joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77dd30
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r10d, 0x40
xor eax, eax
mov r8d, 1
movabs rbx, 0x8000000000000000
nop dword [rax]
mov rdx, r8
mov r11, rcx
shr rax, 1
and edx, 1
neg rdx
and r11, rdx
and rdx, rbx
mov r9, r11
add rax, rdx
xor r9, r8
and r8, r11
shr r9, 1
add r8, r9
sub r10, 1
jne 0x77dd50
pop rbx
ret
Function at 0x788950
Capabilities:
Encrypt data using curve25519

Disassembly:
movzx eax, byte [rcx + 0x1f]
and byte [rcx], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rcx + 0x1f], al
ret
Function at 0x7a2620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
jne 0x7a2670
movzx eax, byte [rcx + 0x10]
test al, al
je 0x7a2670
cmp al, 1
je 0x7a2678
mov r9, qword [rcx + 8]
test r8, r8
je 0x7a264b
mov rax, qword [r9 + 0x18]
mov rax, qword [rax + 0x50]
mov eax, dword [rax + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x7a2685
mov rax, qword [rcx]
mov rcx, qword [r9]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x7a2685
cmp byte [rcx + 0xa], 0
je 0x7a2685
jmp fcn.007624d0
jmp fcn.006e0580
test edx, edx
jne 0x7a2670
mov r9, qword [rcx + 8]
test r8, r8
jne 0x7a263b
xor eax, eax
ret
Function at 0x7bbf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [rcx + 0x28]
mov rdi, rdx
mov r13, r8
test ebx, ebx
jle 0x7bbf9a
mov rsi, qword [rcx + 0x20]
xor ebp, ebp
lea r12, [0x00998440]
nop word [rax + rax]
mov r9d, ebp
xor r9d, 1
cmp ebp, 2
cmovge r9d, ebp
movsxd rax, r9d
shl rax, 5
add rax, rsi
test r13, r13
je 0x7bbf7a
mov r10, qword [rax]
xor r8d, r8d
jmp 0x7bbf67
movzx ecx, byte [r12 + rcx]
cmp byte [r12 + rdx], cl
jne 0x7bbfb0
add r8, 1
movzx edx, byte [r10 + r8]
movzx ecx, byte [r13 + r8]
cmp edx, ecx
jne 0x7bbf58
test edx, edx
jne 0x7bbf63
mov rcx, qword [rax + 0x18]
mov rdx, rdi
add rcx, 0x20
call fcn.006fd530
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x7bbf9c
add ebp, 1
cmp ebp, ebx
jne 0x7bbf30
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r9d, r9d
jne 0x7bbf93
mov r9, r13
lea r8, str.main
jmp 0x7bbfdb
movzx ecx, byte [r12 + rcx]
cmp byte [r12 + rdx], cl
jne 0x7bbf93
add r8, 1
add r9, 1
movzx edx, byte [r8]
movzx ecx, byte [r9]
cmp edx, ecx
jne 0x7bbfc8
test edx, edx
jne 0x7bbfd3
jmp 0x7bbf7a
Function at 0x7d0390
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor eax, eax
mov rsi, qword [rsp + 0x90]
mov dword [rsi], 0
mov dword [rsp + 0x2c], 0
mov edi, edx
mov r12, r8
mov ebp, r9d
test rcx, rcx
je 0x7d045b
mov edx, r9d
sub edx, 1
js 0x7d04ae
movsxd r13, r9d
movsxd rax, edx
mov edx, edx
lea r10, [r8 + r13 - 2]
add rax, r8
sub r10, rdx
mov edx, 0xd
nop dword [rax + rax]
movsx r9d, byte [rax]
lea r8d, [rdx*8]
sub rax, 1
xor r8d, r9d
xor edx, r8d
cmp r10, rax
jne 0x7d03f0
lea eax, [rdx*8]
xor edx, eax
xor edx, edi
and edx, 0x1ff
lea r14, [rcx + rdx*8]
mov rbx, qword [r14]
test rbx, rbx
jne 0x7d0439
jmp 0x7d0470
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x7d0470
cmp dword [rbx + 0xc], edi
jne 0x7d0430
cmp dword [rbx + 8], ebp
jne 0x7d0430
mov rcx, qword [rbx]
mov r8, r13
mov rdx, r12
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x7d0430
mov dword [rsi], 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [r13 + 0x18]
lea rcx, [rsp + 0x2c]
call fcn.007cc570
mov rbx, rax
test rax, rax
je 0x7d04c0
lea rcx, [rbx + 0x18]
mov dword [rbx + 8], ebp
mov r8, r13
mov rdx, r12
mov qword [rbx], rcx
mov dword [rbx + 0xc], edi
call sub.msvcrt.dll_memcpy
mov rax, qword [r14]
mov qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x2c]
mov qword [r14], rbx
jmp 0x7d045b
mov eax, 0x68
mov edx, 0xd
movsxd r13, r9d
jmp 0x7d0412
mov eax, dword [rsp + 0x2c]
jmp 0x7d045b
Function at 0x7dcbe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
movzx r9d, word [rcx + 0x14]
movzx eax, word [rdx + 0x14]
mov r10d, r9d
or r10d, eax
test r10b, 1
jne 0x7dcc68
test r10b, 0x2c
je 0x7dcc38
mov r8d, r9d
and r8d, eax
test r8b, 0x24
jne 0x7dcc88
and r8d, 8
je 0x7dcca8
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x7dcd94
xor r8d, r8d
comisd xmm1, xmm0
seta r8b
jmp 0x7dcc7b
and r10d, 2
je 0x7dcc59
and r9d, 2
je 0x7dcd78
test al, 2
je 0x7dcd94
test r8, r8
jne 0x7dcda0
add rsp, 0x18
jmp fcn.007a2530
and eax, 1
and r9d, 1
sub eax, r9d
mov r8d, eax
jmp 0x7dcc7b
fstp st(0)
fstp st(0)
mov eax, r8d
add rsp, 0x18
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x7dcd94
setg r8b
movzx r8d, r8b
mov eax, r8d
add rsp, 0x18
ret
test r9b, 0x24
jne 0x7dcd88
and r9d, 8
mov r8d, 1
je 0x7dcc7b
test al, 0x24
je 0x7dcd94
movsd xmm0, qword [rcx]
mov r8d, 0xffffffff
movd eax, xmm0
movq rcx, xmm0
neg eax
or eax, ecx
shr rcx, 0x20
and ecx, 0x7fffffff
shr eax, 0x1f
or eax, ecx
mov ecx, 0x7ff00000
cmp ecx, eax
js 0x7dcc7b
cmp byte [0x0086936a], 0
mov rax, qword [rdx]
jne 0x7dcdc0
movsd xmm1, qword [0x00962b30]
comisd xmm1, xmm0
ja 0x7dcc7b
comisd xmm0, xmmword [0x00962ac0]
mov r8d, 1
jae 0x7dcc7b
cvttsd2si rdx, xmm0
cmp rax, rdx
jl 0x7dcc7b
mov r8d, 0xffffffff
jg 0x7dcc7b
pxor xmm1, xmm1
mov r8d, 1
cvtsi2sd xmm1, rax
comisd xmm0, xmm1
ja 0x7dcc7b
xor eax, eax
comisd xmm1, xmm0
seta al
neg eax
mov r8d, eax
jmp 0x7dcc7b
mov r8d, 1
jmp 0x7dcc7b
test al, 8
jne 0x7dcdb0
test al, 0x24
jne 0x7dcc88
mov r8d, 0xffffffff
jmp 0x7dcc7b
xor r9d, r9d
add rsp, 0x18
jmp fcn.00848060
movsd xmm1, qword [rdx]
mov rcx, qword [rcx]
add rsp, 0x18
jmp fcn.007d9d80
mov qword [rsp + 8], rax
fild qword [rsp + 8]
mov r8d, 1
movsd qword [rsp + 8], xmm0
fld qword [rsp + 8]
fcomi st(1)
ja 0x7dcc77
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
neg eax
mov r8d, eax
jmp 0x7dcc7b
Function at 0x7ff9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov edx, dword [rcx + 0x90]
mov rsi, rcx
lea r9d, [rdx + 5]
cmp r9d, dword [rcx + 0x94]
jg 0x7ffbd0
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x88]
lea rax, [rax + rcx*8]
movzx ecx, byte [rbx]
mov byte [rax], cl
movsx r8d, byte [rbx + 1]
mov dword [rax + 4], r8d
movsx r11d, byte [rbx + 2]
lea r8, [0x009982e0]
mov dword [rax + 8], r11d
test r11b, r11b
jle 0x7ffa53
test byte [r8 + rcx], 1
jne 0x7ffbc0
movsx ecx, byte [rbx + 3]
mov byte [rax + 1], 0
mov qword [rax + 0x10], 0
mov dword [rax + 0xc], ecx
xor ecx, ecx
mov word [rax + 2], cx
movzx ecx, byte [rbx + 4]
mov byte [rax + 0x18], cl
movsx r10d, byte [rbx + 5]
mov dword [rax + 0x1c], r10d
movsx r11d, byte [rbx + 6]
mov dword [rax + 0x20], r11d
test r11b, r11b
jle 0x7ffa95
test byte [r8 + rcx], 1
jne 0x7ffbb0
movsx ecx, byte [rbx + 7]
xor r11d, r11d
mov byte [rax + 0x19], 0
mov qword [rax + 0x28], 0
mov dword [rax + 0x24], ecx
mov word [rax + 0x1a], r11w
movzx ecx, byte [rbx + 8]
mov byte [rax + 0x30], cl
movsx r10d, byte [rbx + 9]
mov dword [rax + 0x34], r10d
movsx r11d, byte [rbx + 0xa]
mov dword [rax + 0x38], r11d
test r11b, r11b
jle 0x7ffad9
test byte [r8 + rcx], 1
jne 0x7ffba0
movsx ecx, byte [rbx + 0xb]
xor r10d, r10d
mov byte [rax + 0x31], 0
mov qword [rax + 0x40], 0
mov dword [rax + 0x3c], ecx
mov word [rax + 0x32], r10w
movzx ecx, byte [rbx + 0xc]
mov byte [rax + 0x48], cl
movsx r10d, byte [rbx + 0xd]
mov dword [rax + 0x4c], r10d
movsx r11d, byte [rbx + 0xe]
mov dword [rax + 0x50], r11d
test r11b, r11b
jle 0x7ffb19
test byte [r8 + rcx], 1
jne 0x7ffb90
movsx ecx, byte [rbx + 0xf]
mov byte [rax + 0x49], 0
mov qword [rax + 0x58], 0
mov dword [rax + 0x54], ecx
xor ecx, ecx
mov word [rax + 0x4a], cx
movzx ecx, byte [rbx + 0x10]
mov byte [rax + 0x60], cl
movsx r10d, byte [rbx + 0x11]
mov dword [rax + 0x64], r10d
movsx r10d, byte [rbx + 0x12]
mov dword [rax + 0x68], r10d
test byte [r8 + rcx], 1
je 0x7ffb57
test r10b, r10b
jg 0x7ffb80
movsx edx, byte [rbx + 0x13]
mov byte [rax + 0x61], 0
mov qword [rax + 0x70], 0
mov dword [rax + 0x6c], edx
xor edx, edx
mov word [rax + 0x62], dx
mov dword [rsi + 0x90], r9d
add rsp, 0x28
pop rbx
pop rsi
ret
add edx, r10d
mov dword [rax + 0x68], edx
jmp 0x7ffb57
add r11d, edx
mov dword [rax + 0x50], r11d
jmp 0x7ffb19
add r11d, edx
mov dword [rax + 0x38], r11d
jmp 0x7ffad9
add r11d, edx
mov dword [rax + 0x20], r11d
jmp 0x7ffa95
add r11d, edx
mov dword [rax + 8], r11d
jmp 0x7ffa53
call fcn.0074a700
test eax, eax
jne 0x7ffbe8
mov edx, dword [rsi + 0x90]
lea r9d, [rdx + 5]
jmp 0x7ffa13
xor eax, eax
jmp 0x7ffb77
Function at 0x848060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0xc0
mov rbx, r8
mov rsi, r9
movzx r8d, byte [r8 + 8]
cmp byte [rcx + 0x16], r8b
jne 0x8480b0
mov r11d, dword [rcx + 0x10]
mov rax, qword [rdx + 8]
mov r10, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdx + 0x10]
mov edx, r11d
mov r8, qword [rcx + 8]
mov rcx, r10
call qword [rbx + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop r12
ret
mov rax, qword [rcx + 0x18]
movdqu xmm0, xmmword [rcx]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x98], rax
mov rax, qword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
movzx eax, word [rcx + 0x14]
test ah, 0x20
jne 0x8481d8
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x54], ax
movdqu xmm1, xmmword [rdx]
mov rcx, qword [rdx + 0x10]
movzx edx, word [rdx + 0x14]
mov qword [rsp + 0x90], rcx
movups xmmword [rsp + 0x80], xmm1
test dh, 0x20
jne 0x84812d
and dh, 0x8f
or dh, 0x40
mov word [rsp + 0x94], dx
movzx edx, r8b
xor r12d, r12d
test al, 1
jne 0x84814c
lea rcx, [rsp + 0x40]
call fcn.00847860
movzx edx, byte [rbx + 8]
mov r12, rax
mov r8d, edx
movzx eax, word [rsp + 0x94]
mov ecx, eax
and cx, 0x202
cmp cx, 0x202
je 0x848210
test al, 1
jne 0x8481e8
lea rcx, [rsp + 0x80]
call fcn.00847860
test r12, r12
je 0x8481e8
test rax, rax
je 0x8481e8
mov rcx, qword [rbx + 0x10]
mov edx, dword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9d, dword [rsp + 0x90]
call qword [rbx + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x8481fa
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x84809e
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call fcn.00848830
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop r12
ret
movzx eax, word [rsp + 0x54]
jmp 0x8480fe
test rsi, rsi
je 0x8481f0
mov byte [rsi], 7
mov ecx, dword [rsp + 0x60]
xor eax, eax
test ecx, ecx
je 0x8481a4
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call fcn.00848830
mov eax, dword [rsp + 0x3c]
jmp 0x8481a4
cmp byte [rsp + 0x96], r8b
jne 0x848166
mov rax, qword [rsp + 0x88]
jmp 0x848177
Function at 0x848ee0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ebx, dword [rdx]
mov qword [rdx + 8], rcx
mov rdi, rcx
mov rsi, rdx
mov r12d, r8d
test ebx, ebx
jle 0x849000
xor ebp, ebp
nop dword [rax]
mov rax, qword [rsi + 0x18]
cmp r12d, 2
je 0x849130
lea r14, [rax + rbp]
mov rax, qword [r14 + 0x48]
test rax, rax
je 0x848ff1
mov edx, dword [rax + 0x20]
test edx, edx
je 0x849160
mov r15, qword [rax]
mov eax, dword [0x00869360]
mov qword [r15], 0
test eax, eax
je 0x849180
mov rcx, qword [0x00868fc0]
test rcx, rcx
je 0x848f64
call qword [0x008693e0]
mov ecx, 0x28
call fcn.007dc4f0
mov r13, rax
test r13, r13
je 0x849197
cmp byte [0x00869364], 0
je 0x8490d0
mov rax, qword [0x008694f0]
test rax, rax
je 0x848fa2
mov ecx, 0xc8
call rax
test eax, eax
jne 0x8490d0
lea rax, [0x00849c00]
mov qword [r13 + 0x18], r14
mov r9, r13
xor edx, edx
mov qword [r13 + 0x10], rax
lea rax, [r13 + 8]
lea r8, [0x007fa400]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x8490d0
cmp qword [r13 + 0x10], 0
je 0x8490f8
mov qword [r15], r13
add rbp, 0x50
sub ebx, 1
jne 0x848f10
mov ebx, dword [rsi]
lea r12d, [rbx - 1]
test r12d, r12d
jle 0x849170
movsxd r13, r12d
lea rbp, [rsp + 0x3c]
shl r13, 2
jmp 0x8490a7
mov eax, r12d
sub eax, ebx
mov ebx, eax
add ebx, ebx
lea r14d, [rbx + 1]
movsxd rax, ebx
mov rdx, qword [rsi + 0x18]
lea rax, [rax + rax*4]
shl rax, 4
add rax, rdx
cmp qword [rax + 0x18], 0
je 0x84908f
movsxd rcx, r14d
lea rcx, [rcx + rcx*4]
shl rcx, 4
add rdx, rcx
cmp qword [rdx + 0x18], 0
je 0x8491a0
mov r9d, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
mov dword [rsp + 0x3c], 0
mov eax, dword [rdx + 0x14]
mov rcx, qword [rsi + 8]
mov dword [rsp + 0x28], eax
mov rax, qword [rdx + 0x28]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [rcx + 0x38]
test eax, eax
cmovle r14d, ebx
mov rax, qword [rsi + 0x10]
mov dword [rax + r13], r14d
sub r13, 4
sub r12d, 1
je 0x849170
mov ebx, dword [rsi]
mov eax, ebx
shr eax, 0x1f
add ebx, eax
sar ebx, 1
cmp ebx, r12d
jle 0x849020
mov rdx, qword [rsi + 0x10]
lea eax, [r12 + r12]
mov ebx, dword [rdx + rax*4]
mov r14d, dword [rdx + rax*4 + 4]
jmp 0x84902d
mov qword [r13], 0
mov qword [r13 + 8], 0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
mov qword [r13 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 1
mov rcx, r14
mov dword [r13 + 8], eax
call fcn.00849d10
mov rdx, qword [r14 + 0x48]
cdqe
mov rdx, qword [rdx]
mov dword [rdx + 8], 1
mov qword [r13 + 0x20], rax
jmp 0x848fee
mov edx, ebx
lea rdx, [rdx + rdx*4]
shl rdx, 4
lea rcx, [rax + rdx - 0x50]
call fcn.00849e30
test eax, eax
je 0x848ff1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov rcx, r14
call fcn.00849d10
jmp 0x849144
mov rax, qword [rdi + 0x18]
movzx eax, byte [rax + 0x1f]
jmp 0x84914c
mov ecx, 0x28
call qword [0x00869380]
mov r13, rax
test r13, r13
jne 0x848f7a
mov eax, 7
jmp 0x84914c
mov r14d, ebx
jmp 0x84908f
Function at 0x140002490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x14005fad4], 0
lea rdi, [0x14005fad0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002568
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1400024c0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14000259e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140002580
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1400025df
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400025c3
cmp byte [r8], r9b
jne 0x1400025c3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1400025b0
not eax
pop rdi
ret
Function at 0x1400027c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x1400027d9
mov qword [r8], 0
lea rdx, [0x140036808]
call fcn.1400025f0
mov rbx, rax
test rax, rax
jne 0x1400027f8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400028b8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400028b8
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400028b8
mov rax, qword [0x14005f8c0]
mov rbp, rsi
test rax, rax
je 0x140002855
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400028b8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1400028a5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14005f8c0]
test rax, rax
je 0x14000289a
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400028c1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400028b3
mov qword [rdi], rbp
mov rax, rsi
jmp 0x1400028c3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140011870
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x14005f8c0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x14001198a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x1400118ca
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.1400128a0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x1400118de
mov edx, 8
mov rcx, rbx
call fcn.1400128a0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x14001192a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140011900
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140011939
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x14003680c]
test rax, rax
movsxd rsi, esi
lea rdi, [0x14005f8b8]
mov rcx, r15
cmovne rdi, rax
call fcn.1400025f0
mov rbx, rax
test rax, rax
je 0x140011985
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001d950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001db07
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001d9e6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001d2c0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001c8d0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001d9d7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140012520
mov dword [rbx + 0x80], 0
jmp 0x14001daf3
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001b710
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002c960
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13c0
call fcn.140034cb0
sub rsp, rax
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov rax, qword gs:[0x58]
mov ebx, ecx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14005ff68], eax
jle 0x14002c9e4
lea rcx, [0x14005ff68]
call fcn.140033cd8
cmp dword [0x14005ff68], 0xffffffff
jne 0x14002c9e4
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetSystemMetrics
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14005ff68]
mov qword [0x14005ff48], rax
call fcn.140033c6c
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14002ca00
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.140033a70
mov edx, eax
mov eax, 0x80000000
add rdx, rdx
shr rdx, 0x20
add eax, edx
test ebx, ebx
jne 0x14002ca5f
add eax, 0x80000000
jne 0x14002ca5f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Screen_width_detected__n
call fcn.1400332e0
mov ecx, ebx
call qword [0x14005ff48]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140033c10
add rsp, 0x13c0
pop rbx
ret

Function at 0x14002ca80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13c0
call fcn.140034cb0
sub rsp, rax
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov rax, qword gs:[0x58]
mov rbx, rcx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14005ff98], eax
jle 0x14002cb05
lea rcx, [0x14005ff98]
call fcn.140033cd8
cmp dword [0x14005ff98], 0xffffffff
jne 0x14002cb05
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ShowWindow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14005ff98]
mov qword [0x14005ff50], rax
call fcn.140033c6c
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14002cb20
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.140033a70
mov edx, eax
add rdx, rdx
shr rdx, 0x20
test edx, edx
jne 0x14002cb71
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Window_is_shown__n
call fcn.1400332e0
mov edx, 5
mov rcx, rbx
call qword [0x14005ff50]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140033c10
add rsp, 0x13c0
pop rbx
ret