joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800050d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180005660
mov qword [rsp + 0x28], 0
cmp qword [0x18000e3d8], 0
jne 0x180005118
cmp qword [0x18000e3d0], 0
je 0x180005118
mov rax, qword [0x18000e3d0]
mov qword [0x18000e3d8], rax
cmp qword [0x18000e3d8], 0
je 0x1800051be
mov rax, qword [0x18000e3d8]
cmp qword [rax + 0x10], 0
je 0x1800051be
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800051be
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800051be
mov rax, qword [0x18000e3d8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180005184
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18000518b
xor eax, eax
jmp 0x180005339
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180005339
mov rax, qword [0x18000e3d0]
mov qword [0x18000e3d8], rax
jmp 0x1800051e0
mov rax, qword [0x18000e3d8]
mov rax, qword [rax + 8]
mov qword [0x18000e3d8], rax
cmp qword [0x18000e3d8], 0
je 0x18000522d
cmp qword [0x18000e3d8], 0
je 0x18000522b
mov rax, qword [0x18000e3d8]
cmp qword [rax + 0x10], 0
je 0x18000522b
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000522b
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000522b
jmp 0x18000515c
jmp 0x1800051ce
mov rcx, qword [rsp + 0x60]
call fcn.180007290
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180005340
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180005337
mov rax, qword [rsp + 0x48]
mov qword [0x18000e3d8], rax
mov rax, qword [0x18000e3d8]
mov dword [rax], 0x52727464
mov rax, qword [0x18000e3d8]
mov qword [rax + 0x10], 0
mov rax, qword [0x18000e3d8]
mov rcx, qword [0x18000e3d0]
mov qword [rax + 8], rcx
mov rax, qword [0x18000e3d8]
mov qword [0x18000e3d0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18000e3d8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800052e8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180005322
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800052de
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18000515c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140120000
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180001a55
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x2f0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x2a8], rdi
mov qword [rbp + 0x2a0], rsi

Function at 0x18000d480
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [rcx + 0x50]
call sym.VBoxRT.dll_RTTlsGet
mov rbx, rax
test rax, rax
jne 0x18000d5b6
call sym.VBoxRT.dll_RTThreadIsSelfAlive
test al, al
jne 0x18000d4be
lea rax, [rsi + 0x78]
jmp 0x18000d5bd
mov rcx, qword [rsi + 0x50]
lea rbx, [rsi + 0x78]
mov rdx, rbx
call sym.VBoxRT.dll_RTTlsSet
test eax, eax
js 0x18000d5b6
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntimecommon_allocmemtracker.cpp
mov ecx, 0x100
call sym.VBoxRT.dll_RTMemAllocZTag
mov rdi, rax
test rax, rax
je 0x18000d5b6
mov r9d, 1
lea rcx, [rax + 0x18]
xor r8d, r8d
lea edx, [r9 + 6]
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_RTCritSectInitEx
test eax, eax
js 0x18000d5ae
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
lea rax, [rdi + 0x48]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rdi + 0x10], rsi
mov dword [rdi + 0x58], 1
call sym.VBoxRT.dll_RTThreadSelfName
test rax, rax
je 0x18000d555
lea rcx, [rdi + 0xe0]
mov r8, rax
mov edx, 0x20
call sym.VBoxRT.dll_RTStrCopy
mov rcx, qword [rsi + 0x50]
mov rdx, rdi
call sym.VBoxRT.dll_RTTlsSet
test eax, eax
js 0x18000d5a5
lea rcx, [rsi + 8]
call sym.VBoxRT.dll_RTCritSectEnter
mov eax, dword [rsi + 0x48]
lea rdx, [rsi + 0x38]
mov dword [rdi + 0x5c], eax
inc dword [rsi + 0x48]
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdx + 8]
mov qword [rdi], rdx
mov qword [rdi + 8], rax
mov qword [rdx + 8], rdi
inc dword [rsi + 0x20c]
lea rcx, [rsi + 8]
call sym.VBoxRT.dll_RTCritSectLeave
mov rax, rdi
jmp 0x18000d5bd
lea rcx, [rdi + 0x18]
call sym.VBoxRT.dll_RTCritSectDelete
mov rcx, rdi
call sym.VBoxRT.dll_RTMemFree
lock inc dword [rbx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180214700
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, rdx
mov edx, 1
mov rsi, rcx
lea ecx, [rdx + 0x3f]
mov r12d, r8d
call qword [case.0x18020c598.3]
xor r13d, r13d
mov rdi, rax
xor eax, eax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rax
test rdi, rdi
jne 0x180214751
lea ecx, [rax + 0xc]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1802148e1
mov rcx, qword [rsi + 0x390]
mov qword [rsp + 0x60], rbx
call fcn.180204200
mov rcx, rbp
call qword [case.0x18020c598.1]
mov qword [rsi + 0x390], rax
test rax, rax
jne 0x180214792
mov rcx, rdi
call qword [0x1803d58f8]
mov ecx, ntohl
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1802148dc
xor r8d, r8d
mov dword [rsi + 0x398], r12d
mov byte [rsi + 0x3a8], r13b
mov dword [rsi + 0x3ac], r13d
mov qword [rsi + 0x3a0], r13
mov qword [rsi + 0x3b0], rdi
lea edx, [r8 + 1]
xor ecx, ecx
mov qword [rdi + 0x10], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x18021483c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x18021483c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x30], rax
test rax, rax
je 0x18021483c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x38], rax
test rax, rax
je 0x18021483c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x18021485a
lea rcx, [rsi + 0x390]
call fcn.180214600
mov ecx, ntohl
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1802148dc
lea rax, [rdi + 8]
lea r8, [0x1802144b0]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.MSVCR100.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
jne 0x1802148a2
call qword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x390]
call fcn.180214600
xor al, al
jmp 0x1802148dc
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 0x28]
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, 2
mov ecx, edx
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi + 0x10], rax
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x14001b4a4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b4ba
mov al, 1
jmp 0x14001b51a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b4cb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b518
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400195f8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b518
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b518
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b518
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b51a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f930
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f958
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f958
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14101ba20
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14101ba2a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14101ba53
pop rbp
sub rbp, 0x33
sub rbp, 0x101ba20
sub rsp, 0x20
jmp 0x14101ba72
mov rax, 0x101ba20
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffd496b5bf
xor byte [rax], dl
inc rax
dec rcx
jne 0x14101ba91
jmp 0x14101baa8
div dword [rsi]
push rsi
xor al, 0x36
cmp dword [rdi + 0x3ef7bfbf], 0x7e
mov bh, 0xbe
mov edi, 0x56bef7bf
idiv dword [rax + 0x7f]
mov eax, 0xf7bfbfbf
js 0x14101bb42
xchg edi, eax
mov edi, 0x48f7bfbf
pop rbp
idiv dword [rsi - 0x4cc1cb82]
mov edi, 0xbef7bfbf
push rdi
out dx, eax
out dx, eax
test dword [rdi], 0xbf90eb53
mov edi, 0xf7bfbfbf
invalid
ret 0xbfbf
Function at 0x140004210
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x28], rbx
mov rdx, r8
lea rcx, [rsp + 0x30]
call fcn.140002a10
nop
cmp byte [0x140070c58], 0
je 0x14000432d
movsxd r9, dword [0x140070c54]
mov r8, r9
shl r8, 5
mov r10, qword [0x140070c80]
lea rdx, [r8 + r10]
mov r11, qword [rdx + 0x10]
movsxd rcx, dword [0x140070bb8]
cmp rcx, r11
jae 0x1400042e6
mov rdx, qword [0x140070c98]
add rdx, r8
lea r8, [rdx + 0x10]
mov rax, qword [r8]
dec rax
cmp qword [rdx + 0x18], 0x10
jb 0x14000429b
mov rdx, qword [rdx]
mov qword [r8], rax
mov byte [rdx + rax], 0
movsxd rdx, dword [0x140070c54]
shl rdx, 5
add rdx, qword [0x140070c98]
lea rax, [rsp + 0x30]
cmp rax, rdx
je 0x1400042dc
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400042cc
mov rdx, qword [rdx]
lea rcx, [rsp + 0x30]
call fcn.140009e90
mov ecx, dword [0x140070bb8]
inc ecx
mov dword [0x140070bb8], ecx
jmp 0x14000432d
cmp r9d, 3
jne 0x140004376
cmp byte [0x140070c51], 0
jne 0x140004376
mov rcx, qword [0x140070c98]
add rcx, r8
cmp rcx, rdx
je 0x14000431a
cmp qword [rdx + 0x18], 0x10
jb 0x140004312
mov rdx, qword [rdx]
mov r8, r11
call fcn.140009e90
mov word [0x140070c58], 0x100
mov dword [0x140070bb8], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140002a10
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400043a4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000439e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000439e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea eax, [r9 + 1]
mov dword [0x140070c54], eax
mov rcx, qword [0x140070c88]
sub rcx, r10
sar rcx, 5
cdqe
cmp rax, rcx
jb 0x14000431a
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.14003a858
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400043da
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400043d5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004408
mov rcx, r8
call fcn.14003a858
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003a0c0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140007ae0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rax, [0x140004fc0]
mov qword [rsp + 0x28], rax
mov ecx, 0x120
call fcn.14003a4f4
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x120
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14000c3d0
mov rbx, rax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x48], 0
test rax, rax
je 0x140007c18
lock inc dword [rax + 8]
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], 1
mov dword [rsp + 0x20], 1
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140007bc7
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x140007bb9
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x140007bc7
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
call fcn.140007360
nop
lock xadd dword [rbx + 8], edi
cmp edi, 1
jne 0x140007bfb
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x140007bed
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x140007bfb
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14003a0c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov ecx, 4
call fcn.140006fc0
int3

Function at 0x140008c00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140008c21
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140008c4e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140008c50
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140008ca9
test ecx, ecx
jle 0x140008c89
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140008ca9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140008ca9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140008cd0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140008cf2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140008d01
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140008d24
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008d26
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008d62
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140008dfe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140008d9d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140008dde
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140008dfe
cmp rbx, rax
ja 0x140008db0
test rbx, rbx
je 0x140008dfe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140009230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000925d
xor eax, eax
jmp 0x1400093ba
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140009288
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140009288
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400093ba
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400093ad
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400092cb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400092f6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400093b2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009365
sub eax, 1
je 0x140009365
cmp eax, 2
jne 0x1400093ad
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400093b2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140009393
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400093ad
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400093b2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003a0c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140009b60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140009c33
cmp byte [rcx + 0x71], 0
je 0x140009c33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140009c2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009bf4
sub eax, 1
je 0x140009bf8
cmp eax, 2
jne 0x140009c2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003a0c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140009c26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140009c2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140009bdc
xor al, al
jmp 0x140009bdc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003a0c0
add rsp, 0x60
pop rbx
ret