joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401853b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, r9
mov rbp, r8
mov r15, rdx
mov r12, rcx
xor bl, bl
mov rdx, r8
mov rcx, qword [sym.imp.CoreFoundation.dll_kCFAllocatorDefault]
mov rcx, qword [rcx]
call qword [sym.imp.CoreFoundation.dll_CFDataCreateMutable]
mov rsi, rax
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.CoreFoundation.dll_CFDataSetLength]
mov rcx, rsi
call qword [sym.imp.CoreFoundation.dll_CFDataGetMutableBytePtr]
mov r14, rax
add rax, rbp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], r14
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1401854df
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test rax, rax
je 0x140185499
cmp r14, rax
je 0x14018545a
lea rcx, str.size_mismatch_der:__zu_der_end:__zu
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov r8, rax
mov rdx, r15
mov ecx, 0xffffffff
call fcn.14010a140
jmp 0x140185499
lea rcx, str.fwrite__s
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rbx, rax
mov r9, r12
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor ecx, ecx
cmp rax, 1
setne cl
mov r9, r12
mov r8, rbx
mov rdx, r15
call fcn.14010a050
movzx ebx, al
test rsi, rsi
je 0x1401854a8
mov rcx, rsi
call qword [sym.imp.CoreFoundation.dll_CFRelease]
nop
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1401854c5
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], 0
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x14018ceb0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov eax, 0x3a98
mov ebp, esi
mov dword [rsp + 0x50], eax
mov edi, esi
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14018cf9d
xor r8d, r8d
lea rax, [rsp + 0x50]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0x10]
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x14018cf1a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc edi
cmp edi, 3
jae 0x14018cf8d
mov eax, dword [rsp + 0x50]
jmp 0x14018ced0
test eax, eax
jne 0x14018cf84
mov eax, dword [rbx + 0x58]
test eax, eax
je 0x14018cf84
lea ecx, [rax*2 + 1]
add ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [rbx + 0x58]
mov rbp, rax
mov rdi, rax
test ecx, ecx
je 0x14018cf81
mov qword [rsp + 0x58], r14
lea r14, str._.2X_
nop dword [rax]
dec ecx
mov eax, esi
cmp esi, ecx
lea rdx, str._.2X
mov rcx, rdi
cmovne rdx, r14
movzx r8d, byte [rax + rbx + 0x50]
call fcn.1400ec210
mov ecx, dword [rbx + 0x58]
add rdi, 3
inc esi
cmp esi, ecx
jb 0x14018cf50
mov r14, qword [rsp + 0x58]
mov byte [rdi], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbp
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140198360
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r9, r8
mov r10, rcx
test r8, r8
je 0x140198388
sub r10, rdx
movzx r8d, byte [r10 + rdx]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor r8, rcx
or rax, r8
sub r9, 1
jne 0x140198370
ret
Function at 0x1401b97d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x1401b99ef
mov qword [rsp + 0x68], rbp
xor r9d, r9d
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x38], r14
nop dword [rax]
nop word [rax + rax]
movsxd rbp, dword [rsi + 0x10]
lea r12, [rdi + 0x88]
mov r15d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [rax + 0x20]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x1401b9848
inc dword [rbx + 0x38]
mov r14d, dword [rbx + 0x38]
jmp 0x1401b9858
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0xd8]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x1401b9885
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rdi
call fcn.1401d32a0
jmp 0x1401b98b0
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [r12]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r9
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x71
mov r9, qword [r9 + 0x68]
call fcn.140211c20
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x1401b98f4
mov edx, 5
mov rcx, rdi
call fcn.1401d3310
test eax, eax
jne 0x1401b99d6
movsxd rax, dword [rdi + 0x90]
xor r9d, r9d
lea rcx, [rax + rax*2]
mov rax, qword [r12]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r9d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r9d
add eax, 2
mov dword [rdx + 8], eax
mov byte [rdx + 1], r9b
mov qword [rdx + 0x10], r9
mov word [rdx + 2], r9w
mov qword [rdx + 0x18], 0x7f
mov qword [rdx + 0x20], r9
mov qword [rdx + 0x28], r9
mov qword [rdx + 0x30], 0x61
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r9
mov qword [rdx + 0x48], 0x80
mov qword [rdx + 0x50], r9
mov qword [rdx + 0x58], r9
mov qword [rdx + 0x60], 0x7a
mov qword [rdx + 0x68], r9
mov qword [rdx + 0x70], r9
add dword [rdi + 0x90], 5
test rdx, rdx
je 0x1401b99d6
mov dword [rdx + 0x3c], r14d
lea ecx, [r15 + 1]
mov dword [rdx + 4], ecx
lea eax, [r15 - 1]
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x54], ecx
mov ecx, 8
mov word [rdx + 0x4a], cx
mov dword [rdx + 0x34], eax
mov dword [rdx + 0x50], r14d
test r14d, r14d
je 0x1401b99c5
movzx eax, byte [rbx + 0x1f]
cmp al, cl
jae 0x1401b99c5
mov dword [rbx + rax*4 + 0xd8], r14d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x60]
test rsi, rsi
jne 0x1401b9820
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401c9de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xb0
jne 0x1401c9df9
movzx eax, byte [rdx + 2]
cmp al, 0xb1
jne 0x1401c9e03
mov rax, qword [rdx + 0x20]
jmp 0x1401c9e13
cmp al, 0x8a
jne 0x1401c9f97
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1401c9f97
mov dword [r8], 0
cmp byte [rdx], 0x8a
jne 0x1401c9e3a
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1401f7490
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1401c9f82
mov qword [rsp + 0x80], rbx
lea rcx, [0x140222a90]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.1401cad50]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [rax + r15 + 8]
je 0x1401c9ef0
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x1401c9ee0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140250890
cmp word [rsp + 0x44], 0
je 0x1401c9ef0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.140200a20
jmp 0x1401c9f30
mov rsi, qword [rdi]
test rbx, rbx
je 0x1401c9f0c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1401ca270
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x1401c9f20
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1401fef80
test rbx, rbx
je 0x1401c9f30
mov rdx, rbx
mov rcx, rsi
call fcn.140202cc0
inc ebp
lea rcx, [0x140222a90]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x1401c9ea0
mov eax, dword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.140202590
Function at 0x1401e6510
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.140211890
test ebx, ebx
jne 0x1401e6579
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.140211890
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140205670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x140205779
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x1402e1730]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x1402056f1
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x14020572c
test ecx, ecx
jne 0x14020573a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1401cc380
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140205710
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1402056b0
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x14020573f
inc r8
jmp 0x1402056e0
test r10d, r10d
jne 0x140205709
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140205765
test edx, edx
je 0x1402056f1
inc rax
jmp 0x140205750
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x140205709
inc rax
jmp 0x140205750
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14024c3e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rbp, r8
mov r15, rdx
call fcn.140210f70
mov rbx, rax
test rax, rax
jne 0x14024c422
lea eax, [rbx + 7]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
cmp byte [0x14034a2b4], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
je 0x14024c487
mov rax, qword [0x14034a440]
test rax, rax
je 0x14024c44c
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call rax
test eax, eax
jne 0x14024c487
lea rsi, [rbx + 8]
mov qword [rbx + 0x10], r15
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0
lea r8, [0x140224b00]
mov qword [rbx + 0x18], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x14024c49f
jmp 0x14024c48f
lea rdi, [rbx + 0x10]
lea rsi, [rbx + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rdi], 0
mov rdi, qword [rsp + 0x58]
jne 0x14024c4bc
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rsi], eax
call r15
mov qword [rbx + 0x20], rax
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x14002915c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400292ac
cmp rax, 0xffffffffffffffff
je 0x1400292ac
xor edi, edi
test rbp, rbp
jle 0x140029257
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f068
mov rbx, rax
test rax, rax
jne 0x1400291e4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002924d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a088
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d430
cmp eax, 0xffffffff
je 0x14002922d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400291f4
mov edx, r15d
mov ecx, r14d
call fcn.14001a088
jmp 0x14002924d
cmp byte [rsi + 0x38], dil
je 0x140029244
cmp dword [rsi + 0x34], 5
jne 0x140029244
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002924d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae1c
jmp 0x1400292c0
jns 0x1400292c0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c754
cmp rax, 0xffffffffffffffff
jne 0x140029278
cmp byte [rsi + 0x30], dil
je 0x1400292c0
mov edi, dword [rsi + 0x2c]
jmp 0x1400292c0
mov ecx, r14d
call fcn.140018540
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400292c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400292c0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400292b9
mov eax, dword [rsi + 0x2c]
jmp 0x1400292be
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140002880
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400028a8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400028ce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400028d0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002929
test ecx, ecx
jle 0x140002909
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002929
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002929
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140002950
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002972
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002988
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400029a4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400029a6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400029e2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002a7e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002a1d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002a5e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002a7e
cmp rbx, rax
ja 0x140002a30
test rbx, rbx
je 0x140002a7e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002ea0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002ecd
xor eax, eax
jmp 0x14000302a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140002ef8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140002ef8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000302a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000301d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140002f3b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002f66
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003022
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002fd5
sub eax, 1
je 0x140002fd5
cmp eax, 2
jne 0x14000301d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003022
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003003
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000301d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003022
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400043b0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400032b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003383
cmp byte [rcx + 0x71], 0
je 0x140003383
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000337f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003344
sub eax, 1
je 0x140003348
cmp eax, 2
jne 0x14000337f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400043b0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003376
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000337f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000332c
xor al, al
jmp 0x14000332c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400043b0
add rsp, 0x60
pop rbx
ret

Function at 0x140004cdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004d26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004d26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004d26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004d26
cmp dword [rcx + 0x84], 0xe
jbe 0x140004d26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004d28
xor al, al
add rsp, 0x28
ret