joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b7c
Capabilities:
Get common file path

Disassembly:
jmp 0x14005ccd0
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rcx
mov qword [rbp - 0x31], rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
mov dword [rbp - 0x49], 1
mov qword [rbp - 0x41], r13
lea r9, [rbp - 0x41]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400e0b10]
call sub.SHELL32.dll_SHGetKnownFolderPath
movdqa xmm0, xmmword [0x1400d1ef0]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r13w
mov rdx, qword [rbp - 0x41]
test rdx, rdx
je 0x14005cd8e
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14005cd70
lea rcx, [rbp - 9]
call fcn.140001faf
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r14, [rbp - 9]
mov rsi, qword [rbp - 9]
mov r15, qword [rbp + 0xf]
cmp r15, 8
cmovae r14, rsi
mov r12, qword [rbp + 7]
cmp r12, 8
jae 0x14005cdbe
movups xmm6, xmmword [r14]
movups xmmword [rbp - 0x29], xmm6
mov qword [rbp - 0x11], 7
jmp 0x14005ce02
mov rbx, r12
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x29]
call fcn.1400018a7
mov qword [rbp - 0x29], rax
lea r8, [r12*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x11], rbx
movups xmm6, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], r12
lea rax, [rbp - 0x29]
cmp rdi, rax
je 0x14005ce34
mov rcx, rdi
call fcn.140001339
movups xmmword [rdi], xmm6
movups xmm0, xmmword [rbp - 0x19]
movups xmmword [rdi + 0x10], xmm0
movdqa xmm1, xmmword [0x1400d1ef0]
movdqu xmmword [rbp - 0x19], xmm1
mov word [rbp - 0x29], r13w
lea rcx, [rbp - 0x29]
call fcn.140001339
nop
cmp r15, 8
jb 0x14005ce7c
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005ce74
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ce74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400017ad
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001c58
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400022bb
Capabilities:
Check if file exists

Disassembly:
jmp 0x14009d600
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
lea r14, [0x1400ccd88]
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x24], bpl
mov qword [rsp + 0x28], r14
jb 0x14009d639
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14009d660
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14009cdb0
mov ebp, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x14009d6c5
bt ebx, 0xa
jae 0x14009d6bc
mov rcx, rsi
call fcn.14009c7f0
test al, al
je 0x14009d684
test bl, 0x10
mov eax, VariantTimeToDosDateTime
mov ebx, 4
cmovne ebx, eax
jmp 0x14009d6c5
mov ebx, 9
test rdi, rdi
je 0x14009d69c
mov dword [rdi], 0
mov byte [rdi + 4], 0
mov qword [rdi + 8], r14
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.14009dbe0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
jne 0x14009d689
test ebp, ebp
je 0x14009d689
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rsi
mov ecx, ebp
call fcn.1400011bd
xor al, al
jmp 0x14009d6a9
Function at 0x140002d38
Capabilities:
Write file on windows

Disassembly:
jmp 0x140037830
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400378dc
cmp byte [rcx + 0x71], 0
je 0x1400378dc
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14003789d
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400378a1
sub eax, 1
je 0x1400378a5
sub eax, 2
je 0x1400378dc
xor al, al
jmp 0x1400378de
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400378d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003789d
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400378de
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001c58
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140002db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400975b0
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r13, r9
mov rbx, r8
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r9
call fcn.1400019bf
mov r14d, 0xffffffff
test al, al
je 0x140097734
nop word [rax + rax]
mov rdx, r13
mov rcx, rbx
call fcn.1400019bf
test al, al
je 0x140097734
mov rax, rbx
mov rbp, qword [rbx + 0x18]
cmp rbp, 8
jb 0x140097633
mov rax, qword [rbx]
mov r9, rdi
mov rsi, qword [rdi + 0x18]
cmp rsi, 8
jb 0x140097643
mov r9, qword [rdi]
mov r11, qword [rbx + 0x10]
mov r10, qword [rdi + 0x10]
mov rcx, r10
cmp r11, r10
cmovb rcx, r11
test rcx, rcx
je 0x140097679
sub r9, rax
nop dword [rax]
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x140097683
add rax, 2
sub rcx, 1
jne 0x140097660
cmp r10, r11
jae 0x140097692
mov eax, r14d
jmp 0x14009769a
mov eax, 1
cmp dx, r8w
cmovb eax, r14d
jmp 0x14009769a
xor eax, eax
cmp r10, r11
seta al
shr eax, 0x1f
test al, al
jne 0x1400977c5
mov rax, rdi
cmp rsi, 8
jb 0x1400976b1
mov rax, qword [rdi]
mov r9, rbx
cmp rbp, 8
jb 0x1400976bd
mov r9, qword [rbx]
mov rcx, r11
cmp r10, r11
cmovb rcx, r10
test rcx, rcx
je 0x1400976e9
sub r9, rax
nop
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jne 0x1400976f3
add rax, 2
sub rcx, 1
jne 0x1400976d0
cmp r11, r10
jae 0x140097702
mov eax, r14d
jmp 0x14009770a
mov eax, 1
cmp dx, r8w
cmovb eax, r14d
jmp 0x14009770a
xor eax, eax
cmp r11, r10
seta al
shr eax, 0x1f
test al, al
jne 0x140097786
mov rcx, rdi
call fcn.140003436
mov rcx, rbx
call fcn.140003436
mov rdx, r15
mov rcx, rdi
call fcn.1400019bf
test al, al
jne 0x140097610
mov rcx, qword [rdi + 0x20]
mov rdx, qword [r15 + 0x20]
cmp rcx, rdx
jne 0x1400977bf
mov rax, qword [r15 + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x1400977b0
mov rax, qword [r13 + 0x20]
cmp qword [rbx + 0x20], rax
jne 0x1400977b0
mov rax, qword [r13 + 0x28]
cmp qword [rbx + 0x28], rax
jne 0x1400977b0
mov rcx, rdi
call fcn.140001339
nop
mov rcx, r15
call fcn.140001339
nop
mov rcx, rbx
call fcn.140001339
nop
mov rcx, r13
call fcn.140001339
xor eax, eax
jmp 0x1400977eb
mov rcx, rdi
call fcn.140001339
nop
mov rcx, r15
call fcn.140001339
nop
mov rcx, rbx
call fcn.140001339
nop
mov rcx, r13
call fcn.140001339
mov eax, 1
jmp 0x1400977eb
cmp rcx, rdx
jne 0x1400977bf
mov rax, qword [r15 + 0x28]
cmp qword [rdi + 0x28], rax
je 0x1400977c5
mov r14d, 1
mov rcx, rdi
call fcn.140001339
nop
mov rcx, r15
call fcn.140001339
nop
mov rcx, rbx
call fcn.140001339
nop
mov rcx, r13
call fcn.140001339
mov eax, r14d
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001c58
add rsp, 0x50
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400032d8
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400a23e0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140118ac0]
cmp ecx, 0xffffffff
je 0x1400a2445
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a2445
mov rcx, qword [rax + 0x28]
mov rax, rcx
mov rdx, qword [rcx + 8]
cmp byte [rdx + 0x19], 0
jne 0x1400a2433
cmp qword [rdx + 0x20], rbx
jae 0x1400a241c
mov rdx, qword [rdx + 0x10]
jmp 0x1400a2422
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1400a2410
cmp rax, rcx
je 0x1400a2433
cmp rbx, qword [rax + 0x20]
jae 0x1400a2436
mov rax, rcx
cmp rax, rcx
je 0x1400a2445
add rax, 0x28
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140003bc0
Capabilities:
Get common file path

Disassembly:
jmp 0x14009bc50
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov r14, rdx
mov r15, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov r8d, esi
mov eax, 2
mul r8
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.140003bb1
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x14009bce1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14009bce1
lea r8, str.boost::filesystem::current_path
mov rdx, r14
mov ecx, eax
call fcn.140001c71
jmp 0x14009bcf8
test r14, r14
je 0x14009bcf8
mov dword [r14], esi
mov byte [r14 + 4], sil
lea rax, [0x1400ccd88]
mov qword [r14 + 8], rax
mov qword [r15 + 0x10], rsi
mov qword [r15 + 0x18], 7
mov word [r15], si
nop dword [rax + rax]
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14009bd10
mov r8, rdi
mov rdx, rbx
mov rcx, r15
call fcn.140001faf
nop
mov rcx, rbx
call fcn.140002dd3
mov rax, r15
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140003e81
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1400a3980
jmp fcn.1400a3d70
Function at 0x140004368
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
jmp 0x14005f860
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x14005f888
mov qword [rdi], 0
mov rax, rdi
add rsp, 0x20
pop rdi
ret
cmp qword [rsp + 0x40], 0
jle 0x14005f878
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14005f8bc
inc ebx
cmp ebx, 3
ja 0x14005f8f2
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14005f8a6
mov rbx, qword [rsp + 0x30]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x38]
xorps xmm0, xmm0
mulsd xmm1, qword [0x1400d7178]
cvtsi2sd xmm0, qword [rsp + 0x40]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140034480
Capabilities:
Print debug messages

Disassembly:
jmp 0x140034480
sub rsp, 0x58
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x1400cd840]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
call fcn.140002bee
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140034507
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034502
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034502
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400017ad
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001c58
add rsp, 0x58
ret
Function at 0x140034540
Capabilities:
Write file on windows

Disassembly:
jmp 0x140034540
push rbx
push rbp
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rcx + 0x78]
mov r15, r8
mov r14, rdx
mov rbp, rcx
test rbx, rbx
jne 0x14003467c
mov qword [rsp + 0x98], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x50], rdi
lea rdi, [rcx + 0x80]
cmp qword [rdi + 0x18], 8
mov rsi, qword [rdi + 0x10]
movdqu xmmword [rsp + 0x30], xmm0
jb 0x14003459b
mov rdi, qword [rdi]
lea rcx, [rsp + 0x20]
cmp rsi, 8
jae 0x1400345b9
movups xmm0, xmmword [rdi]
mov qword [rsp + 0x38], 7
movups xmmword [rsp + 0x20], xmm0
jmp 0x140034606
movabs rax, 0x7ffffffffffffffe
mov rbx, rsi
or rbx, 7
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
call fcn.1400018a7
lea r8, [rsi*2 + 2]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 8
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov qword [rsp + 0x30], rsi
lea rdx, [0x1400d1704]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfsopen]
mov rdx, qword [rsp + 0x38]
mov rbx, rax
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
cmp rdx, 8
jb 0x140034673
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003466e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003466e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400017ad
mov qword [rbp + 0x78], rbx
test rbx, rbx
je 0x140034690
mov r9, rbx
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001c58
add rsp, 0x58
pop r15
pop r14
pop rbp
pop rbx
ret

Function at 0x140037830
Capabilities:
Write file on windows

Disassembly:
jmp 0x140037830
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400378dc
cmp byte [rcx + 0x71], 0
je 0x1400378dc
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14003789d
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400378a1
sub eax, 1
je 0x1400378a5
sub eax, 2
je 0x1400378dc
xor al, al
jmp 0x1400378de
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400378d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003789d
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400378de
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001c58
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14003a930
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003a930
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003a95d
xor eax, eax
jmp 0x14003aab2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14003a988
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14003a988
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14003aab2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14003aaa5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14003a9cb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003a9f6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003aaaa
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x14003aaa5
cmp eax, 1
jle 0x14003aa65
cmp eax, 3
jne 0x14003aaa5
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003aaaa
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14003aa93
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14003aaa5
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x14003aaaa
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001c58
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14003cb00
Capabilities:
Read file on windows

Disassembly:
jmp 0x14003cb00
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14003cb37
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x14003cb58
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003cb5a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003cbc0
test ecx, ecx
jle 0x14003cb8e
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003cbc0
cmp qword [rdi + 0x80], 0
je 0x14003cbc0
mov rcx, rdi
call fcn.140004089
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14003cc20
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003cc20
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14003cc57
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14003cc78
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003cc7a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003ccd3
test ecx, ecx
jle 0x14003ccae
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003ccd3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14003ccd3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14005ccd0
Capabilities:
Get common file path

Disassembly:
jmp 0x14005ccd0
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140118988]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rcx
mov qword [rbp - 0x31], rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
mov dword [rbp - 0x49], 1
mov qword [rbp - 0x41], r13
lea r9, [rbp - 0x41]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400e0b10]
call sub.SHELL32.dll_SHGetKnownFolderPath
movdqa xmm0, xmmword [0x1400d1ef0]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r13w
mov rdx, qword [rbp - 0x41]
test rdx, rdx
je 0x14005cd8e
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14005cd70
lea rcx, [rbp - 9]
call fcn.140001faf
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r14, [rbp - 9]
mov rsi, qword [rbp - 9]
mov r15, qword [rbp + 0xf]
cmp r15, 8
cmovae r14, rsi
mov r12, qword [rbp + 7]
cmp r12, 8
jae 0x14005cdbe
movups xmm6, xmmword [r14]
movups xmmword [rbp - 0x29], xmm6
mov qword [rbp - 0x11], 7
jmp 0x14005ce02
mov rbx, r12
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x29]
call fcn.1400018a7
mov qword [rbp - 0x29], rax
lea r8, [r12*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x11], rbx
movups xmm6, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], r12
lea rax, [rbp - 0x29]
cmp rdi, rax
je 0x14005ce34
mov rcx, rdi
call fcn.140001339
movups xmmword [rdi], xmm6
movups xmm0, xmmword [rbp - 0x19]
movups xmmword [rdi + 0x10], xmm0
movdqa xmm1, xmmword [0x1400d1ef0]
movdqu xmmword [rbp - 0x19], xmm1
mov word [rbp - 0x29], r13w
lea rcx, [rbp - 0x29]
call fcn.140001339
nop
cmp r15, 8
jb 0x14005ce7c
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005ce74
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ce74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400017ad
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001c58
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret