joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400131f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140231b80]
mov edi, ecx
cmp byte [rbx + 0x423d], 0
jne 0x140013251
cmp byte [rbx + 0x423e], 0
jne 0x140013251
movsx r9d, word [rbx + 0x5332]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003ec0
test dil, 1
je 0x140013378
jmp 0x1400132dc
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5332]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140172ed0]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x140172eb4]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x3fa8], rax
mov dword [rbx + 0x3f94], 1
movss dword [rbx + 0x3fa0], xmm0
movss dword [rbx + 0x3fa4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x140172dd4]
or dword [rbx + 0x3f90], 0x41
movss dword [rbx + 0x3ff0], xmm0
call fcn.140003ec0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140013330
lea r11, [0x14016d0b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140013313
cmp byte [r8], r9b
jne 0x140013313
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013300
not ecx
call fcn.14000c020
test rax, rax
je 0x140013378
cmp byte [rax + 0x96], 0
je 0x140013378
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5332]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5332]
call fcn.140003ec0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000e790
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140123840
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140018170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140018217
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400181ca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001a4c0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400048b0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140231b90]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001821f
mov rcx, rbx
call fcn.1400048b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140018790
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140231b80]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1400187f3
mov qword [rsp], rbx
lea rbx, [0x14016d0b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400187d3
cmp byte [r8], r9b
jne 0x1400187d3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400187c0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5390]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140018827
mov r10, qword [r10 + 0x5398]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001882e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140018814
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1400481b8
Capabilities:
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x1400481e8
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x1400481ca
mov rax, r8
ret
Function at 0x1400a158c
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
jmp 0x1400a15f1
cmp ecx, 0x29
jne 0x1400a1606
cmp dword [rdi + 0x1c], 0
jne 0x1400a15fb
test dword [rdi + 0x80], 0x10000000
je 0x1400a1739
cmp ecx, 0x5d
jne 0x1400a15d0
test dword [rdi + 0x80], 0x10000000
je 0x1400a1747
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.1400a0b10
mov rcx, rdi
call fcn.1400a4030
mov rcx, rdi
call fcn.1400a40a4
mov ecx, dword [rdi + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
je 0x1400a15fb
cmp ecx, 0x7c
jne 0x1400a15a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x2e
jne 0x1400a1616
lea rcx, [rdi + 0x40]
call fcn.1400a0db0
jmp 0x1400a15dc
cmp ecx, 0x5c
jne 0x1400a166b
mov rcx, rdi
call fcn.1400a4030
test byte [rdi + 0x80], 0x80
je 0x1400a165e
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x1400a1646
lea rcx, [rdi + 0x40]
call fcn.1400a1580
mov rcx, rdi
call fcn.1400a4030
jmp 0x1400a15ec
cmp al, 0x42
jne 0x1400a165e
lea rcx, [rdi + 0x40]
call fcn.1400a1580
lea rcx, [rdi + 0x40]
call fcn.1400a3fc0
jmp 0x1400a163c
mov rcx, rdi
call fcn.1400a1840
jmp 0x1400a15e4
cmp ecx, 0x5b
jne 0x1400a1696
mov rcx, rdi
call fcn.1400a4030
mov rcx, rdi
call fcn.1400a1f9c
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.1400a32c4
jmp 0x1400a15e4
cmp ecx, 0x28
jne 0x1400a16cb
mov rcx, rdi
call fcn.1400a4030
mov rcx, rdi
call fcn.1400a44ac
mov edx, reloc.WLDAP32.dll_Ordinal_41
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.1400a32c4
test bl, bl
je 0x1400a15ec
jmp 0x1400a15e4
cmp ecx, 0x5e
jne 0x1400a16de
lea rcx, [rdi + 0x40]
call fcn.1400a0b04
jmp 0x1400a163c
cmp ecx, 0x24
jne 0x1400a16f1
lea rcx, [rdi + 0x40]
call fcn.1400a0ea0
jmp 0x1400a163c
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400a171d
cmp ecx, 0x3f
je 0x1400a171d
cmp ecx, 0x7b
je 0x1400a171d
cmp ecx, 0x7d
jne 0x1400a15bb
test dword [rdi + 0x80], 0x10000000
je 0x1400a172b
jmp 0x1400a15d0
mov edx, 0xa
mov rcx, rdi
call fcn.1400a32b8
int3
mov edx, 6
mov rcx, rdi
call fcn.1400a32b8
int3
mov edx, 5
mov rcx, rdi
call fcn.1400a32b8
int3
mov edx, 4
mov rcx, rdi
call fcn.1400a32b8
int3
Function at 0x1400ac4d4
Capabilities:
Encode data using xor

Disassembly:
sub r8, rdx
mov rcx, rdx
mov rdx, r8
jmp fcn.1400481b8
Function at 0x1400c23c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400c2493
cmp byte [rcx + 0x71], 0
je 0x1400c2493
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400c248f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400c2454
sub eax, 1
je 0x1400c2458
cmp eax, 2
jne 0x1400c248f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140123840
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400c2486
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400c248f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400c243c
xor al, al
jmp 0x1400c243c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140123840
add rsp, 0x60
pop rbx
ret

Function at 0x1400c3460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400c3488
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 6]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x1400c3470
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x1400c34b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400c34d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 6]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x43
jb 0x1400c34c0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400c34e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x1400c3568
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [r9 + rax]
xor byte [rax + 4], dl
lea ecx, [rdx - 6]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 5]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 4]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 3]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 2]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 1]
xor byte [rax - 0xb], cl
lea ecx, [rdx + 1]
xor byte [rax - 9], cl
lea ecx, [rdx + 2]
xor byte [rax - 8], cl
lea ecx, [rdx + 3]
xor byte [rax - 7], cl
lea ecx, [rdx + 4]
xor byte [rax - 6], cl
lea ecx, [rdx + 5]
xor byte [rax - 5], cl
lea ecx, [rdx + 6]
xor byte [rax - 4], cl
add dl, 7
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x46
jb 0x1400c3500
mov byte [r8 + 0x47], 0
mov rax, r8
ret
Function at 0x1400c84d0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, rcx
mov qword [rsp + 0x90], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x2d
jb 0x1400c871c
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400c8522
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.start_cmd__C__color_b__title_Error__echo
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.1400bff00
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1400c85a3
lea rax, [rcx + 0x11]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x68]
jmp 0x1400c85c5
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recvfrom
lea rcx, [rsp + 0x68]
call fcn.140045fb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400c8651
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c864c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c864c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140123c04
movdqa xmm0, xmmword [0x140172ff0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x1400c86a7
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c86a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c86a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140123c04
xor ecx, ecx
int 0x29
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400c86e1
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400c86dc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400c8715
mov rcx, r8
call fcn.140123c04
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140123840
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400373d0
nop
int3
Function at 0x1400c91e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, str.ALLUSERSPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400c9240
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1400c9227
mov rdx, rax
mov rcx, rbx
call fcn.1400380e0
jmp 0x1400c92f4
lea rcx, [rsp + 0x40]
call fcn.1400c3f60
nop
mov rsi, rax
cmp qword [rax + 0x18], 7
jbe 0x1400c9258
mov rsi, qword [rax]
mov rbp, qword [rax + 0x10]
call fcn.140123170
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
test rbp, rbp
je 0x1400c92ea
cmp rbp, 0x7fffffff
ja 0x1400c9316
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov ecx, eax
call fcn.1401231e0
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x1400c9321
movsxd rdx, edi
xor r8d, r8d
mov rcx, rbx
call fcn.1400cf730
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400c92cd
mov r9, qword [rbx]
mov dword [rsp + 0x20], edi
mov r8d, ebp
mov rdx, rsi
mov ecx, r14d
call fcn.1401231e0
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400c930c
lea rcx, [rsp + 0x40]
call fcn.1400440d0
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
shr rcx, 0x20
call fcn.1400c31a0
int3
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1400c3160
int3
shr rdi, 0x20
mov ecx, edi
call fcn.1400c31a0
int3
Function at 0x1400ce1e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1400ce20d
xor eax, eax
jmp 0x1400ce376
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1400ce24d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1400ce24d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x1400ce36e
cmp qword [rdi + 0x80], 0
je 0x1400ce369
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x1400ce287
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x1400ce2b2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1400ce36e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400ce321
sub eax, 1
je 0x1400ce321
cmp eax, 2
jne 0x1400ce369
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1400ce36e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1400ce34f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400ce369
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x1400ce36e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140123840
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400d30e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jg 0x1400d3102
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400d3118
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1400d3162
cmp rax, rsi
mov rdi, rsi
mov rcx, r14
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, rbp
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, r14
add rbp, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [r14 + 0x80], 0
mov rdi, rbx
je 0x1400d31d1
mov rcx, r14
call fcn.1400c2fa0
cmp rbx, 0xfff
jbe 0x1400d31b1
mov r9, qword [r14 + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add rbp, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400d31ea
cmp rbx, rax
ja 0x1400d3180
test rdi, rdi
je 0x1400d31d1
mov r9, qword [r14 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x1400d31d4
Function at 0x1400d31f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400d3218
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400d328c
test rax, rax
jle 0x1400d326c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400d328c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400d328c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x1400d83d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x1400ea590
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1400ea5ee
mov dl, 1
call fcn.1400da6c0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400da6c0
mov eax, ebx
jmp 0x1400ea632
cmp ebx, 2
ja 0x1400ea630
mov r9, qword [rdi + 0x668]
lea rdx, [0x140162208]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ea650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x1400ea693
cmp qword [rcx + 0x678], 0
je 0x1400ea770
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400d87c0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400ea6c1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1400ea708
cmp byte [rdi + 0x1597], 0
jne 0x1400ea708
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400ea6f0
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x1400ea768
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x1400ea7c3
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x1400ea789
mov dl, 1
mov rcx, rdi
call fcn.1400da6c0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.1400da6c0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140123840
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x140162208]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400ea768
call fcn.140123e80
int3