joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021130
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14007e0d8]
mov edi, ecx
cmp byte [rbx + 0x4235], 0
jne 0x140021191
cmp byte [rbx + 0x4236], 0
jne 0x140021191
movsx r9d, word [rbx + 0x531a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400122a0
test dil, 1
je 0x1400212b8
jmp 0x14002121a
movss xmm1, dword [rbx + 0x3890]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x531a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140057f64]
mulss xmm1, dword [0x140057f48]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xdf4]
addss xmm1, dword [rbx + 0xdf8]
mov qword [rbx + 0x3fa0], rax
mov dword [rbx + 0x3f8c], 1
movss dword [rbx + 0x3f98], xmm0
movss dword [rbx + 0x3f9c], xmm1
movss xmm0, dword [rbx + 0x38ec]
mulss xmm0, dword [0x140057e18]
or dword [rbx + 0x3f88], 0x41
movss dword [rbx + 0x3fe8], xmm0
call fcn.1400122a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140021270
lea r11, [0x140053050]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140021253
cmp byte [r8], r9b
jne 0x140021253
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140021240
not ecx
call fcn.14001a2f0
test rax, rax
je 0x1400212b8
cmp byte [rax + 0x96], 0
je 0x1400212b8
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x531a]
mov edx, 0x10
movsx r9d, word [rbx + 0x531a]
call fcn.1400122a0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14001ca70
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d570
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140025550
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53c8], 0
lea rbx, [rcx + 0x53d0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400255f7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400255aa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400277e0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140012cb0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53c8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53d8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14007e0e8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400255ff
mov rcx, rbx
call fcn.140012cb0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140025b70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14007e0d8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140025bd3
mov qword [rsp], rbx
lea rbx, [0x140053050]
nop dword [rax]
cmp r9b, 0x23
jne 0x140025bb3
cmp byte [r8], r9b
jne 0x140025bb3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140025ba0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5378]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140025c07
mov r10, qword [r10 + 0x5380]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140025c0e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140025bf4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1400455f0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x14004567c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140045650
lea r11, [0x140053050]
nop
cmp r9b, 0x23
jne 0x140045633
cmp byte [r8], r9b
jne 0x140045633
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140045620
mov rcx, qword [0x14007e0d8]
not eax
cmp dword [rcx + 0x3ed4], eax
jne 0x140045667
mov dword [rcx + 0x3ed8], eax
cmp dword [rcx + 0x3f00], eax
jne 0x1400456d6
mov byte [rcx + 0x3f04], 1
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
xor edx, edx
mov rbx, qword [0x14007e0d8]
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov r8, qword [rbx + 0x3e88]
movsxd rax, dword [r8 + 0xd0]
mov r8, qword [r8 + 0xd8]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1400123e0
cmp dword [rbx + 0x3ebc], eax
mov esi, eax
mov rbx, qword [rsp + 0x30]
jne 0x1400456cf
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.1400269a0
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004acf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x14007e194]
movsxd rax, dword [0x140061c94]
xor r9d, r9d
cmp eax, 0x7b
ja 0x14004ad30
lea r9, str.Keybind
mov r9, qword [r9 + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
test r9, r9
jne 0x14004ad76
mov qword [rbp - 0x18], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x140057a28]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], r9b
jmp 0x14004adb2
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r9 + rbx], 0
jne 0x14004ad80
lea rcx, [rbp - 0x28]
cmp rbx, 0xf
ja 0x14004adaa
mov qword [rbp - 0x18], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x28], 0
jmp 0x14004adb2
mov rdx, rbx
call fcn.140010520
cmp edi, 1
jne 0x14004ae04
mov rax, qword [rbp - 0x10]
cmp rax, 0xd
jb 0x14004adef
lea rbx, [rbp - 0x28]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], 0xd
lea r8d, [rdi + 0xc]
lea rdx, str.Press_the_Key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x14004ae04
lea r9, str.Press_the_Key
mov edx, 0xd
lea rcx, [rbp - 0x28]
call fcn.140010520
mov dword [rbp - 0x30], 0x42fa0000
mov dword [rbp - 0x2c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.14003c700
test al, al
je 0x14004ae53
test edi, edi
jne 0x14004ae53
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x14004aca0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14004ae91
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ae8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ae8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d814
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14004d570
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x14004aeb0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
mov rbx, rcx
cvtss2sd xmm1, xmm2
lea rcx, [rsp + 0x38]
mov rdi, rdx
call fcn.1400019c0
cmp qword [rsp + 0x50], 0xf
lea rax, str.C:cfgfn
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x38]
cmova r8, qword [rsp + 0x38]
lea r9, [rsp + 0x58]
mov rdx, rdi
mov dword [rsp + 0x20], 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14004af59
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004af54
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004af54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d814
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004d570
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004d4d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret

Function at 0x14004e18c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004e1d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004e1d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004e1d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004e1d6
cmp dword [rcx + 0x84], 0xe
jbe 0x14004e1d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004e1d8
xor al, al
add rsp, 0x28
ret
Function at 0x140029bbc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d294
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d294
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029d0c
cmp rax, 0xffffffffffffffff
je 0x140029d0c
xor edi, edi
test rbp, rbp
jle 0x140029cb7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fbc0
mov rbx, rax
test rax, rax
jne 0x140029c44
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029cad
mov edx, 0x8000
mov ecx, r14d
call fcn.14001abfc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001df70
cmp eax, 0xffffffff
je 0x140029c8d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c54
mov edx, r15d
mov ecx, r14d
call fcn.14001abfc
jmp 0x140029cad
cmp byte [rsi + 0x38], dil
je 0x140029ca4
cmp dword [rsi + 0x34], 5
jne 0x140029ca4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029cad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b960
jmp 0x140029d20
jns 0x140029d20
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d294
cmp rax, 0xffffffffffffffff
jne 0x140029cd8
cmp byte [rsi + 0x30], dil
je 0x140029d20
mov edi, dword [rsi + 0x2c]
jmp 0x140029d20
mov ecx, r14d
call fcn.1400190b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029d20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029d20
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029d19
mov eax, dword [rsi + 0x2c]
jmp 0x140029d1e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d294
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ae10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001952
cmp dword [rcx + 0x84], 0xe
jbe 0x140001952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001954
xor al, al
add rsp, 0x28
ret
Function at 0x140004c54
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140004c10
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14000557c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14000559e
mov rcx, qword [rsp + 0x40]
call fcn.14000660c
jmp 0x1400055b5
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x1400055b5
mov rcx, qword [rsp + 0x40]
call fcn.140006444
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400057ac
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
Function at 0x140005f08
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140005f33
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140005f3a
mov al, 1
jmp 0x140006093
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140006e6c
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140006e6c
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.140006e74
movzx eax, al
test eax, eax
je 0x140005f91
xor al, al
jmp 0x140006093
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140006001
cmp dword [rsp + 0x30], 1
je 0x14000600d
cmp dword [rsp + 0x30], 3
je 0x140006081
jmp 0x140006091
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140006059
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140006059
xor al, al
jmp 0x140006093
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140006073
mov dword [rsp + 0x34], 1
jmp 0x14000607b
mov dword [rsp + 0x34], 0
mov al, byte [rsp + 0x34]
jmp 0x140006093
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140006093
xor al, al
add rsp, 0xa8
ret
Function at 0x140006444
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov qword [rsp + 0x18], 0
jmp 0x140006465
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0xe3
jae 0x1400064e9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x1400064b4
mov dword [rsp + 4], 0x9908b0df
jmp 0x1400064bc
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140006458
jmp 0x1400064f8
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0x26f
jae 0x14000657f
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
and eax, 1
test eax, eax
je 0x140006549
mov dword [rsp + 0xc], 0x9908b0df
jmp 0x140006551
mov dword [rsp + 0xc], 0
mov eax, dword [rsp + 8]
shr eax, 1
xor eax, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400064eb
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400065c6
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x1400065ce
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x30]
xor eax, dword [rdx + rcx + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
mov rax, qword [rsp + 0x30]
mov dword [rax], 0
add rsp, 0x28
ret
Function at 0x14000660c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14000662d
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x1400066b1
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14000667c
mov dword [rsp + 4], 0x9908b0df
jmp 0x140006684
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140006620
add rsp, 0x18
ret
Function at 0x140006f34
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x58
mov byte [rsp + 0x40], 0x49
mov byte [rsp + 0x41], 0xba
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x43], 0
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x45], 0
mov byte [rsp + 0x46], 0
mov byte [rsp + 0x47], 0
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x4b], 0xff
mov byte [rsp + 0x4c], 0xe2
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov eax, 1
imul rax, rax, 2
lea rax, [rsp + rax + 0x40]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsp + 0x24], 0xd
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x60]
test eax, eax
je 0x14000705a
cmp qword [rsp + 0x78], 0
je 0x14000701d
mov rax, qword [rsp + 0x78]
cmp qword [rax + 0x10], 0
je 0x140006ff8
mov rax, qword [rsp + 0x78]
cmp dword [rax + 0x18], 0
jne 0x140006fff
xor al, al
jmp 0x140007140
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x18]
mov r8d, eax
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140007058
mov eax, dword [rsp + 0x24]
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + 0x20], 1
jmp 0x1400070d0
cmp qword [rsp + 0x78], 0
jne 0x140007069
xor al, al
jmp 0x140007140
mov rax, qword [rsp + 0x78]
cmp qword [rax], 0
je 0x14000707f
mov rax, qword [rsp + 0x78]
cmp dword [rax + 8], 0
jne 0x140007086
xor al, al
jmp 0x140007140
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400070d0
mov eax, dword [rsp + 0x24]
mov r8d, eax
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + 0x20], 1
cmp qword [0x14000f360], 0
jne 0x1400070fe
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f360], rax
mov rax, qword [0x14000f360]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [rsp + 0x38]
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x28]
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x1400072a4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x1408
call fcn.140009530
sub rsp, rax
cmp dword [0x14000f358], 0
je 0x140007418
cmp qword [0x14000f338], 0
jne 0x140007418
mov rcx, qword [rsp + 0x1410]
call fcn.14000759c
movzx eax, al
test eax, eax
je 0x140007418
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x60000
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006c98
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.14000166c
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.140006ac8
mov qword [rsp + 0x40], rax
jmp 0x14000733b
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
je 0x140007404
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
cmp qword [rsp + 0x1410], rax
jbe 0x1400073ff
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 0x18]
cmp qword [rsp + 0x1410], rax
jae 0x1400073ff
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [0x14000f338], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [0x14000f340], rax
mov byte [0x14000f348], 0
lea rcx, [rsp + 0x20]
call fcn.1400011a0
lea rcx, [rsp + 0x20]
call fcn.14000564c
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140004c54
mov r8d, 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140004cc4
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140003540
mov dword [0x14000f34c], eax
lea rcx, [rsp + 0x50]
call fcn.140005198
jmp 0x140007418
jmp 0x14000732d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x1408
ret