joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x180002ccb
nop dword [rax]
cmp rbx, qword [section..data]
jb 0x180002c3e
cmp rbx, qword [0x180008008]
ja 0x180002c3e
sub rbx, 0x8000000
jmp 0x180002cc2
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180002ccb
cmp dword [rsp + 0x40], 0x10000
jne 0x180002ca6
cmp qword [rsp + 0x38], 0x10000
jb 0x180002ca6
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180002ccd
sub rbx, 0x10000
jmp 0x180002cc2
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x180002c20
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180002ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x180002d02
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x180002dbd
nop dword [rax + rax]
cmp rbx, qword [section..data]
jb 0x180002d2e
cmp rbx, qword [0x180008008]
ja 0x180002d2e
add rbx, 0x8000000
jmp 0x180002db4
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180002dbd
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180002d99
cmp rcx, 0x10000
jb 0x180002d99
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180002dbf
add rbx, 0x10000
jmp 0x180002db4
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x180002db4
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180002d10
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180002dd0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x180002df2
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x180002e0e
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180002e25
cmp byte [rcx + 1], 0x25
jne 0x180002e69
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x180002e31
cmp al, 0xe9
jne 0x180002e69
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rbx
jae 0x180002e54
cmp rcx, 0xffffffff80000000
jae 0x180002e4b
lea rsi, [rcx + 0x7ff80000]
jmp 0x180002e69
mov rsi, 0xfffffffffff80000
jmp 0x180002e69
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180002e69
mov edi, 0x80000
mov rdx, qword [0x180008158]
mov rax, qword [0x180008150]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x180002e90
test rax, rax
je 0x180002ea7
mov rdx, rax
mov qword [0x180008158], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180002ea7
cmp rcx, rdi
jb 0x180002ea7
cmp rcx, rsi
jbe 0x180002ffa
mov qword [0x180008158], rax
mov rdx, rax
test rax, rax
je 0x180002ef2
mov rcx, rax
nop dword [rax]
test rax, rax
je 0x180002edc
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x180002edc
cmp rax, rdi
jb 0x180002edc
cmp rax, rsi
jbe 0x180002ffa
mov rdx, qword [rdx + 8]
mov qword [0x180008158], rdx
mov rcx, rdx
mov rax, rdx
test rdx, rdx
jne 0x180002ec0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x180002f1c
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.180002bf0
mov rdx, rax
test rax, rax
jne 0x180002fa8
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x180002f42
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.180002ce0
mov rdx, rax
test rax, rax
jne 0x180002fa8
cmp rbx, 0x40000000
jbe 0x180002f62
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.180002ce0
mov rdx, rax
test rax, rax
jne 0x180002fa8
cmp rbx, rbp
jae 0x180002f7e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.180002bf0
mov rdx, rax
test rax, rax
jne 0x180002fa8
mov rdx, rbx
mov rcx, rdi
call fcn.180002bf0
mov rdx, rax
test rax, rax
jne 0x180002fa8
mov rdx, rsi
mov rcx, rbx
call fcn.180002ce0
mov rdx, rax
test rax, rax
je 0x180003031
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x180008158], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x180008150]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x180008150], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x180002fe2
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x180003031
cmp rax, rsi
ja 0x180003031
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x1800062b0]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x180003033
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180003290
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x1800032be
xor al, al
jmp 0x180003300
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x1800032cf
xor al, al
jmp 0x180003300
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x1800032f6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x1800032f6
mov al, 1
jmp 0x180003300
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x1800037e0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x180008168], 0
jne 0x180003887
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180008168], ecx
jne 0x180003887
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x180008150]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x180008180], rdi
mov qword [0x180008178], rdi
mov qword [0x180008170], rdi
test rbx, rbx
je 0x180003870
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180003868
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180003840
jmp 0x180003870
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x18000816c], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x180003ea0
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18000816c]
mov rdi, rcx
test eax, eax
jne 0x180003f43
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x180003eca
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.1800046c0
mov rbx, rax
test rax, rax
jne 0x180003ee6
lea edi, [rax + 8]
jmp 0x180003f09
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180003f27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180004a74
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18000816c], edi
mov qword [0x180008170], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180008178]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x180008178], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180057b49
Capabilities:
Authenticate hmac

Disassembly:
not cl
sal dx, 0x8c
mov qword [rsp + rax], rdx
add al, 0x34
dec cl
neg word [rsp + rax - 0x34]
add r10, qword [rsp + rax*8 - 0x1a0]
xor r8b, cl
lea rdi, [rbp*4 - 0x225a15d0]
not eax
lea rcx, [rsp + rcx + 8]
or ax, word [rsp + rdx - 0xf97cfff]
mov esi, dword [rcx + rdx*2 - 0x1f2fa000]
xor dword [rsp + r10 + 0x52a8db6f], edi
add byte [rsp + rdx - 0xf97d000], r10b
lea r9, [rdx + r9 - 0xf97d004]
sbb r10w, r10w
mov byte [rsp + rdx - 0xf97cffe], ah
push rdx
mov dword [r9 + rdx*2 - 0x1f2fa000], esi
and dword [rsp + rdx - 0xf97d000], ebp
mov eax, dword [r11 + rdx*2 - 0x1f2fa000]
lea r11, [r11 + rdx*2 - 0x1f2f9ffc]
xor eax, r8d
inc eax
jmp 0x180058c2c

Function at 0x180057c45
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx*2 - 0x70106f2a], rax
mov qword [rsp + rcx - 0x380837a5], rdi
xor dword [rsp + rcx*2 - 0x70106f22], ebp
mov qword [rsp + rcx - 0x3808378d], rax
shl cl, cl
adc eax, edx
mov r8, qword [rsp + rcx*2 - 0x70106f18]
movsxd rbp, ebp
pop rax
add rbx, rbp
sar rdx, cl
movzx ebp, di
movzx r10d, cx
mov r10, qword [r9 + rdx*4]
shl eax, 4
pop rdx
mov rcx, qword [rcx + r9 - 0x38083798]
pop rax
lea r9, [r9 + rbp - 0xff95]
call fcn.1800439f3
Function at 0x140002b60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140002b91
xor eax, eax
jmp 0x140002cdb
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140002bce
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x140002bce
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140002cdb
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140002cd0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140002c15
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002c23
movzx ecx, di
jmp 0x140002c77
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002c90
sub eax, 1
je 0x140002c90
cmp eax, 2
jne 0x140002cd0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140002cd3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140002cbe
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140002cd0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004fd0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400037a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400037cd
xor eax, eax
jmp 0x140003939
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003807
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003807
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003939
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000392c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000384a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003875
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003931
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400038e4
sub eax, 1
je 0x1400038e4
cmp eax, 2
jne 0x14000392c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003931
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003912
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000392c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003931
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004fd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003e95
cmp byte [rcx + 0x72], 0
je 0x140003e95
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140003e91
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003e56
sub eax, 1
je 0x140003e5a
cmp eax, 2
jne 0x140003e91
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004fd0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003e88
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003e91
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140003e3e
xor al, al
jmp 0x140003e3e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004fd0
add rsp, 0x60
pop rbx
ret

Function at 0x140003f70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004043
cmp byte [rcx + 0x71], 0
je 0x140004043
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000403f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004004
sub eax, 1
je 0x140004008
cmp eax, 2
jne 0x14000403f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004fd0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004036
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000403f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003fec
xor al, al
jmp 0x140003fec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004fd0
add rsp, 0x60
pop rbx
ret
Function at 0x140005950
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000599a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000599a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000599a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000599a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000599a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000599c
xor al, al
add rsp, 0x28
ret
Function at 0x140001800
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140001828
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000184e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001850
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400018a9
test ecx, ecx
jle 0x140001889
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400018a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400018a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400018d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400018f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140001908
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001924
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001926
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001962
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400019fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000199d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400019de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400019fe
cmp rbx, rax
ja 0x1400019b0
test rbx, rbx
je 0x1400019fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140001e20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140001e4d
xor eax, eax
jmp 0x140001faa
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140001e78
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140001e78
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140001faa
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140001f9d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140001ebb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140001ee6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140001fa2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140001f55
sub eax, 1
je 0x140001f55
cmp eax, 2
jne 0x140001f9d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140001fa2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140001f83
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140001f9d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140001fa2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003090
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret