joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f570
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040a2b0
mov rcx, qword [rbp + 0x90]
call fcn.0040a2b0
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040a0e0
cmp qword [rbp + 0x90], 0
je 0x40f72f
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040a6a0
xor eax, eax
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x40f61b
mov eax, dword [rcx - 4]
cmp eax, 1
jl 0x40f654
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x40f64d
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.0040b580
jmp 0x40f654
sub eax, 1
test eax, eax
jne 0x40f620
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.0040f1a0
cmp qword [rbp + 0x68], 0
je 0x40f692
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.0040f330
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040a610
jmp 0x40f72e
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040e930
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.0040f330
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040a610
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40f707
cmp byte [0x0043aef0], 0
jne 0x40f707
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.0040e930
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.0040f330
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040a610
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x40f72e
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.0040f450
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040a610
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040a1c0
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040a1c0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x411bb0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x411bd0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x411bf3
cmp eax, 1
jae 0x411bf8
cmp ecx, 5
jbe 0x411c04
mov dword [0x00436a20], 0x7f
jmp 0x411c0e
mov dword [0x00436a20], 0x409
add rsp, 0x28
ret
Function at 0x411ea0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00411e90
mov ebx, eax
test ebx, ebx
je 0x411ee9
cmp dword [0x00432e90], 0xffffffff
jne 0x411ec3
mov ecx, 0xe2
call fcn.00409f60
mov ecx, ebx
call fcn.00411e70
test rax, rax
jne 0x411edb
mov ecx, 0xe2
call fcn.00409f60
jmp 0x411ee9
mov ecx, dword [0x00432e90]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x411f50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x0043c2c0], 0
je 0x411f8b
mov ecx, dword [0x00432e90]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x411f9e
call fcn.00411ea0
mov ecx, dword [0x00432e90]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x411f9e
mov rax, qword [0x0043c2b8]
jmp 0x411f9e
mov rax, qword gs:[0x58]
mov ecx, dword [0x00432e90]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x41fa70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, edx
xor esi, esi
call fcn.0040b0b0
mov r13, rax
mov rcx, r13
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x41fb50
mov eax, edi
test eax, 0x400
jne 0x41fab1
test edi, 0x10
setne sil
jmp 0x41fb50
test bl, bl
je 0x41fafe
mov rcx, r13
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x41fb50
mov rcx, rax
call sub.kernel32.dll_CloseHandle
test edi, 0x10
setne sil
jmp 0x41fb50
test edi, 0x10
je 0x41fb0b
mov sil, 1
jmp 0x41fb50
mov rcx, r13
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x41fb4d
mov rcx, rax
call sub.kernel32.dll_CloseHandle
xor esi, esi
jmp 0x41fb50
mov sil, 1
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x41fd00
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.0040b0b0
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x424ba0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.00424960
mov ebx, eax
mov rax, qword [0x00435468]
cmp byte [rax], 0
je 0x424ccf
mov rcx, qword [0x00435278]
call fcn.00406430
call fcn.00405910
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00424b60]
mov r8d, 1
movsxd r9, esi
call fcn.0040da60
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00424d5c]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x424d12
mov rcx, qword [0x0043c288]
call fcn.0040dfc0
mov rcx, rax
mov rax, qword [0x00435228]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW
xor ecx, ecx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00424b60]
call fcn.0040dc30
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x427c50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040a800
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00411b90
mov esi, eax
cmp esi, 0x104
jbe 0x427cab
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.004055d0
mov rdi, rax
jmp 0x427caf
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00411b90
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x427d05
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x427ce6
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x427d17
mov rcx, rdi
call fcn.00405600
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x42b0e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040a2d0
nop
nop
mov qword [rbp + 0x68], 0
mov rcx, qword [rbp + 0x88]
call fcn.0040ae50
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov qword [rbp + 0x60], rax
cmp qword [rbp + 0x60], 0xffffffffffffffff
je 0x42b1c8
mov rcx, qword [rbp + 0x60]
xor edx, edx
call sub.kernel32.dll_GetFileSize
mov rcx, qword [rbp + 0x90]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rbp + 0x90]
mov edx, dword [rax]
mov r8d, 0x1000
mov r9d, 4
call sub.kernel32.dll_VirtualAlloc
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x90]
mov r8d, dword [rax]
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov rcx, qword [rbp + 0x60]
call sub.kernel32.dll_CloseHandle
jmp 0x42b1c8
nop
lea rcx, [rbp + 0x88]
call fcn.0040a130
mov rax, qword [rbp + 0x68]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x42b510
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x40], rdx
mov dword [rbp + 0x48], r8d
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.0040a2d0
nop
xor eax, eax
mov byte [rbp + 0x4f], al
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x42b5b3
mov rcx, qword [rbp + 0x80]
call fcn.0040ae50
mov rcx, rax
mov edx, 0x40000000
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x42b5b2
mov rcx, rbx
mov rdx, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x48]
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
mov byte [rbp + 0x4f], al
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x80]
call fcn.0040a130
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x42b690
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xf0
mov rbp, rsp
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], rdx
mov qword [rbp + 0x120], r8
mov rcx, qword [rbp + 0x110]
call fcn.0040a2d0
mov rcx, qword [rbp + 0x118]
call fcn.0040a2d0
mov rcx, qword [rbp + 0x120]
call fcn.0040a2d0
nop
cmp qword [rbp + 0x118], 0
je 0x42b75a
lea rcx, [rbp + 0x60]
mov edx, 4
lea r8, [0x0042b89c]
mov r9, qword [rbp + 0x110]
lea rax, [0x0042b8ac]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x118]
mov qword [rsp + 0x28], rax
call fcn.0040add0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x60]
call fcn.0040b190
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x58]
call fcn.0041f0e0
lea rcx, [rbp + 0x118]
mov rdx, qword [rbp + 0x68]
xor r8, r8
call fcn.0040af30
lea rcx, [rbp + 0x70]
mov edx, 0x68
xor r8, r8
call fcn.004064e0
lea rcx, [rbp + 0xd8]
mov edx, 0x18
xor r8, r8
call fcn.004064e0
mov dword [rbp + 0x70], 0x68
mov dword [rbp + 0xac], 1
mov word [rbp + 0xb0], 0
mov rcx, qword [rbp + 0x110]
call fcn.0040ae50
mov rbx, rax
mov rcx, qword [rbp + 0x118]
call fcn.0040ae50
mov rsi, rax
mov rcx, qword [rbp + 0x120]
call fcn.0040ae50
mov rcx, rbx
mov rdx, rsi
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x28], 0x8008000
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessA
nop
lea rcx, [rbp + 0x58]
call fcn.0040a0e0
lea rcx, [rbp + 0x60]
call fcn.0040a130
lea rcx, [rbp + 0x68]
call fcn.0040a0e0
lea rcx, [rbp + 0x110]
mov edx, 3
call fcn.0040a210
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0xf0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x140003dd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140003e00
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140003e28
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003e2a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003e83
test ecx, ecx
jle 0x140003e63
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140003e83
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003e83
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
invalid
Function at 0x140003eb0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003ed2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140003ee1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003f04
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003f06
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140003f40
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140003fe7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140003f7b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140003fc1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140004000
cmp rbx, rax
ja 0x140003f90
mov r8, rdi
test rdi, rdi
je 0x140003fe7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x140003fea
add al, 3
iretd
Function at 0x140004410
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000443d
xor eax, eax
jmp 0x140004592
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140004468
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140004468
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140004592
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140004585
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400044ab
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400044d6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000458a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004545
sub eax, 1
je 0x140004545
cmp eax, 2
jne 0x140004585
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000458a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140004573
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140004585
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000458a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140005550
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400049d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004aa3
cmp byte [rcx + 0x71], 0
je 0x140004aa3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004a9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004a64
sub eax, 1
je 0x140004a68
cmp eax, 2
jne 0x140004a9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140005550
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004a96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140004a9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140004a4c
xor al, al
jmp 0x140004a4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140005550
add rsp, 0x60
pop rbx
ret
Function at 0x1401901e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401901ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401901fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401901e5
lea eax, [rcx + 1]
jmp 0x14019020b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14019021e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140190204
sub eax, 3
jb 0x14019023e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14019028d
sar eax, 1
movsxd rbp, eax
jb 0x140190274
jmp 0x14019024c
add ebx, ebx
jne 0x14019024a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140190274
inc ecx
add ebx, ebx
jne 0x14019025a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140190274
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14019026d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14019025c
add ecx, 2
jmp 0x140190279
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401901a2
jmp 0x1401901ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x53600
mov dl, 0x18
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401902d9
cmp rsi, rcx
jae 0x1401902e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401902c0
cmp al, 0x8f
ja 0x1401902c0
cmp byte [rsi - 2], 0xf
je 0x1401902c6
sub al, 0xe8
cmp al, 1
ja 0x1401902aa
cmp rsi, rcx
jae 0x1401902e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401902b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401902e1
lodsb al, byte [rsi]
jmp 0x1401902c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x18d000]
mov eax, dword [rdi]
or eax, eax
je 0x14019034a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1901e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401902ee
jns 0x140190323
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14019032d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140190344
mov qword [rbx], rax
add rbx, 8
jmp 0x14019030e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140190384
cmp al, 0xef
ja 0x140190376
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140190356
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140190365
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401903d8
sub rsp, 0xffffffffffffff80
jmp 0x140053084