joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800228a0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180018d54
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180018d54
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800229f0
cmp rax, 0xffffffffffffffff
je 0x1800229f0
xor edi, edi
test rbp, rbp
jle 0x18002299b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180016ef4
mov rbx, rax
test rax, rax
jne 0x180022928
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180022991
mov edx, 0x8000
mov ecx, r14d
call fcn.180022728
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800165f8
cmp eax, 0xffffffff
je 0x180022971
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180022938
mov edx, r15d
mov ecx, r14d
call fcn.180022728
jmp 0x180022991
cmp byte [rsi + 0x38], dil
je 0x180022988
cmp dword [rsi + 0x34], 5
jne 0x180022988
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180022991
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180016908
jmp 0x180022a04
jns 0x180022a04
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180018d54
cmp rax, 0xffffffffffffffff
jne 0x1800229bc
cmp byte [rsi + 0x30], dil
je 0x180022a04
mov edi, dword [rsi + 0x2c]
jmp 0x180022a04
mov ecx, r14d
call fcn.18001d324
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180022a04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180022a04
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800229fd
mov eax, dword [rsi + 0x2c]
jmp 0x180022a02
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180018d54
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180199a73
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.18064b411
je 0x180199ad6
add dword [rax], ecx
add eax, dword [rax]
or byte [rdx + 0x3002c004], ah
add byte [rax], al
invalid

Function at 0x18029d41e
Capabilities:
Encode data using xor

Disassembly:
mov r15, qword [rsp + 0x20]
jbe 0x180105286

Function at 0x1802aa57a
Capabilities:
Encode data using xor

Disassembly:
jo 0x18021b73c
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1805aaa70
xor eax, dword [rdi + 0x5246b8ec]
f2xm1
push rcx
pop rax
jno 0x1802aa58f
sub ch, byte [rsi + 0x1ea65428]
scasb al, byte [rdi]
invalid

Function at 0x18033d95c
Capabilities:
Encode data using xor

Disassembly:
test r8w, r8w
call fcn.18003dbdb
movabs rsp, 0x887b9410f3778345
and cl, byte [0x15da7109b]
sbb al, 0xeb
jno fcn.180312381
xchg ebp, eax
fdiv dword [rbx + 0x74]
fstp qword [rbx + 0x228566e6]
invalid
mov rbp, qword [rsp + 0x40]
jns 0x18031238e
jle 0x18004447a
Function at 0x1803e8324
Capabilities:
Encode data using xor

Disassembly:
push rbp
movabs rbp, 0x244d40ec1fad1c3f
movsx r13w, r11w
mov ebp, 0x1fad1c3f
in al, dx
and al, 0x66
movsx r13d, r11w
movsx ebp, bx
mov r11, qword [rsp + 0x28]
mov qword [rsp + 0x28], rbx
lea rbp, [rbp + rbp + 0x4abe0c02]
mov r13d, ebp
call fcn.18024d03c
test byte [0x1b8a6c1c0], dh
jnp 0x1803e83ac
xor byte [0x141c0573c], dl
insb byte [rdi], dx
lodsb al, byte [rsi]
call 0x1a0004440
outsd dx, dword [rsi]
jo 0x1803e8326
mov dl, 0x76
jns 0x1803e83af
sbb dl, byte ds:[rax - 0x49]
jae 0x1803e8331
cmp al, 0x3a
nop
add eax, eax
invalid
imul ebp, dword [0x1b9076bf9], 0xffffffdf
invalid
call 0x19f1dbc7c
sbb eax, 0x8af506a
xlatb
out 0x53, al
invalid

Function at 0x180449741
Capabilities:
Write file on windows

Disassembly:
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x18001613e
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x18001612c
inc dword [rdi + 8]
mov byte [rbx], 0xd
inc rbx
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x180016115
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180016177
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x18001617f
cmp rsi, rbp
jb 0x180016110
jmp 0x18001617f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.180005cf0
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
add qword [rsp + 0x60], 0x7ffb6347
mov r9, qword [rsp + 0x28]
neg byte [rsp + 0x40]
neg dword [rsp + 0x88]
jl 0x18001615b
ja 0x180511c0b
push qword [rsp + 0x80]
popfq
lea rsp, [rsp + 0x90]
ret

Function at 0x18047d32b
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.1805b4cb9
out 0x5a, al
jae 0x18047d3ab
int1
mov ecx, 0xd493745c
mov word [rsi + rcx*4 - 0x4c17a46e], ss
test byte [rsi + rdi*4 + 0x15], ch
push 0x72
insd dword [rdi], dx
insb byte [rdi], dx
mov esi, 0x6d726a15
loope 0x18047d34c
ja 0x18047d3c4
push rdx
sub edi, dword [rsi - 0x6d]
insd dword [rdi], dx
out dx, al
invalid
leave
shr byte [rax + 0x51], 1
lahf
sbb byte [rdx + 0x2c], dl
add al, 0xec
add dword [rax + 0x3b], edi
fdivr qword [rdi]
or edi, dword [rax + 0x14]
adc ecx, dword [rdi + 0x5c]
out dx, eax
mov byte [rdx - 0x5c272054], dl
pop rax
sub al, 0xcc
xor ecx, 0x9a508e86
xchg esp, eax
add esp, dword [rdi + 0x47]
push rdx
jns 0x18047d3ac
invalid
mov edx, 0x64beeb
mov edi, 0xa42a028a
invalid

Function at 0x18053299b
Capabilities:
Get geographical location

Disassembly:
push rax
push rdi
movabs rdi, 0x7fd277337d10732c
pushfq
movsx di, dil
push 0x527c5b04
push rdi
mov rax, qword [rsp + 0x28]
not qword [rsp]
or dil, 0x31
sets byte [rsp]
push rcx
test byte [rsp + 0xa], dil
lea rax, [rax + 1]
push r15
movabs r15, 0x1ea2196d0646443d
push r14
jo 0x1804de4bb
movabs r14, 0x14a10ab6be83642
xor r14b, byte [rsp + 0x1d]
mov qword [rsp + 0x40], rax
add r15w, r14w
push r13
jo 0x18001fcdc
movabs r13, 0x4c50654c2f0243ce
call fcn.18038fb5a
Function at 0x180537e73
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rsp + 0x30]
test qword [rsp + 0x40], 0x5e07458b
not rbx
bswap ebx
mov rbx, qword [rsp + 0x48]
movabs r10, 0x6c596d9c2ec044bf
jns 0x1801df1e6
or r10b, 0xaf
ja 0x180473dc6
Function at 0x18077a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18077a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18077a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18077a06f
add dl, dl
jne 0x18077a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18077a0f6
xor eax, eax
add dl, dl
jne 0x18077a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18077a1ad
add dl, dl
jne 0x18077a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18077a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18077a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18077a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18077a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18077a07e
mov eax, 1
add dl, dl
jne 0x18077a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18077a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18077a0fb
sub eax, ebx
mov ebx, 1
jne 0x18077a14c
mov ecx, 1
add dl, dl
jne 0x18077a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18077a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18077a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18077a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18077a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18077a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18077a15d
cmp eax, 0x7d00
jae 0x18077a19b
cmp eax, 0x500
jb 0x18077a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18077a07e
cmp eax, 0x7f
ja 0x18077a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18077a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18077a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18077a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400099a0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x470], rbx
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], rdi
mov rax, qword [0x1400f8080]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [0x1400f8140]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140009a20
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140009a9a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140009a4b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c5830
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140009a9a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x140009a9d
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x140009aaa
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140009ac2
inc rbx
test eax, eax
jne 0x140009ab0
test ecx, ecx
mov rcx, rsi
je 0x140009b22
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140009a10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140009b1e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140009b19
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009ba5
mov rcx, r8
call fcn.1400c50dc
xor eax, eax
jmp 0x140009b65
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140009b62
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140009b5d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009ba5
mov rcx, r8
call fcn.1400c50dc
mov rax, rbx
mov byte [rdi], r14b
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.1400c4c40
mov rbx, qword [rbp + 0x470]
mov rsi, qword [rbp + 0x480]
mov rdi, qword [rbp + 0x488]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000a640
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rdi
mov rax, qword [0x1400f8080]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
nop word [rax + rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000a6c0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000a73a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000a6eb
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c5830
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14000a73a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x2c]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x14000a73d
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x14000a74a
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x14000a762
inc rbx
test eax, eax
jne 0x14000a750
test ecx, ecx
mov rcx, rsi
je 0x14000a7c2
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a6b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000a7be
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000a7b9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a843
mov rcx, r8
call fcn.1400c50dc
xor eax, eax
jmp 0x14000a803
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rbp + 8]
cmp rdx, 0x10
jb 0x14000a801
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000a7fc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a843
mov rcx, r8
call fcn.1400c50dc
mov eax, ebx
mov byte [rdi], r14b
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.1400c4c40
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
mov rdi, qword [rbp + 0x288]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000bef0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400f8080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c05e
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14000bf50
cmp qword [rbx + 0x18], 8
mov r9, rbx
mov r10, qword [rbx + 0x10]
jb 0x14000bf6b
mov r9, qword [rbx]
cmp rcx, r10
lea rdx, [rsp + 0x4c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x14000bfa4
lea rax, [rsp + 0x4c]
sub r9, rax
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14000bfaf
add rdx, 2
sub r8, 1
jne 0x14000bf90
cmp r10, rcx
jb 0x14000bfaf
jbe 0x14000c0cf
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000c055
nop word [rax + rax]
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14000bfe0
cmp qword [rbx + 0x18], 8
mov r9, rbx
mov r10, qword [rbx + 0x10]
jb 0x14000bffb
mov r9, qword [rbx]
cmp rcx, r10
lea rdx, [rsp + 0x4c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x14000c034
lea rax, [rsp + 0x4c]
sub r9, rax
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14000c03f
add rdx, 2
sub r8, 1
jne 0x14000c020
cmp r10, rcx
jb 0x14000c03f
jbe 0x14000c0cf
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000bfd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000c09d
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c098
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c12d
mov rcx, r8
call fcn.1400c50dc
xor eax, eax
mov word [rbx], ax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400c4c40
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
mov edi, dword [rsp + 0x28]
cmp rdx, 8
jb 0x14000c117
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c112
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c12d
mov rcx, r8
call fcn.1400c50dc
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
mov rax, rdi
jmp 0x14000c0ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000d4c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000d4e8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000d50e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000d510
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000d569
test ecx, ecx
jle 0x14000d549
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000d569
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000d569
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14000d590
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000d5b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000d5c8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000d5e4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000d5e6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000d622
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000d6be
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000d65d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000d69e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000d6be
cmp rbx, rax
ja 0x14000d670
test rbx, rbx
je 0x14000d6be
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14000daf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f8080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000db1d
xor eax, eax
jmp 0x14000dc89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000db57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000db57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000dc89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000dc7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000db9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000dbc5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000dc81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000dc34
sub eax, 1
je 0x14000dc34
cmp eax, 2
jne 0x14000dc7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000dc81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000dc62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000dc7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000dc81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c4c40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret