joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62d6a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62d7bf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], r8
mov rdx, qword [rax + 0x80]
test rdx, rdx
jne 0x62d75a
mov rdx, qword [rax + 0x88]
test rdx, rdx
je 0x62d748
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x62d742
nop
test rcx, rcx
jne 0x62d742
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x31
lea rcx, [0x006c1a67]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x48]
lea rcx, [0x00728640]
mov rdi, rax
mov rax, qword [rsp + 0x38]
add rsp, 0x58
pop rbp
ret
lea rax, [0x008ccf00]
call fcn.00568ec0
add rsp, 0x58
pop rbp
ret
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
test rax, rax
jne 0x62d7b9
test rcx, rcx
jne 0x62d7b9
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rax
nop
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x38
lea rcx, [0x006c30d5]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x50]
lea rcx, [0x00728640]
mov rdi, rax
mov rax, qword [rsp + 0x40]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0062d6a0
Function at 0x62d820
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62d9b0
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
movq qword [rsp + 0x40], xmm15
mov byte [rsp + 0x17], 0
mov byte [rsp + 0x16], 0
lea rsi, [rax + 0x90]
mov rdx, rax
xor eax, eax
mov r8d, 1
lock cmpxchg dword [rdx + 0x90], r8d
sete r8b
test r8b, r8b
jne 0x62d8ab
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rcx
mov rax, rsi
call fcn.00480e60
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x70]
movups xmmword [rsp + 0x30], xmm15
lea r8, [0x0062da00]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rsi
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x17], 1
cmp qword [rdx + 0x98], 0
jne 0x62d8e5
cmp qword [rdx + 0xa0], 0
je 0x62d904
mov byte [rsp + 0x16], 0
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx]
call rax
movzx eax, byte [rsp + 0x16]
add rsp, 0x48
pop rbp
ret
cmp dword [0x00921500], 0
je 0x62d920
call fcn.004665c0
mov qword [r11], rbx
mov rsi, qword [rdx + 0x98]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x98], rbx
mov qword [rdx + 0xa0], rcx
cmp dword [0x00921500], 0
je 0x62d94a
call fcn.004665c0
mov qword [r11], rdi
mov rcx, qword [rdx + 0xa8]
mov qword [r11 + 8], rcx
mov qword [rdx + 0xa8], rdi
test rbx, rbx
jne 0x62d962
cmp qword [rdx + 0xa0], 0
nop
je 0x62d98a
mov rax, qword [rdx + 0x78]
call fcn.00406060
mov byte [rsp + 0x16], 1
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x16]
add rsp, 0x48
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727ae0]
call fcn.00436ac0
nop
nop
call fcn.00435fa0
movzx eax, byte [rsp + 0x16]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0062d820
Function at 0x62dd40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62ddf2
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r8
mov rdx, qword [rax + 0x90]
test rdx, rdx
je 0x62dd8c
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
jmp 0x62dda5
mov rdx, qword [rax + 0x98]
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x62ddec
test rcx, rcx
jne 0x62ddec
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
lea rax, [0x00673e00]
call fcn.0040d680
mov qword [rax + 8], 0x41
lea rcx, [0x006c40e3]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x38]
lea rcx, [0x00728640]
mov rdi, rax
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.0062dd40
Function at 0x633240
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6334ba
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
test rdi, rdi
je 0x6334b0
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x88], rdi
mov rcx, qword [rax + 0xb0]
xor ebx, ebx
mov rax, rcx
call fcn.004064e0
mov rax, qword [rsp + 0x70]
call fcn.00632aa0
test rax, rax
jne 0x6334aa
mov rdx, qword [rsp + 0x78]
lea rsi, [rdx + 0x20]
xor eax, eax
mov edi, 1
lock cmpxchg dword [rdx + 0x20], edi
sete dil
test dil, dil
jne 0x6332e6
mov qword [rsp + 0x38], rsi
mov rax, rsi
call fcn.00480e60
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x38]
mov rax, qword [rdx + 0x28]
mov rbx, qword [rdx + 0x30]
nop
mov edi, 0xffffffff
lock xadd dword [rdx + 0x20], edi
lea edx, [rdi - 1]
nop dword [rax]
test edx, edx
je 0x633322
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rax, rsi
mov ebx, edx
call fcn.00481140
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x6334a4
mov rax, qword [rsp + 0x88]
cmp qword [0x008be1c0], rax
jne 0x633360
mov rcx, qword [0x008be1c8]
mov rbx, qword [rsp + 0x90]
call fcn.00404940
test al, al
jne 0x63348e
mov rax, qword [rsp + 0x88]
lea rcx, [0x00728f00]
cmp rax, rcx
jne 0x6333c6
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx + 0x78], rcx
jne 0x6333b8
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rcx
lea rax, [0x00682300]
lea rbx, [rsp + 0x50]
call fcn.0040abe0
mov rbx, rax
lea rax, [0x00728ee0]
add rsp, 0x60
pop rbp
ret
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x70]
call fcn.006329e0
test al, al
je 0x633478
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x70]
cmp qword [r8 + 0x78], rdx
je 0x63343d
movups xmmword [rsp + 0x40], xmm15
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x633404
mov rdi, qword [rdx + 8]
jmp 0x633407
mov rdi, rdx
mov qword [rsp + 0x40], rdi
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x48], rdx
lea rax, [0x006c1f70]
mov ebx, 0x32
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rcx
lea rax, [0x00682300]
lea rbx, [rsp + 0x50]
call fcn.0040abe0
mov rbx, rax
lea rax, [0x00728ee0]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
add rsp, 0x60
pop rbp
ret
add rsp, 0x60
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00633240
Function at 0x634780
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x6349bd
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
cmp qword [rax + 0xe8], 0
jne 0x6349b4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xa0], rax
mov rdx, qword [rax + 0x68]
mov r8, qword [rdx + 0x30]
sub r8, qword [rdx + 0x28]
nop dword [rax]
test r8, r8
jle 0x6348e9
mov rax, rdx
mov rbx, r8
call fcn.004eeda0
cmp rbx, 0xc
jl 0x63481d
cmp dword [rax], 0x50545448
jne 0x63481d
cmp word [rax + 4], 0x312f
jne 0x63481d
cmp byte [rax + 6], 0x2e
jne 0x63481d
cmp dword [rax + 8], 0x38303420
je 0x634990
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
call fcn.0040aee0
lea rdx, [0x00658a60]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x63484f
mov rbx, qword [rdx + 8]
jmp 0x634852
mov rbx, rdx
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rdx
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x00634a00]
mov qword [rsp + 0x60], rsi
lea rsi, [0x006c4bed]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 0x4b
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], 2
mov qword [rsp + 0x88], 2
mov rax, qword [0x008cc108]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x60]
call fcn.005e6f20
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x28]
cmp qword [0x008bd9f0], rbx
jne 0x634920
mov rdx, qword [0x008bd9f8]
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.00404940
test al, al
jne 0x63496c
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x28]
movups xmmword [rsp + 0x30], xmm15
test rbx, rbx
je 0x63492f
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
lea rax, [0x006b8bd1]
mov ebx, 0x1a
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
call fcn.004dd6a0
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0xa0]
call fcn.00636920
jmp 0x634987
mov rbx, qword [0x008be1c0]
mov rcx, qword [0x008be1c8]
mov rax, qword [rsp + 0xa0]
call fcn.00636920
add rsp, 0x90
pop rbp
ret
mov rbx, qword [0x008be1c0]
mov rcx, qword [0x008be1c8]
mov rax, qword [rsp + 0xa0]
call fcn.00636920
add rsp, 0x90
pop rbp
ret
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00634780
Function at 0x636920
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x636ab3
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
test rbx, rbx
je 0x636a9f
mov byte [rax + 0x108], 1
cmp qword [rax + 0xe8], 0
je 0x636965
mov rdx, rax
nop
jmp 0x636a76
mov qword [rsp + 0x90], rbx
mov qword [rax + 0xe8], rbx
cmp dword [0x00921500], 0
je 0x636993
nop dword [rax]
call fcn.004665c0
mov qword [r11], rcx
mov rdx, qword [rax + 0xf0]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
mov qword [rax + 0xf0], rcx
mov rdx, qword [rax + 0x10]
mov r11, qword [rax + 0x18]
mov qword [rsp + 0x40], r11
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rsp + 0x68], xmm0
mov rbx, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
movzx r10d, byte [rsp + 0x70]
mov rax, rdx
mov rcx, r11
nop dword [rax]
call fcn.0062f140
mov rdx, qword [rsp + 0x88]
cmp qword [rdx], 0
jne 0x636a76
mov rax, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [0x008be1d0], rax
jne 0x636a4c
mov rcx, qword [0x008be1d8]
mov rbx, qword [rsp + 0x98]
call fcn.00404940
nop dword [rax]
test al, al
jne 0x636a5a
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rdx + 0x50]
mov rax, qword [rdx + 0x58]
mov rcx, qword [rcx + 0x18]
call rcx
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx + 0x90]
call fcn.00406060
mov rdx, qword [rsp + 0x88]
cmp dword [0x00921500], 0
je 0x636a8e
mov rax, qword [rdx + 0x110]
call fcn.004665a0
mov qword [r11], rax
mov qword [rdx + 0x110], 0
add rsp, 0x78
pop rbp
ret
lea rax, [0x0065b7a0]
lea rbx, [0x00727b00]
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00636920
Function at 0x636b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x636c42
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.0058b8a0
test rdi, rdi
jne 0x636b93
mov rbx, qword [0x008cbf40]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0066ac40]
call fcn.00412420
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x78]
call fcn.00636ae0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403d80
xorps xmm15, xmm15
mov r14, qword [0x00921328]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x636c15
xor eax, eax
lea rbx, [0x006b05a2]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b062d]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.0044f780
jmp 0x636c3c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00725918]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.0044f6c0
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004646a0
mov rax, qword [rsp + 8]
jmp fcn.00636b40
Function at 0x14000ff30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000ff58
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000ff7e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000ff80
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000ffd9
test ecx, ecx
jle 0x14000ffb9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000ffd9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000ffd9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140010000
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140010022
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140010038
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140010054
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140010056
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140010092
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je fcn.14001012e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400100cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe fcn.14001010e
nop word [rax + rax]
Function at 0x140010560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ca200]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001058d
xor eax, eax
jmp 0x1400106f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400105c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400105c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400106f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400106ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001060a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140010635
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400106f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400106a4
sub eax, 1
je 0x1400106a4
cmp eax, 2
jne 0x1400106ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400106f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400106d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400106ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400106f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009cc90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140012940
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400ca200]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140012a13
cmp byte [rcx + 0x71], 0
je 0x140012a13
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140012a0f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400129d4
sub eax, 1
je 0x1400129d8
cmp eax, 2
jne 0x140012a0f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009cc90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140012a06
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140012a0f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400129bc
xor al, al
jmp 0x1400129bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009cc90
add rsp, 0x60
pop rbx
ret
Function at 0x140023510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140023544
mov eax, esi
lea ecx, [rax - 0x57]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140023530
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14001a120
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140023569
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400300f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400235e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400235de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400235de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009cf4c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400235f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x140023624
mov ecx, ebx
lea eax, [rcx - 0x57]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140023610
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14001a120
nop
cmp byte [rdi + 9], 0
je 0x140023654
lea eax, [rbx - 0x57]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x140023641
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14001a120
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140029110
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400236c4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400236be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400236be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009cf4c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140023704
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400236ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400236ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009cf4c
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret