joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404dd8d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movzx eax, di
mov ah, 0x10
push rsi
lahf
push rdi
push r14
mov rax, 0x9e57b29
mov eax, 0x1450
call fcn.140449f0c
sub rsp, rax
bsf ax, r14w
mov rax, qword [0x1400b7288]
setp dil
movsxd r10, r14d
xor rax, rsp
rcr esi, 0xcd
sbb rsi, 0x10985dac
sar r14b, cl
mov qword [rsp + 0x1440], rax
movsxd r10, edx
rol dil, cl
mov bp, r14w
mov rdi, rcx
inc dx
mov rax, r10
clc
mov ebp, r9d
or dl, r11b
clc
sar rax, 6
movzx r14, bx
xor esi, 0xb4d6931
shld dx, r10w, 0x63
lea rcx, [0x1400ba940]
shl r14, cl
bts esi, r9d
sbb sil, r9b
and r10d, 0x3f
rcr r14, 0x61
lea rbp, [rbp + r8]
sar edx, 0xcf
sbb r14, r14
mov rsi, r8
xchg r14b, r14b
mov rax, qword [rcx + rax*8]
shld r14, r14, 0xf2
rcr dh, cl
shrd r14, r9, 0x15
lea rdx, [r10 + r10*8]
sub r14b, 0x30
shr r14b, cl
mov r14, qword [rax + rdx*8 + 0x28]
test dil, 0x7f
xor eax, eax
clc
mov qword [rdi], rax
mov dword [rdi + 8], eax
clc
cmp r12, 0x52d21c70
stc
cmp r8, rbp
jae 0x1404ddaaf
lea rbx, [rsp + 0x40]
jmp 0x1404dd9ca
cmp rsi, rbp
jae 0x1404dda1e
mov al, byte [rsi]
inc rsi
jmp 0x1404dd9de
cmp al, 0xa
jmp 0x1404dd9e5
jne 0x1404dd9fe
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404dd9f6
inc rbx
jmp 0x1404dd9fe
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
jmp 0x1404dda10
cmp rbx, rax
jmp 0x1404dda18
jb 0x1404dd9ca
and qword [rsp + 0x20], 0
bsf rax, r15
shrd ax, r9w, 4
movsx edx, r14w
lea rax, [rsp + 0x40]
rcr dh, cl
xor r8w, 0x593c
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
cwd
not ecx
lea rdx, [rsp + 0x40]
movzx cx, r10b
movzx ecx, r13w
jmp 0x1404dda60
mov rcx, r14
jmp 0x1404dda68
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dda75
je 0x1404ddaa3
mov eax, dword [rsp + 0x30]
clc
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404dda8a
jb 0x1404ddaaf
cmp rsi, rbp
jmp 0x1404dda98
jb 0x1404dd9c0
jmp 0x1404ddaaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movsx rax, r13w
mov rax, rdi
sar ch, 0xde
mov rcx, qword [rsp + 0x1440]
test ax, 0x544c
stc
xor rcx, rsp
jmp 0x1404ddaca
call fcn.1404a1418
lea r11, [rsp + 0x1450]
movzx r14, sp
movzx di, r15b
movsx esi, r13w
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
setae dil
mov r14, rsi
mov rsp, r11
movsx r14d, r13w
mov r14b, 0xbd
bswap r14w
pop r14
movsx edi, ax
movsxd rsi, ebp
movzx rsi, cx
pop rdi
jmp 0x1404ddb1b
pop rsi
ret
Function at 0x1404ddb1d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
movzx eax, r13w
movzx ax, dl
push rdi
movsxd rax, edx
cbw
mov eax, 0xf7e5c25
push r14
cwde
jmp 0x1404ddb4a
mov eax, 0x1450
jmp 0x1404ddb54
call fcn.140449f0c
sub rsp, rax
btc di, 0x4b
rcl eax, 0x2b
dec bp
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1440], rax
xchg bpl, sil
movsxd r10, edx
rcl al, 0xb
and si, cx
mov rdi, rcx
and r14w, 0x43ef
sar r14b, 0x43
or ax, 0x13f9
mov rax, r10
bswap bp
bts r14, r14
and si, r10w
mov ebp, r9d
bswap r14
btc edx, 0x57
sar rax, 6
movzx dx, dil
sub rdx, 0x43d87693
adc si, 0x2388
lea rcx, [0x1400ba940]
shr dh, 0xb6
xadd r14b, dl
and r10d, 0x3f
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
ror r14b, 0xf7
dec dl
bt dx, 0x27
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
stc
xor eax, eax
test r12b, 0x20
cmc
mov qword [rdi], rax
test r8, 0x1c6b2c61
mov dword [rdi + 8], eax
test r15b, 0x16
cmp dl, 0xf3
stc
cmp r8, rbp
jmp 0x1404ddc18
jae 0x1404ddd60
lea rbx, [rsp + 0x40]
test bl, r11b
stc
cmp rsi, rbp
jmp 0x1404ddc2f
jae 0x1404ddca5
movzx eax, word [rsi]
jmp 0x1404ddc3d
add rsi, 2
stc
cmp cl, 0x50
cmp ax, 0xa
jmp 0x1404ddc4e
jne 0x1404ddc7b
add dword [rdi + 8], 2
movsx ecx, r12w
movzx ecx, r14w
mov ecx, 0xd
test al, 0x33
mov word [rbx], cx
add rbx, 2
test cx, 0xd0a
test r13b, r15b
jmp 0x1404ddc7b
mov word [rbx], ax
dec rax
add rbx, 2
test rdx, rbx
lea rax, [rsp + 0x143e]
cmc
test edx, 0x78777b9
cmp rbx, rax
jmp 0x1404ddc9f
jb 0x1404ddc27
and qword [rsp + 0x20], 0
sbb ax, 0x57e
and r9b, r11b
test r12b, 0x94
lea rax, [rsp + 0x40]
sbb ch, 0x65
shr r9b, 0xd3
mov r9b, 0x47
sub rbx, rax
shld r8d, r10d, 0xd6
shr ecx, 0xff
lea r9, [rsp + 0x30]
mov r8b, 0x8f
movsxd rcx, eax
xor r8b, r12b
sar rbx, 1
rol r8, 0xbd
lea rdx, [rsp + 0x40]
movzx r8d, dx
btr cx, ax
add ebx, ebx
movsxd r8, ebp
mov rcx, r14
seto r8b
jmp 0x1404ddd07
mov r8d, ebx
jmp 0x1404ddd0f
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404ddd1c
je 0x1404ddd53
mov eax, dword [rsp + 0x30]
test r15b, 0x1d
cmp bpl, dil
add dword [rdi + 4], eax
test r11b, r15b
cmp eax, ebx
jmp 0x1404ddd3a
jb 0x1404ddd60
cmp rsi, rbp
jmp 0x1404ddd48
jb 0x1404ddc1e
jmp 0x1404ddd60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
add ecx, ebp
sbb rax, r10
mov rax, rdi
movsxd rcx, ebp
and cl, r13b
mov rcx, qword [rsp + 0x1440]
clc
stc
cmc
xor rcx, rsp
jmp 0x1404ddd7c
call fcn.1404a1418
lea r11, [rsp + 0x1450]
bswap bp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movsx r14w, bpl
mov di, r15w
mov rsp, r11
movzx r14, r10w
movsx r14w, r9b
jmp 0x1404dddae
pop r14
pop rdi
movzx rsi, r8w
movsxd rsi, edx
movsx esi, bp
pop rsi
jmp 0x1404dddc1
ret
Function at 0x1404dddc2
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, r14d
mov qword [rsp + 0x18], rbp
movzx ax, dh
push rsi
nop
not ax
cmovns eax, r15d
push rdi
cwde
movzx eax, r8w
push r12
push r14
setbe al
push r15
mov eax, 0x1470
jmp 0x1404dddf5
call fcn.140449f0c
sub rsp, rax
mov rax, qword [0x1400b7288]
xor rax, rsp
stc
shrd r12d, eax, 0x9a
cmc
mov qword [rsp + 0x1460], rax
bt ax, r14w
add r14w, 0x1e4e
sal ax, cl
movsxd r10, edx
mov rbx, rcx
dec rdx
mov rax, r10
mov r14d, r9d
rcr ecx, 0x9d
sar rax, 6
lea rcx, [0x1400ba940]
bswap edx
and r10d, 0x3f
sbb rdx, rbx
add r14, r8
rcl r15b, 0x9c
xadd dl, dil
mov r15, r8
or r12b, 0x8f
xor rdi, rbp
mov rdi, r8
mov rax, qword [rcx + rax*8]
movsx edx, cx
lea rdx, [r10 + r10*8]
sbb r12b, r10b
sar r12b, 0xa9
mov r12, qword [rax + rdx*8 + 0x28]
sub eax, eax
mov qword [rbx], rax
cmc
test rdi, 0x393b7fc4
cmp r8, r14
jmp 0x1404dde8e
mov dword [rbx + 8], eax
jmp 0x1404dde96
jae 0x1404de034
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x1404ddea9
jae 0x1404ddefd
movzx ecx, word [rdi]
add rdi, 2
jmp 0x1404ddebf
cmp cx, 0xa
jmp 0x1404ddec8
jne 0x1404ddee0
mov edx, 0xd
mov word [rax], dx
cmc
add rax, 2
jmp 0x1404ddee0
mov word [rax], cx
add rax, 2
lea rcx, [rsp + 0x6f8]
clc
test r14b, 0x73
cmp rax, rcx
jb 0x1404ddea1
and qword [rsp + 0x38], 0
btc cx, r12w
clc
stc
lea rcx, [rsp + 0x50]
jmp 0x1404ddf1b
and qword [rsp + 0x30], 0
sbb r9b, 0x77
bsf r9, r10
lea r8, [rsp + 0x50]
dec r9b
jmp 0x1404ddf36
sub rax, rcx
rcr cl, cl
movzx r9d, r12w
mov dword [rsp + 0x28], 0xd55
test r12b, 0xc0
lea rcx, [rsp + 0x700]
sar rax, 1
bts r9w, bx
xchg r9d, r9d
mov qword [rsp + 0x20], rcx
sbb r9b, r13b
mov r9d, eax
mov ecx, 0xfde9
sub edx, edx
call fcn.1404cabd1
mov ebp, eax
test eax, eax
jmp 0x1404ddf7e
je 0x1404de029
sub esi, esi
test eax, eax
jmp 0x1404ddf8d
je 0x1404de008
and qword [rsp + 0x20], 0
btc dx, si
sbb dl, sil
btr r8w, bp
lea rdx, [rsp + 0x700]
rol r9w, cl
bswap ecx
mov ecx, esi
jmp 0x1404ddfbe
lea r9, [rsp + 0x40]
rcl r8b, 0x84
sbb r8d, 0x52086fb9
movsx r8w, al
mov r8d, ebp
cmp r15w, 0x5320
stc
lea rdx, [rdx + rcx]
mov rcx, r12
stc
sub r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404ddff5
je 0x1404de029
add esi, dword [rsp + 0x40]
stc
cmp esi, ebp
jb 0x1404ddf93
mov eax, edi
cmc
stc
sub eax, r15d
clc
cmp sil, spl
test esi, 0x6632615f
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x1404de024
jmp 0x1404dde96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sar cx, cl
mov rax, rbx
adc ecx, 0x4b357225
and cl, 0xe7
shld rcx, rbx, 0xcc
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
jmp 0x1404de055
call fcn.1404a1418
lea r11, [rsp + 0x1470]
setle r14b
mov di, r8w
movzx rbx, cx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
movzx di, r9b
mov r12b, r12b
bswap r12w
mov rsp, r11
pop r15
cmovs r14w, bx
movzx edi, r9w
movzx di, r15b
pop r14
movsxd r12, ebx
not di
pop r12
movsxd rdi, r12d
xchg rdi, rsi
movsx rsi, r12w
pop rdi
movzx rsi, bx
mov sil, r13b
pop rsi
jmp 0x1404de0b7
ret
Function at 0x1404e15d0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
ror r8b, cl
sub rsp, 0x20
mov rbx, rcx
or dh, ch
lea r9, [0x1400c8e90]
sub ecx, ecx
movzx r8, r14w
movsx edx, di
lea r8, [0x1400c8e88]
lea rdx, [0x1400cfb70]
call fcn.1404e18bd
test rax, rax
jmp 0x1404e1609
je 0x1404e162b
mov rcx, rbx
sal bh, cl
movsxd rbx, edi
add rsp, 0x20
movsxd rbx, r11d
pop rbx
jmp 0x1404e1624
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404e1739
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movzx rbx, r10w
or bl, 0xef
push rdi
shl bl, 0xe2
sub rsp, 0x20
movzx r9w, r10b
mov rbx, rdx
lea r9, [0x1400c8ea8]
cmovns edi, ebp
mov edi, ecx
lea rdx, [0x1400cf748]
mov ecx, 3
not r8w
xchg r8b, r8b
lea r8, [0x1400c8ea0]
jmp 0x1404e1780
call fcn.1404e18bd
mov rdx, rbx
btr rcx, r8
dec cx
mov ecx, edi
test bx, r9w
clc
jmp 0x1404e179b
test rax, rax
jmp 0x1404e17a3
je 0x1404e17b4
call qword [0x1400b8d90]
jmp 0x1404e17ba
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
test r9b, 0x72
add rsp, 0x20
jmp 0x1404e17d3
pop rdi
jmp 0x1404e17d9
ret
Function at 0x1404e18bd
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
or ax, r10w
ror al, 0xf6
shl al, 0x75
mov qword [rsp + 0x10], rbp
and bp, r12w
ror al, cl
mov qword [rsp + 0x18], rsi
shl eax, 0x88
push rdi
movzx ax, r12b
push r12
push r13
xchg r12b, al
cbw
push r14
ror r12w, 0xa5
cbw
clc
push r15
movsx bp, spl
not ah
sub rsp, 0x20
or di, 0x2332
shl eax, 0x89
mov edi, ecx
mov r15w, sp
lea r15, [0x140000000]
rol al, 0x4f
rcr r12w, 0x88
sal ah, cl
or r14, 0xffffffffffffffff
movzx ax, r8b
cmp bl, r14b
mov r12, r9
sbb bpl, 4
movzx r13w, dl
mov rbp, r8
mov r13, rdx
rcl rax, 0x5f
test bx, 0x69f1
mov rax, qword [r15 + rdi*8 + 0xbae00]
nop
cmp rax, r14
jmp 0x1404e195c
je 0x1404e1b1a
test rax, rax
jmp 0x1404e196a
jne 0x1404e1b23
cmp r8, r9
jmp 0x1404e1978
je 0x1404e1b12
mov esi, dword [rbp]
shrd ebx, r13d, 0x73
mov rbx, qword [r15 + rsi*8 + 0xbade8]
cmc
cmp cl, 0x65
nop
jmp 0x1404e1998
test rbx, rbx
jmp 0x1404e19a0
je 0x1404e19b9
cmp rbx, r14
jmp 0x1404e19ae
jne 0x1404e1adf
jmp 0x1404e1a8c
mov r15, qword [r15 + rsi*8 + 0xc8e70]
shld cx, dx, 0xa4
ror r8b, 0x89
btr r8d, r13d
sub edx, edx
xchg cl, r8b
mov rcx, r15
cmovl r8w, bx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
cmp r8b, dl
test rax, rax
jmp 0x1404e19f5
jne 0x1404e1aa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1404e1a64
lea r8d, [rbx + 7]
movsx cx, r9b
mov rcx, r15
movsx rdx, r11w
movzx dx, r9b
cdq
lea rdx, [0x1400d25d8]
jmp 0x1404e1a2c
call fcn.1401323db
test eax, eax
jmp 0x1404e1a38
je 0x1404e1a64
sub r8d, r8d
xor edx, edx
movsxd rcx, r9d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
cmp ax, 0x2c22
test rax, rax
jmp 0x1404e1a5e
jne 0x1404e1aa1
mov rax, r14
movzx r15d, bx
lea r15, [0x140000000]
cmc
cmp r13b, 0x39
xchg qword [r15 + rsi*8 + 0xbade8], rax
cmp r15d, 0x7a3c1016
stc
jmp 0x1404e1a8c
add rbp, 4
cmp r15b, 0xcc
cmp rbp, r12
jmp 0x1404e1a9c
jmp 0x1404e1978
mov rax, rbx
bswap r15w
neg r15b
btr r15, 0xb
lea r15, [0x140000000]
xchg qword [r15 + rsi*8 + 0xbade8], rax
test r9b, 0x56
test rax, rax
jmp 0x1404e1acb
je 0x1404e1adf
mov rcx, rbx
jmp 0x1404e1ad9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, r13
movzx rcx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jmp 0x1404e1af7
je 0x1404e1b12
mov rcx, rax
jmp 0x1404e1b05
xchg qword [r15 + rdi*8 + 0xbae00], rcx
jmp 0x1404e1b23
xchg qword [r15 + rdi*8 + 0xbae00], r14
xor eax, eax
rol dil, 0xad
movsxd rdi, ecx
mov rbx, qword [rsp + 0x50]
btr r15w, di
movsx ebp, sp
mov rbp, qword [rsp + 0x58]
sal di, 0xc7
shl r12d, cl
shrd r13, r13, 0x33
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
movsx r14d, dx
jmp 0x1404e1b57
pop r15
setne r13b
pop r14
movsxd r13, r10d
pop r13
cmovl rdi, r8
pop r12
mov dil, r12b
movsx di, dl
pop rdi
jmp 0x1404e1b77
ret
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x140013900
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112e4
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014c50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014c70
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014c83
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014cad
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014cc1
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014cd3
xor al, al
jmp 0x140014cf1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014cef
xor al, al
jmp 0x140014cf1
mov al, 1
add rsp, 0x38
ret
Function at 0x140004890
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rdx
mov qword [rbp - 0x11], rdx
xor edi, edi
lea rdx, [rcx + 0x48]
lea rcx, [rbp - 0x31]
call fcn.140006ec0
mov rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
mov rax, qword [rax + 0x10]
cmp rax, 5
jb 0x140004a93
add rax, 0xfffffffffffffffb
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
cmp qword [rdx + 0x18], 0x10
jb 0x140004907
mov rdx, qword [rdx]
add rdx, 5
lea rcx, [rbp + 0xf]
call fcn.140005950
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x140004953
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000494e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000494e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000dabc
movdqa xmm0, xmmword [0x1400112e0]
movdqu xmmword [rbp - 0x21], xmm0
mov byte [rbp - 0x31], 0
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp + 7], rax
mov eax, dword [rbp + 0x1f]
mov dword [rbp - 1], eax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 1]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
xorps xmm0, xmm0
test eax, eax
je 0x140004a3c
mov r8d, dword [rbp - 0x11]
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
mov rdx, qword [rbp - 9]
lea rcx, [rbp + 0x2f]
call fcn.140005950
mov rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rbp + 0x2f]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x3f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140004a18
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a8c
call fcn.14000dabc
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14000da60
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
xor r8d, r8d
lea rdx, [0x14001071f]
mov rcx, rbx
call fcn.140005950
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140004a18
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004a13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400051b0
int3
Function at 0x140007670
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140007698
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400076be
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400076c0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140007719
test ecx, ecx
jle 0x1400076f9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140007719
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140007719
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140007740
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140007762
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140007778
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140007794
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140007796
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400077d2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000786e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000780d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000784e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000786e
cmp rbx, rax
ja 0x140007820
test rbx, rbx
je 0x14000786e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140007ca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140007ccd
xor eax, eax
jmp 0x140007e39
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140007d07
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140007d07
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140007e39
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140007e2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140007d4a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140007d75
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140007e31
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140007de4
sub eax, 1
je 0x140007de4
cmp eax, 2
jne 0x140007e2c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140007e31
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140007e12
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140007e2c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140007e31
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000da60
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140007fe0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400080b3
cmp byte [rcx + 0x71], 0
je 0x1400080b3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400080af
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140008074
sub eax, 1
je 0x140008078
cmp eax, 2
jne 0x1400080af
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000da60
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400080a6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400080af
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000805c
xor al, al
jmp 0x14000805c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000da60
add rsp, 0x60
pop rbx
ret