joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b3c0
Capabilities:
Execute command

Disassembly:
mov eax, ecx
mov rcx, rdx
test eax, eax
je 0x14000b3e0
cmp eax, 1
je 0x14000b3d0
ret
add rcx, 0x10
jmp method.RunWindow.RunWindow_QWidget_::lambda__2::operator_____const
test rdx, rdx
je 0x14000b3ce
mov edx, 0x18
jmp sym.operator_delete_void__unsigned_long_long_

Function at 0x140010820
Capabilities:
Get graphical window text

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rbp, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x140010968
lea ebx, [rax + 1]
movabs rax, 0x3ffffffffffffffc
movsxd rcx, ebx
cmp rax, rcx
jb 0x1400109f1
add rcx, rcx
lea r13, [rsp + 0x30]
call sym.operator_new___unsigned_long_long_
mov r8d, ebx
mov rcx, rsi
mov rdi, rax
mov rdx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rdi
mov qword [rsp + 0x20], r13
call sym.wcslen
lea r12, [rax + rax]
mov rbx, rax
mov r14, r12
sar r14, 1
cmp r12, 0xe
ja 0x140010910
mov rcx, qword [rsp + 0x20]
cmp r14, 1
jne 0x140010970
movzx eax, word [rdi]
mov word [rcx], ax
xor eax, eax
mov qword [rsp + 0x28], r14
mov word [rcx + rbx*2], ax
mov rcx, rdi
lea rbx, [0x1402e636a]
call sym.operator_delete___void_
mov rcx, rbx
mov rdi, qword [rsp + 0x28]
call sym.wcslen
mov rcx, qword [rsp + 0x20]
cmp rdi, rax
je 0x140010980
mov ebx, 1
cmp rcx, r13
je 0x1400108fd
mov rax, qword [rsp + 0x30]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movabs rax, 0x7ffffffffffffffe
cmp rax, r12
jb 0x1400109e5
movabs rax, 0x3fffffffffffffff
cmp r14, rax
je 0x1400109e0
lea rcx, [r12 + 2]
call sym.operator_new_unsigned_long_long_
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rax
mov rcx, rax
mov r8, r12
mov rdx, rdi
call sym.memcpy
mov rcx, qword [rsp + 0x20]
jmp 0x1400108af
mov ebx, 1
jmp 0x1400108fd
test r14, r14
je 0x1400108af
jmp 0x14001094d
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x1400109c0
cmp rcx, rbx
je 0x1400109c0
test rcx, rcx
je 0x1400109d0
xor eax, eax
nop word cs:[rax + rax]
movzx edi, word [rbx + rax*2]
cmp word [rcx + rax*2], di
jne 0x1400108e4
add rax, 1
cmp rdx, rax
jne 0x1400109a0
nop word [rax + rax]
mov qword [rbp], rsi
xor ebx, ebx
jmp 0x1400108e9
mov ebx, 1
jmp 0x1400108ee
call sym.std::__throw_bad_alloc__
lea rcx, [0x1402e6352]
call sym.std::__throw_length_error_char_const_
call sym.__cxa_throw_bad_array_new_length
nop
nop
nop dword [rax + rax]
Function at 0x1400110c0
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x238
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rsi, qword [sym.imp.USER32.dll_GetWindow]
mov rcx, rax
mov edx, 5
call rsi
mov rbx, rax
xor r15d, r15d
xor ebp, ebp
xor r14d, r14d
jmp 0x14001110d
mov edx, 2
mov rcx, rbx
call rsi
mov rbx, rax
test rbx, rbx
je 0x140011138
mov edx, 4
mov rcx, rbx
call rsi
cmp rdi, rax
jne 0x140011100
cmp r15, rbp
je 0x140011218
mov qword [rbp], rbx
add rbp, 8
jmp 0x140011100
cmp r14, rbp
je 0x1400111e8
lea rax, [method.std::ctype_char_.do_widen_char__const]
mov r12, qword [sym.imp.USER32.dll_GetWindowTextW]
mov rsi, r14
lea r13, [rsp + 0x30]
mov qword [rsp + 0x28], rax
jmp 0x14001117d
movsx edx, byte [rdi + 0x43]
mov rcx, rbx
call sym.std::ostream::put_char_
mov rcx, rax
call sym.std::ostream::flush__
add rsi, 8
cmp rbp, rsi
je 0x1400111e8
mov rcx, qword [rsi]
mov r8d, 0x200
mov rdx, r13
call r12
mov rdx, qword [rsi]
mov rcx, qword [str.8P8_]
call sym.std::ostream_std::ostream::_M_insert_void_const__void_const_
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rdi, qword [rbx + rax + 0xf0]
test rdi, rdi
je 0x1400112f9
cmp byte [rdi + 0x38], 0
jne 0x140011160
mov rcx, rdi
call sym.std::ctype_char_::_M_widen_init___const
mov rax, qword [rdi]
mov rcx, qword [rsp + 0x28]
mov edx, 0xa
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140011164
mov rcx, rdi
call rax
movsx edx, al
jmp 0x140011164
test r14, r14
je 0x1400111fb
mov rdx, r15
mov rcx, r14
sub rdx, r14
call sym.operator_delete_void__unsigned_long_long_
xor eax, eax
add rsp, 0x238
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movabs rdx, 0xfffffffffffffff
mov r12, r15
sub r12, r14
mov rax, r12
sar rax, 3
cmp rax, rdx
je 0x14001131b
cmp r14, r15
je 0x1400112d8
lea rdx, [rax + rax]
cmp rdx, rax
jb 0x140011280
test rdx, rdx
jne 0x1400112fe
xor r9d, r9d
xor r13d, r13d
mov qword [r9 + r12], rbx
lea rbp, [r9 + r12 + 8]
test r12, r12
jg 0x1400112a6
test r14, r14
jne 0x1400112b7
mov r15, r13
mov r14, r9
jmp 0x140011100
movabs r13, 0x7ffffffffffffff8
mov rcx, r13
call sym.operator_new_unsigned_long_long_
mov r9, rax
add r13, rax
mov qword [r9 + r12], rbx
lea rbp, [r9 + r12 + 8]
test r12, r12
jle 0x140011267
mov rcx, r9
mov r8, r12
mov rdx, r14
call sym.memmove
mov r9, rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x28], r9
sub rdx, r14
call sym.operator_delete_void__unsigned_long_long_
mov r9, qword [rsp + 0x28]
jmp 0x14001126c
add rax, 1
jb 0x140011280
movabs rdx, 0xfffffffffffffff
cmp rax, rdx
cmova rax, rdx
lea r13, [rax*8]
jmp 0x14001128a
call sym.std::__throw_bad_cast__
movabs rax, 0xfffffffffffffff
cmp rdx, rax
cmovbe rax, rdx
mov r13, rax
shl r13, 3
jmp 0x14001128a
lea rcx, [0x1402e6374]
call sym.std::__throw_length_error_char_const_
mov rbx, rax
mov rcx, rbx
call sym._Unwind_Resume
mov rdx, r15
mov rbx, rax
sub rdx, r14
test r14, r14
je 0x14001132a
mov rcx, r14
call sym.operator_delete_void__unsigned_long_long_
jmp 0x14001132a
Function at 0x140012030
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov r14, rcx
mov r13, rdx
mov rcx, qword [rcx]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x5c], 0
mov edx, 0x20
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
jne 0x140012080
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movq xmm0, qword [rsp + 0x74]
mov edx, 1
movzx eax, word [rsp + 0x82]
mov dword [rsp + 0x90], 0x28
mov word [rsp + 0x9c], dx
mov ecx, 0x42
movd edx, xmm0
mov word [rsp + 0x9e], ax
pshufd xmm1, xmm0, 0xe5
mov qword [rsp + 0xa0], 0
imul eax, edx
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
movq qword [rsp + 0x94], xmm0
lea ebx, [rax + 0x3e]
add eax, 0x1f
cmovns ebx, eax
movd eax, xmm1
mov edx, eax
sar ebx, 5
neg edx
cmovns eax, edx
imul ebx, eax
lea edx, [rbx*4]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x140012068
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x1400122a0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, qword [r14]
mov rbp, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [r14]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea r14, [rsp + 0x90]
mov dword [rsp + 0x30], 0
mov r9d, dword [rsp + 0x78]
mov rcx, rbp
mov qword [rsp + 0x28], r14
call qword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x140012288
mov rcx, r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140012288
lea eax, [rbx + 0x36]
lea rdx, [rsp + 0x62]
mov rcx, r13
mov dword [rsp + 0x6c], 0x36
mov dword [rsp + 0x64], eax
mov eax, 0x4d42
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, 0xe
mov word [rsp + 0x62], ax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
mov r9, rax
mov qword [rsp + 0x20], 0
call r15
test eax, eax
je 0x140012250
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x48]
mov rdx, r14
mov rcx, r13
mov r8d, 0x28
call r15
test eax, eax
je 0x140012250
mov r9, qword [rsp + 0x48]
mov r8d, ebx
mov rdx, rdi
mov rcx, r13
mov qword [rsp + 0x20], 0
call r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x140012068
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14001226b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140012068
Function at 0x140012ad0
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r15, qword [rcx + 8]
mov rbp, qword [rcx]
cmp r15, 1
je 0x140012bd0
mov rsi, qword [0x1403820d0]
test rsi, rsi
je 0x140012bc8
lea r14, [0x1403820c8]
mov r12d, 0x80000000
movabs r13, 0xffffffff7fffffff
mov rdi, r14
jmp 0x140012b29
mov rsi, qword [rsi + 0x18]
test rsi, rsi
je 0x140012b6b
mov rbx, qword [rsi + 0x28]
cmp r15, rbx
mov r8, rbx
cmovbe r8, r15
test r8, r8
je 0x140012b4c
mov rcx, qword [rsi + 0x20]
mov rdx, rbp
call sym.memcmp
test eax, eax
jne 0x140012b5b
sub rbx, r15
cmp rbx, r12
jge 0x140012b5f
cmp rbx, r13
jle 0x140012b20
mov eax, ebx
test eax, eax
js 0x140012b20
mov rdi, rsi
mov rsi, qword [rsi + 0x10]
test rsi, rsi
jne 0x140012b29
xor eax, eax
cmp rdi, r14
je 0x140012bb4
mov rbx, qword [rdi + 0x28]
cmp r15, rbx
mov r8, rbx
cmovbe r8, r15
test r8, r8
je 0x140012b95
mov rdx, qword [rdi + 0x20]
mov rcx, rbp
call sym.memcmp
test eax, eax
jne 0x140012bad
sub r15, rbx
cmp r15, 0x7fffffff
jg 0x140012bb1
cmp r15, 0xffffffff80000000
jl 0x140012bc8
mov eax, r15d
test eax, eax
js 0x140012bc8
mov eax, dword [rdi + 0x40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140012bb4
movsx ecx, byte [rbp]
call qword [sym.imp.USER32.dll_VkKeyScanA]
movzx eax, al
jmp 0x140012bb4
Function at 0x140012be0
Capabilities:
Log keystrokes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
call method.WindowManager.GetVkCode_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
movsxd rbx, eax
test ebx, ebx
je 0x140012c48
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov r8, rbx
mov edx, 0x100
shl eax, 0x10
mov rbp, qword [sym.imp.USER32.dll_PostMessageW]
mov esi, eax
or esi, 1
mov r9, rsi
call rbp
mov rcx, qword [rdi]
mov r9, rsi
mov r8, rbx
mov edx, 0x101
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbx, qword [str.0P8_]
mov r8d, 0xd
lea rdx, str.Invalid_key:
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rsi, qword [rbx + rax + 0xf0]
test rsi, rsi
je 0x140012cda
cmp byte [rsi + 0x38], 0
je 0x140012cb0
movsx edx, byte [rsi + 0x43]
mov rcx, rbx
call sym.std::ostream::put_char_
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.std::ostream::flush__
mov rcx, rsi
call sym.std::ctype_char_::_M_widen_init___const
mov rax, qword [rsi]
mov edx, 0xa
lea rcx, [method.std::ctype_char_.do_widen_char__const]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140012c94
mov rcx, rsi
call rax
movsx edx, al
jmp 0x140012c94
call sym.std::__throw_bad_cast__
nop
Function at 0x140012ce0
Capabilities:
Log keystrokes

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rcx
mov rcx, rdx
mov rdi, rdx
mov ebx, r8d
call method.WindowManager.GetVkCode_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
movsxd rsi, eax
test esi, esi
je 0x140012dc0
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8, rsi
mov rcx, qword [rbp]
mov r12, qword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
mov edx, 0x100
mov edi, eax
or edi, 1
mov r9, rdi
call r12
movsxd r8, ebx
test r8, r8
jle 0x140012d95
movabs rax, 0x20c49ba5e353f7cf
mov r13, qword [sym.imp.msvcrt.dll__errno]
lea rbx, [rsp + 0x20]
imul r8
mov rax, r8
sar rax, 0x3f
sar rdx, 7
sub rdx, rax
mov qword [rsp + 0x20], rdx
imul rdx, rdx, 0x3e8
sub r8, rdx
imul r8, r8, 0xf4240
mov dword [rsp + 0x28], r8d
mov rdx, rbx
mov rcx, rbx
call sym.nanosleep
cmp eax, 0xffffffff
jne 0x140012d95
call r13
cmp dword [rax], 4
je 0x140012d7d
mov rcx, qword [rbp]
mov r9, rdi
mov r8, rsi
mov edx, 0x101
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp rax
mov rbx, qword [str.0P8_]
mov r8d, 0xd
lea rdx, str.Invalid_key:
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rsi, qword [rbx + rax + 0xf0]
test rsi, rsi
je 0x140012e5a
cmp byte [rsi + 0x38], 0
je 0x140012e30
movsx edx, byte [rsi + 0x43]
mov rcx, rbx
call sym.std::ostream::put_char_
mov rcx, rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.std::ostream::flush__
mov rcx, rsi
call sym.std::ctype_char_::_M_widen_init___const
mov rax, qword [rsi]
mov edx, 0xa
lea rcx, [method.std::ctype_char_.do_widen_char__const]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140012e0c
mov rcx, rsi
call rax
movsx edx, al
jmp 0x140012e0c
call sym.std::__throw_bad_cast__
nop
Function at 0x140012e60
Capabilities:
Log keystrokes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
call method.WindowManager.GetVkCode_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov ebx, eax
test eax, eax
je 0x140012eb0
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
movsxd r8, ebx
mov edx, 0x100
shl eax, 0x10
mov r9d, eax
or r9d, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [str.0P8_]
mov r8d, 0xd
lea rdx, str.Invalid_key:
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rsi, qword [rbx + rax + 0xf0]
test rsi, rsi
je 0x140012f42
cmp byte [rsi + 0x38], 0
je 0x140012f18
movsx edx, byte [rsi + 0x43]
mov rcx, rbx
call sym.std::ostream::put_char_
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.std::ostream::flush__
mov rcx, rsi
call sym.std::ctype_char_::_M_widen_init___const
mov rax, qword [rsi]
mov edx, 0xa
lea rcx, [method.std::ctype_char_.do_widen_char__const]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140012efc
mov rcx, rsi
call rax
movsx edx, al
jmp 0x140012efc
call sym.std::__throw_bad_cast__
nop
nop dword [rax + rax]
Function at 0x140012f50
Capabilities:
Log keystrokes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
call method.WindowManager.GetVkCode_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov ebx, eax
test eax, eax
je 0x140012fa0
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
movsxd r8, ebx
mov edx, 0x101
shl eax, 0x10
mov r9d, eax
or r9d, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [str.0P8_]
mov r8d, 0xd
lea rdx, str.Invalid_key:
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rsi, qword [rbx + rax + 0xf0]
test rsi, rsi
je 0x140013032
cmp byte [rsi + 0x38], 0
je 0x140013008
movsx edx, byte [rsi + 0x43]
mov rcx, rbx
call sym.std::ostream::put_char_
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.std::ostream::flush__
mov rcx, rsi
call sym.std::ctype_char_::_M_widen_init___const
mov rax, qword [rsi]
mov edx, 0xa
lea rcx, [method.std::ctype_char_.do_widen_char__const]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140012fec
mov rcx, rsi
call rax
movsx edx, al
jmp 0x140012fec
call sym.std::__throw_bad_cast__
nop
nop dword [rax + rax]
Function at 0x140024910
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, 0xfffffffe
mov rbx, rcx
mov rdi, rdx
cmp rax, rdx
jae 0x1400249c0
mov eax, 0xffffffff
cmp rdx, rax
je 0x140024ac0
mov rsi, rdx
shr rsi, 0x20
mov rdx, rsi
mov rcx, rbx
call sym._ZNSt24uniform_int_distributionIxEclISt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2
shl rax, 0x20
mov r8, rax
mov rax, qword [rbx + 0x9c0]
cmp rax, 0x26f
jbe 0x140024970
mov rcx, rbx
call sym._ZNSt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2636928640ELy15ELj4022730752ELy18EL
mov rax, qword [rbx + 0x9c0]
lea rdx, [rax + 1]
mov eax, dword [rbx + rax*4]
mov qword [rbx + 0x9c0], rdx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
xor edx, edx
add rax, r8
setb dl
cmp rdi, rax
jb 0x140024940
test rdx, rdx
jne 0x140024940
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rcx + 0x9c0]
add rdi, 1
mov r11d, edi
cmp rax, 0x26f
ja 0x140024b10
mov r8d, dword [rbx + rax*4]
lea rcx, [rax + 1]
mov qword [rbx + 0x9c0], rcx
mov eax, r8d
shr eax, 0xb
xor r8d, eax
mov eax, r8d
shl eax, 7
and eax, 0x9d2c5680
xor r8d, eax
mov eax, r8d
shl eax, 0xf
and eax, 0xefc60000
xor r8d, eax
mov eax, r8d
shr eax, 0x12
xor r8d, eax
imul r8, rdi
cmp r8d, edi
jae 0x140024aa8
mov eax, edi
xor edx, edx
neg eax
div r11d
mov r10d, edx
cmp r8d, edx
jb 0x140024a86
jmp 0x140024aa8
lea rcx, [rax + 1]
mov eax, dword [rbx + rax*4]
mov qword [rbx + 0x9c0], rcx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov r8d, eax
shl r8d, 0xf
and r8d, 0xefc60000
xor eax, r8d
mov edx, eax
shr edx, 0x12
xor eax, edx
imul rax, rdi
mov r8, rax
cmp eax, r10d
jae 0x140024aa8
mov rax, rcx
cmp rcx, 0x26f
jbe 0x140024a40
mov rcx, rbx
call sym._ZNSt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2636928640ELy15ELj4022730752ELy18EL
mov rax, qword [rbx + 0x9c0]
jmp 0x140024a40
mov rax, r8
shr rax, 0x20
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rcx + 0x9c0]
cmp rax, 0x26f
ja 0x140024b28
lea rdx, [rax + 1]
mov eax, dword [rbx + rax*4]
mov qword [rbx + 0x9c0], rdx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sym._ZNSt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2636928640ELy15ELj4022730752ELy18EL
mov rax, qword [rbx + 0x9c0]
jmp 0x1400249da
call sym._ZNSt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2636928640ELy15ELj4022730752ELy18EL
mov rax, qword [rbx + 0x9c0]
jmp 0x140024acf
Function at 0x1400a8520
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400a91f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140382368]
test eax, eax
je 0x1400a928a
lea rax, [0x140382340]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140382370]
mov qword [rbp - 8], rax
jmp 0x1400a926e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400a9262
cmp qword [rbp - 0x10], 0
je 0x1400a9262
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400a9228
lea rax, [0x140382340]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400a928b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400a9390
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400a93b8
mov eax, 0
jmp 0x1400a9406
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400a93e1
mov eax, 0
jmp 0x1400a9406
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400a9401
mov eax, 0
jmp 0x1400a9406
mov eax, 1
add rsp, 0x20
pop rbp
ret