joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d100
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400dec84], 1
je 0x14001d167
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffeb
movzx edx, byte [r8 + r9 + 0x15]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x29
jne 0x14001d120
mov dword [0x1400dec84], 1
mov eax, 0x36350781
ret

Function at 0x14001d170
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400decc4], 1
je 0x14001d1df
mov eax, 0xaf286bcb
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x20
mov r11d, r8d
sub r11d, r10d
shr r11d, 1
add r11d, r10d
shr r11d, 4
imul r10d, r11d, 0xffffffed
movzx r11d, byte [rdx + r8 + 0x13]
add r10d, r8d
movsxd r9, r10d
xor r11b, byte [rdx + r9]
mov byte [rcx + r8], r11b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x3b
jne 0x14001d190
mov dword [0x1400decc4], 1
mov eax, 0xa2a6f4cd
ret

Function at 0x14001d1f0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400decfc], 1
je 0x14001d24f
mov eax, 0xb21642c9
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
imul r10d, r10d, 0xffffffe9
movzx r11d, byte [rdx + r8 + 0x17]
add r10d, r8d
movsxd r9, r10d
xor r11b, byte [rdx + r9]
mov byte [rcx + r8], r11b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x33
jne 0x14001d210
mov dword [0x1400decfc], 1
mov eax, 0xf9ed6b04
ret

Function at 0x14001d260
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400de0f8], 1
je 0x14001d2bd
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffe2
movzx edx, byte [r8 + r9 + 0x1e]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x26
jne 0x14001d280
mov dword [0x1400de0f8], 1
mov eax, 0xefbf79a6
ret

Function at 0x14001d2d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400de580], 1
je 0x14001d335
mov eax, 0xf0f0f0f1
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
mov r11d, r10d
shl r11d, 4
add r11d, r10d
movzx r10d, byte [rdx + r8 + 0x11]
sub r9d, r11d
movsxd r9, r9d
xor r10b, byte [rdx + r9]
mov byte [rcx + r8], r10b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x4e
jne 0x14001d2f0
mov dword [0x1400de580], 1
mov eax, 0xa307cc3d
ret
Function at 0x14001e540
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400dec24], 1
je 0x14001e5a5
mov eax, 0xf0f0f0f1
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
mov r11d, r10d
shl r11d, 4
add r11d, r10d
movzx r10d, byte [rdx + r8 + 0x11]
sub r9d, r11d
movsxd r9, r9d
xor r10b, byte [rdx + r9]
mov byte [rcx + r8], r10b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x26
jne 0x14001e560
mov dword [0x1400dec24], 1
mov eax, 0x3c6aba59
ret

Function at 0x14001e5e0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400de098], 1
je 0x14001e647
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe3
movzx edx, byte [r8 + r9 + 0x1d]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x26
jne 0x14001e600
mov dword [0x1400de098], 1
mov eax, 0x78579fa1
ret

Function at 0x14001e650
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400de0cc], 1
je 0x14001e6ad
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffe2
movzx edx, byte [r8 + r9 + 0x1e]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x30
jne 0x14001e670
mov dword [0x1400de0cc], 1
mov eax, 0x937b2f13
ret

Function at 0x140021530
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400deed8], 1
je 0x140021599
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, 0x18
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2f
mov rdx, rsi
jne 0x140021550
mov dword [0x1400deed8], 1
mov eax, 0x49840e3c
pop rsi
ret

Function at 0x140021a30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dede4], 1
je 0x140021aa9
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, 0x1d
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2e
mov r9, rax
jne 0x140021a60
mov dword [0x1400dede4], 1
mov eax, 0x2cbaed86
pop rsi
ret
Function at 0x140022280
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400dee0c], 1
je 0x1400222e7
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe9
movzx edx, byte [r8 + r9 + 0x17]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x24
jne 0x1400222a0
mov dword [0x1400dee0c], 1
mov eax, 0x86e5e62a
ret

Function at 0x1400223f0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400dee28], 1
je 0x14002242e
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x16
jne 0x140022400
mov dword [0x1400dee28], 1
mov eax, 0xe078758b
ret

Function at 0x140022440
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400dee48], 1
je 0x1400224a7
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe9
movzx edx, byte [r8 + r9 + 0x17]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x19
jne 0x140022460
mov dword [0x1400dee48], 1
mov eax, 0x2c4103ac
ret

Function at 0x140022c00
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dedcc], 1
je 0x140022c63
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x24
mov rdx, rsi
jne 0x140022c20
mov dword [0x1400dedcc], 1
mov eax, 0x1c61549a
pop rsi
ret

Function at 0x140022c70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400deda0], 1
je 0x140022ce9
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x31
mov r9, rax
jne 0x140022ca0
mov dword [0x1400deda0], 1
mov eax, 0x1327bddd
pop rsi
ret

Function at 0x140023180
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df344], 1
je 0x1400231e3
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x26
mov rdx, rsi
jne 0x1400231a0
mov dword [0x1400df344], 1
mov eax, 0xc7e5c9
pop rsi
ret
Function at 0x14002c850
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [0x1400dfacc]
lea rdx, [0x14003ba80]
mov rcx, rdi
call fcn.14002ead0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14002c918
lea rsi, [0x1400dfaf0]
lea rdx, [0x14003bafa]
mov rcx, rsi
call fcn.14002ebc0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov rdx, rsi
call fcn.140006020
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
jmp 0x14002c96e
mov ebx, dword [rsi + 0x10]
inc ebx
cmp qword [rsi + 0x18], 0x10
jb 0x14002c927
mov rsi, qword [rsi]
mov r14, rsi
mov rsi, qword [rsp + 0x58]
lea rdi, [0x1400dfae4]
lea rdx, str.e_2P_eN_Q
mov rcx, rdi
call fcn.14002ec10
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140034800
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002c990
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [0x1400dfacc]
lea rdx, [0x14003ba80]
mov rcx, rdi
call fcn.14002ead0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14002ca58
lea rsi, [0x1400dfaf0]
lea rdx, [0x14003bafa]
mov rcx, rsi
call fcn.14002ebc0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov rdx, rsi
call fcn.140006020
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
jmp 0x14002caae
mov ebx, dword [rsi + 0x10]
inc ebx
cmp qword [rsi + 0x18], 0x10
jb 0x14002ca67
mov rsi, qword [rsi]
mov r14, rsi
mov rsi, qword [rsp + 0x58]
lea rdi, [0x1400dfb18]
lea rdx, str.FNzF
mov rcx, rdi
call fcn.14002eb50
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140034800
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002cad0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rsi, rcx
mov dword [rsp + 0x34], 0x104
lea rdi, [0x1400dfacc]
lea rdx, [0x14003ba80]
mov rcx, rdi
call fcn.14002ead0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002cb78
mov rdi, qword [rsp + 0x38]
lea rbx, [0x1400dfb18]
lea rdx, str.FNzF
mov rcx, rbx
call fcn.14002eb50
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14002cba0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, rsi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002cc5e
mov rdi, rax
mov rbx, rax
cmp rax, 0xf
ja 0x14002cbed
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov byte [rdi], 0
jmp 0x14002cb8e
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002cc2c
lea rcx, [r15 + 0x28]
call fcn.1400338a8
test rax, rax
je 0x14002cc63
mov rcx, rax
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14002cc38
lea rcx, [r15 + 1]
call fcn.1400338a8
mov r14, rax
mov qword [rsi], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
lea rdx, [rsp + 0x40]
mov rcx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
jmp 0x14002cb8e
call fcn.1400014c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14002d4d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfa98], 1
je 0x14002d533
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x22
mov rdx, rsi
jne 0x14002d4f0
mov dword [0x1400dfa98], 1
mov eax, 0xa7298576
pop rsi
ret

Function at 0x14002d540
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfaa0], 1
je 0x14002d5a3
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1d
mov rdx, rsi
jne 0x14002d560
mov dword [0x1400dfaa0], 1
mov eax, 0xbc9919a1
pop rsi
ret
Function at 0x14002d850
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
je 0x14002d900
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14002d900
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14002d8f8
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x14002d8fc
cmp eax, 1
je 0x14002d8c8
test eax, eax
jne 0x14002d8f8
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14002d8ef
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14002d8f8
cmp byte [rsi + 0x71], 0
sete al
jmp 0x14002d902
xor eax, eax
jmp 0x14002d902
mov byte [rsi + 0x71], 0
mov al, 1
mov ebx, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140034800
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002d990
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rsp + 0x88], rax
cmp edx, 0xffffffff
je 0x14002dacc
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14002d9ee
mov rax, qword [rcx + 0x58]
mov r8d, dword [rax]
test r8d, r8d
jle 0x14002d9ee
mov r9d, edx
dec r8d
mov dword [rax], r8d
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
lea r8, [rcx + 1]
mov qword [rax], r8
mov byte [rcx], dl
mov ecx, edx
jmp 0x14002db17
cmp qword [rcx + 0x80], 0
je 0x14002dad0
mov rax, qword [rcx + 0x18]
lea r8, [rcx + 0x70]
cmp qword [rax], r8
jne 0x14002da2e
mov r8d, dword [rcx + 0x90]
mov r9, qword [rcx + 0x88]
mov qword [rax], r9
mov rax, qword [rcx + 0x38]
mov qword [rax], r9
mov eax, r9d
sub r8d, r9d
mov rax, qword [rcx + 0x50]
mov dword [rax], r8d
mov rax, qword [rcx + 0x68]
test rax, rax
je 0x14002dad7
mov ebp, edx
mov byte [rsp + 0x5f], dl
lea r8, [rsp + 0x80]
lea r9, [rsp + 0x60]
mov r14, rcx
lea rdx, [rcx + 0x74]
mov r10, qword [rax]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea rsi, [rsp + 0x5f]
mov rcx, rax
mov r8, rsi
call qword [r10 + 0x38]
cmp eax, 2
jae 0x14002daf3
mov rbx, qword [rsp + 0x48]
sub rbx, rdi
je 0x14002dabb
mov r9, qword [r14 + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 0xffffffff
cmp rbx, rax
jne 0x14002db17
mov byte [r14 + 0x71], 1
cmp qword [rsp + 0x50], rsi
mov eax, 0xffffffff
jmp 0x14002db12
xor ecx, ecx
jmp 0x14002db17
mov ecx, 0xffffffff
jmp 0x14002db17
mov rax, qword [rcx + 0x80]
movsx ecx, dl
mov esi, edx
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
mov ecx, esi
jmp 0x14002db14
mov ecx, 0xffffffff
cmp eax, 3
jne 0x14002db17
mov rdx, qword [r14 + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
mov ecx, ebp
cmove ecx, eax
mov esi, ecx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140034800
mov eax, esi
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14002dfa0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14002dfd5
mov rsi, r8
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je case.default.0x14002dfce
mov rcx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor eax, eax
jmp 0x14002e0f7
mov rax, qword [rdi + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x14002e039
mov rcx, qword [rdi + 0x50]
movsxd rbx, dword [rcx]
test rbx, rbx
je 0x14002e039
cmp rbx, rsi
cmovae rbx, rsi
mov rcx, rdx
mov r14, rdx
mov rdx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, r14
add rax, rbx
mov ecx, ebx
mov rdx, qword [rdi + 0x50]
sub dword [rdx], ebx
mov rdx, qword [rdi + 0x38]
movsxd rcx, ebx
add qword [rdx], rcx
mov rcx, rsi
sub rcx, rbx
cmp qword [rdi + 0x80], 0
jne 0x14002e04d
jmp 0x14002e0f1
mov rcx, rsi
mov rax, rdx
cmp qword [rdi + 0x80], 0
je 0x14002e0f1
mov rdx, qword [rdi + 0x18]
lea r8, [rdi + 0x70]
cmp qword [rdx], r8
jne 0x14002e07f
mov r8d, dword [rdi + 0x90]
mov r9, qword [rdi + 0x88]
mov qword [rdx], r9
mov rdx, qword [rdi + 0x38]
mov qword [rdx], r9
mov edx, r9d
sub r8d, r9d
mov rdx, qword [rdi + 0x50]
mov dword [rdx], r8d
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r14, rax
nop dword [rax]
mov rbx, rcx
cmp rcx, 0x1000
jb 0x14002e0ca
mov r9, qword [rdi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call r15
add r14, rax
sub rbx, rax
mov rcx, rbx
cmp rax, 0xfff
je 0x14002e090
sub rsi, rbx
jmp 0x14002e0f4
test rbx, rbx
je 0x14002e0ef
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rcx, rbx
jmp 0x14002e0f1
xor ecx, ecx
sub rsi, rcx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002e110
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x68], 0
je case.default.0x14002e129
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov rax, qword [rax]
test rax, rax
je 0x14002e197
test r8, r8
jle 0x14002e197
mov r9, qword [rcx + 0x58]
mov r9d, dword [r9]
test r9d, r9d
jle 0x14002e197
mov esi, r9d
cmp rsi, r8
cmovae rsi, r8
mov rbx, rcx
mov rcx, rax
mov rdi, rdx
mov r14, r8
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
mov r8, r14
add rdi, rsi
mov edx, esi
mov r9, qword [rbx + 0x58]
sub dword [r9], esi
mov rdx, qword [rbx + 0x40]
add qword [rdx], rsi
mov rdx, r14
sub rdx, rsi
mov rax, rdi
mov rsi, rdx
test rsi, rsi
jg 0x14002e1a2
jmp 0x14002e1c8
mov rax, rdx
mov rsi, r8
test rsi, rsi
jle 0x14002e1c8
mov r9, qword [rcx + 0x80]
test r9, r9
je 0x14002e1c8
mov edx, 1
mov rcx, rax
mov rdi, r8
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r8, rdi
sub rsi, rax
mov rax, r8
sub rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
add byte [rax - 0x2e8b7f80], 0x33
rcr byte [rsi + 0x5b], 0xc3
jmp 0x140082770
sbb eax, eax
or eax, 1
pop rsi
pop rbx
ret

Function at 0x14002e7b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400e0378], 1
je 0x14002e824
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1a
jne 0x14002e7e0
mov dword [0x1400e0378], 1
mov eax, 0x57d4958
pop rsi
ret

Function at 0x14002ead0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfae0], 1
je 0x14002eb3a
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, 0x14
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x28
mov rdx, rsi
jne 0x14002eaf0
mov dword [0x1400dfae0], 1
mov eax, 0xfdeed940
pop rsi
ret

Function at 0x14002eb50
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfb20], 1
je 0x14002ebb3
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, 0x1b
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x23
mov rdx, rsi
jne 0x14002eb70
mov dword [0x1400dfb20], 1
mov eax, 0xbb48db31
pop rsi
ret