joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140191c18
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140270070]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140266468]
test eax, eax
je 0x140191c63
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140266468]
test eax, eax
jne 0x140191c6c
call fcn.14001ce78
test eax, eax
je 0x140191c88
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14025e4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140191c90
xor eax, eax
jmp 0x140191ced
test rbx, rbx
jne 0x140191cb0
lea rcx, str.PrintDlgW
call fcn.14001cc54
mov rbx, rax
test rax, rax
je 0x140191cbb
mov qword [0x140270070], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140191cd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140191cd2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140191ceb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1800027c0
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov eax, dword [rcx + 0x14]
xor edi, edi
sub eax, 3
mov rbp, rcx
lea esi, [rdi + 0x12]
cmp eax, 1
ja 0x1800028e2
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetCompressionWorkSpaceSize
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCompressBuffer
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x1800029ac
test rax, rax
je 0x1800029ac
movzx ecx, word [rbp + 0x14]
lea r8, [rsp + 0x78]
dec cx
mov qword [rsp + 0x80], r13
mov r13d, 0x100
lea rdx, [rsp + 0x70]
or cx, r13w
call r15
test eax, eax
jne 0x1800029a5
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18000299b
mov ecx, dword [0x180010f04]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x180010f18], rax
test rax, rax
je 0x1800028cc
movzx ecx, word [rbp + 0x14]
lea rdx, [0x180010f08]
mov r8d, dword [0x180010f04]
dec cx
mov qword [rsp + 0x38], rbx
or cx, r13w
mov qword [rsp + 0x30], rdx
mov r9, rax
mov rdx, qword [0x180010f10]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r8d
call r14
test eax, eax
je 0x1800028d1
mov edi, esi
jmp 0x1800028d1
mov edi, 6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, qword [rsp + 0x80]
cmp dword [rbp + 0x14], 2
jne 0x180002972
mov ecx, dword [0x180010f04]
call fcn.180001bdf
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x180010f18], rax
test rax, rax
je 0x1800029b0
mov ecx, dword [0x180010f04]
call fcn.180001bd9
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1800029b0
mov r8d, dword [0x180010f04]
mov r9, rax
mov rdx, qword [0x180010f18]
mov rcx, qword [0x180010f10]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call fcn.180002696
cmp eax, 0xffffffff
mov dword [0x180010f08], eax
mov rcx, rbx
cmove edi, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
jne 0x180002985
cmp dword [rbp + 0x14], 1
je 0x180002985
mov ecx, dword [0x180010f08]
mov dword [rbp + 4], ecx
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov edi, 6
jmp 0x1800028da
mov edi, esi
jmp 0x1800028da
mov eax, esi
jmp 0x180002987
mov edi, 6
jmp 0x180002985
Function at 0x180002d80
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180002dbd
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180002df0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x18000a008]
xor rax, rsp
mov qword [rsp + 0x150], rax
movups xmm0, xmmword [str.HMN34P67R9TWCXYF]
movzx eax, byte [0x180007988]
mov rdi, rdx
mov rsi, rcx
mov byte [rsp + 0x48], al
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180002ecd
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
mov edx, 0x100
mov qword [rsp + 0x178], rbx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
mov rbx, qword [rsp + 0x178]
je 0x180002ecd
xor r8d, r8d
test rdi, rdi
je 0x180002ebf
lea r9, [rsp + 0x50]
mov rcx, rsi
sub r9, rsi
nop dword [rax]
movzx edx, byte [r9 + rcx]
lea rcx, [rcx + 1]
and edx, 0xf
inc r8d
movzx edx, byte [rsp + rdx + 0x38]
mov byte [rcx - 1], dl
movsxd rdx, r8d
cmp rdx, rdi
jb 0x180002ea0
movsxd rcx, r8d
mov eax, 1
mov byte [rcx + rsi], 0
jmp 0x180002ecf
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800054c0
mov rsi, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
Function at 0x180004fc0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, r9
mov rbp, r8
mov r10d, edx
mov r11, rcx
mov rdi, r8
test r9, r9
je 0x1800050e0
mov eax, 0xaaaaaaab
mul r10d
shr edx, 1
lea edx, [rdx*4 + 4]
test r8, r8
jne 0x180005014
mov dword [r9], edx
lea eax, [r8 + 1]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
cmp edx, dword [r9]
ja 0x1800050e0
test r10d, r10d
je 0x1800050a0
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
test r10d, r10d
je 0x180005064
movzx eax, byte [r11]
inc r11
shl eax, 8
cmp r10d, 1
jbe 0x180005066
movzx ecx, byte [r11]
lea rdx, [r11 + 1]
or ecx, eax
mov r11, rdx
shl ecx, 8
cmp r10d, 2
jbe 0x18000506b
movzx eax, byte [rdx]
lea r11, [rdx + 1]
jmp 0x18000506d
xor eax, eax
mov ecx, eax
shl ecx, 8
xor eax, eax
or eax, ecx
mov edx, 4
shl eax, 8
add r10d, 1
je 0x1800050a8
nop dword [rax]
test edx, edx
je 0x180005030
rol eax, 6
dec edx
mov ecx, eax
and ecx, 0x3f
movzx ecx, byte [rcx + r8]
mov byte [rdi], cl
inc rdi
add r10d, 0xffffffff
jne 0x180005080
jmp 0x1800050a4
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1800050c4
mov r8d, edx
mov rcx, rdi
mov qword [rsp + 0x38], rbx
mov ebx, edx
mov dl, 0x3d
call sub.VCRUNTIME140.dll_memset
add rdi, rbx
mov rbx, qword [rsp + 0x38]
mov byte [rdi], 0
mov eax, 1
sub edi, ebp
mov dword [rsi], edi
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180005270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18000a008]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r10d, r10d
xor r14d, r14d
mov r15, rcx
movzx ecx, byte [r10 + r15]
test cl, cl
je 0x1800052cc
cmp r10d, 0x40
je 0x1800052cc
mov byte [rsp + r9 + 0x10], cl
inc r10d
inc r9d
cmp r9d, 0x10
jne 0x18000547e
jmp 0x1800053c8
mov eax, r9d
lea r8, [rsp + 0x10]
add r8, rax
mov ecx, 0x10
sub ecx, r9d
xor eax, eax
mov rdi, r8
rep stosb byte [rdi], al
mov byte [r8], 0x80
cmp r9d, 0xc
jb 0x1800053b9
movaps xmm0, xmmword [rsp + 0x10]
mov rax, rdx
movdqa xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov r11d, dword [rsp + 0x2c]
mov rdi, rdx
mov ebx, dword [rsp + 0x28]
mov r8d, edx
mov esi, dword [rsp + 0x24]
mov r9d, dword [rsp + 0x20]
shr rax, 0x20
shr rdi, 0x20
mov qword [rsp], rdx
nop dword [rax + rax]
ror r8d, 8
lea ecx, [rbp + 2]
add r8d, eax
rol edi, 3
xor r8d, r9d
ror esi, 8
xor edi, r8d
ror ebx, 8
add esi, r9d
ror r8d, 8
add r8d, edi
rol r9d, 3
rol edi, 3
lea eax, [rcx - 1]
xor esi, ebp
ror r11d, 8
xor r9d, esi
add ebp, 3
xor r8d, r9d
add ebx, r9d
xor edi, r8d
rol r9d, 3
xor ebx, eax
ror r8d, 8
xor r9d, ebx
add r8d, edi
add r11d, r9d
rol edi, 3
xor r8d, r9d
xor r11d, ecx
xor edi, r8d
rol r9d, 3
xor r9d, r11d
mov dword [rsp + 4], edi
mov eax, edi
cmp ebp, 0x1b
jb 0x180005330
mov dword [rsp], r8d
lea rdi, [rsp + 0x10]
xor rdx, qword [rsp]
mov ecx, 0x10
xor eax, eax
rep stosb byte [rdi], al
lea eax, [r10*8]
inc r14d
mov dword [rsp + 0x1c], eax
movaps xmm0, xmmword [rsp + 0x10]
mov rax, rdx
movdqa xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov r11d, dword [rsp + 0x2c]
mov rdi, rdx
mov ebx, dword [rsp + 0x28]
mov r8d, edx
mov esi, dword [rsp + 0x24]
mov r9d, dword [rsp + 0x20]
shr rax, 0x20
shr rdi, 0x20
mov qword [rsp], rdx
nop dword [rax]
ror r8d, 8
lea ecx, [rbp + 2]
add r8d, eax
rol edi, 3
xor r8d, r9d
ror esi, 8
xor edi, r8d
ror ebx, 8
add esi, r9d
ror r8d, 8
add r8d, edi
rol r9d, 3
rol edi, 3
lea eax, [rcx - 1]
xor esi, ebp
ror r11d, 8
xor r9d, esi
add ebp, 3
xor r8d, r9d
add ebx, r9d
xor edi, r8d
rol r9d, 3
xor ebx, eax
ror r8d, 8
xor r9d, ebx
add r8d, edi
add r11d, r9d
rol edi, 3
xor r8d, r9d
xor r11d, ecx
xor edi, r8d
rol r9d, 3
xor r9d, r11d
mov dword [rsp + 4], edi
mov eax, edi
cmp ebp, 0x1b
jb 0x180005400
mov dword [rsp], r8d
xor rdx, qword [rsp]
xor r9d, r9d
test r14d, r14d
je 0x1800052a3
mov rax, rdx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800054c0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001609c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x1400160c3
and qword [r8], 0
call fcn.1400161a8
mov rbx, rax
test rax, rax
je 0x14001618b
mov rcx, rax
call fcn.140016024
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140016182
mov rax, qword [0x1401b6e50]
test rax, rax
je 0x1400160fb
inc dword [rax + 0xf4]
mov rdx, qword [0x1401b6e60]
lea rcx, [rdi + rbp]
call qword [0x1400ee050]
mov rsi, rax
test rax, rax
je 0x140016182
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x14001615a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401b6e50]
test rax, rax
je 0x140016148
dec dword [rax + 0xf4]
mov rdx, qword [0x1401b6e60]
mov rcx, rsi
call qword [0x1400ee058]
jmp 0x14001618b
test ebp, ebp
jle 0x14001616c
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14001617d
mov qword [r14], rdi
mov rax, rsi
jmp 0x14001618d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400164cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x1400164fa
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1400c12f0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x1400164d7
not r8d
mov eax, r8d
ret

Function at 0x140016504
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14001655e
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rbx, [0x1400c12f0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x140016548
cmp rdx, 2
jb 0x140016548
cmp byte [r10], r11b
jne 0x140016548
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x140016526
jmp 0x14001659f
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14001659f
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rbx, [0x1400c12f0]
cmp dl, r11b
jne 0x140016583
cmp byte [r10], r11b
jne 0x140016583
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x140016571
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x14001790c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400179a5
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x14001795d
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140022724
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140021e28
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x1401b6e58]
movsxd r8, eax
mov rax, qword [rdi + 0x53f0]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400179ad
mov rcx, rbx
call fcn.140021e28
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001ddd8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1401b6e50]
mov rbx, rcx
and dword [rax + 0x537c], 0
test rcx, rcx
je 0x14001de41
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14001de4c
lea rdx, [0x1400c26f8]
mov rcx, rbx
mov rdi, rax
call fcn.1400161a8
mov rbx, rax
test rax, rax
je 0x14001de41
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140042650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401b67c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400426bf
cmp byte [rcx + 0x71], 0
je 0x1400426bf
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140042714
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400426d9
sub eax, 1
je 0x1400426dd
cmp eax, 2
jne 0x140042714
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bbdc0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004270b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140042714
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400426c1
xor al, al
jmp 0x1400426c1
Function at 0x140042a2c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401b67c0]
xor rax, rsp
mov qword [rbp - 8], rax
or esi, 0xffffffff
mov r14d, edx
mov rdi, rcx
cmp edx, esi
jne 0x140042a66
xor eax, eax
jmp 0x140042b85
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140042a9f
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140042a9f
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], r14b
mov eax, r14d
jmp 0x140042b85
cmp qword [rdi + 0x80], 0
je 0x140042b83
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140042ad9
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140042afa
movsx ecx, r14b
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, esi
jmp 0x140042b7f
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], r14b
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140042b48
sub eax, 1
je 0x140042b48
cmp eax, 2
jne 0x140042b83
movsx ecx, byte [rbp - 0x40]
jmp 0x140042ae6
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x140042b73
mov r9, qword [rdi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140042b83
lea rax, [rbp - 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne esi, r14d
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bbdc0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140043210
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14004323e
xor eax, eax
jmp 0x140043325
cmp qword [rcx + 0x68], 0
je 0x140043250
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140043325
mov rdi, rsi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140043290
cmp rax, rsi
mov rbx, rsi
mov rcx, rbp
cmovb rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, r14
mov rdx, rax
call fcn.1400bd0c2
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rdi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x14004331f
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0x70]
cmp rax, rcx
jne 0x1400432ca
mov rdx, qword [rbp + 0x88]
mov rcx, rbp
mov r9, qword [rbp + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, rdi
mov ebx, 0xfff
jmp 0x1400432fa
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rcx, rdi
cmp rax, rbx
jne 0x14004331f
cmp rdi, rbx
ja 0x1400432d4
test rcx, rcx
je 0x14004331f
mov r9, qword [rbp + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140043340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14004336a
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400433da
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400433d4
test rax, rax
jle 0x1400433b4
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.1400bd0c2
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400433d4
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400433d4
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400452c8
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400452e6
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
xor ecx, ecx
cmp dword [rax], 0x4550
cmovne rax, rcx
ret
xor eax, eax
ret