joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x43
mov byte [rsp + 0x22], 0x69
mov byte [rsp + 0x23], 0x63
mov byte [rsp + 0x24], 0x59
mov byte [rsp + 0x25], 0x7e
mov byte [rsp + 0x26], 0x63
mov byte [rsp + 0x27], 0x60
mov byte [rsp + 0x28], 0x75
mov byte [rsp + 0x29], 0x73
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2b], 0x7f
mov byte [rsp + 0x2c], 0x62
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d70c], eax
jle 0x14003f71d
lea rcx, [0x14023d70c]
call fcn.140124ec8
cmp dword [0x14023d70c], 0xffffffff
jne 0x14003f71d
mov edx, 8
lea rcx, [0x14023d888]
call fcn.140009120
lea rdx, [0x14023d888]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x140131340]
call fcn.140125274
nop
lea rcx, [0x14023d70c]
call fcn.140124e5c
nop
lea rcx, [0x14023d888]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003f740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x58
mov byte [rsp + 0x22], 0x44
mov byte [rsp + 0x23], 0x44
mov byte [rsp + 0x24], 0x40
mov byte [rsp + 0x25], 0x30
mov byte [rsp + 0x26], 0x54
mov byte [rsp + 0x27], 0x75
mov byte [rsp + 0x28], 0x72
mov byte [rsp + 0x29], 0x65
mov byte [rsp + 0x2a], 0x77
mov byte [rsp + 0x2b], 0x77
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], 0x62
mov byte [rsp + 0x2e], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d7dc], eax
jle 0x14003f812
lea rcx, [0x14023d7dc]
call fcn.140124ec8
cmp dword [0x14023d7dc], 0xffffffff
jne 0x14003f812
mov edx, 8
lea rcx, [0x14023d858]
call fcn.140009120
lea rdx, [0x14023d858]
lea rcx, [rsp + 0x20]
call fcn.140042b10
lea rcx, [0x140131320]
call fcn.140125274
nop
lea rcx, [0x14023d7dc]
call fcn.140124e5c
nop
lea rcx, [0x14023d858]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003fc70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x43
mov byte [rsp + 0x22], 0x69
mov byte [rsp + 0x23], 0x63
mov byte [rsp + 0x24], 0x51
mov byte [rsp + 0x25], 0x7e
mov byte [rsp + 0x26], 0x71
mov byte [rsp + 0x27], 0x7c
mov byte [rsp + 0x28], 0x69
mov byte [rsp + 0x29], 0x6a
mov byte [rsp + 0x2a], 0x75
mov byte [rsp + 0x2b], 0x62
mov byte [rsp + 0x2c], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d924], eax
jle 0x14003fd38
lea rcx, [0x14023d924]
call fcn.140124ec8
cmp dword [0x14023d924], 0xffffffff
jne 0x14003fd38
mov edx, 8
lea rcx, [0x14023d760]
call fcn.140009120
lea rdx, [0x14023d760]
lea rcx, [rsp + 0x20]
call fcn.140042d50
lea rcx, [0x140131260]
call fcn.140125274
nop
lea rcx, [0x14023d924]
call fcn.140124e5c
nop
lea rcx, [0x14023d760]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003fe40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x40
mov byte [rsp + 0x22], 0x62
mov byte [rsp + 0x23], 0x7f
mov byte [rsp + 0x24], 0x73
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x63
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x30
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x68
mov byte [rsp + 0x2b], 0x60
mov byte [rsp + 0x2c], 0x7c
mov byte [rsp + 0x2d], 0x7f
mov byte [rsp + 0x2e], 0x62
mov byte [rsp + 0x2f], 0x75
mov byte [rsp + 0x30], 0x62
mov byte [rsp + 0x31], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d7c0], eax
jle 0x14003ff21
lea rcx, [0x14023d7c0]
call fcn.140124ec8
cmp dword [0x14023d7c0], 0xffffffff
jne 0x14003ff21
mov edx, 8
lea rcx, [0x14023d8f0]
call fcn.140009120
lea rdx, [0x14023d8f0]
lea rcx, [rsp + 0x20]
call fcn.140041fd0
lea rcx, [0x140131220]
call fcn.140125274
nop
lea rcx, [0x14023d7c0]
call fcn.140124e5c
nop
lea rcx, [0x14023d8f0]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003ff40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x7d
mov byte [rsp + 0x23], 0x7d
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x25], 0x7e
mov byte [rsp + 0x26], 0x79
mov byte [rsp + 0x27], 0x64
mov byte [rsp + 0x28], 0x69
mov byte [rsp + 0x29], 0x54
mov byte [rsp + 0x2a], 0x75
mov byte [rsp + 0x2b], 0x72
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x2d], 0x77
mov byte [rsp + 0x2e], 0x77
mov byte [rsp + 0x2f], 0x75
mov byte [rsp + 0x30], 0x62
mov byte [rsp + 0x31], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d728], eax
jle 0x140040021
lea rcx, [0x14023d728]
call fcn.140124ec8
cmp dword [0x14023d728], 0xffffffff
jne 0x140040021
mov edx, 8
lea rcx, [0x14023d930]
call fcn.140009120
lea rdx, [0x14023d930]
lea rcx, [rsp + 0x20]
call fcn.140041fd0
lea rcx, [0x140131200]
call fcn.140125274
nop
lea rcx, [0x14023d728]
call fcn.140124e5c
nop
lea rcx, [0x14023d930]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x140040110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x78
mov byte [rsp + 0x23], 0x75
mov byte [rsp + 0x24], 0x71
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x26], 0x30
mov byte [rsp + 0x27], 0x55
mov byte [rsp + 0x28], 0x7e
mov byte [rsp + 0x29], 0x77
mov byte [rsp + 0x2a], 0x79
mov byte [rsp + 0x2b], 0x7e
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d8a4], eax
jle 0x1400401dd
lea rcx, [0x14023d8a4]
call fcn.140124ec8
cmp dword [0x14023d8a4], 0xffffffff
jne 0x1400401dd
mov edx, 8
lea rcx, [0x14023d8c8]
call fcn.140009120
lea rdx, [0x14023d8c8]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x1401311c0]
call fcn.140125274
nop
lea rcx, [0x14023d8a4]
call fcn.140124e5c
nop
lea rcx, [0x14023d8c8]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x1400402e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x42
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x63
mov byte [rsp + 0x24], 0x7f
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x62
mov byte [rsp + 0x27], 0x73
mov byte [rsp + 0x28], 0x75
mov byte [rsp + 0x29], 0x30
mov byte [rsp + 0x2a], 0x58
mov byte [rsp + 0x2b], 0x71
mov byte [rsp + 0x2c], 0x73
mov byte [rsp + 0x2d], 0x7b
mov byte [rsp + 0x2e], 0x75
mov byte [rsp + 0x2f], 0x62
mov byte [rsp + 0x30], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d8d4], eax
jle 0x1400403bc
lea rcx, [0x14023d8d4]
call fcn.140124ec8
cmp dword [0x14023d8d4], 0xffffffff
jne 0x1400403bc
mov edx, 8
lea rcx, [0x14023d700]
call fcn.140009120
lea rdx, [0x14023d700]
lea rcx, [rsp + 0x20]
call fcn.1400422d0
lea rcx, [0x140131180]
call fcn.140125274
nop
lea rcx, [0x14023d8d4]
call fcn.140124e5c
nop
lea rcx, [0x14023d700]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x1400403e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x52
mov byte [rsp + 0x22], 0x62
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x24], 0x64
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x30
mov byte [rsp + 0x27], 0x43
mov byte [rsp + 0x28], 0x78
mov byte [rsp + 0x29], 0x71
mov byte [rsp + 0x2a], 0x62
mov byte [rsp + 0x2b], 0x7b
mov byte [rsp + 0x2c], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d740], eax
jle 0x1400404a8
lea rcx, [0x14023d740]
call fcn.140124ec8
cmp dword [0x14023d740], 0xffffffff
jne 0x1400404a8
mov edx, 8
lea rcx, [0x14023d7f0]
call fcn.140009120
lea rdx, [0x14023d7f0]
lea rcx, [rsp + 0x20]
call fcn.140042d50
lea rcx, [0x140131160]
call fcn.140125274
nop
lea rcx, [0x14023d740]
call fcn.140124e5c
nop
lea rcx, [0x14023d7f0]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x1400406b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x7b
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x62
mov byte [rsp + 0x24], 0x7e
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x7c
mov byte [rsp + 0x27], 0x23
mov byte [rsp + 0x28], 0x22
mov byte [rsp + 0x29], 0x3e
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x7c
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d93c], eax
jle 0x14004077d
lea rcx, [0x14023d93c]
call fcn.140124ec8
cmp dword [0x14023d93c], 0xffffffff
jne 0x14004077d
mov edx, 8
lea rcx, [0x14023d910]
call fcn.140009120
lea rdx, [0x14023d910]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x140131520]
call fcn.140125274
nop
lea rcx, [0x14023d93c]
call fcn.140124e5c
nop
lea rcx, [0x14023d910]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x1400407a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x57
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x53
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x62
mov byte [rsp + 0x27], 0x62
mov byte [rsp + 0x28], 0x75
mov byte [rsp + 0x29], 0x7e
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2b], 0x44
mov byte [rsp + 0x2c], 0x78
mov byte [rsp + 0x2d], 0x62
mov byte [rsp + 0x2e], 0x75
mov byte [rsp + 0x2f], 0x71
mov byte [rsp + 0x30], 0x74
mov byte [rsp + 0x31], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d874], eax
jle 0x140040881
lea rcx, [0x14023d874]
call fcn.140124ec8
cmp dword [0x14023d874], 0xffffffff
jne 0x140040881
mov edx, 8
lea rcx, [0x14023d7c8]
call fcn.140009120
lea rdx, [0x14023d7c8]
lea rcx, [rsp + 0x20]
call fcn.140041fd0
lea rcx, [0x140131500]
call fcn.140125274
nop
lea rcx, [0x14023d874]
call fcn.140124e5c
nop
lea rcx, [0x14023d7c8]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x140040a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x7b
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x62
mov byte [rsp + 0x24], 0x7e
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x7c
mov byte [rsp + 0x27], 0x23
mov byte [rsp + 0x28], 0x22
mov byte [rsp + 0x29], 0x3e
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x7c
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d940], eax
jle 0x140040afd
lea rcx, [0x14023d940]
call fcn.140124ec8
cmp dword [0x14023d940], 0xffffffff
jne 0x140040afd
mov edx, 8
lea rcx, [0x14023d6e0]
call fcn.140009120
lea rdx, [0x14023d6e0]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x140131580]
call fcn.140125274
nop
lea rcx, [0x14023d940]
call fcn.140124e5c
nop
lea rcx, [0x14023d6e0]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x140040b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x41
mov byte [rsp + 0x22], 0x65
mov byte [rsp + 0x23], 0x75
mov byte [rsp + 0x24], 0x62
mov byte [rsp + 0x25], 0x69
mov byte [rsp + 0x26], 0x40
mov byte [rsp + 0x27], 0x75
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0x76
mov byte [rsp + 0x2a], 0x7f
mov byte [rsp + 0x2b], 0x62
mov byte [rsp + 0x2c], 0x7d
mov byte [rsp + 0x2d], 0x71
mov byte [rsp + 0x2e], 0x7e
mov byte [rsp + 0x2f], 0x73
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0x53
mov byte [rsp + 0x32], 0x7f
mov byte [rsp + 0x33], 0x65
mov byte [rsp + 0x34], 0x7e
mov byte [rsp + 0x35], 0x64
mov byte [rsp + 0x36], 0x75
mov byte [rsp + 0x37], 0x62
mov byte [rsp + 0x38], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d8ac], eax
jle 0x140040c24
lea rcx, [0x14023d8ac]
call fcn.140124ec8
cmp dword [0x14023d8ac], 0xffffffff
jne 0x140040c24
mov edx, 8
lea rcx, [0x14023d988]
call fcn.140009120
lea rdx, [0x14023d988]
lea rcx, [rsp + 0x20]
call fcn.140041f10
lea rcx, [0x140131560]
call fcn.140125274
nop
lea rcx, [0x14023d8ac]
call fcn.140124e5c
nop
lea rcx, [0x14023d988]
call fcn.14000a080
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x58
ret
Function at 0x140040c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x41
mov byte [rsp + 0x22], 0x65
mov byte [rsp + 0x23], 0x75
mov byte [rsp + 0x24], 0x62
mov byte [rsp + 0x25], 0x69
mov byte [rsp + 0x26], 0x40
mov byte [rsp + 0x27], 0x75
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0x76
mov byte [rsp + 0x2a], 0x7f
mov byte [rsp + 0x2b], 0x62
mov byte [rsp + 0x2c], 0x7d
mov byte [rsp + 0x2d], 0x71
mov byte [rsp + 0x2e], 0x7e
mov byte [rsp + 0x2f], 0x73
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0x56
mov byte [rsp + 0x32], 0x62
mov byte [rsp + 0x33], 0x75
mov byte [rsp + 0x34], 0x61
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x75
mov byte [rsp + 0x37], 0x7e
mov byte [rsp + 0x38], 0x73
mov byte [rsp + 0x39], 0x69
mov byte [rsp + 0x3a], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d9ac], eax
jle 0x140040d5e
lea rcx, [0x14023d9ac]
call fcn.140124ec8
cmp dword [0x14023d9ac], 0xffffffff
jne 0x140040d5e
mov edx, 8
lea rcx, [0x14023d788]
call fcn.140009120
lea rdx, [0x14023d788]
lea rcx, [rsp + 0x20]
call fcn.140041e50
lea rcx, [0x140131540]
call fcn.140125274
nop
lea rcx, [0x14023d9ac]
call fcn.140124e5c
nop
lea rcx, [0x14023d788]
call fcn.14000a080
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x58
ret

Function at 0x140040d80
Capabilities:
Execute command
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
add rsp, 0x28
ret
Function at 0x1400434b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x1400434e9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400435d8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140043580
cmp qword [rsp + 0x20], 0
jle 0x140043580
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140043529
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14000a500
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x1400435c8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x1400435c8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x1400435e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140043614
xor eax, eax
jmp 0x140043811
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140043646
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140043811
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1400436f8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000ae00
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.14000a500
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140043801
mov rcx, qword [rsp + 0x80]
call fcn.140044e60
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x1400437ae
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1400437a9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140043811
jmp 0x140043724
cmp qword [rsp + 0x50], 0
jbe 0x140043801
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x78
ret
Function at 0x140044f20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140044f5d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140044f64
mov al, 1
jmp 0x1400450bc
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140026c10
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140026c10
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140026c70
movzx eax, al
test eax, eax
je 0x140044fb9
xor al, al
jmp 0x1400450bc
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140045029
cmp dword [rsp + 0x30], 1
je 0x140045035
cmp dword [rsp + 0x30], 3
je 0x1400450aa
jmp 0x1400450ba
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140045081
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140045081
xor al, al
jmp 0x1400450bc
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004509b
mov dword [rsp + 0x34], 1
jmp 0x1400450a3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400450bc
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400450bc
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140124e00
add rsp, 0xa8
ret