joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800060b0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800060ee
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x18000617a
cmp dword [rsp + 0x40], 0x1000
jne 0x180006160
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x180006160
bt eax, 8
jb 0x180006160
mov rbx, qword [rsp + 0x28]
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x180006123
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x18000617a
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
je 0x18000613e
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x18000617a
cmp word [rax + rbx + 0x14], 0
jne 0x180006154
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x18000617a
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, rbx
jmp 0x18000617a
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x18000617a
add rsp, 0x50
pop rbx
ret

Function at 0x180006790
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbx + 8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbx], rax
test rax, rax
mov rax, rbx
jne 0x1800067c2
mov dword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180007f20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [rsp + 0x40]
mov edx, 8
mov rdi, rcx
mov rcx, rbx
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180007f88
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax]
mov r8d, dword [rsp + 0x40]
xor r9d, r9d
mov rcx, qword [rax]
mov qword [rbx], rcx
lea edx, [r9 + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180007fa0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r13, rdx
mov r14, rcx
test rcx, rcx
jne 0x180005ef2
call sub.KERNEL32.dll_GetModuleHandleW
mov r14, rax
mov eax, 0x5a4d
cmp word [r14], ax
je 0x180005f0e
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180006089
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
je 0x180005f2d
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180006089
cmp word [rax + r14 + 0x14], 0
jne 0x180005f47
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180006089
mov ecx, dword [rax + r14 + 0x90]
test ecx, ecx
je 0x180005f59
lea rdi, [r14 + rcx]
jmp 0x180005f5b
xor edi, edi
mov qword [rsp + 0x28], rdi
test rdi, rdi
jne 0x180005f76
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180006089
mov ecx, dword [rdi]
test ecx, ecx
je 0x18000605b
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x18000604d
mov ebx, eax
add rbx, r14
je 0x18000604d
lea r15, [r14 + rcx]
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x180005fa7
lea r12, [r14 + rax]
jmp 0x180005faa
xor r12d, r12d
mov rcx, qword [r12]
call fcn.1800060b0
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x180005fd1
mov r8, rbx
mov rdx, rax
mov rcx, r13
call r9
test eax, eax
je 0x18000605b
xor ebx, ebx
mov dword [rsp + 0x24], ebx
test r15, r15
je 0x18000603f
nop dword [rax]
lea rcx, [rbx*8]
mov rax, qword [rcx + r15]
test rax, rax
je 0x18000602d
xor edx, edx
mov dword [rsp + 0x20], edx
xor r8d, r8d
test rax, rax
jns 0x180006008
movzx edx, ax
mov dword [rsp + 0x20], edx
jmp 0x180006013
add eax, 2
je 0x180006013
mov r8d, eax
add r8, r14
test rsi, rsi
je 0x180006025
lea r9, [rcx + r12]
mov rcx, r13
call rsi
test eax, eax
je 0x18000602d
inc ebx
mov dword [rsp + 0x24], ebx
jmp 0x180005fe0
test rsi, rsi
je 0x18000603f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rsi
add rdi, 0x14
mov qword [rsp + 0x28], rdi
jmp 0x180005f76
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180006089
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x18000606f
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rax
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov eax, 1
jmp 0x180006089
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rdx
lea r9, [0x180007fc0]
mov rdx, rcx
lea r8, [0x180008160]
mov rcx, rax
jmp 0x180005ec0

Function at 0x180008320
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rcx, rax
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180008360
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x70
lea rdi, [rcx + rdx]
mov rbx, r8
cmp rcx, rdi
jae 0x1800083f2
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800083f2
mov rax, qword [rsp + 0x38]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rdx, qword [rbx + 0x10]
je 0x1800083d6
movups xmm0, xmmword [rsp + 0x20]
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdx], xmm0
movsd qword [rdx + 0x10], xmm1
add qword [rbx + 8], 0x18
jmp 0x1800083e3
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.180007c00
mov rcx, qword [rsp + 0x38]
add rcx, qword [rsp + 0x50]
cmp rcx, rdi
jb 0x180008380
mov r8, qword [rbx + 8]
movabs rbp, 0x2aaaaaaaaaaaaaab
mov r9, qword [rbx]
mov rcx, r8
sub rcx, r9
mov rax, rbp
imul rcx
xor edi, edi
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800084ad
mov qword [rsp + 0x88], rsi
mov esi, edi
nop
sub r8, r9
mov rax, rbp
imul r8
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, rdi
jbe 0x1800084bf
movups xmm1, xmmword [rsi + r9]
lea r9, [rsp + 0x80]
mov r8d, 0x40
movdqa xmm0, xmm1
movq rcx, xmm1
psrldq xmm0, 8
movq rdx, xmm0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbx + 8]
mov rax, rbp
mov r9, qword [rbx]
mov rcx, r8
sub rcx, r9
inc rdi
imul rcx
add rsi, 0x18
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x180008430
mov rsi, qword [rsp + 0x88]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180008600
int3
Function at 0x180010400
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x98]
mov r14, rdx
mov edx, dword [rsp + 0x90]
mov rsi, r8
mov r8d, dword [rsp + 0x80]
mov eax, edx
or eax, ebx
mov rbp, r9
mov r15, rcx
test eax, 0xbfffffff
je 0x180010452
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800104f8
mov eax, dword [rsp + 0x88]
test r8d, r8d
mov qword [rsp + 0x38], rbp
mov ecx, 0x1000
cmovne ecx, r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
or edx, 1
mov dword [rsp + 0x20], ecx
mov r9d, 1
mov rcx, r15
mov qword [rsp + 0x60], rdi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
test rax, rax
je 0x1800104e4
mov qword [rsp + 0x30], 0
bts ebx, 7
mov dword [rsp + 0x28], ebx
mov r9, rbp
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1800104e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800104f3
mov qword [r14], rdi
mov qword [rsi], rax
mov eax, 1
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x180010be0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x180067d80]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [rcx + 0x5c], 0
mov edi, edx
mov rbx, rcx
je 0x180010dbc
mov rcx, qword [rcx + 0x80]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x170], rsi
xor r9d, r9d
xor esi, esi
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180010db3
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180010cb6
nop dword [rax]
mov rcx, qword [rbx + 0x80]
lea r9, [rsp + 0x34]
mov r8d, 0xfa
mov qword [rsp + 0x20], rsi
cmp eax, r8d
lea rdx, [rsp + 0x40]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180010d69
mov eax, dword [rsp + 0x34]
cmp rax, 0xfb
jae 0x180010dc0
lea rdx, [rsp + 0x40]
mov byte [rsp + rax + 0x40], sil
lea rcx, [0x18004f73c]
call qword [case.0x18002567f.0]
mov eax, dword [rsp + 0x30]
sub eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
jne 0x180010c50
mov rcx, qword [rbx + 0x70]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180010daa
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180010d53
nop word [rax + rax]
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x34]
mov r8d, 0xfa
mov qword [rsp + 0x20], rsi
cmp eax, r8d
lea rdx, [rsp + 0x40]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180010da1
mov eax, dword [rsp + 0x34]
cmp rax, 0xfb
jae 0x180010dc6
lea rdx, [rsp + 0x40]
mov byte [rsp + rax + 0x40], sil
lea rcx, [0x18004f73c]
call qword [case.0x18002567f.0]
mov eax, dword [rsp + 0x30]
sub eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
jne 0x180010cf0
mov rcx, qword [rbx + 0x40]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
sete al
jmp 0x180010d78
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdErr_ReadFile._n
call qword [case.0x18002567f.0]
xor al, al
mov rsi, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18004a5b0
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
ret
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdOut_ReadFile._n
jmp 0x180010d70
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdOut_PeekNamedPipe._n
jmp 0x180010d70
lea rcx, str.AFXERROR:_COutFFMPEGVideoStream::HandleOutAndErr:_StdErr_PeekNamedPipe._n
jmp 0x180010d70
xor al, al
jmp 0x180010d80
call fcn.18004a808
int3
call fcn.18004a808
int3
Function at 0x180011120
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
sub rsp, 0x38
cmp dword [rcx + 0x5c], 1
mov rbp, r8
mov rbx, rcx
je 0x18001113c
xor al, al
add rsp, 0x38
pop rbp
pop rbx
ret
mov qword [rsp + 0x58], rsi
mov esi, dword [rcx + 0x30]
mov ecx, dword [rcx + 0x18]
mov qword [rsp + 0x60], rdi
sub ecx, 1
je 0x180011172
sub ecx, 1
je 0x18001116b
sub ecx, 1
je 0x180011164
cmp ecx, 1
je 0x18001116b
xor edi, edi
jmp 0x180011177
mov edi, 1
jmp 0x180011177
mov edi, 4
jmp 0x180011177
mov edi, 3
imul edi, dword [rbx + 0x1c]
mov eax, edi
cmp rax, qword [rbx + 0x28]
jne 0x180011187
imul edi, dword [rbx + 0x20]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x30], r15
test esi, esi
je 0x180011243
mov r15d, edi
lea r14, [rbx + 0x90]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x68]
xor r9d, r9d
mov r8d, edi
mov qword [rsp + 0x20], r14
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180011236
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18001120b
nop dword [rax]
xor edx, edx
mov rcx, rbx
call fcn.180010be0
test al, al
je 0x18001120b
mov rcx, qword [rbx + 0xa8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180011217
cmp eax, 0x102
je 0x1800111e0
mov rcx, rbx
call fcn.180010590
xor al, al
jmp 0x180011245
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x50]
xor r9d, r9d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x18001120b
cmp dword [rsp + 0x50], esi
jne 0x18001120b
sub esi, edi
add rbp, r15
test esi, esi
jne 0x1800111b0
mov al, 1
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x38
pop rbp
pop rbx
ret

Function at 0x180014b10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180067d80]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180014be3
cmp byte [rcx + 0x71], 0
je 0x180014be3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180014bdf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180014ba4
sub eax, 1
je 0x180014ba8
cmp eax, 2
jne 0x180014bdf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004a5b0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180014bd6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180014bdf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180014b8c
xor al, al
jmp 0x180014b8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004a5b0
add rsp, 0x60
pop rbx
ret
Function at 0x180014db0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180067d80]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x180014ddd
xor eax, eax
jmp 0x180014f46
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x180014e1d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x180014e1d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x180014f3e
cmp qword [rdi + 0x80], 0
je 0x180014f39
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x180014e57
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x180014e82
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x180014f3e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180014ef1
sub eax, 1
je 0x180014ef1
cmp eax, 2
jne 0x180014f39
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x180014f3e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x180014f1f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x180014f39
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x180014f3e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18004a5b0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180015690
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x1800156c1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1800156df
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x180015729
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x1800157a1
mov rcx, rbp
call fcn.180014c20
cmp rbx, 0xfff
jbe 0x180015781
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1800157c2
cmp rbx, rax
ja 0x180015750
test rdi, rdi
je 0x1800157a1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x1800157a4
Function at 0x1800157d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1800157f8
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x18001586c
test rax, rax
jle 0x18001584c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x18001586c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18001586c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x18002d590
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movzx esi, r8b
mov r14, rdx
xor r15d, r15d
xor r8d, r8d
xor edx, edx
xor r9d, r9d
mov ebx, r15d
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
movsxd rdi, eax
test eax, eax
je 0x18002d63d
mov rcx, rdi
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18002d63d
xor r9d, r9d
mov r8, rax
mov edx, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
inc eax
cmp edi, eax
jne 0x18002d63d
mov eax, r15d
lea ebp, [r15 + 0x5c]
mov edi, r15d
test rax, rax
je 0x18002d60d
mov word [rax], r15w
inc edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18002d666
test sil, sil
je 0x18002d62e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18002d666
mov edx, ebp
mov rcx, rbx
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
jne 0x18002d607
xor sil, sil
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
movzx eax, sil
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov sil, 1
nop dword [rax]
test edi, edi
je 0x18002d6a7
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x18002d680
xor edx, edx
mov word [rbx + rax*2], bp
mov rcx, rbx
dec edi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne sil
test eax, eax
jne 0x18002d670
test sil, sil
je 0x18002d640
mov rdx, rbx
mov rcx, r14
call fcn.18002d8e0
jmp 0x18002d640