joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fe300
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400a42f0
lea rcx, [rsp + 0x20]
call fcn.1400fe1f0
movzx eax, al
test eax, eax
jne 0x1400fe345
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1400fe1d0
mov rax, qword [rsp + 0x40]
jmp 0x1400fe43f
lea rcx, [rsp + 0x20]
call fcn.1400a34b0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400fe270
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400cf600
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400a42f0
lea rcx, [rsp + 0x28]
call fcn.1400a43a0
movzx eax, al
test eax, eax
jne 0x1400fe3df
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400a4360
lea rcx, [rsp + 0x20]
call fcn.1400fe1d0
mov rax, qword [rsp + 0x50]
jmp 0x1400fe43f
lea rcx, [rsp + 0x20]
call fcn.1400a34b0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400a34b0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140115840
lea rcx, [rsp + 0x28]
call fcn.1400aa8d0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400a4360
lea rcx, [rsp + 0x20]
call fcn.1400fe1d0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x140683058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406831df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140683089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068306f
add dl, dl
jne 0x140683096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406830f6
xor eax, eax
add dl, dl
jne 0x1406830a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406831ad
add dl, dl
jne 0x1406830b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406830c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406830d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406830dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406830ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14068307e
mov eax, 1
add dl, dl
jne 0x140683106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140683113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406830fb
sub eax, ebx
mov ebx, 1
jne 0x14068314c
mov ecx, 1
add dl, dl
jne 0x14068312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14068313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140683123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140683168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140683175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068315d
cmp eax, 0x7d00
jae 0x14068319b
cmp eax, 0x500
jb 0x140683196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068307e
cmp eax, 0x7f
ja 0x14068319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406831d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14068307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400011f4
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, rsi
call fcn.140002a5e
mov rcx, rsi
mov rdx, rdi
call fcn.140002aee
mov rcx, rsi
call fcn.140002ce4
mov rbx, rax
mov rcx, rsi
call fcn.140002ca0
cmp rax, 3
jb 0x140001278
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x140001268
cmp word [rbx + 4], 0x5c
jne 0x140001278
movzx eax, word [rbx]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x140001278
jmp 0x140001335
cmp ax, 0x5c
jne 0x140001278
cmp word [rbx], 0x5c
je 0x140001335
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401f4650]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1400029f0
xor ecx, ecx
mov rdx, rbx
call fcn.140001127
test eax, eax
js 0x140001374
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002ca0
mov r14, rax
mov rcx, rbx
call fcn.140002ce4
mov rcx, rsi
mov rdx, rax
mov r8, r14
call fcn.140002b20
mov rcx, rbx
call fcn.140002ce4
mov rcx, rax
mov dx, 0x5c
call fcn.1401b2e40
test rax, rax
je 0x140001385
mov rbx, rax
lea r14, [rsp + 0x20]
mov rcx, r14
call fcn.140002ce4
sub rbx, rax
add rbx, 2
sar rbx, 1
mov rcx, r14
call fcn.140002ce4
mov rcx, rsi
mov rdx, rax
mov r8, rbx
call fcn.140002b20
mov rcx, rsi
mov rdx, rdi
call fcn.140002bce
mov rcx, r14
call fcn.140002a02
mov rcx, rsi
call fcn.140001074
xor ebx, ebx
test al, al
jne 0x140001394
lea rcx, str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
mov rdi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rdi
mov rcx, rsi
call fcn.140002ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1401f4a4e]
call rdi
mov ebx, 0x80070002
jmp 0x140001394
mov ebx, eax
lea rcx, str.WebView2:_Failed_to_find_the_app_exe_path._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14000138a
mov ebx, 0x80004005
lea rcx, [rsp + 0x20]
call fcn.140002a02
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401afad0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140007080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x1400070a1
mov eax, 0xff
call fcn.140002680
xor byte [rsi], al
jne 0x140007091
pop rsi
pop rbx
ret
Function at 0x1401c2688
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401c2484

Function at 0x1401c5eb4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1401c5eca
mov al, 1
jmp 0x1401c5f2a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1401c5edb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401c5f28
mov ecx, dword [rcx + 0x18]
nop
call fcn.1401c71e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401c5f28
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401c5f28
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401c5f28
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401c5f2a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401c72f0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1401be4e4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1401be4e4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401c7440
cmp rax, 0xffffffffffffffff
je 0x1401c7440
xor edi, edi
test rbp, rbp
jle 0x1401c73eb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401c6538
mov rbx, rax
test rax, rax
jne 0x1401c7378
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401c73e1
mov edx, 0x8000
mov ecx, r14d
call fcn.1401c016c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1401bf940
cmp eax, 0xffffffff
je 0x1401c73c1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401c7388
mov edx, r15d
mov ecx, r14d
call fcn.1401c016c
jmp 0x1401c73e1
cmp byte [rsi + 0x38], dil
je 0x1401c73d8
cmp dword [rsi + 0x34], 5
jne 0x1401c73d8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1401c73e1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401c43f0
jmp 0x1401c7454
jns 0x1401c7454
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1401be4e4
cmp rax, 0xffffffffffffffff
jne 0x1401c740c
cmp byte [rsi + 0x30], dil
je 0x1401c7454
mov edi, dword [rsi + 0x2c]
jmp 0x1401c7454
mov ecx, r14d
call fcn.1401c71e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401c7454
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1401c7454
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401c744d
mov eax, dword [rsi + 0x2c]
jmp 0x1401c7452
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1401be4e4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140012130
Capabilities:
Delete file
Encode data using xor

Disassembly:
sub rsp, 0x68
cmp byte [0x1400b34eb], 0
movups xmm0, xmmword [0x1400b34d0]
mov eax, dword [0x1400b34e8]
mov dword [rsp + 0x48], eax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x1400b34e0]
movsd qword [rsp + 0x40], xmm0
je 0x1400122ef
xor ecx, ecx
cmp dword [0x140238558], 2
jl 0x1400122b3
movdqa xmm0, xmmword [0x1400b46c0]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x1400b4620]
movdqa xmm3, xmmword [0x1400b46f0]
movdqa xmm5, xmmword [str.::::]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400b4690]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x1400121c0
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x1c
jge 0x1400122ef
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x1c
jl 0x1400122c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add rsp, 0x68
ret
Function at 0x14001d8a0
Capabilities:
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r10, rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rbp]
call fcn.14001da40
lea rdx, [rbp + 0x48]
lea rcx, [rbp]
call fcn.14001d2e0
nop
mov rdx, r10
lea rcx, [rbp - 0x80]
call fcn.140031aa0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.140031740
mov r8, qword [rax]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x80]
call fcn.140031760
mov rdx, qword [rax]
lea rcx, [rbp - 0x60]
call fcn.140034ad0
nop
lea rcx, [rbp - 0x60]
call fcn.140011890
add ax, ax
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], ax
lea rcx, [rbp - 0x60]
call fcn.140031560
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x40]
call fcn.14001da20
movzx ecx, byte [rax + 8]
test cl, cl
je 0x14001d96f
xor byte [rax], 0x33
xor byte [rax + 1], 0x34
xor byte [rax + 2], 0x35
xor byte [rax + 3], 0x36
xor byte [rax + 4], 0x37
xor byte [rax + 5], 0x38
xor byte [rax + 6], 0x39
xor byte [rax + 7], 0x3a
xor cl, 0x3b
mov byte [rax + 8], cl
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140031a60
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x40]
call fcn.140031740
mov r8, qword [rax]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.140031760
mov rdx, qword [rax]
lea rcx, [rbp - 0x20]
call fcn.140034ad0
lea rcx, [rbp - 0x20]
call fcn.140011890
add ax, ax
mov word [rsp + 0x60], ax
mov word [rsp + 0x62], ax
lea rcx, [rbp - 0x20]
call fcn.140031560
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0x18], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0x10
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x18]
mov edx, 3
mov r8d, edx
mov ecx, 0x50000018
call qword [sym.imp.ntdll.dll_ZwRaiseHardError]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14001dbd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], eax
nop word [rax + rax]
movups xmm0, xmmword [str.DYU]
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [0x1400b4338]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x1400b4340]
mov dword [rsp + 0x38], eax
movzx eax, word [0x1400b4344]
mov word [rsp + 0x3c], ax
cmp byte [0x1400b4345], cl
je 0x14001ddbe
cmp dword [0x140238558], 2
jl 0x14001dd7d
movdqa xmm4, xmmword [0x1400b4620]
movdqa xmm3, xmmword [0x1400b46f0]
movdqa xmm5, xmmword [str.::::]
movdqa xmm0, xmmword [0x1400b46c0]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x24]
movdqa xmm6, xmmword [0x1400b4690]
mov r8d, dword [rsp + 0x50]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x18
jl 0x14001dc91
cmp ecx, 0x1e
jge 0x14001ddbe
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax + rax]
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
sub al, dl
add al, 0x33
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1e
jl 0x14001dd90
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001dde0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140035750
nop
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001da80
nop
lea rcx, [rsp + 0x50]
call fcn.140033230
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140099880
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
ret
Function at 0x14002fdb0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14002fdd1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14002fdfe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002fe00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14002fe59
test ecx, ecx
jle 0x14002fe39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14002fe59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002fe59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
mov eax, 0xf81bd39d
xor ecx, edx
std
int3
Function at 0x14002fe80
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14002fea2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14002feb1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002fed4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002fed6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002ff12
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14002ffae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14002ff4d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14002ff8e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14002ffae
cmp rbx, rax
ja 0x14002ff60
test rbx, rbx
je 0x14002ffae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140030420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003044d
xor eax, eax
jmp 0x1400305b9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140030487
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140030487
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400305b9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400305ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400304ca
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400304f5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400305b1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140030564
sub eax, 1
je 0x140030564
cmp eax, 2
jne 0x1400305ac
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400305b1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140030592
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400305ac
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400305b1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140099880
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140032af0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140032bc3
cmp byte [rcx + 0x71], 0
je 0x140032bc3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140032bbf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140032b84
sub eax, 1
je 0x140032b88
cmp eax, 2
jne 0x140032bbf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140099880
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140032bb6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140032bbf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140032b6c
xor al, al
jmp 0x140032b6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140099880
add rsp, 0x60
pop rbx
ret

Function at 0x140037740
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.140099da0
lea rcx, [0x14001d330]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140038240]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400377ba
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140099880
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3