joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076a73
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14015d0b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1b0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x34
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1401b3780]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x1401caa44]
call fcn.140078341
movss xmm0, dword [0x140177ad8]
movss dword [rbp + 4], xmm0
mov dword [rbp + 0x24], 0x32
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rbp + 0x48]
call fcn.1400779fa
mov byte [rbp + 0x74], 0xff
mov rax, qword [rbp + 0x1b8]
add rax, 0x4e8
xor r8d, r8d
mov rdx, rax
mov rax, qword [0x1401b4070]
mov rcx, qword [rax + 0x10]
call fcn.140078567
mov rcx, qword [0x1401b4068]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401babb8]
movzx eax, byte [rax]
cmp eax, 1
jne 0x14015d18a
mov rax, qword [rbp + 0x1b8]
add rax, 0x69c
lea r8, [rbp + 4]
mov rdx, rax
mov rax, qword [0x1401b4070]
mov rcx, qword [rax + 0x10]
call fcn.140076677
mov rax, qword [0x1401babb8]
movzx eax, byte [rax + 1]
cmp eax, 1
jne 0x14015d1c2
mov rax, qword [0x1401b4068]
mov rax, qword [rax + 0x20]
add rax, 0x474
lea r8, [rbp + 0x24]
mov rdx, rax
mov rax, qword [0x1401b4070]
mov rcx, qword [rax + 0x10]
call fcn.140078003
mov rax, qword [0x1401babb8]
movzx eax, byte [rax + 2]
cmp eax, 1
jne 0x14015d276
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14015d276
mov rax, qword [0x1401b4068]
mov rax, qword [rax + 8]
add rax, 0x1d0
xor r9d, r9d
mov r8, rax
mov rax, qword [0x1401b4070]
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x154]
call fcn.1400770ef
lea rcx, [rbp + 0x48]
mov rdi, rcx
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rbp + 0x50]
addss xmm0, dword [0x140177a54]
movss dword [rbp + 0x50], xmm0
mov rax, qword [0x1401b4068]
mov rax, qword [rax + 8]
add rax, 0x1d0
lea r9, [rbp + 0x48]
mov r8, rax
mov rax, qword [0x1401b4070]
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x174]
call fcn.1400783cd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401bac28], eax
mov rax, qword [0x1401babb8]
movzx eax, byte [rax + 9]
test eax, eax
je 0x14015d2b8
mov rax, qword [0x1401babb8]
add rax, 4
mov rcx, qword [0x1401b4068]
mov rcx, qword [rcx + 0x10]
add rcx, 0x624
mov r8, rax
mov rdx, rcx
mov rax, qword [0x1401b4070]
mov rcx, qword [rax + 0x10]
call fcn.140076677
mov rax, qword [0x1401babb8]
movzx eax, byte [rax + 8]
cmp eax, 1
jne 0x14015d2f4
mov byte [rbp + 0x74], 0xff
mov rax, qword [0x1401b4068]
mov rax, qword [rax + 0x10]
add rax, 0x620
lea r8, [rbp + 0x74]
mov rdx, rax
mov rax, qword [0x1401b4070]
mov rcx, qword [rax + 0x10]
call fcn.140077748
lea rcx, [rbp - 0x20]
lea rdx, reloc.XINPUT1_3.dll_Ordinal_4
call fcn.140077db5
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.1400770e5
lea rsp, [rbp + 0x190]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140076f91
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14015e810
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x708
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x728]
mov rax, qword [0x1401b3780]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x1401cacc5]
call fcn.140078341
mov qword [rbp + 8], 0
mov edx, dword [rbp + 0x700]
mov ecx, 0x18
call fcn.140077086
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x14015e8ca
mov dword [rbp + 0x50], 0x438
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14007761c
test eax, eax
je 0x14015e8ca
mov rdx, qword [rbp + 0x708]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x14015e8b9
mov rax, qword [rbp + 0x68]
mov qword [rbp + 8], rax
jmp 0x14015e8ca
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14007655a
test eax, eax
jne 0x14015e897
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14019db60]
call fcn.140077db5
mov rax, rdi
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.1400770e5
lea rsp, [rbp + 0x6e8]
pop rdi
pop rbp
ret

Function at 0x140077397
Capabilities:
Terminate process

Disassembly:
jmp 0x1401603d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140077491
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14015e6a0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x1401b3780]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1401cacc5]
call fcn.140078341
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 2
call fcn.140077086
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0xffffffffffffffff
jne 0x14015e714
xor eax, eax
jmp 0x14015e795
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.14007759a
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call fcn.1400763bb
test eax, eax
jne 0x14015e74a
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
jmp 0x14015e795
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140077e82
test eax, eax
je 0x14015e786
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call fcn.1400763bb
test eax, eax
jne 0x14015e784
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
jmp 0x14015e795
jmp 0x14015e74a
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14019dae0]
call fcn.140077db5
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400770e5
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x1400778fb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140162540
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140162560
xor al, al
jmp 0x1401625e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140162573
xor al, al
jmp 0x1401625e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14016259d
xor al, al
jmp 0x1401625e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401625b1
xor al, al
jmp 0x1401625e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401625c3
xor al, al
jmp 0x1401625e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401625df
xor al, al
jmp 0x1401625e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140077dc9
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x14015dd70
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x198]
mov rax, qword [0x1401b3780]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x1401cab8b]
call fcn.140078341
mov qword [rbp + 0x118], 0
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140076d2f
lea rax, [rbp + 0x134]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 8]
lea rcx, [0x14015d540]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
jne 0x14015de1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14015de1e
cmp qword [rbp + 8], 0
je 0x14015de1e
mov rax, qword [rbp + 8]
jmp 0x14015de20
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14019d9e0]
call fcn.140077db5
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1400770e5
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x140078440
Capabilities:
Create thread

Disassembly:
jmp 0x140157ee0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1401b3780]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1401ca6b3]
call fcn.140078341
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140077ec8
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.14007720c
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140077a63
nop
lea rcx, [rbp + 0x108]
call fcn.140076352
lea rax, [0x140077450]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.140076875
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x140157fe0
lea rcx, [rbp + 8]
call fcn.140078481
jmp 0x140157ff9
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400767f8
nop
lea rcx, [rbp + 8]
call fcn.140076352
lea rcx, [rbp - 0x30]
lea rdx, [0x14019cd90]
call fcn.140077db5
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1400770e5
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x18000e624
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x18000e64e
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18000e6c1
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x18000e665
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18000e667
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18000e6bb
test ecx, ecx
jle 0x18000e69b
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x18000e6bb
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18000e6bb
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18000e6d4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x18000e702
xor eax, eax
jmp 0x18000e7e6
cmp qword [rcx + 0x68], 0
je 0x18000e714
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x18000e7e6
mov rax, qword [rcx + 0x38]
mov rsi, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x18000e72b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000e72d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000e75a
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x18000e7e0
mov r8, qword [rbp + 0x18]
lea rax, [rbp + 0x70]
cmp qword [r8], rax
jne 0x18000e791
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbp + 0x38]
mov qword [rax], rcx
mov rax, qword [rbp + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18000e7bb
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x18000e7e0
cmp rsi, rbx
ja 0x18000e798
test rsi, rsi
je 0x18000e7e0
mov r9, qword [rbp + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rsi, rax
sub rdi, rsi
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000ebb8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
or esi, 0xffffffff
mov edi, edx
mov rbx, rcx
cmp edx, esi
jne 0x18000ebe0
xor eax, eax
jmp 0x18000ecf4
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000ec0e
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x18000ec0e
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x18000ecf4
cmp qword [rbx + 0x80], 0
je 0x18000ecf2
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000ec49
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18000ec6a
movsx ecx, dil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, esi
cmove edi, esi
jmp 0x18000ec07
lea rax, [rbp + 0x30]
mov byte [rbp - 0x30], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18000ecb8
sub eax, 1
je 0x18000ecb8
cmp eax, 2
jne 0x18000ecf2
movsx ecx, byte [rbp - 0x30]
jmp 0x18000ec56
mov r14, qword [rbp + 0x30]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x18000ece3
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x18000ecf2
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0x38], rax
cmovne esi, edi
mov eax, esi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000ef90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18000efec
cmp byte [rcx + 0x71], 0
je 0x18000efec
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000f034
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18000eff9
sub eax, 1
je 0x18000effd
cmp eax, 2
jne 0x18000f034
mov byte [rbx + 0x71], 0
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x18000f02b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18000f034
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000efee
xor al, al
jmp 0x18000efee
Function at 0x18000f6e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rcx]
mov ebx, 0x270
mov ecx, dword [r9]
cmp ecx, ebx
jne 0x18000f74b
lea r8, [r9 + 8]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r10d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub rbx, 1
jne 0x18000f70e
mov ecx, dword [r9]
jmp 0x18000f821
cmp ecx, 0x4e0
jb 0x18000f821
lea rbx, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [rbx]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov eax, edi
mov r8, rbx
mov edx, eax
add rbx, 4
mov edi, dword [rbx]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x18000f771
lea rbx, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [rbx]
mov eax, edi
mov r8, rbx
mov edx, eax
add rbx, 4
mov edi, dword [rbx]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x18000f7b6
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
ret
Function at 0x18001757c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rdi, rdx
mov rbp, rcx
mov rcx, r8
mov rax, 0xfffffffffffff000
and rcx, rax
mov rsi, r8
mov qword [rdx], rcx
mov rdx, r8
sub rdx, rcx
lea r9, [rdi + 0x10]
add rdx, 0x1004
mov r8d, 0x40
and rdx, rax
mov qword [rdi + 8], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800175fc
mov r9, qword [rdi + 8]
lea rdx, str.__unprotect_memory__p__size_llu______p__size_llu__n
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.180016c64
xor eax, eax
jmp 0x180017649
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x40]
call fcn.18001704c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rdi + 8]
lea rdx, str.Failed_to_unprotect_memory__p__size_llu______p__size_llu__error_lu__s__
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.180016c70
mov eax, 9
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180017d48
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180017d89
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
and qword [rsp + 0x28], 0
lea r8, [0x180017d94]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180017d89
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180018124
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
movabs rcx, 0xedb6ef8d210ce66c
movabs rax, 0x97986f64d4616265
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
movabs rax, 0x97986f14a7131213
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, [0x1801467cc]
mov rcx, rbx
mov r9, rax
lea rdx, str.CONOUT_
add rsp, 0x40
pop rbx
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]

Function at 0x180018594
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x40
mov rbx, rcx
mov r10d, 0x811c9dc5
cmp byte [rdx], 0
je 0x1800185c9
mov al, byte [rdx]
movzx eax, al
xor eax, r10d
imul r10d, eax, 0x1000193
inc rdx
mov al, byte [rdx]
test al, al
jne 0x1800185b3
mov dword [rsp + 0x50], r10d
lea rcx, [rsp + 0x50]
call fcn.1800190ac
and rax, qword [rbx + 0x30]
add rax, rax
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, qword [rbx + 8]
je 0x180018605
mov rdx, qword [rdx + rax*8]
jmp 0x1800185fd
cmp rcx, rdx
je 0x180018605
mov rcx, qword [rcx + 8]
cmp r10d, dword [rcx + 0x10]
jne 0x1800185f4
jmp 0x180018607
xor ecx, ecx
test rcx, rcx
cmove rcx, qword [rbx + 8]
cmp rcx, qword [rbx + 8]
je 0x18001861e
lea rax, [rcx + 0x18]
jmp 0x1800186a8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.18001873c
nop
mov rcx, qword [rsp + 0x60]
call fcn.18000d430
test al, al
je 0x18001865c
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18001878c
mov rbx, qword [rax]
add rbx, 0x18
jmp 0x180018686
mov ecx, dword [0x180150bb4]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1801514dc], eax
jg 0x1800186b3
lea rbx, [0x180151440]
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1800186a5
mov rcx, rdi
call fcn.18000d3d0
mov edx, 0x38
mov rcx, rdi
call fcn.180019af4
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rcx, [0x1801514dc]
call fcn.18001970c
cmp dword [0x1801514dc], 0xffffffff
jne 0x18001867f
lea rcx, [0x18001b374]
call fcn.180019adc
nop
lea rcx, [0x1801514dc]
call fcn.1800196a0
jmp 0x18001867f

Function at 0x1800190ac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rdx + r8]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 4
jb 0x180019089
mov rax, rcx
ret
mov rdx, rcx
jmp 0x18001907c