joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140164310
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp word [rcx + 0xe], 3
mov rbx, rcx
jne 0x140164330
cmp dword [rcx + 0x48], 8
je 0x140164384
mov eax, dword [rcx + 0x68]
cmp dword [rcx + 0x78], eax
jl 0x140164365
jmp 0x140164360
mov edx, 1
lea r8d, [rdx + 0xb]
call fcn.1401643e0
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0xb]
call fcn.1401643e0
cmp dword [rbx + 0x48], 8
je 0x140164384
mov eax, dword [rbx + 0x68]
cmp dword [rbx + 0x78], eax
jl 0x140164365
mov rcx, rbx
call fcn.140164690
mov rcx, qword [rbx + 0x70]
movzx eax, byte [rbx + 0x44]
mov byte [rcx], al
inc qword [rbx + 0x70]
inc dword [rbx + 0x78]
mov dword [rbx + 0x48], 8
mov dword [rbx + 0x44], 0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140164690

Function at 0x140164690
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x78]
mov rbx, rcx
test eax, eax
jle 0x1401646c9
mov r9, qword [rcx + 0x38]
mov rcx, qword [rcx + 0x60]
mov rdx, rax
mov r9, qword [r9]
mov r8d, 1
call fcn.1401c24f8
mov rcx, qword [rbx + 0x60]
mov dword [rbx + 0x78], 0
mov qword [rbx + 0x70], rcx
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140165470
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov qword [rcx], rdx
mov dword [rcx + 8], r8d
xor edx, edx
mov rcx, rbx
call fcn.14015e6b0
test eax, eax
jne 0x1401654d3
cmp dword [rbx + 0x18], eax
jne 0x1401654c2
mov r9, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x68]
lea r8d, [rax + 1]
mov r9, qword [r9]
mov edx, 0x1000
call fcn.1401c24f8
mov rcx, qword [rbx + 0x68]
add dword [rbx + 0x70], 0x1000
mov qword [rbx + 0x10], rcx
mov dword [rbx + 0x18], 0x1000
cmp dword [rbx + 8], 0
ja 0x140165480
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140165540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
mov dword [rcx + 8], 0
nop dword [rax]
mov edx, 4
mov rcx, rbx
call fcn.14015e6b0
mov edi, eax
test eax, eax
js 0x1401655d6
cmp eax, 1
jg 0x1401655d6
mov ecx, dword [rbx + 0x18]
cmp ecx, 0x1000
je 0x1401655ba
mov r9, qword [rbx + 0x60]
mov edx, 0x1000
mov r8d, 1
mov r9, qword [r9]
sub edx, ecx
mov rcx, qword [rbx + 0x68]
call fcn.1401c24f8
mov ecx, 0x1000
sub ecx, dword [rbx + 0x18]
mov dword [rbx + 0x18], 0x1000
add dword [rbx + 0x70], ecx
mov rcx, qword [rbx + 0x68]
mov qword [rbx + 0x10], rcx
cmp edi, 1
jne 0x140165560
mov ecx, dword [rbx + 0x70]
mov eax, edi
mov dword [rsi], ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401681c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x28]
mov rdi, rcx
mov edx, 1
mov r9, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x40]
mov r8d, 0x1000
call fcn.1401c1e14
mov rcx, rax
test rax, rax
jne 0x140168232
cmp byte [rbx + 0x48], al
je 0x140168208
mov rax, qword [rdi]
mov rcx, rdi
mov dword [rax + 0x28], 0x2a
mov rax, qword [rdi]
call qword [rax]
mov rax, qword [rdi]
or edx, 0xffffffff
mov rcx, rdi
mov dword [rax + 0x28], 0x78
mov rax, qword [rdi]
call qword [rax + 8]
mov rax, qword [rbx + 0x40]
mov ecx, 2
mov byte [rax], 0xff
mov rax, qword [rbx + 0x40]
mov byte [rax + 1], 0xd9
mov rax, qword [rbx + 0x40]
mov qword [rbx + 8], rcx
mov byte [rbx + 0x48], 0
mov qword [rbx], rax
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140168ff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x28]
mov rdi, rcx
movsxd rax, dword [rbx + 0x40]
cmp eax, 0xffffffff
jne 0x140169012
mov r8d, 0x1000
jmp 0x14016902a
test eax, eax
je 0x140169047
mov r8d, 0x1000
cmp eax, r8d
jge 0x140169024
mov r8, rax
sub eax, r8d
mov dword [rbx + 0x40], eax
mov r9, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x48]
mov edx, 1
mov r9, qword [r9]
call fcn.1401c1e14
mov rcx, rax
test rax, rax
jne 0x140169089
cmp byte [rbx + 0x50], 0
je 0x14016905f
mov rax, qword [rdi]
mov rcx, rdi
mov dword [rax + 0x28], 0x2a
mov rax, qword [rdi]
call qword [rax]
mov rax, qword [rdi]
or edx, 0xffffffff
mov rcx, rdi
mov dword [rax + 0x28], 0x78
mov rax, qword [rdi]
call qword [rax + 8]
mov rax, qword [rbx + 0x48]
mov ecx, 2
mov byte [rax], 0xff
mov rax, qword [rbx + 0x48]
mov byte [rax + 1], 0xd9
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rcx
mov byte [rbx + 0x50], 0
mov qword [rbx], rax
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1401691d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, dword [rsp + 0x50]
mov r14, rcx
mov rbx, rdx
add eax, 0x800
movsxd rdi, eax
mov rcx, rdi
call fcn.1401bee78
mov rsi, rax
test rax, rax
jne 0x14016920f
lea eax, [rsi + 1]
jmp 0x1401692c2
mov r9, qword [r14]
mov r8, rdi
mov edi, 1
mov rcx, rax
mov edx, edi
mov qword [rsp + 0x30], rbp
call fcn.1401c1e14
lea r8d, [rdi + 0x57]
lea rdx, [0x14021128c]
mov dword [rbx + 8], eax
lea rax, [0x1400e7320]
xor ebp, ebp
mov qword [rbx + 0x30], rax
lea rax, [fcn.140169310]
mov rcx, rbx
mov qword [rbx], rsi
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x38], rax
call fcn.140150550
test eax, eax
jne 0x1401692ba
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
test rax, rax
cmovne rcx, rax
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x10], rcx
mov ecx, dword [rax + 0x70]
imul ecx, dword [rax + 0x14]
mov dword [rbx + 0x18], ecx
mov edx, edi
mov rcx, rbx
call fcn.14014ec60
cmp eax, edi
je 0x1401692aa
cmp eax, 0xfffffffd
jne 0x1401692a1
mov rcx, rbx
call fcn.140150710
test eax, eax
jne 0x1401692d8
cmp dword [rbx + 0x18], ebp
ja 0x140169286
mov rcx, rsi
call fcn.1401be23c
mov rcx, rbx
call fcn.140150410
movzx eax, bp
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rsi
call fcn.1401be23c
mov eax, 4
jmp 0x1401692bd
Function at 0x140169540
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r14
push r15
sub rsp, 0x38
xor eax, eax
mov r12, r9
mov r15d, r8d
mov r14, rcx
mov esi, eax
test r8d, r8d
jle 0x140169637
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov rbp, qword [rsp + 0x80]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x30], r13
mov r13, qword [rsp + 0x88]
nop word [rax + rax]
cmp dword [rbp], 0
mov rdi, r12
mov ebx, eax
jle 0x1401695f6
nop dword [rax + rax]
mov r9, qword [r14]
mov edx, 3
lea rcx, [rsp + 0x70]
lea r8d, [rdx - 2]
call fcn.1401c1e14
test rax, rax
je 0x14016961e
movzx eax, byte [rsp + 0x71]
movzx ecx, byte [rsp + 0x70]
lea rdx, [rsp + 0x20]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x72]
shl ecx, 8
or ecx, eax
call fcn.1401699d0
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140169810
inc ebx
add rdi, 3
cmp ebx, dword [rbp]
jl 0x1401695a0
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r13
or edx, r8d
call fcn.1400615b0
test ax, ax
jne 0x140169623
inc esi
cmp esi, r15d
jge 0x140169623
xor eax, eax
jmp 0x140169590
mov eax, 4
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r12
pop rsi
ret
Function at 0x140199660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r9
mov r10, r8
mov r9, rdx
call fcn.140199540
mov rcx, r9
mov r11d, eax
call fcn.140199540
mov ebx, eax
cmp r11d, eax
jge 0x1401996ef
movdqu xmm0, xmmword [r10]
mov edx, 0x10
mov ebx, r11d
mov r11d, eax
pxor xmm0, xmmword [0x14024a150]
pand xmm0, xmmword [0x14024a160]
movdqu xmmword [rsp + 0x20], xmm0
cmp rdx, rdx
jge 0x140199712
lea rax, [rsp + 0x30]
sub r10, rax
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
inc rdx
movzx eax, byte [r10 + rcx + 0x10]
xor al, 1
and al, 3
mov byte [rcx], al
cmp rdx, 0x10
jl 0x1401996d0
jmp 0x140199712
jne 0x140199709
xor eax, eax
cmp rax, 0x10
jae 0x14019973c
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x10
jl 0x1401996f7
jmp 0x140199712
movups xmm0, xmmword [r10]
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov r9, rdi
mov edx, ebx
mov ecx, r11d
call fcn.140199750
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.1401be39c
int3
Function at 0x14019b410
Capabilities:
Write file on windows

Disassembly:
push rdi
push r15
sub rsp, 0x28
cmp dword [rcx + 0x118], 0
mov r15, rdx
mov rdi, rcx
jne 0x14019b431
xor eax, eax
add rsp, 0x28
pop r15
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rbx, qword [rcx + 0x130]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r12
xor r12d, r12d
mov qword [rsp + 0x20], r14
test rbx, rbx
je 0x14019b4bf
mov eax, dword [rcx + 0x138]
lea rcx, [0x14019b8e0]
lea rbp, [fcn.14019b900]
cmp eax, 0x49492a00
lea r14, [fcn.14019c140]
mov esi, r12d
cmove rbp, rcx
lea rcx, [0x14019c120]
cmove r14, rcx
cmp dword [rdi + 0x13c], r12d
jle 0x14019b4bf
lea rcx, [rbx + 8]
call rbp
test esi, esi
je 0x14019b4b1
test eax, eax
je 0x14019b4b1
mov edx, dword [rdi + 0x12c]
lea rcx, [rbx + 8]
add edx, eax
call r14
inc esi
add rbx, 0x10
cmp esi, dword [rdi + 0x13c]
jl 0x14019b494
lea rdx, [0x1401f6fd8]
mov rcx, r15
call fcn.1401be7e4
mov rbx, rax
test rax, rax
je 0x14019b5c2
mov rdx, rax
mov ecx, 0xff
mov esi, 1
call fcn.1401c1ae4
mov rdx, rbx
mov ecx, 0xd8
call fcn.1401c1ae4
mov rcx, qword [rdi + 0x120]
mov eax, dword [rcx + 8]
sub eax, 0xe0
cmp eax, esi
jbe 0x14019b521
lea edx, [rsi + 0x11]
lea rcx, [0x14024b9b0]
mov r9, rbx
mov r8d, esi
call fcn.1401c24f8
mov eax, dword [rdi + 0x128]
mov r14d, r12d
dec eax
test eax, eax
jle 0x14019b58c
mov rbp, r12
mov rdx, rbx
mov ecx, 0xff
call fcn.1401c1ae4
mov rax, qword [rdi + 0x120]
mov rdx, rbx
movzx ecx, byte [rax + rbp + 8]
call fcn.1401c1ae4
mov rax, qword [rdi + 0x120]
mov r9, rbx
mov edx, dword [rax + rbp + 0xc]
mov rcx, qword [rax + rbp]
mov r8d, 1
call fcn.1401c24f8
lea rbp, [rbp + 0x10]
test rax, rax
mov eax, dword [rdi + 0x128]
cmove esi, r12d
dec eax
inc r14d
cmp r14d, eax
jl 0x14019b533
mov rcx, qword [rdi + 0x120]
movsxd rdx, r14d
mov r9, rbx
shl rdx, 4
mov r8d, 1
add rcx, rdx
mov edx, dword [rcx + 0xc]
mov rcx, qword [rcx]
call fcn.1401c24f8
mov rcx, rbx
test rax, rax
cmove esi, r12d
call fcn.1401be6a4
mov eax, esi
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop rdi
ret
Function at 0x14019b5f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14019b870
cmp eax, 0xd8
je 0x14019b638
call fcn.1401be514
lea r8, str.Expected_SOI_marker_first
lea rdx, [0x1401f6bac]
lea rcx, [rax + 0x60]
call fcn.1401be844
mov rcx, rbx
call qword [rbx + pe_nt_image_headers64]
mov rcx, rbx
call fcn.14019bfd0
mov rcx, rbx
mov esi, eax
call fcn.14019c090
mov ebp, eax
cmp eax, 2
jae 0x14019b676
call fcn.1401be514
lea r8, str.Erroneous_JPEG_marker_length
lea rdx, [0x1401f6bac]
lea rcx, [rax + 0x60]
call fcn.1401be844
mov rcx, rbx
call qword [rbx + pe_nt_image_headers64]
mov rcx, qword [rbx + 0x120]
test rcx, rcx
je 0x14019b698
mov eax, dword [rbx + 0x128]
inc eax
movsxd rdx, eax
shl rdx, 4
call fcn.1401bef30
jmp 0x14019b6a2
mov ecx, 0x10
call fcn.1401bee78
mov qword [rbx + 0x120], rax
movsxd rax, dword [rbx + 0x128]
mov rcx, rbp
mov rdi, rax
shl rdi, 4
add rdi, qword [rbx + 0x120]
inc eax
mov dword [rbx + 0x128], eax
call fcn.1401bee78
mov qword [rdi], rax
test rax, rax
jne 0x14019b6fb
call fcn.1401be514
lea r8, str.No_more_memory
lea rdx, [0x1401f6bac]
lea rcx, [rax + 0x60]
call fcn.1401be844
mov rcx, rbx
call qword [rbx + pe_nt_image_headers64]
mov rax, qword [rdi]
mov dword [rdi + 0xc], ebp
mov dword [rdi + 8], esi
mov ecx, ebp
lea edx, [rbp - 2]
mov r8d, 1
shr ecx, 8
mov byte [rax], cl
mov rax, qword [rdi]
mov byte [rax + 1], bpl
mov rcx, qword [rdi]
mov r9, qword [rbx]
add rcx, 2
call fcn.1401c1e14
sub esi, 0xd9
je 0x14019b847
dec esi
jne 0x14019b638
mov rcx, qword [rbx]
call fcn.1401c2310
mov rcx, qword [rbx]
lea r8d, [rsi + 2]
xor edx, edx
mov ebp, eax
call fcn.1401c1f88
mov rcx, qword [rbx]
call fcn.1401c2310
mov rcx, qword [rbx]
xor r8d, r8d
mov edx, ebp
mov esi, eax
call fcn.1401c1f88
mov rcx, qword [rbx + 0x120]
test rcx, rcx
je 0x14019b78f
mov edx, dword [rbx + 0x128]
inc edx
movsxd rdx, edx
shl rdx, 4
call fcn.1401bef30
jmp 0x14019b799
mov ecx, 0x10
call fcn.1401bee78
mov qword [rbx + 0x120], rax
movsxd rax, dword [rbx + 0x128]
sub esi, ebp
mov rdi, rax
movsxd rbp, esi
shl rdi, 4
mov rcx, rbp
add rdi, qword [rbx + 0x120]
inc eax
mov dword [rbx + 0x128], eax
call fcn.1401bee78
mov dword [rdi + 0xc], esi
mov qword [rdi], rax
test rax, rax
jne 0x14019b7fa
call fcn.1401be514
lea r8, str.could_not_allocate_data_for_entire_image
lea rdx, [0x1401f6bac]
lea rcx, [rax + 0x60]
call fcn.1401be844
mov rcx, rbx
call qword [rbx + pe_nt_image_headers64]
mov r9, qword [rbx]
mov rcx, qword [rdi]
mov r8, rbp
mov edx, 1
call fcn.1401c1e14
cmp eax, esi
je 0x14019b836
call fcn.1401be514
lea r8, str.could_not_read_the_rest_of_the_image
lea rdx, [0x1401f6bac]
lea rcx, [rax + 0x60]
call fcn.1401be844
mov rcx, rbx
call qword [rbx + pe_nt_image_headers64]
mov dword [rdi + 8], 0x123
mov dword [rbx + 0x118], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1401b5000
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r10d, r9d
mov r9d, r8d
mov r8d, edx
lea rdx, [rsp + 0x40]
mov rbx, rcx
mov rax, rcx
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rdx + rax - 1], cl
test cl, cl
jne 0x1401b5040
lea rax, [rsp + 0x40]
or rcx, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rax + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1401b5060
lea rax, [rsp + 0x40]
xor esi, esi
lea rdx, [rsp + 0x40]
mov byte [rcx + rax - 1], 0x5f
mov eax, esi
mov rcx, rbx
cmp word [rsp + 0x298], ax
setne al
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x290]
mov word [rsp + 0x30], si
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.1401b51d0
movzx edi, ax
test ax, ax
je 0x1401b50d4
mov rcx, rbx
call fcn.1401c2588
test eax, eax
jne 0x1401b50cf
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1401c42f4
test eax, eax
je 0x1401b50de
movzx eax, si
jmp 0x1401b50e1
lea rcx, [rsp + 0x40]
call fcn.1401c2588
movzx eax, di
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401be1ec
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1401be054

Function at 0x1401d69a4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401d69ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401d69bc
xor eax, eax
test eax, eax
je 0x1401d69cc
mov ecx, eax
call fcn.1401c7f1c
or eax, 0xffffffff
jmp 0x1401d69ce
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401ec584
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401ec59c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401ec59e
xor eax, eax
test eax, eax
je 0x1401ec5ae
mov ecx, eax
call fcn.1401c7f1c
or eax, 0xffffffff
jmp 0x1401ec5b0
xor eax, eax
add rsp, 0x28
ret
Function at 0x140bd8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140bd81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140bd8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bd806f
add dl, dl
jne 0x140bd8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bd80f6
xor eax, eax
add dl, dl
jne 0x140bd80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bd81ad
add dl, dl
jne 0x140bd80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140bd80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140bd807e
mov eax, 1
add dl, dl
jne 0x140bd8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bd8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bd80fb
sub eax, ebx
mov ebx, 1
jne 0x140bd814c
mov ecx, 1
add dl, dl
jne 0x140bd812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bd813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bd8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bd807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140bd8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bd8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bd815d
cmp eax, 0x7d00
jae 0x140bd819b
cmp eax, 0x500
jb 0x140bd8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bd807e
cmp eax, 0x7f
ja 0x140bd819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bd807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140bd81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140bd807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140edd0d0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140edd0da
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140edd103
pop rbp
sub rbp, 0x33
sub rbp, 0xedd0d0
sub rsp, 0x20
jmp 0x140edd122
mov rax, 0xedd0d0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffc45f5213
xor byte [rax], dl
inc rax
dec rcx
jne 0x140edd141
jmp 0x140edd158
pop rbx
invalid
Function at 0x1410f21f4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1410f21fe
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1410f2227
pop rbp
sub rbp, 0x33
sub rbp, 0x10f21f4
sub rsp, 0x20
jmp 0x1410f2246
mov rax, 0x10f21f4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffc02e0242
xor byte [rax], dl
inc rax
dec rcx
jne 0x1410f2265
jmp 0x1410f227c
or cl, bl
stosd dword [rdi], eax
leave
retf
Function at 0x14000d480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140045188]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x14000d4bd
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000d4c4
mov al, 1
jmp 0x14000d60e
call fcn.14000dda0
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + 0x18]
mov dword [rsp + 0x38], eax
call fcn.14000dda0
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x3c]
call fcn.14000ddb0
movzx eax, al
test eax, eax
je 0x14000d515
xor al, al
jmp 0x14000d60e
mov qword [rsp + 0x50], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000d57b
cmp dword [rsp + 0x30], 1
je 0x14000d587
cmp dword [rsp + 0x30], 3
je 0x14000d5fc
jmp 0x14000d60c
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x14000d5d3
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x40], rax
je 0x14000d5d3
xor al, al
jmp 0x14000d60e
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000d5ed
mov dword [rsp + 0x34], 1
jmp 0x14000d5f5
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14000d60e
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000d60e
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14002dac0
add rsp, 0x98
ret
Function at 0x14000ee20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140045188]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x14000ee54
xor eax, eax
jmp 0x14000f006
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14000ee7d
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14000f006
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000ef1c
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.140001ca0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140009610
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14000eff6
mov rcx, qword [rsp + 0x70]
call fcn.14000d9f0
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x14000efbd
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x14000efbb
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14000f006
jmp 0x14000ef42
cmp qword [rsp + 0x40], 0
jbe 0x14000eff6
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002dac0
add rsp, 0x68
ret