joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180623058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806231df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180623089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18062306f
add dl, dl
jne 0x180623096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806230f6
xor eax, eax
add dl, dl
jne 0x1806230a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806231ad
add dl, dl
jne 0x1806230b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806230c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806230d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806230dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806230ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18062307e
mov eax, 1
add dl, dl
jne 0x180623106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180623113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806230fb
sub eax, ebx
mov ebx, 1
jne 0x18062314c
mov ecx, 1
add dl, dl
jne 0x18062312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18062313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180623123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18062307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180623168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180623175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18062315d
cmp eax, 0x7d00
jae 0x18062319b
cmp eax, 0x500
jb 0x180623196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18062307e
cmp eax, 0x7f
ja 0x18062319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18062307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806231d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18062307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400049f0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov r11, qword [rcx]
mov qword [rsp + 0x30], r11
mov rbx, r11
mov qword [rsp + 0x38], rbx
mov rax, r11
nop word [rax + rax]
mov r8, qword [rax + 0x30]
mov qword [rsp + 0x40], r8
movsxd rax, dword [r8 + 0x3c]
mov rcx, qword [rax + r8 + 0x88]
mov qword [rsp + 0x70], rcx
mov r10d, ecx
add r10, r8
mov qword [rsp + 0x48], r10
shr rcx, 0x20
mov dword [rsp + 0x50], ecx
cmp r10, r8
je 0x140004ace
mov r9d, dword [r10 + 0x18]
mov dword [rsp + 0x20], r9d
nop dword [rax + rax]
mov eax, r9d
dec r9d
mov dword [rsp + 0x20], r9d
test eax, eax
je 0x140004ace
mov eax, dword [r10 + 0x20]
add rax, r8
mov eax, dword [rax + r9*4]
add rax, r8
mov qword [rsp + 0x28], rax
mov edx, 0xc2e12de0
nop word [rax + rax]
movsx ecx, byte [rax]
inc rax
mov qword [rsp + 0x28], rax
test cl, cl
jne 0x140004ac4
cmp edx, 0xa1967da
jne 0x140004ac2
mov edx, dword [r10 + 0x1c]
add rdx, r8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
jmp 0x140004aeb
jmp 0x140004a60
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x140004a90
mov r11, qword [r11]
mov rax, r11
mov qword [rsp + 0x30], r11
cmp r11, rbx
je 0x140004ae9
cmp qword [r11 + 0x30], 0
jne 0x140004a20
xor eax, eax
call rax
nop
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x140004b00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1400ac0c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
mov r9, qword [r11 + 0x30]
xor r14d, r14d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140004bb8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140004bb8
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x5d2abedf
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140004bb3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140004b90
cmp edx, 0x28618d8b
je 0x140004c7b
test r8d, r8d
jne 0x140004b70
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140004bcd
cmp qword [rax + 0x30], r14
jne 0x140004b40
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140004c64
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140004c64
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x5c2abd4c
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140004c5f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140004c40
cmp edx, 0x2f57d0b2
je 0x140004c97
test r8d, r8d
jne 0x140004c20
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140004caf
cmp qword [rax + 0x30], r14
jne 0x140004bf0
jmp 0x140004caf
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x140004bd0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call r14
lea rdx, [rsp + 0x20]
mov rcx, rax
call rbp
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140081d90
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400064d0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
mov qword [rsp + 0x30], r8
movsxd rcx, dword [r8 + 0x3c]
mov rdx, qword [rcx + r8 + 0x88]
mov qword [rsp + 0x60], rdx
mov r11d, edx
add r11, r8
mov qword [rsp + 0x38], r11
shr rdx, 0x20
mov dword [rsp + 0x40], edx
cmp r11, r8
je 0x1400065a3
mov r10d, dword [r11 + 0x18]
mov dword [rsp + 0x20], r10d
nop
mov ecx, r10d
dec r10d
mov dword [rsp + 0x20], r10d
test ecx, ecx
je 0x1400065a3
mov ecx, dword [r11 + 0x20]
add rcx, r8
mov ecx, dword [rcx + r10*4]
add rcx, r8
mov qword [rsp + 0x28], rcx
mov r9d, 0xc2ee0281
nop dword [rax + rax]
movsx edx, byte [rcx]
inc rcx
mov qword [rsp + 0x28], rcx
test dl, dl
jne 0x140006597
cmp r9d, 0xa2ed9f6b
jne 0x140006595
mov edx, dword [r11 + 0x1c]
add rdx, r8
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx ecx, word [rcx + r10*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
call rax
jmp 0x1400065ab
jmp 0x140006530
xor edx, r9d
imul r9d, edx, 0x1000193
jmp 0x140006560
mov rax, qword [rax]
jmp 0x1400064f0
add rsp, 0x58
ret
Function at 0x140006c40
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, 1
call fcn.140081db0
mov ecx, 1
mov qword [rbx + 0x10], rax
call fcn.140081db0
mov ecx, 1
mov qword [rbx + 0x18], rax
call fcn.140081db0
mov ecx, 1
mov qword [rbx + 0x20], rax
call fcn.140081db0
mov ecx, 1
mov qword [rbx + 8], rax
call fcn.140081db0
mov ecx, 1
mov qword [rbx], rax
call fcn.140081db0
mov qword [rbx + 0x28], rax
call fcn.140005a40
call fcn.140005d50
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
mov rax, rdi
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi], xmm0
movups xmm0, xmmword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi + 0x20], xmm0
add rsp, 0x20
pop rdi
ret
Function at 0x1400115b0
Capabilities:
Find taskbar

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400115db
mov edx, 5
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_ShowWindow]
add rsp, 0x28
ret

Function at 0x1400119e0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1400ac0c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
lea rax, [rsp + 0x28]
mov qword [rbp - 0x41], rax
mov byte [rsp + 0x20], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rbp - 0x71], rdi
mov qword [rbp - 0x69], rdi
lea rax, [rsp + 0x20]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x140011a34
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14001b6c0
nop
mov dword [rbp - 0x39], 0x64
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
lea rax, [rbp - 0x29]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140011a80
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x61]
call fcn.14001b6c0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x61]
call fcn.140008250
test al, al
je 0x140011ab1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rax, [rbp - 0x61]
mov qword [rbp - 0x41], rax
mov byte [rsp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
lea rax, [rsp + 0x20]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140011ad5
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x61]
call fcn.14001b6c0
nop
mov dword [rbp - 0x39], 0x64
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rbp - 0x71], rdi
mov qword [rbp - 0x69], rdi
lea rax, [rbp - 0x29]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140011b17
mov r8, rbx
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x28]
call fcn.14001b6c0
nop
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x28]
call fcn.140008250
test al, al
je 0x140011b4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140081d90
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400181e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140018201
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001822e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140018230
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140018289
test ecx, ecx
jle 0x140018269
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140018289
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140018289
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
mov eax, ecx
inc ecx
mov dword [rsi + rax*4 + 4], ebp
cmp ecx, dword [rsi]
jb 0x140130824
mov dword [rsi], r10d
test r10d, r10d
je 0x140130853
nop dword [rax + rax]
lea edx, [r10 - 1]
mov r10d, edx
cmp dword [rsi + rdx*4 + 4], ebp
jne 0x140130853
mov dword [rsi], edx
test edx, edx
jne 0x140130840
mov rax, r11
jmp 0x14013085a
add rsp, 0x220
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140018850
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ac0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001887d
xor eax, eax
jmp 0x1400189e9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400188b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400188b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400189e9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400189dc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400188fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140018925
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400189e1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140018994
sub eax, 1
je 0x140018994
cmp eax, 2
jne 0x1400189dc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400189e1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400189c2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400189dc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400189e1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140081d90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400199c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400ac0c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140019a93
cmp byte [rcx + 0x71], 0
je 0x140019a93
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140019a8f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140019a54
sub eax, 1
je 0x140019a58
cmp eax, 2
jne 0x140019a8f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140081d90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140019a86
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140019a8f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140019a3c
xor al, al
jmp 0x140019a3c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140081d90
add rsp, 0x60
pop rbx
ret

Function at 0x14001a920
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400ac0c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140081db0
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14001c7e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14001a999
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140081d90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14001a9b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400ac0c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rcx
mov ecx, Ordinal_60
call fcn.140081db0
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x20], xmm0
lea rcx, [0x140011630]
mov qword [rax + 0x30], rcx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14001c810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14001aa47
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140081d90
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14001d860
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14001d894
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14001d880
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14001d260
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001d8b9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14002c910
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001d933
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d92e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d92e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082104
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001d940
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14001d974
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14001d960
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14001d260
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001d999
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14002c910
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001da13
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001da0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001da0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082104
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001da20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14001da54
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14001da40
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14001d260
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001da79
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14002c910
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001daf3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001daee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001daee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082104
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001db00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14001db34
mov eax, esi
lea ecx, [rax + 0x7f]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14001db20
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14001d260
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001db59
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14002c910
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14001dbd3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dbce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001dbce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082104
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140025270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140025293
lea edx, [rax + 0x7f]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140025280
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14001d260
mov rax, rbx
add rsp, 0x30
pop rbx
ret