joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180052730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x14
mov byte [rsp + 0x30], 0xb1
mov byte [rsp + 0x31], 2
mov byte [rsp + 0x32], 0x6a
mov byte [rsp + 0x33], 0x6e
mov byte [rsp + 0x34], 0x41
mov byte [rsp + 0x35], 0x23
mov byte [rsp + 0x36], 0xd5
mov byte [rsp + 0x37], 0x74
mov byte [rsp + 0x38], 0x92
mov byte [rsp + 0x39], 7
mov byte [rsp + 0x3a], 0x50
mov byte [rsp + 0x3b], 0x65
mov byte [rsp + 0x3c], 0x7c
mov byte [rsp + 0x3d], 0x3f
mov byte [rsp + 0x3e], 0xf3
mov byte [rsp + 0x3f], 0x79
mov byte [rsp + 0x40], 0x86
mov byte [rsp + 0x41], 0xd
mov byte [rsp + 0x42], 0x72
mov byte [rsp + 0x43], 0xb
mov eax, 0xc8
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x180052843
mov eax, 0xc8
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181023130]
mov rcx, qword gs:[0x58]
mov edx, 0xc8
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xb0
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180052a10
lea rcx, [0x18009f7e0]
call fcn.18008b8b0
nop
mov eax, 0xb0
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret
Function at 0x18008a0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x28], 0x41
mov byte [rsp + 0x30], 0x19
mov byte [rsp + 0x31], 0xde
mov byte [rsp + 0x32], 0xa9
mov byte [rsp + 0x33], 0x20
mov byte [rsp + 0x34], 0xc1
mov byte [rsp + 0x35], 0xad
mov byte [rsp + 0x36], 0xae
mov byte [rsp + 0x37], 0xa1
mov byte [rsp + 0x38], 0x49
mov byte [rsp + 0x39], 0xdc
mov byte [rsp + 0x3a], 0xf9
mov byte [rsp + 0x3b], 0x27
mov byte [rsp + 0x3c], 0xc3
mov byte [rsp + 0x3d], 0xae
mov byte [rsp + 0x3e], 0xf3
mov byte [rsp + 0x3f], 0xf4
mov byte [rsp + 0x40], 0x1e
mov byte [rsp + 0x41], 0xdc
mov byte [rsp + 0x42], 0xad
mov byte [rsp + 0x43], 0x70
mov byte [rsp + 0x44], 0xc1
mov byte [rsp + 0x45], 0xfb
mov byte [rsp + 0x46], 0xaf
mov byte [rsp + 0x47], 0xa0
mov byte [rsp + 0x48], 0x1f
mov byte [rsp + 0x49], 0xd9
mov byte [rsp + 0x4a], 0xa4
mov byte [rsp + 0x4b], 0x71
mov byte [rsp + 0x4c], 0xc8
mov byte [rsp + 0x4d], 0xf8
mov byte [rsp + 0x4e], 0xfc
mov byte [rsp + 0x4f], 0xa2
mov byte [rsp + 0x50], 0x49
mov byte [rsp + 0x51], 0x8a
mov byte [rsp + 0x52], 0xa8
mov byte [rsp + 0x53], 0x72
mov byte [rsp + 0x54], 0xc9
mov byte [rsp + 0x55], 0xae
mov byte [rsp + 0x56], 0xae
mov byte [rsp + 0x57], 0xf6
mov byte [rsp + 0x58], 0x4a
mov byte [rsp + 0x59], 0x8a
mov byte [rsp + 0x5a], 0xab
mov byte [rsp + 0x5b], 0x7d
mov byte [rsp + 0x5c], 0x95
mov byte [rsp + 0x5d], 0xff
mov byte [rsp + 0x5e], 0xae
mov byte [rsp + 0x5f], 0xf7
mov byte [rsp + 0x60], 0x4a
mov byte [rsp + 0x61], 0x8d
mov byte [rsp + 0x62], 0xac
mov byte [rsp + 0x63], 0x7d
mov byte [rsp + 0x64], 0xc3
mov byte [rsp + 0x65], 0xfd
mov byte [rsp + 0x66], 0xfa
mov byte [rsp + 0x67], 0xf4
mov byte [rsp + 0x68], 0x19
mov byte [rsp + 0x69], 0x8e
mov byte [rsp + 0x6a], 0xf9
mov byte [rsp + 0x6b], 0x74
mov byte [rsp + 0x6c], 0xc8
mov byte [rsp + 0x6d], 0xfa
mov byte [rsp + 0x6e], 0xf9
mov byte [rsp + 0x6f], 0xa6
mov byte [rsp + 0x70], 0x2b
mov eax, 0x194
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18008a2d7
mov eax, 0x194
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181023130]
mov rcx, qword gs:[0x58]
mov edx, 0x194
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x150
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18008b350
lea rcx, [0x18009f9c0]
call fcn.18008b8b0
nop
mov eax, 0x150
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x88
ret
Function at 0x18008a560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x28], 0x41
mov byte [rsp + 0x30], 0xe1
mov byte [rsp + 0x31], 0xca
mov byte [rsp + 0x32], 0xd9
mov byte [rsp + 0x33], 0x5a
mov byte [rsp + 0x34], 0x5b
mov byte [rsp + 0x35], 0x3f
mov byte [rsp + 0x36], 0xb6
mov byte [rsp + 0x37], 0x69
mov byte [rsp + 0x38], 0xb1
mov byte [rsp + 0x39], 0xc8
mov byte [rsp + 0x3a], 0x89
mov byte [rsp + 0x3b], 0x5d
mov byte [rsp + 0x3c], 0x59
mov byte [rsp + 0x3d], 0x3c
mov byte [rsp + 0x3e], 0xeb
mov byte [rsp + 0x3f], 0x3c
mov byte [rsp + 0x40], 0xe6
mov byte [rsp + 0x41], 0xc8
mov byte [rsp + 0x42], 0xdd
mov byte [rsp + 0x43], 0xa
mov byte [rsp + 0x44], 0x5b
mov byte [rsp + 0x45], 0x69
mov byte [rsp + 0x46], 0xb7
mov byte [rsp + 0x47], 0x68
mov byte [rsp + 0x48], 0xe7
mov byte [rsp + 0x49], 0xcd
mov byte [rsp + 0x4a], 0xd4
mov byte [rsp + 0x4b], 0xb
mov byte [rsp + 0x4c], 0x52
mov byte [rsp + 0x4d], 0x6a
mov byte [rsp + 0x4e], 0xe4
mov byte [rsp + 0x4f], 0x6a
mov byte [rsp + 0x50], 0xb1
mov byte [rsp + 0x51], 0x9e
mov byte [rsp + 0x52], 0xd8
mov byte [rsp + 0x53], 8
mov byte [rsp + 0x54], 0x53
mov byte [rsp + 0x55], 0x3c
mov byte [rsp + 0x56], 0xb6
mov byte [rsp + 0x57], 0x3e
mov byte [rsp + 0x58], 0xb2
mov byte [rsp + 0x59], 0x9e
mov byte [rsp + 0x5a], 0xdb
mov byte [rsp + 0x5b], 7
mov byte [rsp + 0x5c], 0xf
mov byte [rsp + 0x5d], 0x6d
mov byte [rsp + 0x5e], 0xb6
mov byte [rsp + 0x5f], 0x3f
mov byte [rsp + 0x60], 0xb2
mov byte [rsp + 0x61], 0x99
mov byte [rsp + 0x62], 0xdc
mov byte [rsp + 0x63], 7
mov byte [rsp + 0x64], 0x59
mov byte [rsp + 0x65], 0x6f
mov byte [rsp + 0x66], 0xe2
mov byte [rsp + 0x67], 0x3c
mov byte [rsp + 0x68], 0xe1
mov byte [rsp + 0x69], 0x9a
mov byte [rsp + 0x6a], 0x89
mov byte [rsp + 0x6b], 0xe
mov byte [rsp + 0x6c], 0x52
mov byte [rsp + 0x6d], 0x68
mov byte [rsp + 0x6e], 0xe1
mov byte [rsp + 0x6f], 0x6e
mov byte [rsp + 0x70], 0xd3
mov eax, 0x214
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18008a757
mov eax, 0x214
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181023130]
mov rcx, qword gs:[0x58]
mov edx, 0x214
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x1d0
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18008b350
lea rcx, [0x18009f990]
call fcn.18008b8b0
nop
mov eax, 0x1d0
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x88
ret
Function at 0x18008a780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x28], 0x21
mov byte [rsp + 0x30], 0xb2
mov byte [rsp + 0x31], 0xc2
mov byte [rsp + 0x32], 0xdc
mov byte [rsp + 0x33], 8
mov byte [rsp + 0x34], 0x5d
mov byte [rsp + 0x35], 0x3c
mov byte [rsp + 0x36], 0xe2
mov byte [rsp + 0x37], 0x6d
mov byte [rsp + 0x38], 0xb6
mov byte [rsp + 0x39], 0xc9
mov byte [rsp + 0x3a], 0xda
mov byte [rsp + 0x3b], 0xe
mov byte [rsp + 0x3c], 0x5d
mov byte [rsp + 0x3d], 0x3e
mov byte [rsp + 0x3e], 0xb2
mov byte [rsp + 0x3f], 0x38
mov byte [rsp + 0x40], 0xe0
mov byte [rsp + 0x41], 0xcc
mov byte [rsp + 0x42], 0x8f
mov byte [rsp + 0x43], 0x59
mov byte [rsp + 0x44], 0xf
mov byte [rsp + 0x45], 0x32
mov byte [rsp + 0x46], 0xb5
mov byte [rsp + 0x47], 0x3e
mov byte [rsp + 0x48], 0xe3
mov byte [rsp + 0x49], 0x9e
mov byte [rsp + 0x4a], 0xd8
mov byte [rsp + 0x4b], 7
mov byte [rsp + 0x4c], 0x59
mov byte [rsp + 0x4d], 0x69
mov byte [rsp + 0x4e], 0xe0
mov byte [rsp + 0x4f], 0x3b
mov byte [rsp + 0x50], 0xd3
mov eax, 0x23c
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18008a8d4
mov eax, 0x23c
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181023130]
mov rcx, qword gs:[0x58]
mov edx, 0x23c
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x218
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18008b2e0
lea rcx, [0x18009f960]
call fcn.18008b8b0
nop
mov eax, 0x218
mov eax, eax
mov ecx, dword [0x181023130]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x68
ret
Function at 0x180092464
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18009233b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18009233b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18009233b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18009233b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18009233b
cmp dword [rcx + 0x84], 0xe
jbe 0x18009233b
cmp dword [rcx + 0xf8], 0
je 0x18009233b
mov ecx, ebx
call fcn.1800923dc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800921cc
cmp dword [rbp + 0x20], 0
je 0x180092388
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180092390
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800922d4
Function at 0x140006e70
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rdi
mov rax, qword [0x140116340]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
nop dword [rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006ef0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140006f6c
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140006f1b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400d6470
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140006f6c
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x2c]
mov dword [rsp + 0x28], eax
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 3
mov byte [rbx], r14b
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x140006f6f
mov rbx, r14
cmp qword [rdi + 0x18], 0xf
mov rcx, rdi
jbe 0x140006f7c
mov rcx, qword [rdi]
sub rcx, rbx
nop
movzx edx, byte [rbx]
movzx eax, byte [rbx + rcx]
sub edx, eax
jne 0x140006f92
inc rbx
test eax, eax
jne 0x140006f80
mov rcx, rsi
test edx, edx
je 0x140006fc0
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006ee0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400064f0
xor eax, eax
jmp 0x140006fd3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 8]
mov rcx, rdi
call fcn.1400064f0
mov eax, ebx
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.1400d5170
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
mov rdi, qword [rbp + 0x288]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop rbp
ret
Function at 0x140025550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x20]
mov dword [rcx + 0x20], eax
movzx eax, byte [rdx + 0x24]
mov byte [rcx + 0x24], al
mov rax, qword [rdx + 0x28]
mov qword [rcx + 0x28], rax
add rcx, 0x30
add rdx, 0x30
call fcn.1400086a0
mov eax, dword [rdi + 0x50]
mov dword [rsi + 0x50], eax
lea rbx, [rsi + 0x58]
mov qword [rsp + 0x38], rbx
mov rax, qword [rdi + 0x58]
mov qword [rbx], rax
lea rcx, [rbx + 8]
lea rdx, [rdi + 0x60]
call fcn.140025710
nop
vmovsd xmm0, qword [rdi + 0x80]
vmovsd qword [rbx + 0x28], xmm0
vmovsd xmm0, qword [rdi + 0x88]
vmovsd qword [rbx + 0x30], xmm0
mov eax, dword [rdi + 0x90]
mov dword [rbx + 0x38], eax
vmovsd xmm0, qword [rdi + 0x94]
vmovsd qword [rbx + 0x3c], xmm0
vmovsd xmm0, qword [rdi + 0x9c]
vmovsd qword [rbx + 0x44], xmm0
mov eax, dword [rdi + 0xa4]
mov dword [rbx + 0x4c], eax
mov eax, dword [rdi + 0xa8]
mov dword [rbx + 0x50], eax
lea rcx, [rbx + 0x58]
lea rdx, [rdi + 0xb0]
call fcn.1400086a0
mov eax, dword [rdi + 0xd0]
mov dword [rbx + 0x78], eax
vmovsd xmm0, qword [rdi + 0xd4]
vmovsd qword [rbx + 0x7c], xmm0
vmovups xmm0, xmmword [rdi + 0xe0]
vmovups xmmword [rbx + 0x88], xmm0
mov eax, dword [rdi + 0xf0]
mov dword [rbx + 0x98], eax
mov eax, dword [rdi + 0xf4]
mov dword [rbx + 0x9c], eax
mov eax, dword [rdi + 0xf8]
mov dword [rbx + 0xa0], eax
mov eax, dword [rdi + 0xfc]
mov dword [rbx + 0xa4], eax
mov eax, dword [rdi + 0x100]
mov dword [rbx + 0xa8], eax
mov eax, dword [rdi + 0x104]
mov dword [rbx + 0xac], eax
mov eax, dword [rdi + 0x108]
mov dword [rbx + 0xb0], eax
mov rax, qword [rdi + 0x110]
mov qword [rbx + 0xb8], rax
mov eax, dword [rdi + 0x118]
mov dword [rbx + 0xc0], eax
mov eax, dword [rdi + 0x11c]
mov dword [rbx + 0xc4], eax
movzx eax, byte [rdi + 0x120]
mov byte [rbx + 0xc8], al
vmovss xmm0, dword [rdi + 0x128]
vmovss dword [rsi + 0x128], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140026110
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140026131
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14002615e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140026160
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400261b9
test ecx, ecx
jle 0x140026199
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400261b9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400261b9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
rol byte [0x144e1a9e8], 1
add byte [rbx - 0x20], ah
add al, byte [rax]
jns 0x1401f5aee
inc dword [rcx]
add byte [rax], al
inc dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
jge 0x1401f5afc
add dword [rax], eax
add bh, bh
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rbp], bh
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
inc dword [rax]
add byte [rax], al
inc dword [rax]
add byte [rax], al
inc byte [rax]
add byte [rdx], dl
inc dword [rcx]
add byte [rsp + rbp*8 + 2], ah
add byte [rcx - 0xc], ch
add eax, dword [rax]
jno 0x1401f5b4e
add eax, 0x7dd7f00
add byte [rdx - 0x2d], bh
or eax, dword [rax]
adc esi, 0xd485000f
adc al, 0
xchg ecx, edx
sbb al, byte [rax]
xchg esi, edx
and byte [rax], al
xchg bh, dl
sub byte [rax], al
test esi, edx
xor byte [rax], al
xchg ah, dl
cmp byte [rax], al
xchg esp, edx
add byte [r14 - 0x78ffb52b], al
invalid
Function at 0x1400261e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140026202
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140026211
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140026234
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140026236
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140026272
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14002630e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400262ad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400262ee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14002630e
cmp rbx, rax
ja 0x1400262c0
test rbx, rbx
je 0x14002630e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
invalid
Function at 0x140026730
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140116340]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002675d
xor eax, eax
jmp 0x1400268c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140026797
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140026797
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400268c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400268bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400267da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140026805
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400268c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140026874
sub eax, 1
je 0x140026874
cmp eax, 2
jne 0x1400268bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400268c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400268a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400268bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400268c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d5170
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret