joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401de010
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, r9
mov r14, r8
mov rax, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
mov dword [rsp + 0x3c], 0x208
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x1401de067
mov rdx, qword [r8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1401de0c7
xor edi, edi
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov r8d, 0xd
lea rdx, str.ERROR_READREG
mov rcx, rbx
call fcn.1400f8950
nop
mov rcx, r14
call fcn.1400ebe10
nop
mov rcx, rsi
call fcn.1400ebe10
jmp 0x1401de232
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401de0d4
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401de109
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401de089
cmp dword [rsp + 0x38], 2
jne 0x1401de0fc
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401de11d
mov rdx, qword [rsi]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401de0fc
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 7
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1401de165
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.1400f8950
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbx + 0x10], xmm1
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x1401de1d8
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1401de1d3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401de252
mov rcx, r8
call fcn.14020be84
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x1401de223
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1401de21e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401de258
mov rcx, r8
call fcn.14020be84
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14020c3e0
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x1401de260
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, r9
mov r14, r8
mov rax, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r9
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x1401de2af
mov rdx, qword [r8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1401de30f
xor edi, edi
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov r8d, 0xd
lea rdx, str.ERROR_READREG
mov rcx, rbx
call fcn.1400f8950
nop
mov rcx, r14
call fcn.1400ebe10
nop
mov rcx, rsi
call fcn.1400ebe10
jmp 0x1401de48f
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401de31c
mov rdx, qword [rsi]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401de351
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401de2d1
cmp dword [rsp + 0x38], 1
jne 0x1401de344
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401de377
mov rdx, qword [rsi]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401de344
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1401de3c1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400f8950
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbx + 0x10], xmm1
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x1401de435
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1401de430
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401de4af
mov rcx, r8
call fcn.14020be84
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x1401de480
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1401de47b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401de4b5
mov rcx, r8
call fcn.14020be84
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14020c3e0
add rsp, 0x280
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x1401de4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x68], 8
cmp qword [r8 + 0x18], 8
mov qword [rsp + 0x58], rbx
jb 0x1401de4df
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x1401de4e9
mov rdx, qword [rdx]
lea rax, [rsp + 0x68]
or r9d, 0x40
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
cmove rbx, qword [rsp + 0x58]
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x1401de520
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x58], 4
cmp qword [r8 + 0x18], 8
mov dword [rsp + 0x68], ebx
jb 0x1401de53e
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x1401de548
mov rdx, qword [rdx]
lea rax, [rsp + 0x58]
or r9d, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
cmove ebx, dword [rsp + 0x68]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1401de580
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], r9
mov r9d, dword [rsp + 0xa0]
mov eax, VariantTimeToDosDateTime
test r9d, r9d
cmove r9d, eax
cmp qword [r8 + 0x18], 8
jb 0x1401de5c0
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x1401de5ca
mov rdx, qword [rdx]
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x1401de601
mov rcx, rbx
call fcn.1400ebe10
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14020c3e0
add rsp, 0x70
pop rbx
ret
mov r8d, eax
lea rdx, str.Cannot_set_DWORD64_to_registry
lea rcx, [rsp + 0x38]
call fcn.1401dd4c0
lea rdx, [0x14033e010]
lea rcx, [rsp + 0x38]
call fcn.14024304c
int3

Function at 0x1401de630
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r8
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x30], r9d
mov r9d, dword [rsp + 0xa0]
mov eax, 4
test r9d, r9d
cmove r9d, eax
cmp qword [r8 + 0x18], 8
jb 0x1401de670
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x1401de67a
mov rdx, qword [rdx]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x1401de6ad
mov rcx, rbx
call fcn.1400ebe10
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14020c3e0
add rsp, 0x70
pop rbx
ret
mov r8d, eax
lea rdx, str.Cannot_set_DWORD_to_registry
lea rcx, [rsp + 0x38]
call fcn.1401dd4c0
lea rdx, [0x14033e010]
lea rcx, [rsp + 0x38]
call fcn.14024304c
int3
Function at 0x1401de6e0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], rdx
mov rdi, r8
mov qword [rsp + 0x58], r8
mov rbx, rdx
cmp qword [rdx + 0x18], 8
mov rsi, rcx
mov dword [rsp + 0x50], r9d
jb 0x1401de70a
mov rdx, qword [rdx]
lea rax, [rsp + 0x58]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1401de769
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x1401de734
mov rdx, qword [rbx]
xor ecx, ecx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1401de7ab
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x1401de776
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x1401de7c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400ebe10
mov rcx, rdi
call fcn.1400ebe10
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400ebe10
mov rcx, rdi
call fcn.1400ebe10
mov eax, 1
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401de7f0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov rdi, r9
mov qword [rsp + 0x50], r8
mov rsi, r8
mov qword [rsp + 0x50], r9
mov rbx, rdx
cmp qword [rdx + 0x18], 8
mov rbp, rcx
jb 0x1401de81e
mov rdx, qword [rdx]
lea rax, [rsp + 0x50]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1401de87d
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x1401de848
mov rdx, qword [rbx]
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1401de8cd
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x1401de88a
mov rcx, qword [rdi]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x1401de897
mov rdx, qword [rsi]
mov eax, dword [rdi + 0x10]
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x1401de8f0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400ebe10
mov rcx, rsi
call fcn.1400ebe10
mov rcx, rdi
call fcn.1400ebe10
xor eax, eax
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.1400ebe10
mov rcx, rsi
call fcn.1400ebe10
mov rcx, rdi
call fcn.1400ebe10
mov eax, 1
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401e7d10
Capabilities:
Check if file exists
Create directory
Delete directory
Get file attributes

Disassembly:
sub rsp, 0x28
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysis_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jae 0x1401e7d33
lea rcx, [0x1402d0f90]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir
lea rcx, str.C:ProgramData_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401e7d4c
shr eax, 4
and al, 1
jne 0x1401e7d58
lea rcx, str.C:ProgramData_
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
lea rcx, str.C:ProgramDataASUS_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401e7d71
shr eax, 4
and al, 1
jne 0x1401e7d7d
lea rcx, str.C:ProgramDataASUS_
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
lea rcx, str.C:ProgramDataASUSASUS_System_Control_Interface_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401e7d96
shr eax, 4
and al, 1
jne 0x1401e7da2
lea rcx, str.C:ProgramDataASUSASUS_System_Control_Interface_
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
lea rcx, [0x1402d0f90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401e7dbb
shr eax, 4
and al, 1
jne 0x1401e7dc7
lea rcx, [0x1402d0f90]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysis_
add rsp, 0x28
jmp fcn.1401f2b60

Function at 0x1401e7de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401e7df6
xor al, al
add rsp, 0x28
ret
shr eax, 4
and al, 1
add rsp, 0x28
ret
Function at 0x1401f8780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401f87f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1401f87f8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1401f87e5
nop
cmp rbx, rcx
jae 0x1401f87f8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1401f87d0
cmp rbx, rcx
jae 0x1401f87f8
cmp word [rbx], 0
je 0x1401f87f8
lfence
mov rax, rbx
jmp 0x1401f87fa
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000168c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x1800130c0]
lea rsi, [0x180000000]
movsxd r11, edx
xor edi, edi
dec r11
mov r10, rcx
mov r9, qword [rsi + r8*8 + 0x130d0]
inc r8d
test r11, r11
jle 0x1800016ee
mov rax, r9
sub r10, r9
mov rbx, r11
mov cl, byte [r10 + rax]
mov edx, 0xf
xor cl, byte [rdx + rsi + 0xda08]
sub rdx, 1
jns 0x1800016d6
mov byte [rax], cl
inc rax
sub rbx, 1
jne 0x1800016cd
mov rbx, qword [rsp + 8]
cmp r8d, 0xf
mov rsi, qword [rsp + 0x10]
mov rax, r9
cmovge r8d, edi
mov byte [r11 + r9], dil
mov rdi, qword [rsp + 0x18]
mov dword [0x1800130c0], r8d
ret

Function at 0x180001714
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov rbp, rdx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov ebx, dword [r8 + 0x1c]
mov edi, dword [r8 + 0x24]
add rbx, rcx
mov r10d, dword [r8 + 0x20]
add rdi, rcx
mov esi, dword [r8 + 0x18]
add r10, rcx
xor ecx, ecx
test esi, esi
je 0x18000178c
mov edx, dword [r10]
mov rax, rbp
add rdx, r9
sub rdx, rbp
movzx r8d, byte [rax]
movzx r11d, byte [rax + rdx]
sub r8d, r11d
jne 0x18000177d
inc rax
test r11d, r11d
jne 0x180001767
test r8d, r8d
je 0x1800017a3
inc ecx
add r10, 4
cmp ecx, esi
jb 0x18000175b
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rdi + rcx*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
jmp 0x18000178e

Function at 0x1800017b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
movsxd r8, dword [0x1800130c0]
lea r14, [0x180000000]
movsxd rdi, edx
xor esi, esi
mov r10, rcx
mov r9, qword [r14 + r8*8 + 0x130d0]
inc r8d
lea eax, [rdi - 1]
test eax, eax
jle 0x18000181c
mov rcx, r9
mov r11d, eax
movzx edx, byte [r10]
mov ebx, 0xf
movzx eax, byte [rbx + r14 + 0xda08]
xor dx, ax
sub rbx, 1
jns 0x1800017fa
mov word [rcx], dx
inc r10
add rcx, 2
sub r11, 1
jne 0x1800017f1
mov rbx, qword [rsp + 8]
cmp r8d, 0xf
mov r14, qword [rsp + 0x20]
mov rax, r9
cmovge r8d, esi
mov word [r9 + rdi*2 - 2], si
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [0x1800130c0], r8d
ret
Function at 0x180003c68
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180003c99
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x180003d0c
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180003cb0
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180003cb2
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180003d06
test ecx, ecx
jle 0x180003ce6
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x180003d06
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180003d06
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180003d28
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180003d4d
xor eax, eax
jmp 0x180003e48
cmp qword [rcx + 0x68], 0
je 0x180003d5f
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x180003e48
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x180003d76
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180003d78
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180003da8
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov r8, rbp
cmp qword [rsi + 0x80], 0
je 0x180003e42
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x180003de3
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x180003e1c
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x180003e59
cmp rbp, r15
ja 0x180003df1
mov r8, rbx
test rbx, rbx
je 0x180003e42
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x180003e45
Function at 0x180004204
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180012010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x18000423d
xor eax, eax
jmp 0x180004350
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x180004266
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x180004266
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x180004350
cmp qword [rcx + 0x80], 0
je 0x18000434e
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1800042a1
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800042c5
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x18000434e
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180004313
sub eax, 1
je 0x180004313
cmp eax, 2
jne 0x18000434e
movsx ecx, byte [rbp - 0x30]
jmp 0x1800042ae
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x18000433e
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x18000434e
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x180004350
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b3d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000494c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180012010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800049bb
cmp byte [rcx + 0x71], 0
je 0x1800049bb
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180004a10
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800049d5
sub eax, 1
je 0x1800049d9
cmp eax, 2
jne 0x180004a10
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000b3d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180004a07
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180004a10
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800049bd
xor al, al
jmp 0x1800049bd