joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140215680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1402156ae
cvtsi2ss xmm0, rdx
jmp 0x1402156c3
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x14031bb90]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1402156f1
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1402156f1
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14021571f
cmp rbx, 0x200
jae 0x14021571c
shl rbx, 3
cmp rbx, rcx
jae 0x14021571f
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401f3900

Function at 0x14023b8e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
mov rsi, rdx
mov ebx, 0x198
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov dil, byte [rbx]
mov byte [rsp + 0x28], dil
mov byte [rbx], 1
mov rcx, qword [rdx]
call fcn.14023b5b0
mov rax, qword [rsi]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [case.0x14004a846.0]
mov byte [rbx], dil
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1402445e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
mov eax, 0x90
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
movups xmm0, xmmword [r8]
movdqu xmmword [rbp - 9], xmm0
lea r8, [rbp - 9]
lea rdx, [rbp - 0x11]
call fcn.140244730
mov r9d, dword [rax]
lea ecx, [r9 - 1]
xor edi, edi
cmp ecx, 1
jbe 0x140244643
cmp r9d, 4
je 0x14024464d
mov byte [rbx + 0x20], dil
jmp 0x14024470c
cmp r9d, 4
jne 0x1402446e8
movups xmm0, xmmword [rsi]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp - 0x21], r9d
movdqu xmmword [rbp - 9], xmm0
lea r8, [rbp - 9]
lea rdx, [rbp - 0x11]
mov rcx, r14
call fcn.140245bec
cmp byte [rbp - 0xd], dil
je 0x14024463a
mov eax, dword [rbp - 0x11]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rdx, qword [rbp + 7]
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14024463a
mov edx, dword [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.140010290
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov byte [rbx + 0x20], 1
lea rcx, [rbp + 7]
call fcn.14000ac30
jmp 0x14024470c
lea eax, [r9 - 1]
cmp eax, 1
ja 0x14024463a
movups xmm0, xmmword [rsi]
movdqu xmmword [rbp + 7], xmm0
lea r8, [rbp + 7]
mov rdx, rbx
mov rcx, r14
call fcn.140245aac
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140244730
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, r8
and qword [rsp + 0x20], 0
mov rbx, rdx
xor r8d, r8d
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140244776
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov byte [rbx + 4], 1
jmp 0x14024477a
mov byte [rbx + 4], 0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140245aac
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
mov eax, 0x90
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov dword [rbp - 0x21], r9d
movaps xmm0, xmmword [r8]
movdqa xmmword [rbp - 9], xmm0
lea r8, [rbp - 9]
lea rdx, [rbp - 0x19]
call fcn.140245bec
xor r14d, r14d
cmp byte [rbp - 0x15], r14b
jne 0x140245b08
mov byte [rbx + 0x20], r14b
jmp 0x140245bce
mov qword [rbp + 7], r14
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], 7
mov rax, qword [rbp - 0x19]
mov dword [rbp - 0x29], eax
mov edx, eax
shr rdx, 1
sub rdx, 1
jne 0x140245b36
mov qword [rbp + 0x17], rdx
mov word [rbp + rdx*2 + 7], r14w
jmp 0x140245b42
xor r8d, r8d
lea rcx, [rbp + 7]
call fcn.14000aabc
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140245bbb
mov byte [rbx + 0x20], r14b
mov rax, qword [rbp + 0x1f]
cmp rax, 8
jb 0x140245bce
mov rcx, qword [rbp + 7]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x140245bb3
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140245bb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140245bce
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov byte [rbx + 0x20], 1
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140245bec
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x58]
and dword [rsp + 0x40], 0
mov rax, r8
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rax]
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x140245c3a
mov byte [rbx + 4], 0
jmp 0x140245c44
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov byte [rbx + 4], 1
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14024754c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
mov r10, qword [r8 + 0x10]
mov rcx, r8
cmp qword [r8 + 0x18], 8
jb 0x140247576
mov rcx, qword [r8]
xor edx, edx
movabs r9, 0xcbf29ce484222325
add r10, r10
je 0x1402475a4
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r11, 0x100000001b3
imul r9, r11
inc rdx
cmp rdx, r10
jb 0x140247587
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d4240
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1402475be
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 8]
jne 0x1402475ca
mov byte [rbx + 0x20], 0
jmp 0x1402475da
add rdx, 0x30
mov rcx, rbx
call fcn.14000ad78
mov byte [rbx + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1402475e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140247628
mov rdx, qword [r14]
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
add r8, r8
je 0x140247656
movzx eax, byte [rcx + rdx]
xor rbp, rax
movabs r9, 0x100000001b3
imul rbp, r9
inc rcx
cmp rcx, r8
jb 0x140247639
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400d4240
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14024767f
mov qword [rdi], rdx
mov byte [rdi + 8], 0
jmp 0x1402477c4
movabs rax, 0x333333333333333
cmp qword [rsi + 0x10], rax
jne 0x14024769d
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r12, [rsi + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1402476c6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
int3
mov qword [rsp + 0x38], rbx
mov rdx, r14
lea rcx, [rax + 0x10]
call fcn.14000ad78
and qword [rbx + 0x30], 0
and qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 7
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1402476fd
cvtsi2ss xmm0, rcx
jmp 0x140247712
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140247725
cvtsi2ss xmm1, rcx
jmp 0x14024773a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14024776d
mov rcx, rsi
call fcn.140126e50
mov r9, rbp
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d4240
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rsi + 0x10]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1402477a6
mov qword [rcx + rax*8], rbx
jmp 0x1402477b8
cmp r9, rdx
jne 0x1402477b1
mov qword [rcx + rax*8], rbx
jmp 0x1402477bd
cmp qword [rcx + rax*8 + 8], r8
jne 0x1402477bd
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1402477e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140247827
mov rdx, qword [r14]
movabs rbp, 0xcbf29ce484222325
xor r13d, r13d
mov ecx, r13d
add r8, r8
je 0x140247859
movzx eax, byte [rcx + rdx]
xor rbp, rax
movabs r9, 0x100000001b3
imul rbp, r9
inc rcx
cmp rcx, r8
jb 0x14024783c
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d4240
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x140247882
mov qword [rsi], rdx
mov byte [rsi + 8], r13b
jmp 0x1402479e5
movabs rax, 0x333333333333333
cmp qword [rdi + 0x10], rax
jne 0x1402478a0
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r12, [rdi + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1402478c8
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
int3
mov qword [rsp + 0x38], rbx
lea r15, [rax + 0x10]
mov qword [r15], r13
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], r13
movups xmm0, xmmword [r14]
movups xmmword [r15], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [r14 + 0x10], r13
mov eax, 7
mov qword [r14 + 0x18], rax
mov word [r14], r13w
mov qword [r15 + 0x20], r13
mov qword [r15 + 0x30], r13
mov qword [r15 + 0x38], rax
mov rcx, qword [rdi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14024791f
cvtsi2ss xmm0, rcx
jmp 0x140247934
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rdi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140247947
cvtsi2ss xmm1, rcx
jmp 0x14024795c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rdi]
seta al
test al, al
je 0x14024798e
mov rcx, rdi
call fcn.140126e50
mov r9, rbp
mov r8, r15
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d4240
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rdi + 0x10]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1402479c7
mov qword [rcx + rax*8], rbx
jmp 0x1402479d9
cmp r9, rdx
jne 0x1402479d2
mov qword [rcx + rax*8], rbx
jmp 0x1402479de
cmp qword [rcx + rax*8 + 8], r8
jne 0x1402479de
mov qword [rcx + rax*8 + 8], rbx
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14024a9a0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14024a9da
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14024aa4d
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14024a9f1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14024a9f3
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14024aa47
test ecx, ecx
jle 0x14024aa22
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14024aa47
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14024aa47
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14024aa70
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov rdi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14024aaa7
xor eax, eax
jmp 0x14024ab8b
cmp qword [rcx + 0x68], 0
je 0x14024aab9
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14024ab8b
mov rax, qword [rcx + 0x38]
mov rsi, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x14024aad0
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14024aad2
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14024aaff
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x14024ab85
mov r8, qword [rbp + 0x18]
lea rax, [rbp + 0x70]
cmp qword [r8], rax
jne 0x14024ab36
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbp + 0x38]
mov qword [rax], rcx
mov rax, qword [rbp + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14024ab60
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14024ab85
cmp rsi, rbx
ja 0x14024ab3d
test rsi, rsi
je 0x14024ab85
mov r9, qword [rbp + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rsi, rax
sub rdi, rsi
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14024af80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
mov eax, 0x80
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x14024afbf
xor eax, eax
jmp 0x14024b0ce
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14024afe8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x14024afe8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14024b0ce
cmp qword [rcx + 0x80], 0
je 0x14024b0cc
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14024b023
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14024b044
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x14024b0c9
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14024b092
sub eax, 1
je 0x14024b092
cmp eax, 2
jne 0x14024b0cc
movsx ecx, byte [rbp - 0x40]
jmp 0x14024b030
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14024b0bd
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x14024b0cc
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14024b4dc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x60
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14024b55b
cmp byte [rcx + 0x71], 0
je 0x14024b55b
mov rax, qword [rcx]
or edx, 0xffffffff
mov rax, qword [rax + 0x18]
call qword [case.0x14004a846.0]
cmp eax, 0xffffffff
je 0x14024b5b0
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14024b575
sub eax, 1
je 0x14024b579
cmp eax, 2
jne 0x14024b5b0
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14024b5a7
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14024b5b0
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14024b55d
xor al, al
jmp 0x14024b55d

Function at 0x14024d64c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14024d696
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14024d696
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14024d696
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14024d696
cmp dword [rcx + 0x84], 0xe
jbe 0x14024d696
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14024d698
xor al, al
add rsp, 0x28
ret

Function at 0x14024e4ac
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14024e524
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14024e524
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14024e524
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14024e518
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14024e536
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14024e506
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14024e526