joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006f53
Capabilities:
Execute shellcode via indirect call

Disassembly:
push r12
push rdi
push rsi
sub rsp, 0x20
mov r9d, 0x40
mov r8d, 0x3000
mov r12, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, r12
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
call rax
xor eax, eax
add rsp, 0x20
pop rsi
pop rdi
pop r12
ret
mov rax, qword [0x14014f7e0]
movsxd rdx, dword [rax]
mov rax, qword [0x14014f7d0]
mov rcx, qword [rax]
jmp 0x140006edc
sub rsp, 0x28
call fcn.140006f26
nop
add rsp, 0x28
jmp 0x140006f3b

Function at 0x140010a20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001e800
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001e800
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140011652
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14017d388]
test eax, eax
je 0x1400116ea
lea rax, [0x14017d360]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14017d390]
mov qword [rbp - 8], rax
jmp 0x1400116ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400116c2
cmp qword [rbp - 0x10], 0
je 0x1400116c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140011688
lea rax, [0x14017d360]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400116eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400117f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140011818
mov eax, 0
jmp 0x140011866
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140011841
mov eax, 0
jmp 0x140011866
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140011861
mov eax, 0
jmp 0x140011866
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140022d65
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x140022b8b]
mov rdx, rax
lea rax, [0x14017de30]
mov rcx, rax
call fcn.140022196
mov eax, dword [0x1400c3590]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140022db8
mov rax, qword [rbp - 0x10]
jmp 0x140022f18
call fcn.140021900
mov qword [rbp - 0x10], rax
mov rax, qword [0x140180050]
test rax, rax
je 0x140022dd4
cmp qword [rbp - 0x10], 0
jne 0x140022dde
mov eax, 0
jmp 0x140022f18
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.140021a24
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x140022eb9
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x1400c3590]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x140022f14
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140086360
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140086387
call rbp
cmp dword [rax], 4
jne 0x1400863a4
mov rcx, rdi
call fcn.1400861a0
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140086380
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400bfca0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400bf330
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov r13, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov r12, qword [rbx - 0x38]
call fcn.14002a810
mov rcx, rax
jmp 0x1400bfbc0
call fcn.1400bf330
call fcn.1400bf590
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bfc47
mov rbx, qword [rbx]
lea r14, [rsp + 0x20]
mov rdx, r13
xor ecx, ecx
mov r8, r14
call fcn.14002a370
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r14
call fcn.14002a460
test al, al
jne 0x1400bfc65
lea r13, [0x140151fa0]
mov r9, rsi
xor r8d, r8d
mov rcx, r14
mov rdx, r13
call fcn.14002a460
test al, al
je 0x1400bfc6a
mov ecx, 8
call fcn.1400bf2c0
lea r8, [0x14008c840]
mov rdx, r13
mov rcx, rax
mov rax, qword [0x14014f2b0]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bf850
add rbx, 0x90
jmp 0x1400bfbd6
call fcn.1400bf800
mov rcx, r12
call fcn.14002a7f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov rcx, rax
call fcn.1400bf330
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bfd1c
call fcn.1400bf330
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sub.msvcrt.dll_fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
call fcn.1400bf460
call sub.msvcrt.dll_abort
mov rcx, r13
call sub.msvcrt.dll_free
call fcn.1400bf800
call fcn.1400bf330
call fcn.1400bf460
jmp 0x1400bfd0a
Function at 0x1400013c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], 0x1bc1c17b
mov qword [rsp + 0x28], 0x1647810e
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rcx, qword [rsp + 0x28]
sub rcx, 0x420824ac
and al, 8
cmp rcx, 0x46a02f83

Function at 0x1400031f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
lea rax, [fcn.1400031f0]
mov ecx, dword [rsp + 0x24]
mov edx, ecx
xor edx, 0xffffffff
mov dword [rsp + 0x24], edx
mov dword [rsp + 0x14], ecx
mov qword [rsp + 8], rax
jmp 0x14000323f
mov rax, qword [rsp]
movsxd rcx, dword [rax + 0x3c]
mov rdx, qword [rsp + 0x18]
xor rdx, 0xffffffffffffffff
mov r8d, dword [rax + rcx]
mov qword [rsp + 0x18], rdx
cmp r8d, 0x4550
jne 0x14000324f
mov rax, qword [rsp]
add rsp, 0x28
ret
mov rax, qword [rsp + 8]
cmp word [rax], 0x5a4d
mov qword [rsp], rax
je 0x140003213
mov eax, dword [rsp + 0x14]
imul ecx, eax, 0x2c773039
mov dword [rsp + 0x24], ecx
mov rdx, qword [rsp]
add rdx, 0xfffffffffffff000
and rdx, 0xfffffffffffff000
mov qword [rsp + 8], rdx
jmp 0x14000323f

Function at 0x140003280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
xor eax, eax
mov qword [rsp + 8], rcx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x10]
xor rcx, qword [rsp + 0x10]
mov edx, eax
mov r8d, edx
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 8]
mov r9b, byte [rcx + r8]
mov edx, eax
add edx, 1
cmp r9b, 0
mov dword [rsp], eax
mov dword [rsp + 4], edx
jne 0x14000328f
mov eax, dword [rsp]
add rsp, 0x18
ret

Function at 0x1400032d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x64], 0x1a9c9d8d
mov dword [rsp + 0x60], 0x11da1d56
mov eax, dword [rsp + 0x60]
imul eax, eax, 0x6e2e9bc6
mov r9, qword [rsp + 0x58]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x50], 0
cmp r8d, 0
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x44], r8d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r9
jne 0x14000331e
add rsp, 0x68
ret
lea rax, [0x140005260]
imul ecx, dword [rsp + 0x64], 0x1a08ffe7
mov edx, dword [rsp + 0x50]
mov r8d, edx
and r8d, 0xf
mov r8d, r8d
mov r9d, r8d
mov r10, qword [rsp + 0x30]
xor r10, 0x5bccd2da
mov qword [rsp + 0x58], r10
mov r10, qword [rsp + 0x38]
mov dword [rsp + 0x2c], ecx
mov rcx, r10
mov r11, qword [rsp + 0x48]
mov dword [rsp + 0x28], edx
mov rdx, r11
mov r8d, dword [rsp + 0x28]
movzx r9d, byte [rax + r9]
call fcn.140001170
mov rax, qword [rsp + 0x30]
and rax, 0x2e53e841
mov qword [rsp + 0x58], rax
mov r8d, dword [rsp + 0x28]
add r8d, 1
mov dword [rsp + 0x60], 0x3ce34e07
mov dword [rsp + 0x54], r8d
mov dword [rsp + 0x50], 0x5cef9e81
mov r8d, dword [rsp + 0x2c]
cmp r8d, 0x7f3a1926
jae 0x14000331e
mov dword [rsp + 0x60], 0xa995b15e
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x50], ecx
mov ecx, dword [rsp + 0x44]
cmp eax, ecx
je 0x140003319
jmp 0x14000331e
Function at 0x140001ac0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xc0000004
jne 0x140001b63
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140001b43
xor eax, eax
jmp 0x140001c6b
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
add byte [rcx - 0x14d7dbbc], cl
xchg ebp, eax
cmp dword [rsp + 0x28], 0
jge 0x140001b84
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140001c6b
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140001bb0
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140001c6b
mov dword [rsp + 0x20], 0
jmp 0x140001bc4
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140001c56
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140001c51
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add byte [rax - 0x75], cl
and al, 0x48
jmp 0x140001c6b
jmp 0x140001bba
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x58
ret
Function at 0x140009d50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x208
mov rcx, qword [rsp + 0x220]
call fcn.14000b390
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140009dd5
lea rdx, str.____Invalid_format_of_PE_image
mov rcx, qword [0x140013258]
call fcn.140002c20
mov qword [rsp + 0xa8], rax
lea rdx, [0x140003030]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0xb0], rax
lea rdx, [0x140003030]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
jmp 0x14000a61f
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140009e39
lea rdx, str.____Image_is_not_64_bit
mov rcx, qword [0x140013258]
call fcn.140002c20
mov qword [rsp + 0xb8], rax
lea rdx, [0x140003030]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
add byte [rax - 0x77], cl
test byte [rax + rax*8], ah
add byte [rax], al
add byte [rax - 0x73], cl
adc eax, 0xffff920c
mov rcx, qword [rsp + 0xc0]
invalid
invalid
xchg edx, eax
invalid
invalid
Function at 0x14000b390
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000b3b4
xor eax, eax
jmp 0x14000b3e2
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14000b3dd
xor eax, eax
jmp 0x14000b3e2
mov rax, qword [rsp + 8]
add rsp, 0x18
ret

Function at 0x14000e220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14000e259
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000e347
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14000e2ef
cmp qword [rsp + 0x20], 0
jle 0x14000e2ef
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14000e299
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140006f20
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
invalid
cmp qword [rsp + 0x50], 0
jle 0x14000e337
Function at 0x14000e350
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x14000e375
xor eax, eax
jmp 0x14000e53b
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14000e39e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14000e53b
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x14000e43d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.1400081b0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140006f20
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14000e52b
mov rcx, qword [rsp + 0x70]
call fcn.14000f100
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14000e4de
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14000e4dc
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x14000e53b
jmp 0x14000e463
cmp qword [rsp + 0x20], 0
jbe 0x14000e52b
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x14000eac0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
call fcn.140006e90
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x50]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x14000eb04
lea rcx, [rsp + 0xd8]
call fcn.14000f8c0
jmp 0x14000ed6c
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000eb74
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
add byte [rax - 0x77], cl
and al, 0x60

Function at 0x14000f1c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000f1eb
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f1f2
mov al, 1
jmp 0x14000f34c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140006e90
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140006e90
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.140006ea0
movzx eax, al
test eax, eax
je 0x14000f249
xor al, al
jmp 0x14000f34c
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000f2b9
cmp dword [rsp + 0x30], 1
je 0x14000f2c5
cmp dword [rsp + 0x30], 3
je 0x14000f33a
jmp 0x14000f34a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000f311
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14000f311
xor al, al
jmp 0x14000f34c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f32b
mov dword [rsp + 0x34], 1
jmp 0x14000f333
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14000f34c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000f34c
xor al, al
add rsp, 0xa8
ret
Function at 0x14011568a
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
movsx rcx, r11w
jmp 0x14012378c
mov rcx, qword [rsp + 8]
jmp 0x14013ea9c
push rcx
jmp 0x140114ad0
lea rcx, [0x140030170]
jmp 0x1401241a7
mov rcx, qword [rcx]
jmp 0x14018d4c8
lea rcx, [rcx + 1]
jmp 0x14002a1f7
lea rcx, [rcx + 0x4e31b110]
jmp 0x14018db09
xchg qword [rsp], rcx
jmp fcn.14000eb24