joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003cc70
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.1400473e0
sub rsp, rax
xor r9d, r9d
add rsp, 0x28
jmp 0x14003cc90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x30
call fcn.1400473e0
sub rsp, rax
mov r14d, r9d
mov ebp, r8d
movzx edi, dl
mov rsi, rcx
test rcx, rcx
je 0x14003cd73
movzx eax, byte [rcx]
cmp al, byte [0x140066c50]
jne 0x14003cce3
movzx eax, byte [rcx + 1]
cmp al, byte [0x140066c51]
je 0x14003cd73
mov edx, ebp
movzx ecx, dil
call fcn.14003f210
mov rdx, rax
mov rcx, rsi
call sub.libcrypto_1_1_x64.dll_BIO_new_file
mov rbx, rax
test r14d, r14d
jne 0x14003ce11
test rax, rax
jne 0x14003ce68
cmp dil, 0x61
je 0x14003cd3b
cmp dil, 0x72
je 0x14003cd32
cmp dil, 0x77
lea rbx, str._doing_something_
lea rax, str.writing
cmove rbx, rax
jmp 0x14003cd42
lea rbx, str.reading
jmp 0x14003cd42
lea rbx, str.appending
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400827b8]
lea rdx, str.Cant_open__s_for__s___s_n
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call sub.libcrypto_1_1_x64.dll_BIO_printf
jmp 0x14003ce5a
mov ebx, ebp
shr ebx, 0xb
and ebx, 0x10
cmp dil, 0x72
jne 0x14003cd98
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_1_1_x64.dll_BIO_new_fp
mov rbx, rax
jmp 0x14003ce0c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_1_1_x64.dll_BIO_new_fp
mov rbx, rax
bt ebp, 0xf
jae 0x14003ce0c
lea rcx, str.HARNESS_OSSL_PREFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
je 0x14003ce0c
mov rax, qword [0x140083bd0]
test rax, rax
jne 0x14003cde3
call fcn.1400450c0
mov qword [0x140083bd0], rax
mov rcx, rax
call sub.libcrypto_1_1_x64.dll_BIO_new
mov rcx, rax
mov rdx, rbx
call sub.libcrypto_1_1_x64.dll_BIO_push
mov r9, rsi
xor r8d, r8d
mov edx, 0x8000
mov rcx, rax
mov rbx, rax
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
test r14d, r14d
je 0x14003ce1b
call sub.libcrypto_1_1_x64.dll_ERR_clear_error
mov rax, rbx
jmp 0x14003ce68
test rbx, rbx
jne 0x14003ce16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400827b8]
lea r8, str.stdout
mov r9, rax
lea rdx, str.Cant_open__s___s_n
cmp dil, 0x72
lea rax, str.stdin
cmove r8, rax
call sub.libcrypto_1_1_x64.dll_BIO_printf
mov rcx, qword [0x1400827b8]
call sub.libcrypto_1_1_x64.dll_ERR_print_errors
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14003cc90
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.1400473e0
sub rsp, rax
xor r9d, r9d
add rsp, 0x28
jmp 0x14003cc90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x30
call fcn.1400473e0
sub rsp, rax
mov r14d, r9d
mov ebp, r8d
movzx edi, dl
mov rsi, rcx
test rcx, rcx
je 0x14003cd73
movzx eax, byte [rcx]
cmp al, byte [0x140066c50]
jne 0x14003cce3
movzx eax, byte [rcx + 1]
cmp al, byte [0x140066c51]
je 0x14003cd73
mov edx, ebp
movzx ecx, dil
call fcn.14003f210
mov rdx, rax
mov rcx, rsi
call sub.libcrypto_1_1_x64.dll_BIO_new_file
mov rbx, rax
test r14d, r14d
jne 0x14003ce11
test rax, rax
jne 0x14003ce68
cmp dil, 0x61
je 0x14003cd3b
cmp dil, 0x72
je 0x14003cd32
cmp dil, 0x77
lea rbx, str._doing_something_
lea rax, str.writing
cmove rbx, rax
jmp 0x14003cd42
lea rbx, str.reading
jmp 0x14003cd42
lea rbx, str.appending
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400827b8]
lea rdx, str.Cant_open__s_for__s___s_n
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call sub.libcrypto_1_1_x64.dll_BIO_printf
jmp 0x14003ce5a
mov ebx, ebp
shr ebx, 0xb
and ebx, 0x10
cmp dil, 0x72
jne 0x14003cd98
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_1_1_x64.dll_BIO_new_fp
mov rbx, rax
jmp 0x14003ce0c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_1_1_x64.dll_BIO_new_fp
mov rbx, rax
bt ebp, 0xf
jae 0x14003ce0c
lea rcx, str.HARNESS_OSSL_PREFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
je 0x14003ce0c
mov rax, qword [0x140083bd0]
test rax, rax
jne 0x14003cde3
call fcn.1400450c0
mov qword [0x140083bd0], rax
mov rcx, rax
call sub.libcrypto_1_1_x64.dll_BIO_new
mov rcx, rax
mov rdx, rbx
call sub.libcrypto_1_1_x64.dll_BIO_push
mov r9, rsi
xor r8d, r8d
mov edx, 0x8000
mov rcx, rax
mov rbx, rax
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
test r14d, r14d
je 0x14003ce1b
call sub.libcrypto_1_1_x64.dll_ERR_clear_error
mov rax, rbx
jmp 0x14003ce68
test rbx, rbx
jne 0x14003ce16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, qword [0x1400827b8]
lea r8, str.stdout
mov r9, rax
lea rdx, str.Cant_open__s___s_n
cmp dil, 0x72
lea rax, str.stdin
cmove r8, rax
call sub.libcrypto_1_1_x64.dll_BIO_printf
mov rcx, qword [0x1400827b8]
call sub.libcrypto_1_1_x64.dll_ERR_print_errors
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14003d200
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x30
call fcn.1400473e0
sub rsp, rax
xor sil, sil
mov dword [rcx + 4], 0
cmp dword [rcx], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14003d296
mov dword [rcx], setsockopt
lea rdx, str.apps_apps.c
lea ecx, [rax + 0x70]
mov r8d, 0x3b6
call sub.libcrypto_1_1_x64.dll_CRYPTO_malloc
test rax, rax
jne 0x14003d292
call fcn.14003ab70
mov rcx, qword [0x1400827b8]
lea rdx, str._s:_Could_not_allocate__d_bytes_for__s_n
mov r8, rax
mov r9d, 0xa0
lea rax, str.argv_space
mov qword [rsp + 0x20], rax
call sub.libcrypto_1_1_x64.dll_BIO_printf
mov rcx, qword [0x1400827b8]
call sub.libcrypto_1_1_x64.dll_ERR_print_errors
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rdi + 8], rax
movzx eax, byte [rbx]
test al, al
je 0x14003d2b8
nop dword [rax]
movzx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x14003d2dd
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x14003d2a0
mov rax, qword [rdi + 8]
movsxd rcx, dword [rdi + 4]
mov qword [rax + rcx*8], 0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movzx ecx, byte [rbx]
test cl, cl
je 0x14003d2b8
mov r8d, dword [rdi + 4]
mov eax, dword [rdi]
cmp r8d, eax
jl 0x14003d325
mov rcx, qword [rdi + 8]
lea r8, str.apps_apps.c
add eax, 0x14
mov r9d, 0x59
movsxd rdx, eax
shl rdx, 3
mov dword [rdi], eax
call sub.libcrypto_1_1_x64.dll_CRYPTO_realloc
test rax, rax
je 0x14003d3bc
mov r8d, dword [rdi + 4]
mov qword [rdi + 8], rax
movzx ecx, byte [rbx]
cmp cl, 0x27
je 0x14003d333
cmp cl, 0x22
je 0x14003d333
xor edx, edx
jmp 0x14003d338
mov edx, 1
test edx, edx
movzx ecx, cl
lea rax, [rbx + 1]
cmove rax, rbx
mov rbx, rax
movzx eax, sil
cmove ecx, eax
mov rax, qword [rdi + 8]
movzx esi, cl
movsxd rcx, r8d
mov qword [rax + rcx*8], rbx
inc dword [rdi + 4]
movzx eax, byte [rbx]
test edx, edx
je 0x14003d38b
test al, al
je 0x14003d380
nop dword [rax + rax]
cmp al, sil
je 0x14003d380
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x14003d370
mov byte [rbx], 0
inc rbx
jmp 0x14003d296
test al, al
je 0x14003d3a8
nop
movzx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x14003d3a8
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x14003d390
cmp byte [rbx], 0
je 0x14003d296
mov byte [rbx], 0
inc rbx
jmp 0x14003d296
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14003d830
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1400473e0
sub rsp, rax
mov ebx, ecx
mov edi, ecx
shr ebx, 0xb
lea ecx, [rax - 0x1f]
and ebx, 0x10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov edx, ebx
call sub.libcrypto_1_1_x64.dll_BIO_new_fp
mov rbx, rax
bt edi, 0xf
jae 0x14003d8c2
lea rcx, str.HARNESS_OSSL_PREFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
je 0x14003d8bf
mov rax, qword [0x140083bd0]
test rax, rax
jne 0x14003d896
call fcn.1400450c0
mov qword [0x140083bd0], rax
mov rcx, rax
call sub.libcrypto_1_1_x64.dll_BIO_new
mov rcx, rax
mov rdx, rbx
call sub.libcrypto_1_1_x64.dll_BIO_push
mov r9, rdi
xor r8d, r8d
mov edx, 0x8000
mov rcx, rax
mov rbx, rax
call sub.libcrypto_1_1_x64.dll_BIO_ctrl
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003f2b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x30
call fcn.1400473e0
sub rsp, rax
xor ebx, ebx
mov rsi, rdx
mov r8, rdx
mov r14, rcx
movzx edx, byte [rdx]
mov eax, ebx
test dl, dl
je 0x14003f2f3
cmp eax, 0x80000000
jae 0x14003f2f3
inc r8
inc eax
cmp byte [r8], bl
jne 0x14003f2e2
mov edi, eax
btr edi, 0x1f
cmp rdi, 0xffff
jb 0x14003f309
xor eax, eax
jmp 0x14003f3f9
mov qword [rsp + 0x40], rbp
mov rcx, rsi
mov eax, ebx
test dl, dl
je 0x14003f327
cmp eax, 0x80000000
jae 0x14003f327
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x14003f317
btr eax, 0x1f
lea rdx, str.apps_apps.c
mov r8d, 0x3b6
mov ebp, eax
lea rcx, [rax + 1]
call sub.libcrypto_1_1_x64.dll_CRYPTO_malloc
mov r9, rax
test rax, rax
jne 0x14003f38e
call fcn.14003ab70
mov rcx, qword [0x1400827b8]
lea r9d, [rbp + 1]
mov r8, rax
lea rdx, str._s:_Could_not_allocate__d_bytes_for__s_n
lea rax, str.NPN_buffer
mov qword [rsp + 0x20], rax
call sub.libcrypto_1_1_x64.dll_BIO_printf
mov rcx, qword [0x1400827b8]
call sub.libcrypto_1_1_x64.dll_ERR_print_errors
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rbx
cmp rax, rdi
je 0x14003f3aa
movzx edx, byte [rsi + rax]
lea rcx, [rax + 1]
cmp dl, 0x2c
je 0x14003f3aa
mov byte [r9 + rax + 1], dl
jmp 0x14003f3c9
mov rcx, rax
sub rcx, rbx
cmp rcx, 0xff
ja 0x14003f3dd
movzx ecx, al
sub cl, bl
mov byte [r9 + rbx], cl
lea rcx, [rax + 1]
mov rbx, rcx
mov rax, rcx
cmp rcx, rdi
jbe 0x14003f391
lea rax, [rdi + 1]
mov qword [r14], rax
mov rax, r9
jmp 0x14003f3f4
mov r8d, 0x7af
lea rdx, str.apps_apps.c
mov rcx, r9
call sub.libcrypto_1_1_x64.dll_CRYPTO_free
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14003ff70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.1400473e0
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x40]
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x14003ffd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x30
call fcn.1400473e0
sub rsp, rax
mov rdi, rcx
mov ebx, edx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x1400425a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1400473e0
sub rsp, rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rdx*2 + 1]
cmp rcx, rdx
jb 0x14004262c
test ecx, ecx
js 0x14004262c
movsxd rax, ecx
cmp rcx, rax
jne 0x14004262c
lea rdx, str.TLSA_hex_data_buffer
call fcn.14003ca10
mov r9, rax
mov rdx, rax
test rbx, rbx
je 0x14004261b
mov r8, qword [str.0123456789abcdef]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
shr rcx, 4
movzx ecx, byte [rcx + r8]
mov byte [rdx], cl
movzx eax, byte [rdi - 1]
and eax, 0xf
movzx eax, byte [rax + r8]
mov byte [rdx + 1], al
add rdx, 2
sub rbx, 1
jne 0x1400425f0
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov byte [rdx], 0
add rsp, 0x20
pop rdi
ret
call fcn.14003ab70
mov rcx, qword [0x1400827b8]
lea rdx, str._s:__zu_byte_buffer_too_large_to_hexencode_n
mov r8, rax
mov r9, rbx
call sub.libcrypto_1_1_x64.dll_BIO_printf
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140003f20
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1080
call fcn.14000fc20
sub rsp, rax
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov r14, qword [rsp + 0x10d0]
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov rsi, rcx
test r8, r8
je 0x140004049
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea r9d, [rbx + 0x28]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x28], ebx
mov edx, 0x80862007
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0x33
mov qword [rsp + 0x68], 0x1000
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140003fc5
lea rdx, str.____Cant_read_module_headers
jmp 0x14000402d
movsxd rax, dword [rsp + 0xac]
lea rcx, [rsp + 0x70]
add rcx, rax
mov r8d, ebx
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
movzx r9d, word [rcx + 6]
add r10, rax
test r9d, r9d
je 0x140004026
nop dword [rax]
mov eax, r8d
lea rcx, [rax + rax*4]
cmp dword [r10 + rcx*8], 0x45474150
lea rdx, [r10 + rcx*8]
jne 0x14000401e
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], bl
jne 0x140004010
cmp rax, 4
je 0x14000407d
inc r8d
cmp r8d, r9d
jb 0x140003ff0
lea rdx, str.____Cant_find_section
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006000
lea rdx, [0x1400061e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, rbx
mov r8d, ebx
mov r9, rbp
mov rcx, rsi
mov qword [rsp + 0x20], r14
call fcn.140003d40
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.14000ea10
add rsp, 0x1080
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x140004026
mov ecx, dword [rdx + 8]
mov edx, eax
lea rax, [rsp + 0x70]
add rax, rdx
je 0x140004026
test ecx, ecx
je 0x140004026
mov ebx, ecx
add rdx, rdi
jmp 0x14000404c
Function at 0x140004e30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140004e67
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140004e88
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004e8a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140004ee3
test ecx, ecx
jle 0x140004ec3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140004ee3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140004ee3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140004f10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140004f32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140004f48
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140004f64
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004f66
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140004fa0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140005047
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140004fdb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140005021
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140005060
cmp rbx, rax
ja 0x140004ff0
mov r8, rdi
test rdi, rdi
je 0x140005047
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14000504a
Function at 0x140005470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000549d
xor eax, eax
jmp 0x1400055f2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400054c8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400054c8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400055f2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400055e5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000550b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005536
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400055ea
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400055a5
sub eax, 1
je 0x1400055a5
cmp eax, 2
jne 0x1400055e5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400055ea
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400055d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400055e5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400055ea
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000ea10
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400059f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005ac3
cmp byte [rcx + 0x71], 0
je 0x140005ac3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140005abf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005a84
sub eax, 1
je 0x140005a88
cmp eax, 2
jne 0x140005abf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ea10
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005ab6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140005abf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140005a6c
xor al, al
jmp 0x140005a6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ea10
add rsp, 0x60
pop rbx
ret