0
vmovdqu ymmword [rax], ymm1
cmp rax, rcx
jne 0x180110d40
test rbx, rbx
vzeroupper
je 0x180110eb8
lea r8, [rbx + 7]
mov dword [rbp], 0
shr r8, 3
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memcpy
movd xmm0, dword [rbp]
lea rdx, [rbp + 0x60]
vmovdqu ymm1, ymmword [0x18011b480]
vpshufb xmm0, xmm0, xmm6
vpxor xmm3, xmm3, xmm3
sub rdx, rbx
mov r8, rbx
mov rcx, rdi
vpermd ymm1, ymm1, ymm0
vpand ymm2, ymm1, ymmword [0x18011b4a0]
vmovdqu ymm0, ymmword [rbp + 0x20]
vpcmpeqb ymm3, ymm2, ymm3
vpblendvb ymm0, ymm0, ymmword [rbp + 0x40], ymm3
vmovdqu ymmword [rbp + 0x40], ymm0
vzeroupper
jmp 0x180110eb3
movsx ecx, byte [rsp + 0x120]
movdqa xmm5, xmmword [0x18011b450]
xor r9b, cl
movsx eax, r9b
movd xmm4, ecx
punpcklbw xmm4, xmm4
movd xmm3, eax
punpcklbw xmm3, xmm3
punpcklwd xmm3, xmm3
punpcklwd xmm4, xmm4
pshufd xmm3, xmm3, 0
pshufd xmm4, xmm4, 0
cmp rbx, 0x10
jb 0x180110e6a
and ebx, 0xf
lea rcx, [r8 + rdi]
xorps xmm2, xmm2
lea r8, [rbx + rdi]
nop dword [rax + rax]
movzx eax, word [rdx]
sub rcx, 0x10
movdqa xmm1, xmm5
add rdx, 2
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklbw xmm0, xmm0
pshufd xmm0, xmm0, 5
andps xmm1, xmm0
movdqa xmm0, xmm2
pcmpeqb xmm0, xmm1
andps xmm0, xmm3
xorps xmm0, xmm4
movdqu xmmword [rcx], xmm0
cmp rcx, r8
jne 0x180110e30
test rbx, rbx
je 0x180110eb8
cmp rbx, 8
jbe 0x180110e7a
movzx eax, word [rdx]
jmp 0x180110e7d
movzx eax, byte [rdx]
movzx eax, ax
lea rdx, [rbp + 0x30]
xorps xmm0, xmm0
sub rdx, rbx
mov r8, rbx
mov rcx, rdi
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklbw xmm1, xmm1
pshufd xmm2, xmm1, 5
andps xmm2, xmm5
pcmpeqb xmm2, xmm0
andps xmm2, xmm3
xorps xmm2, xmm4
movdqu xmmword [rbp + 0x20], xmm2
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180111c00
lea r11, [rsp + 0xe0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rdi
pop rbx
pop rbp
ret
Function at 0x1801111f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18011122a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18011122f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180111278
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180138580]
cmp byte [rcx + rax], 0
je 0x180111278
dec r8
sub rdx, 1
jne 0x18011125e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140002260
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002333
cmp byte [rcx + 0x71], 0
je 0x140002333
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000232f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400022f4
sub eax, 1
je 0x1400022f8
cmp eax, 2
jne 0x14000232f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400038f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002326
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000232f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400022dc
xor al, al
jmp 0x1400022dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400038f0
add rsp, 0x60
pop rbx
ret
Function at 0x140002550
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14000257d
xor eax, eax
jmp 0x1400026e6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1400025bd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1400025bd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x1400026de
cmp qword [rdi + 0x80], 0
je 0x1400026d9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x1400025f7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140002622
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1400026de
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002691
sub eax, 1
je 0x140002691
cmp eax, 2
jne 0x1400026d9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1400026de
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1400026bf
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400026d9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x1400026de
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400038f0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002ea0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jg 0x140002ec2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002ed1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140002f22
cmp rax, rsi
mov rdi, rsi
mov rcx, r14
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, rbp
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, r14
add rbp, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [r14 + 0x80], 0
mov rdi, rbx
je 0x140002f91
mov rcx, r14
call fcn.140002370
cmp rbx, 0xfff
jbe 0x140002f71
mov r9, qword [r14 + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add rbp, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140002faa
cmp rbx, rax
ja 0x140002f40
test rdi, rdi
je 0x140002f91
mov r9, qword [r14 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140002f94
Function at 0x140002fb0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140002fd1
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14000304c
test rax, rax
jle 0x14000302c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14000304c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000304c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x14000422c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004276
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004276
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004276
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004276
cmp dword [rcx + 0x84], 0xe
jbe 0x140004276
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004278
xor al, al
add rsp, 0x28
ret
Function at 0x14000aa60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001e1a0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000aaa4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000ab0a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000ab41
test eax, eax
js 0x14000ab1b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000ab34
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140005fd0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140002440
mov ecx, 7
int 0x29
ud2