joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180104810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x18016d028]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1801049ac
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1801049ac
cmp r10d, r14d
jne 0x1801048b0
sub rbx, 0x10
jmp 0x1801049f4
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x180104922
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1801048e4
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1801048ec
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x18010490b
movzx edx, r11b
mov rcx, rsi
call fcn.1801059c0
test al, al
jne 0x180104a05
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.180106030
test al, al
jne 0x180104a05
mov edx, dword [rsi + 0x64]
lea r9, [0x180106390]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x18010494e
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.180104690
jmp 0x1801049a2
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.180104690
test dil, dil
je 0x18010499a
cmp byte [rsi + 0x6a], 0
jne 0x18010499a
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x180104a05
sub rbx, 0x10
jmp 0x1801049f4
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x180104a09
mov ebp, dword [rbx]
jmp 0x180104870
mov al, 1
jmp 0x180104a12
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180110aa0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x18010ad60
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x18010ad7c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18010add0
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18010aef5
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x18010aef5
test rax, rax
je 0x18010aef5
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x18010aef5
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x18010ae6a
lea rax, [0x18010af50]
jmp 0x18010aec3
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x18010aef5
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18010aee3
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x18010ae90
lea rax, [0x18010af20]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x18010af0a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x18010c4e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x18010c4eb
xor eax, eax
ret
lea r11, [0x180130420]
not ecx
cmp r8d, 8
jb 0x18010c5c1
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x18010c510
test r8d, r8d
je 0x18010c5ed
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x18010c5d0
not ecx
mov eax, ecx
ret
Function at 0x14047d2a4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbx
sub rsp, 0x220
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
lea r11, [rsp + 0x60]
mov r8, qword [rax + 0x30]
mov r9d, dword [r8 + 0x3fb519]
mov r10d, dword [r8 + 0x3fb51d]
test r9d, r9d
je 0x14047d301
mov rdx, r11
add r9d, 2
mov eax, 2
mov ecx, eax
add eax, 1
add rdx, 4
mov ebx, dword [r8 + rcx*4 + 0x3fb519]
add ebx, r10d
mov dword [rdx - 4], ebx
cmp r9d, eax
jne 0x14047d2e5
mov eax, dword [rsp + 0x94]
mov qword [rsp + 0x30], r11
lea rcx, [rsp + 0x20]
add r8, rax
call r8
nop
add rsp, 0x220
pop rbx
ret
Function at 0x1400011b0
Capabilities:
Bypass uac via icmluautil

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x34], 0xc0000022
mov dword [rsp + 0x30], 0x80004005
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x40], 0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x38], eax
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [0x140003450]
lea rcx, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
call fcn.140001030
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140001225
jmp 0x14000127f
cmp qword [rsp + 0x40], 0
jne 0x140001237
mov dword [rsp + 0x30], 0x8007000e
jmp 0x14000127f
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x48]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x140001275
mov dword [rsp + 0x34], 0
xor eax, eax
test eax, eax
jne 0x1400011fa
cmp qword [rsp + 0x40], 0
je 0x140001297
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x10]
cmp dword [rsp + 0x38], 0
jne 0x1400012a4
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001720
add rsp, 0x58
ret
Function at 0x140075ca0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x14025d030]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, rdx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140075d06
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140066f70
mov dword [rsp + 0x30], 3
lea rax, str.Cherax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140066f70
mov dword [rsp + 0x30], 7
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400485a0
nop
lea rcx, [rsp + 0x58]
call fcn.140055ab0
mov rax, rbx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14013ea20
add rsp, 0x1a0
pop rbx
ret

Function at 0x140076940
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14025d030]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
call fcn.140048cb0
mov rdx, rax
call fcn.140075d90
test al, al
je 0x1400769a1
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400487f0
cmp qword [rax + 0x18], 0x10
jb 0x14007698d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rsp + 0x48]
call fcn.140057660
nop
mov rcx, rbx
call fcn.140055ab0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14013ea20
add rsp, 0x80
pop rbx
ret
Function at 0x140077680
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x140077715
test r8, r8
jle 0x14007770d
nop word [rax + rax]
mov rcx, rdi
call fcn.1400793f0
test rax, rax
jle 0x1400776ee
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140077705
mov rax, qword [rdi]
movzx edx, byte [rbp]
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007770d
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x1400776b0
sub r14, rbx
mov rax, r14
jmp 0x140077794
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x14007772e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140077730
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x140077789
test ecx, ecx
jle 0x140077769
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x140077789
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140077789
mov r8, r14
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400777b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400777d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140077849
mov rdi, r14
mov rcx, rbx
call fcn.140079410
test rax, rax
jle 0x140077824
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140077839
mov rax, qword [rbx]
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140077841
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400777e6
sub r14, rdi
jmp 0x140077931
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140077860
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140077862
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140077894
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14007792e
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400778cf
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14007790e
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14007792e
cmp rbp, rax
ja 0x1400778e0
test rbp, rbp
je 0x14007792e
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140077d40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14025d030]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140077d70
xor eax, eax
jmp 0x140077f02
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140077daa
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140077daa
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140077f02
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x140077ef5
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140077ded
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140077e28
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov edx, 1
mov byte [rsp + 0x58], dil
mov r8d, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
mov ecx, 0xffffffff
cmove ecx, edi
mov eax, ecx
jmp 0x140077efa
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
je 0x140077ead
sub eax, 1
je 0x140077ead
cmp eax, 2
jne 0x140077ef5
movzx eax, byte [rsp + 0x50]
lea rcx, [rsp + 0x58]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, edx
mov byte [rsp + 0x58], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
mov ecx, 0xffffffff
cmove ecx, edi
mov eax, ecx
jmp 0x140077efa
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
sub rsi, rax
je 0x140077edb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x60]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140077ef5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140077efa
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14013ea20
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x140078590
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400785b8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400785de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400785e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140078639
test ecx, ecx
jle 0x140078619
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140078639
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140078639
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140078660
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140078682
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140078698
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400786b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400786b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400786f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14007878e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14007872d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14007876e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14007878e
cmp rbx, rax
ja 0x140078740
test rbx, rbx
je 0x14007878e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140078a40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14025d030]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140078a6d
xor eax, eax
jmp 0x140078bd9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140078aa7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140078aa7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140078bd9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140078bcc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140078aea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140078b15
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140078bd1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140078b84
sub eax, 1
je 0x140078b84
cmp eax, 2
jne 0x140078bcc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140078bd1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140078bb2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140078bcc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140078bd1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14013ea20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret