joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ec90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401bfbd4], eax
jle 0x14004ed7f
lea rcx, [0x1401bfbd4]
call fcn.1400728d0
cmp dword [0x1401bfbd4], 0xffffffff
jne 0x14004ed7f
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
mov r8d, 0x19
lea rdx, str.MmProtectMdlSystemAddress
lea rcx, [rbp + 0x27]
call fcn.14005a6a0
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x1401bc9a8]
mov rcx, rbx
call fcn.14004f4a0
mov qword [0x1401bfb98], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14004ed73
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ed6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ed6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b0
nop
lea rcx, [0x1401bfbd4]
call fcn.140072864
mov r8, qword [0x1401bfb98]
test r8, r8
jne 0x14004ee79
mov dword [rbp - 0x39], 0x41bb41c2
mov dword [rbp - 0x35], 0x41bc41c6
mov dword [rbp - 0x31], 0x41ff41db
mov dword [rbp - 0x2d], 0x41cc41f6
mov dword [rbp - 0x29], 0x41c641c4
mov dword [rbp - 0x25], 0x41d04183
mov dword [rbp - 0x21], 0x418641ca
mov dword [rbp - 0x1d], 0x41c141c1
mov dword [rbp - 0x19], 0x41ce41c7
mov dword [rbp - 0x15], 0x41e1418b
mov dword [rbp - 0x11], 0x41fe41c0
mov dword [rbp - 0xd], 0x41df41dd
mov dword [rbp - 9], 0x41d741c5
mov dword [rbp - 5], 0x41c041d0
mov dword [rbp - 1], 0x41d241f8
mov dword [rbp + 3], 0x41eb41db
mov dword [rbp + 7], 0x41c941c0
mov dword [rbp + 0xb], 0x41d941cf
mov dword [rbp + 0xf], 0x41ff41d0
mov dword [rbp + 0x13], 0x41a441db
mov dword [rbp + 0x17], 0x41a741b3
mov dword [rbp + 0x1b], 0x41b741b0
xor eax, eax
mov word [rbp + 0x1f], ax
mov byte [rbp + 0x21], 1
mov edx, 0x4199
nop dword [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x39], cx
inc rax
cmp rax, 0x2c
jb 0x14004ee40
mov byte [rbp + 0x21], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140055b70
lea rdx, [0x140055d50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004ee9b
mov dword [rsp + 0x20], 0x40
mov r9, rdi
lea rdx, [rbp + 0x47]
mov rcx, rbx
call fcn.140056b20
test al, al
je 0x14004ee75
cmp dword [rbp + 0x47], 0
setge al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400726c0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14004eec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401bfb40], eax
jle 0x14004efaf
lea rcx, [0x1401bfb40]
call fcn.1400728d0
cmp dword [0x1401bfb40], 0xffffffff
jne 0x14004efaf
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x27], xmm1
mov r8d, send
lea rdx, str.MmUnmapLockedPages
lea rcx, [rbp + 0x17]
call fcn.14005a6a0
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x1401bc9a8]
mov rcx, rbx
call fcn.14004f4a0
mov qword [0x1401bfc00], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14004efa3
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ef9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ef9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b0
nop
lea rcx, [0x1401bfb40]
call fcn.140072864
mov r8, qword [0x1401bfc00]
test r8, r8
jne 0x14004f089
mov dword [rbp - 0x39], 0x41bb41c2
mov dword [rbp - 0x35], 0x41bc41c6
mov dword [rbp - 0x31], 0x41ff41db
mov dword [rbp - 0x2d], 0x41cc41f6
mov dword [rbp - 0x29], 0x41c641c4
mov dword [rbp - 0x25], 0x41d04183
mov dword [rbp - 0x21], 0x418641ca
mov dword [rbp - 0x1d], 0x41c141c1
mov dword [rbp - 0x19], 0x41ce41c7
mov dword [rbp - 0x15], 0x41e1418b
mov dword [rbp - 0x11], 0x41fb41c0
mov dword [rbp - 0xd], 0x41dd41c1
mov dword [rbp - 9], 0x41c241d0
mov dword [rbp - 5], 0x41db41ff
mov dword [rbp - 1], 0x41dd41d6
mov dword [rbp + 3], 0x41dc41d2
mov dword [rbp + 7], 0x41db41e9
mov dword [rbp + 0xb], 0x41d941dc
mov dword [rbp + 0xf], 0x41ce
xor eax, eax
mov byte [rbp + 0x13], 1
mov edx, 0x4199
nop
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x39], cx
inc rax
cmp rax, 0x25
jb 0x14004f050
mov byte [rbp + 0x13], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140055b70
lea rdx, [0x140055d50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004f09d
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea rdx, [rbp + 0x37]
mov rcx, rbx
call fcn.1400571d0
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400726c0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004f0c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401bfb18], eax
jle 0x14004f1af
lea rcx, [0x1401bfb18]
call fcn.1400728d0
cmp dword [0x1401bfb18], 0xffffffff
jne 0x14004f1af
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
mov r8d, send
lea rdx, str.MmFreePagesFromMdl
lea rcx, [rbp + 0x27]
call fcn.14005a6a0
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x1401bc9a8]
mov rcx, rbx
call fcn.14004f4a0
mov qword [0x1401bfbd8], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14004f1a3
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f19d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f19d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b0
nop
lea rcx, [0x1401bfb18]
call fcn.140072864
mov r8, qword [0x1401bfbd8]
test r8, r8
jne 0x14004f289
mov dword [rbp - 0x29], 0x41bb41c2
mov dword [rbp - 0x25], 0x41bc41c6
mov dword [rbp - 0x21], 0x41ff41db
mov dword [rbp - 0x1d], 0x41cc41f6
mov dword [rbp - 0x19], 0x41c641c4
mov dword [rbp - 0x15], 0x41d04183
mov dword [rbp - 0x11], 0x418641ca
mov dword [rbp - 0xd], 0x41c141c1
mov dword [rbp - 9], 0x41ce41c7
mov dword [rbp - 5], 0x41e1418b
mov dword [rbp - 1], 0x41e841c0
mov dword [rbp + 3], 0x41d541dd
mov dword [rbp + 7], 0x41e241d4
mov dword [rbp + 0xb], 0x41d341d2
mov dword [rbp + 0xf], 0x41c541d0
mov dword [rbp + 0x13], 0x41ca41f1
mov dword [rbp + 0x17], 0x41d741d6
mov dword [rbp + 0x1b], 0x41d841f6
mov dword [rbp + 0x1f], 0x41d1
xor eax, eax
mov byte [rbp + 0x23], 1
mov edx, 0x4199
nop
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x29], cx
inc rax
cmp rax, 0x25
jb 0x14004f250
mov byte [rbp + 0x23], 0
lea rdx, [rbp - 0x29]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140055b70
lea rdx, [0x140055d50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004f298
mov r9, rdi
lea rdx, [rbp + 0x47]
mov rcx, rbx
call fcn.140057890
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400726c0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14004f2c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x14004f475
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401bfbb8], eax
jle 0x14004f3aa
lea rcx, [0x1401bfbb8]
call fcn.1400728d0
cmp dword [0x1401bfbb8], 0xffffffff
jne 0x14004f3aa
xorps xmm0, xmm0
movups xmmword [rbp + 0x37], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x47], xmm1
mov r8d, 0xa
lea rdx, str.ExFreePool
lea rcx, [rbp + 0x37]
call fcn.14005a6a0
nop
lea r8, [rbp + 0x37]
mov rdx, qword [0x1401bc9a8]
mov rcx, rdi
call fcn.14004f4a0
mov qword [0x1401bfb88], rax
mov rdx, qword [rbp + 0x4f]
cmp rdx, 0x10
jb 0x14004f39e
inc rdx
mov rcx, qword [rbp + 0x37]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f398
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f398
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b0
nop
lea rcx, [0x1401bfbb8]
call fcn.140072864
mov r8, qword [0x1401bfb88]
test r8, r8
jne 0x14004f479
mov dword [rbp - 0x19], 0x41bb41c2
mov dword [rbp - 0x15], 0x41bc41c6
mov dword [rbp - 0x11], 0x41ff41db
mov dword [rbp - 0xd], 0x41cc41f6
mov dword [rbp - 9], 0x41c641c4
mov dword [rbp - 5], 0x41d04183
mov dword [rbp - 1], 0x418641ca
mov dword [rbp + 3], 0x41c141c1
mov dword [rbp + 7], 0x41ce41c7
mov dword [rbp + 0xb], 0x41e9418b
mov dword [rbp + 0xf], 0x41ef41d5
mov dword [rbp + 0x13], 0x41dc41c3
mov dword [rbp + 0x17], 0x41d141de
mov dword [rbp + 0x1b], 0x41c041d2
mov dword [rbp + 0x1f], 0x41e641d0
mov dword [rbp + 0x23], 0x41d741d8
mov dword [rbp + 0x27], 0x41d5
xor eax, eax
mov byte [rbp + 0x2b], 1
mov edx, 0x4199
nop dword [rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x19], cx
inc rax
cmp rax, 0x21
jb 0x14004f440
mov byte [rbp + 0x2b], 0
lea rdx, [rbp - 0x19]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140055b70
lea rdx, [0x140055d50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004f486
mov r9, rbx
xor edx, edx
mov rcx, rdi
call fcn.140057f40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140050200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400503d5
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401bfbd0], eax
jle 0x1400502ea
lea rcx, [0x1401bfbd0]
call fcn.1400728d0
cmp dword [0x1401bfbd0], 0xffffffff
jne 0x1400502ea
xorps xmm0, xmm0
movups xmmword [rbp + 0x37], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x47], xmm1
mov r8d, socket
lea rdx, str.ExReleaseResourceLite
lea rcx, [rbp + 0x37]
call fcn.14005a6a0
nop
lea r8, [rbp + 0x37]
mov rdx, qword [0x1401bc9a8]
mov rcx, rdi
call fcn.14004f4a0
mov qword [0x1401bfb60], rax
mov rdx, qword [rbp + 0x4f]
cmp rdx, 0x10
jb 0x1400502de
inc rdx
mov rcx, qword [rbp + 0x37]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400502d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400502d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b0
nop
lea rcx, [0x1401bfbd0]
call fcn.140072864
mov r8, qword [0x1401bfb60]
test r8, r8
jne 0x1400503d9
mov dword [rbp - 0x29], 0x41bb41c2
mov dword [rbp - 0x25], 0x41bc41c6
mov dword [rbp - 0x21], 0x41ff41db
mov dword [rbp - 0x1d], 0x41cc41f6
mov dword [rbp - 0x19], 0x41c641c4
mov dword [rbp - 0x15], 0x41d04183
mov dword [rbp - 0x11], 0x418641ca
mov dword [rbp - 0xd], 0x41c141c1
mov dword [rbp - 9], 0x41ce41c7
mov dword [rbp - 5], 0x41e9418b
mov dword [rbp - 1], 0x41fc41d5
mov dword [rbp + 3], 0x41dc41ca
mov dword [rbp + 7], 0x41d341d4
mov dword [rbp + 0xb], 0x41d141c0
mov dword [rbp + 0xf], 0x41d341e7
mov dword [rbp + 0x13], 0x41d741c4
mov dword [rbp + 0x17], 0x41c841cc
mov dword [rbp + 0x1b], 0x41d941d8
mov dword [rbp + 0x1f], 0x41d741f1
mov dword [rbp + 0x23], 0x41a541cb
xor eax, eax
mov word [rbp + 0x27], ax
mov byte [rbp + 0x29], 1
mov edx, 0x4199
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x29], cx
inc rax
cmp rax, 0x28
jb 0x1400503a0
mov byte [rbp + 0x29], 0
lea rdx, [rbp - 0x29]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140055b70
lea rdx, [0x140055d50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x1400503e6
mov r9, rbx
xor edx, edx
mov rcx, rdi
call fcn.140058c90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140051a60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.1400738a0
sub rsp, rax
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov rdi, r9
mov rbx, r8
test r8, r8
je 0x140051c78
mov r9d, 0x1000
lea rdx, [rsp + 0x60]
call fcn.14004e2c0
xor edx, edx
test al, al
jne 0x140051b61
mov dword [rsp + 0x20], 0x41b741c2
mov r8d, 0x4199
mov dword [rsp + 0x24], 0x41bc41c6
mov dword [rsp + 0x28], 0x41ff41de
mov dword [rsp + 0x2c], 0x418741f1
mov dword [rsp + 0x30], 0x418241d5
mov dword [rsp + 0x34], 0x41c141d1
mov dword [rsp + 0x38], 0x41c241c4
mov dword [rsp + 0x3c], 0x41c54187
mov dword [rsp + 0x40], 0x41ce41c6
mov dword [rsp + 0x44], 0x41c041de
mov dword [rsp + 0x48], 0x418e41c8
mov dword [rsp + 0x4c], 0x41d541c7
mov dword [rsp + 0x50], 0x41d641d0
mov dword [rsp + 0x54], 0x41c641d6
mov dword [rsp + 0x58], 0x41c6
mov byte [rsp + 0x5c], 1
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x1d
jb 0x140051b40
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x20]
jmp 0x140051c5c
movsxd rax, dword [rbp - 0x64]
lea rcx, [rsp + 0x60]
add rcx, rax
mov r9d, edx
movzx eax, word [rcx + 0x14]
lea r11, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add r11, rax
test r10d, r10d
je 0x140051bcb
nop word [rax + rax]
mov eax, r9d
lea rcx, [rax + rax*4]
cmp dword [r11 + rcx*8], 0x45474150
lea r8, [r11 + rcx*8]
jne 0x140051bc3
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r8 + rax], dl
jne 0x140051bb0
cmp rax, 4
je 0x140051c94
inc r9d
cmp r9d, r10d
jb 0x140051b90
mov dword [rsp + 0x20], 0x41b741c2
mov r8d, 0x4199
mov dword [rsp + 0x24], 0x41bc41c6
mov dword [rsp + 0x28], 0x41ff41de
mov dword [rsp + 0x2c], 0x418741f1
mov dword [rsp + 0x30], 0x418241d5
mov dword [rsp + 0x34], 0x41cd41c5
mov dword [rsp + 0x38], 0x41c241cb
mov dword [rsp + 0x3c], 0x41db4187
mov dword [rsp + 0x40], 0x41c941cc
mov dword [rsp + 0x44], 0x41c541df
mov dword [rsp + 0x48], 0x41c041c2
mov word [rsp + 0x4c], dx
mov byte [rsp + 0x4e], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x16
jb 0x140051c40
mov byte [rsp + 0x4e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140055b70
lea rdx, [0x140055d50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.1400726c0
add rsp, 0x1070
pop rdi
pop rbx
pop rbp
ret
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x140051bcb
mov ecx, dword [r8 + 8]
lea rax, [rsp + rax + 0x60]
test rax, rax
je 0x140051bcb
test ecx, ecx
je 0x140051bcb
test rdi, rdi
je 0x140051cc1
mov dword [rdi], ecx
lea rcx, [rsp + 0x60]
sub rax, rcx
add rax, rbx
jmp 0x140051c7a
Function at 0x1400543b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x1400543d5
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x3a
jb 0x1400543c0
mov byte [rcx + 0x76], 0
ret

Function at 0x1400543e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
je 0x140054405
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x35
jb 0x1400543f0
mov byte [rcx + 0x6c], 0
ret

Function at 0x140054410
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x74], 0
je 0x140054435
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x39
jb 0x140054420
mov byte [rcx + 0x74], 0
ret

Function at 0x140054440
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
je 0x140054465
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x36
jb 0x140054450
mov byte [rcx + 0x6e], 0
ret

Function at 0x140054470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x140054495
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x23
jb 0x140054480
mov byte [rcx + 0x48], 0
ret

Function at 0x1400544a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x66], 0
je 0x1400544c5
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x32
jb 0x1400544b0
mov byte [rcx + 0x66], 0
ret

Function at 0x140054860
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140054881
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400548ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400548b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140054909
test ecx, ecx
jle 0x1400548e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140054909
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140054909
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
sti
pop rsp
invalid
Function at 0x140054930
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140054952
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140054961
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140054984
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140054986
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400549c2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140054a5e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400549fd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140054a3e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140054a5e
cmp rbx, rax
ja 0x140054a10
test rbx, rbx
je 0x140054a5e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sbb eax, dword [ebp + 0x73]
movabs dword [0x2afb08fb2af71fd6], eax
invalid