joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141010058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410101df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141010089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14101006f
add dl, dl
jne 0x141010096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410100f6
xor eax, eax
add dl, dl
jne 0x1410100a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410101ad
add dl, dl
jne 0x1410100b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410100c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410100d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410100dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410100ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14101007e
mov eax, 1
add dl, dl
jne 0x141010106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141010113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410100fb
sub eax, ebx
mov ebx, 1
jne 0x14101014c
mov ecx, 1
add dl, dl
jne 0x14101012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14101013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141010123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14101007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141010168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141010175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14101015d
cmp eax, 0x7d00
jae 0x14101019b
cmp eax, 0x500
jb 0x141010196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14101007e
cmp eax, 0x7f
ja 0x14101019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14101007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410101d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14101007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003a30
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003a64
cmp word [rcx], 0x5a4d
jne 0x140003a64
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003a64
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a64
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003970
test eax, eax
jne 0x140003a80
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400039e0
test rax, rax
je 0x140003a75
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004223
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004130
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400040d0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004cf0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004d13
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004d13
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004dc1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140535330]
mov r8, rcx
mov rcx, r9
call fcn.140004cf0
test eax, eax
je 0x140004ded
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004d14
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400049d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rbp - 8], rax
xor edx, edx
mov cl, 0x6e
call fcn.140001b40
mov edx, 1
mov byte [rbp - 0x30], al
mov cl, 0x74
call fcn.140001b40
mov edx, 2
mov byte [rbp - 0x2f], al
mov cl, 0x64
call fcn.140001b40
mov edx, 3
mov byte [rbp - 0x2e], al
mov cl, 0x6c
call fcn.140001b40
mov edx, 4
mov byte [rbp - 0x2d], al
call fcn.140001b40
mov edx, 5
mov byte [rbp - 0x2c], al
mov cl, 0x2e
call fcn.140001b40
mov edx, 6
mov byte [rbp - 0x2b], al
mov cl, 0x64
call fcn.140001b40
mov edx, 7
mov byte [rbp - 0x2a], al
mov cl, 0x6c
call fcn.140001b40
mov edx, 8
mov byte [rbp - 0x29], al
call fcn.140001b40
mov byte [rbp - 0x28], al
xor eax, eax
xor ebx, ebx
mov byte [rbp - 0x27], al
mov edx, ebx
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x16]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x140004a80
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x27], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
test rax, rax
je 0x140004bcc
xor edx, edx
mov cl, 0x44
call fcn.140001b40
mov edx, 1
mov byte [rbp - 0x20], al
mov cl, 0x62
call fcn.140001b40
mov edx, 2
mov byte [rbp - 0x1f], al
mov cl, 0x67
call fcn.140001b40
mov edx, 3
mov byte [rbp - 0x1e], al
mov cl, 0x42
call fcn.140001b40
mov edx, 4
mov byte [rbp - 0x1d], al
mov cl, 0x72
call fcn.140001b40
mov edx, 5
mov byte [rbp - 0x1c], al
mov cl, 0x65
call fcn.140001b40
mov edx, 6
mov byte [rbp - 0x1b], al
mov cl, 0x61
call fcn.140001b40
mov edx, 7
mov byte [rbp - 0x1a], al
mov cl, 0x6b
call fcn.140001b40
mov edx, 8
mov byte [rbp - 0x19], al
mov cl, 0x50
call fcn.140001b40
mov edx, 9
mov byte [rbp - 0x18], al
mov cl, 0x6f
call fcn.140001b40
mov edx, 0xa
mov byte [rbp - 0x17], al
mov cl, 0x69
call fcn.140001b40
mov edx, 0xb
mov byte [rbp - 0x16], al
mov cl, 0x6e
call fcn.140001b40
mov edx, 0xc
mov byte [rbp - 0x15], al
mov cl, 0x74
call fcn.140001b40
mov byte [rbp - 0x14], al
xor eax, eax
mov byte [rbp - 0x13], al
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rbx - 0x16]
inc ebx
xor byte [rcx], al
cmp ebx, 0xd
jb 0x140004b80
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x13], 0
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140004bcc
mov edx, 1
lea r9, [rbp - 0x10]
mov rcx, rax
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140004bcc
mov byte [rbx], 0xc3
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140027490
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400050c0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [0x140032e58]
mov rbx, r8
cmp rdx, qword [0x140032e60]
je 0x14000519c
mov rdx, qword [rdx]
mov rcx, rdx
movzx eax, byte [rcx]
cmp al, 0xc3
je 0x1400050fc
cmp al, 0xcc
je 0x14000514e
inc rcx
mov rax, rcx
sub rax, rdx
cmp rax, rdx
jbe 0x1400050e3
mov rcx, qword [r8]
test rcx, rcx
je 0x140005146
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140005134
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400051e8
mov rcx, r8
call fcn.1400274f4
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
xor al, al
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r8]
test rcx, rcx
je 0x140005194
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140005182
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400051e8
mov rcx, r8
call fcn.1400274f4
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov al, 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r8]
test rcx, rcx
je 0x1400051e2
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400051d0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400051e8
mov rcx, r8
call fcn.1400274f4
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140005df0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13d0
call fcn.1400283c0
sub rsp, rax
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
lea ecx, [rsi + 1]
nop word [rax + rax]
mov eax, r8d
shr eax, 0x1e
xor eax, r8d
imul r8d, eax, 0x6c078965
add r8d, ecx
mov dword [rsp + rcx*4 + 0x34], r8d
inc rcx
cmp rcx, 0x270
jb 0x140005e50
mov dword [rsp + 0x30], 0x270
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
cmp rdi, 0xf
jbe 0x140005ead
mov rdx, rdi
mov rcx, rbx
call fcn.1400259a0
mov qword [rbx + 0x10], rsi
jmp 0x140005eb2
test rdi, rdi
je 0x140005f22
lea rcx, [rsp + 0x30]
call fcn.140026f00
mov ecx, eax
mov eax, 0x8d3dcb09
mul ecx
shr edx, 5
cmp edx, 0x469ee58
jae 0x140005eb2
mov eax, 0x8d3dcb09
mul ecx
shr edx, 5
imul eax, edx, 0x3a
sub ecx, eax
lea edx, [rcx - 0x7fffffbf]
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
cmp rcx, r8
jae 0x140005f10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r8, 0x10
jb 0x140005f06
mov rax, qword [rbx]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x140005f1c
movzx r9d, dl
mov rcx, rbx
call fcn.140025af0
sub rdi, 1
jne 0x140005eb2
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.140027490
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000e6a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [rdx + 0x5d], 0
mov r8, rdx
mov rdi, rcx
je 0x14000e7b2
mov qword [rsp + 0x30], rbx
lea r9, [rdx + 2]
mov ebx, 1
mov qword [rsp + 0x38], rsi
sub rbx, rdx
lea rsi, [0x140032d10]
mov r11, rdx
mov r10, 0xfffffffffffffffe
sub r10, rdx
not r11
nop dword [rax]
nop word [rax + rax]
cmp qword [0x140032d28], 0x10
lea rax, [r10 + r9]
mov rcx, rsi
cmovae rcx, qword [0x140032d10]
xor edx, edx
div qword [0x140032d20]
movzx eax, byte [rdx + rcx]
mov rcx, rsi
xor byte [r9 - 2], al
lea rax, [r11 + r9]
cmp qword [0x140032d28], 0x10
cmovae rcx, qword [0x140032d10]
xor edx, edx
div qword [0x140032d20]
movzx eax, byte [rdx + rcx]
mov rcx, rsi
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x140032d28], 0x10
cmovae rcx, qword [0x140032d10]
sub rax, r8
xor edx, edx
div qword [0x140032d20]
movzx eax, byte [rdx + rcx]
mov rcx, rsi
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x140032d28], 0x10
cmovae rcx, qword [0x140032d10]
xor edx, edx
div qword [0x140032d20]
movzx eax, byte [rdx + rcx]
xor byte [r9 + 1], al
add r9, 4
lea rax, [r10 + r9]
cmp rax, 0x5c
jb 0x14000e6f0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [r8 + 0x5d], 0
mov rdx, r8
mov rcx, rdi
call fcn.140024dc0
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14000eff0
Capabilities:
Encode data using xor
Execute command
Set console window title

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x38], edi
xor edx, edx
mov cl, 0x63
call fcn.140001b40
mov byte [rsp + 0x30], al
lea edx, [rdi + 1]
mov cl, 0x6f
call fcn.140001b40
mov byte [rsp + 0x31], al
lea edx, [rdi + 2]
mov cl, 0x6c
call fcn.140001b40
mov byte [rsp + 0x32], al
lea edx, [rdi + 3]
mov cl, 0x6f
call fcn.140001b40
mov byte [rsp + 0x33], al
lea edx, [rdi + 4]
mov cl, 0x72
call fcn.140001b40
mov byte [rsp + 0x34], al
lea edx, [rdi + 5]
mov cl, 0x20
call fcn.140001b40
mov byte [rsp + 0x35], al
lea edx, [rdi + 6]
mov cl, 0x32
call fcn.140001b40
mov byte [rsp + 0x36], al
xor eax, eax
mov byte [rsp + 0x37], al
mov edx, edi
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x16]
xor byte [rcx], al
inc edx
cmp edx, 7
jb 0x14000f090
mov byte [rsp + 0x37], dil
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x18
lea rcx, [rsp + 0x48]
call fcn.14000e7f0
cmp qword [rax + 0x18], 0x10
jb 0x14000f0d0
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000f119
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f114
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f114
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400274f4
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov dword [rsp + 0x38], 1
cmp qword [rbx + 0x18], 0x10
jb 0x14000f13d
mov rbx, qword [rbx]
lea rdx, [0x14002bc24]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov rbp, rax
test rax, rax
je 0x14000f20d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne 0x14000f204
nop word [rax + rax]
mov r8, rbp
mov edx, 0x80
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x14000f1f3
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000f194
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x14000f1de
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x14000f1c4
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x14000f1f3
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
call fcn.140025f90
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x14000f170
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov rax, rsi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140027490
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014c10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x24], 0
je 0x140014dce
mov qword [rsp + 0x10], rbx
lea r9, [rcx + 2]
mov qword [rsp + 0x18], rbp
mov ebx, 1
mov qword [rsp + 0x20], rsi
lea rbp, [0x140032cb0]
mov qword [rsp + 0x28], rdi
mov esi, 3
mov qword [rsp], r14
mov edi, 2
mov r14d, 4
mov r11, rcx
sub r14, rcx
sub rbx, rcx
sub rdi, rcx
sub rsi, rcx
mov r10, 0xfffffffffffffffe
not r11
sub r10, rcx
nop dword [rax]
nop word [rax + rax]
cmp qword [0x140032cc8], 0x10
lea rax, [r10 + r9]
mov r8, rbp
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 - 2], al
lea rax, [r11 + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
sub rax, rcx
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 + 1], al
lea rax, [rdi + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 + 2], al
lea rax, [rsi + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 + 3], al
lea rax, [r14 + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
xor byte [r9 + 4], al
add r9, 7
lea rax, [r10 + r9]
cmp rax, 0x23
jb 0x140014c80
mov r14, qword [rsp]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rcx + 0x24], 0
mov rax, rcx
add rsp, 8
ret
Function at 0x14001d480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14001d4b7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14001d4d8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001d4da
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001d533
test ecx, ecx
jle 0x14001d513
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001d533
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001d533
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001d560
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001d582
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14001d598
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001d5b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001d5b6
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x14001d5f0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001d697
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14001d62b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14001d671
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14001d6b0
cmp rbx, rax
ja 0x14001d640
mov r8, rdi
test rdi, rdi
je 0x14001d697
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14001d69a
Function at 0x14001dab0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001dadd
xor eax, eax
jmp 0x14001dc32
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14001db08
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14001db08
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14001dc32
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001dc25
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001db4b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001db76
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001dc2a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001dbe5
sub eax, 1
je 0x14001dbe5
cmp eax, 2
jne 0x14001dc25
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001dc2a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001dc13
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001dc25
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001dc2a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140027490
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret