joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d870
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002d898
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002d898
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140037958
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140031414
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400379f9
cmp ebx, dword [rsp + 0x30]
je 0x1400379f2
test esi, esi
je 0x1400379f2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400379cd
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400379da
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400379b7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400379de
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400379fb
mov eax, 1
jmp 0x1400379fb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400388c8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003894f
mov rsi, rbx
cmp word [rax], bp
je 0x14003890e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400388f8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400388f4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400097a0
mov rdi, rax
test rax, rax
je 0x14003893c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001a050
mov rbp, rdi
xor ecx, ecx
call fcn.140010610
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003b5e4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003b5fa
mov al, 1
jmp 0x14003b65a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003b60b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003b658
mov ecx, dword [rcx + 0x18]
nop
call fcn.140025f0c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b658
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003b658
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003b658
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003b65a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14005f020
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x14005f033
cmp dword [0x140091250], ecx
jle 0x14005f03a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.14005f080
test edi, edi
je 0x14005f033
cmp byte [rsi + rdi - 1], 0xa
je 0x14005f033
lea rcx, str._nl_
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14005f080

Function at 0x14005f080
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14007c028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x14005f0f7
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x14005f0f7
add rdi, rax
test ecx, ecx
jne 0x14005f0bd
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140017f80
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140002238
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1cd0]
mov eax, 0x1dd0
call fcn.14000fca0
sub rsp, rax
mov rax, qword [0x1400234e8]
xor rax, rsp
mov qword [rbp + 0x1cc0], rax
mov rdi, rdx
mov rbx, rcx
mov r14d, 0x1000
lea rcx, [rbp + 0xcc0]
mov r8d, r14d
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov esi, 0x800
lea rcx, [rbp + 0x4c0]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rdx, [rbp + 0x4c0]
lea rcx, [0x1400137d8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x7fe
ja 0x1400022d5
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0xcc0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1400022e7
mov r8, r14
lea rdx, [rbp + 0xcc0]
mov rcx, rbx
call fcn.140008428
lea rdx, [0x1400137e8]
lea rcx, [rbp + 0xcc0]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
test rax, rax
jne 0x140002491
mov esi, 0x104
lea rcx, [rbp + 0x3b0]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rcx, [rbp + 0x190]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
shr ebp, 0
add byte [rbx - 0x7272b72a], cl
mov al, 3
add byte [rax], al
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [rbp + 0x3b0]
lea rdx, [0x140013808]
lea rcx, [rbp + 0x190]
call fcn.140003860
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r8d, esi
lea rcx, [rbp + 0x2a0]
xor edx, edx
mov r14, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rcx, [rbp + 0x80]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rdx, [rbp + 0x2a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x2a0]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x1400023b6
mov byte [rax], 0
lea r8, [rbp + 0x2a0]
lea rdx, [0x1400137fc]
lea rcx, [rbp + 0x80]
call fcn.140003860
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp r14, 0xffffffffffffffff
jne 0x140002419
cmp rax, r14
je 0x140002491
mov r8, rbx
lea r9, [rbp + 0x80]
lea rbx, [0x1400238e0]
mov rcx, rbx
lea rdx, [0x140013878]
call fcn.140003860
mov rcx, rsi
jmp 0x140002465
lea r9, [rbp + 0x190]
mov r8, rbx
lea rbx, [0x1400238e0]
mov rcx, rbx
cmp rsi, 0xffffffffffffffff
je 0x140002456
lea rax, [rbp + 0x80]
lea rdx, [0x140013830]
mov qword [rsp + 0x20], rax
call fcn.140003860
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140002414
lea rdx, [0x140013858]
call fcn.140003860
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x30], rbx
cmp qword [rdi + 0x10], rdx
je 0x140002484
mov qword [rdx], rbx
add qword [rdi + 8], 8
jmp 0x140002491
lea r8, [rsp + 0x30]
mov rcx, rdi
call fcn.140003468
mov rcx, qword [rbp + 0x1cc0]
xor rcx, rsp
call fcn.14000fd10
lea r11, [rsp + 0x1dd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140007620
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403e9f40]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1403ea5a0]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x140007688
cmp byte [rbx + 0x4a5e], 0
jne 0x140007688
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14000cd10
test sil, 1
je 0x1400077b9
jmp 0x140007721
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400e09b0]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400e09a0]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x47a8], 1
mov qword [rbx + 0x47c0], rax
movss dword [rbx + 0x47b8], xmm0
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mov rax, qword [0x1403ea5a0]
mulss xmm0, dword [0x1400e0950]
or dword [rax + 0x47a8], 0x40
movss dword [rax + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.14000cd10
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140007771
lea r11, [0x1400df210]
cmp r9b, 0x23
jne 0x140007754
cmp byte [r8], r9b
jne 0x140007754
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140007741
not ecx
call fcn.14000b830
test rax, rax
je 0x1400077b9
cmp byte [rax + 0xae], 0
je 0x1400077b9
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b5a]
call fcn.14000cd10
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400047f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d9560
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000b780
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1403ea5a0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14000b7e3
mov qword [rsp], rbx
lea rbx, [0x1400df210]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000b7c3
cmp byte [r8], r9b
jne 0x14000b7c3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14000b7b0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bb8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14000b817
mov r10, qword [r10 + 0x5bc0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14000b81e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14000b804
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14004dde0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1403e9f40]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004deb3
cmp byte [rcx + 0x71], 0
je 0x14004deb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14004deaf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004de74
sub eax, 1
je 0x14004de78
cmp eax, 2
jne 0x14004deaf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d9560
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004dea6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004deaf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004de5c
xor al, al
jmp 0x14004de5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d9560
add rsp, 0x60
pop rbx
ret
Function at 0x14004e0e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1403e9f40]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14004e10d
xor eax, eax
jmp 0x14004e276
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14004e14d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14004e14d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14004e26e
cmp qword [rdi + 0x80], 0
je 0x14004e269
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14004e187
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14004e1b2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14004e26e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004e221
sub eax, 1
je 0x14004e221
cmp eax, 2
jne 0x14004e269
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14004e26e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14004e24f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14004e269
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14004e26e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d9560
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004ea20
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14004ea42
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14004ea51
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x14004eaa2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x14004eb11
mov rcx, rbp
call fcn.14004def0
cmp rbx, 0xfff
jbe 0x14004eaf1
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14004eb2a
cmp rbx, rax
ja 0x14004eac0
test rdi, rdi
je 0x14004eb11
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x14004eb14
cld
and esp, ecx
scasd eax, dword [rdi]
movsxd rbp, dword [r15 + rdx*4 + 0x1238646b]
xchg ecx, eax
loop 0x1401ed1b1
invalid
mov al, 0x86
add edi, dword [rbx]
pop qword [rdx]
mov ecx, 0xdef49313
xchg byte [rax + 0x1e1653dc], dh
cmp byte [rbp + 0x6ac2695a], dl
mov esi, 0x83b9471
mov bl, bh
pop rcx
jb 0x1401ed23f
insb byte [rdi], dx
fsub dword [rdx + rsi*4 - 0x65c77b08]
sal byte fs:[0xcd182410], cl
ficomp word [rbx]
sahf
sub bh, byte [rbx + 0x1c4eca33]
invalid
rcl dword [rbx + 0x4c9bd812], 0xc6
ret 0xa882
Function at 0x14004eb30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14004eb51
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14004ebcc
test rax, rax
jle 0x14004ebac
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14004ebcc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14004ebcc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
insb byte [rdi], dx

Function at 0x14004f770
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x3f], 0
mov rbx, rcx
je 0x14004f796
xor eax, eax
lea r8d, [rax + 0x6b]
xor byte [rdx + rax], r8b
inc rax
cmp rax, 0x3e
jb 0x14004f781
mov byte [rdx + 0x3f], 0
call fcn.14004ec10
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400627a0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [0x1403eafd0]
xor ebx, ebx
mov eax, dword [0x1403eaf44]
mov dword [0x1403eaf40], eax
test rcx, rcx
jne 0x14006294a
mov rax, qword gs:[0x60]
mov r11d, 0xf4d8b55
mov qword [rsp + 0x60], rbp
mov ebp, ebx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r12, qword [rcx + 0x10]
mov rsi, r12
nop
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14006284c
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140062844
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140062830
cmp edx, ebp
jne 0x140062913
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov r10d, ecx
shr r15, 0x20
add r10, r9
cmp r10, r9
je 0x140062913
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140062913
mov r14d, dword [r10 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400628c7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400628b0
cmp edx, r11d
je 0x1400628d3
test r8d, r8d
jne 0x140062890
jmp 0x140062913
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, r10
jbe 0x140062925
lea rax, [r15 + r10]
cmp rcx, rax
jae 0x140062925
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
mov r11, qword [rsp + 0x58]
shr r11, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x140062800
mov rcx, rbx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [0x1403eafd0], rcx
call rcx
mov ecx, dword [0x1403eaf40]
mov dword [0x1403eaf44], eax
test ecx, ecx
je 0x1400629ab
sub eax, ecx
cmp eax, 0x1770
jbe 0x1400629ab
mov dword [rsp + 0x50], 0xb00053f
mov word [rsp + 0x54], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x6b]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140062980
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x55], 0
call fcn.140069bc0
mov qword [0], 1
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140062a30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140062a53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6b]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x140062a40
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140069bc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, rcx
mov dword [rsp + 0x20], 0x11f1e0e
xor edx, edx
mov dword [rsp + 0x24], 0x524b501d
mov word [rsp + 0x28], 0x100
nop dword [rax]
lea eax, [rdx + 0x6b]
xor byte [rsp + rdx + 0x20], al
inc rdx
cmp rdx, 8
jb 0x140069bf0
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x29], 0
mov rcx, rbx
call fcn.14004ec10
mov rdx, rdi
mov rcx, rbx
call fcn.14004ec10
lea rdx, [0x14004f0c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140069cb7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140069cb7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140069cb2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140069c90
cmp r8d, 0x2fa62ca8
je 0x140069cbc
test r9d, r9d
jne 0x140069c70
mov rax, qword [rax]
jmp 0x140069c40
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov rbx, qword [rsp + 0x40]
mov qword [0], 1
add rsp, 0x30
pop rdi
ret