joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003aa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140003ad5
mov r8d, 0x87c
lea rdx, str.C:UserskrymiDownloadsimgui_1.90.8imgui_1.90.8imgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor r14d, r14d
test rsi, rsi
je 0x140003ae0
mov qword [rsi], r14
lea rdx, [0x140050e98]
mov rcx, rbx
call fcn.140003910
mov rbx, rax
test rax, rax
jne 0x140003b08
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003c32
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003c32
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003c32
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003c32
cmp rdi, 0xffffffffffffffff
je 0x140003c32
mov rcx, rdi
call fcn.140008000
mov rbp, rax
test rax, rax
je 0x140003c32
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003c1f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x14017a3e0]
test r8, r8
je 0x140003c14
movsx rdx, word [r8 + 0x60e8]
lea rcx, [r8 + 0x60ec]
mov r9d, dword [r8 + 0x3f68]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140003c09
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60e8], cx
movsx rax, cx
lea rcx, [r8 + 0x60ec]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60e4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003c3b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140003c2d
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140003c3d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140017650
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14017a3e0]
mov edi, ecx
cmp byte [rbx + 0x4d3d], 0
jne 0x1400176a2
cmp byte [rbx + 0x4d3e], 0
jne 0x1400176a2
movsx r9d, word [rbx + 0x5eb0]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003670
test dil, 2
je 0x1400177cf
jmp 0x14001772b
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140170bd0]
xor eax, eax
mulss xmm1, dword [0x140170bc8]
addss xmm0, dword [rbx + 0xf8]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xfc]
mov qword [rbx + 0x4a30], rax
mov dword [rbx + 0x4a1c], 1
movss dword [rbx + 0x4a28], xmm0
movss dword [rbx + 0x4a2c], xmm1
movss xmm0, dword [rbx + 0x3a20]
mulss xmm0, dword [0x140170b38]
or dword [rbx + 0x4a18], 0x41
movss dword [rbx + 0x4a78], xmm0
movsx r9d, word [rbx + 0x5eb0]
call fcn.140003670
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140017780
lea r11, [0x1400516c0]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140017763
cmp byte [r8], r9b
jne 0x140017763
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017750
not ecx
call fcn.14000b680
test rax, rax
je 0x1400177cf
cmp byte [rax + 0xca], 0
je 0x1400177cf
mov byte [rax + 0xcf], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xec], 1
mov edx, 0x10
inc word [rbx + 0x5eb0]
movsx r9d, word [rbx + 0x5eb0]
call fcn.140003670
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14000e7d0
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14001d110
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6008], 0
lea rbx, [rcx + 0x6010]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001d1b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001d16a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001fc10
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004190
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6008]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6018]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14017a3d8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001d1bf
mov rcx, rbx
call fcn.140004190
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x14017a3e0]
xor ebp, ebp
cmp byte [rbx + 0x5f60], bpl
jne 0x14001d60c
cmp dword [rbx + 0x5f88], ebp
je 0x14001d557
mov r8d, 0x35b8
lea rdx, str.C:UserskrymiDownloadsimgui_1.90.8imgui_1.90.8imgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001d605
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140003aa0
mov rdi, rax
test rax, rax
je 0x14001d605
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14001d591
mov rcx, rax
call fcn.14001d760
mov r8, qword [0x14017a3e0]
test r8, r8
je 0x14001d5fc
movsx rdx, word [r8 + 0x60e8]
lea rcx, [r8 + 0x60ec]
mov r9d, dword [r8 + 0x3f68]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14001d5f1
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60e8], cx
movsx rax, cx
lea rcx, [r8 + 0x60ec]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x60e4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f60], 1
movss xmm0, dword [rbx + 0x5f64]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001d6a9
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f64], xmm0
jb 0x14001d6a9
mov rdi, qword [rbx + 0x20]
mov qword [rsp + 0x38], rsi
test rdi, rdi
je 0x14001d697
mov rax, qword [0x14017a3e0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f64], ebp
call fcn.14001d9e0
lea rdx, [0x140050e9c]
mov rcx, rdi
mov rsi, rax
call fcn.140003910
mov rdi, rax
test rax, rax
je 0x14001d69e
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001d69e
mov byte [rbx + 0xce], 1
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0x5f64], ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d6c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14017a3e0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001d723
mov qword [rsp], rbx
lea rbx, [0x1400516c0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001d703
cmp byte [r8], r9b
jne 0x14001d703
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001d6f0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f78]
not eax
mov r8, qword [r10 + 0x5f80]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001d74f
cmp dword [r8 + 8], eax
je 0x14001d756
add r8, 0x48
cmp r8, rcx
jne 0x14001d740
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x14003c7b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
mov eax, 0x13c8
call fcn.140049920
sub rsp, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14003c7e0
mov rax, qword [0x14017ac20]
xor ebp, ebp
mov rsi, qword [0x14017ac18]
sub rax, rsi
mov dword [rsp + 0x20], 0x270
sar rax, 3
test rax, rax
je 0x14003ca41
movss xmm4, dword [0x1401710e0]
xorps xmm5, xmm5
mov qword [rsp + 0x13e0], rbx
mov ebx, ebp
mov qword [rsp + 0x13e8], rdi
mov qword [rsp + 0x13f0], r14
mov r14d, ebp
mov qword [rsp + 0x13c0], r15
mov r15, qword [0x14017a3e0]
movaps xmmword [rsp + 0x13b0], xmm6
movsd xmm6, qword [0x140170b88]
nop
mov rdi, qword [0x14017ac30]
xorps xmm2, xmm2
mov rax, qword [0x14017ac68]
movss xmm0, dword [rbx + rsi]
cvtps2pd xmm0, xmm0
mov ecx, dword [r14 + rax]
movss xmm1, dword [rbx + rdi]
cvtps2pd xmm1, xmm1
cvtsi2ss xmm2, ecx
mulsd xmm1, xmm6
addsd xmm1, xmm0
movss xmm0, dword [rbx + rsi + 4]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm3, xmm1
movss dword [rbx + rsi], xmm3
movss xmm1, dword [rbx + rdi + 4]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm6
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movaps xmm1, xmm3
subss xmm1, xmm2
movss dword [rbx + rsi + 4], xmm0
comiss xmm5, xmm1
ja 0x14003c8f6
mov rax, qword [r15 + 0x4010]
movaps xmm0, xmm2
addss xmm0, xmm3
comiss xmm0, dword [rax + 0x30]
ja 0x14003c8f6
movss xmm1, dword [rbx + rdi + 4]
jmp 0x14003c962
movss xmm0, dword [rbx + rdi]
xorps xmm0, xmm4
movss dword [rbx + rdi], xmm0
lea rcx, [rsp + 0x20]
call fcn.140048a80
mov r8d, eax
mov eax, 0x6b1490ab
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 8
cmp ecx, 0xb58a48
jae 0x14003c903
mov eax, 0x6b1490ab
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 8
imul eax, eax, 0x169
sub r8d, eax
and r8d, 1
lea eax, [r8*2 - 1]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [rbx + rdi + 4], xmm1
movss xmm3, dword [rbx + rsi + 4]
movaps xmm0, xmm3
subss xmm0, xmm2
comiss xmm5, xmm0
ja 0x14003c985
mov rax, qword [r15 + 0x4010]
addss xmm2, xmm3
comiss xmm2, dword [rax + 0x34]
jbe 0x14003c9ee
xorps xmm1, xmm4
movss dword [rbx + rdi + 4], xmm1
nop
lea rcx, [rsp + 0x20]
call fcn.140048a80
mov r8d, eax
mov eax, 0x6b1490ab
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 8
cmp ecx, 0xb58a48
jae 0x14003c990
mov eax, 0x6b1490ab
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 8
imul eax, eax, 0x169
sub r8d, eax
and r8d, 1
lea eax, [r8*2 - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + rdi], xmm0
mov rcx, qword [0x14017ac20]
inc ebp
mov rsi, qword [0x14017ac18]
add rbx, 8
sub rcx, rsi
movsxd rax, ebp
sar rcx, 3
add r14, 4
cmp rax, rcx
jb 0x14003c870
movaps xmm6, xmmword [rsp + 0x13b0]
mov r15, qword [rsp + 0x13c0]
mov r14, qword [rsp + 0x13f0]
mov rdi, qword [rsp + 0x13e8]
mov rbx, qword [rsp + 0x13e0]
add rsp, 0x13c8
pop rsi
pop rbp
ret
Function at 0x14003cdb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x13b0
call fcn.140049920
sub rsp, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14003cde0
xor ebx, ebx
mov dword [rsp + 0x20], 0x270
lea edi, [rbx - 1]
nop dword [rax]
lea rcx, [rsp + 0x20]
call fcn.140048a80
mov ecx, eax
mov eax, 0xf2805af1
mul ecx
shr edx, 0xa
cmp edx, 0x3ca016
jae 0x14003ce10
mov eax, 0xf2805af1
mul ecx
shr edx, 0xa
imul eax, edx, 0x439
sub ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.140048a80
mov ecx, eax
mov eax, 0x422a20d3
mul ecx
shr edx, 9
cmp edx, 0x211510
jae 0x14003ce50
mov eax, 0x422a20d3
movss dword [rsp + 0x13cc], xmm1
mul ecx
shr edx, 9
imul eax, edx, 0x7bd
mov rdx, qword [0x14017ac20]
sub ecx, eax
cmp rdx, qword [0x14017ac28]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x13c8], xmm0
je 0x14003cec0
movsd xmm0, qword [rsp + 0x13c8]
movsd qword [rdx], xmm0
add qword [0x14017ac20], 8
jmp 0x14003ced4
lea r8, [rsp + 0x13c8]
lea rcx, [0x14017ac18]
call fcn.140048500
lea rcx, [rsp + 0x20]
call fcn.140048a80
mov ecx, eax
and eax, 1
and ecx, 0xfffffffe
lea rcx, [rsp + 0x20]
lea eax, [rax*2 - 1]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.140048a80
mov rdx, qword [0x14017ac38]
mov ecx, eax
and ecx, 0xfffffffe
bt eax, 0
mov eax, 1
movss dword [rsp + 0x13d4], xmm1
cmovae eax, edi
cmp rdx, qword [0x14017ac40]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x13d0], xmm0
je 0x14003cf4f
movsd xmm0, qword [rsp + 0x13d0]
movsd qword [rdx], xmm0
add qword [0x14017ac38], 8
jmp 0x14003cf63
lea r8, [rsp + 0x13d0]
lea rcx, [0x14017ac30]
call fcn.140048500
mov rdx, qword [0x14017ac70]
cmp rdx, qword [0x14017ac78]
mov dword [rsp + 0x13c0], 3
je 0x14003cf8e
mov dword [rdx], 3
add qword [0x14017ac70], 4
jmp 0x14003cf9b
lea r8, [rsp + 0x13c0]
call fcn.140048350
inc ebx
cmp ebx, 0x3e8
jl 0x14003ce10
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x13b0
pop rdi
ret
Function at 0x14003d0a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x260
mov rbx, rcx
xor ebp, ebp
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140046750
nop
lea rcx, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
cmovae rcx, r8
mov rax, qword [rsp + 0x38]
lea r14, [rcx + rax*2]
lea rdi, [rsp + 0x28]
cmovae rdi, r8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
cmp rdi, r14
jne 0x14003d12a
mov byte [rbx], bpl
jmp 0x14003d207
mov rax, r14
sub rax, rdi
sar rax, 1
movabs rsi, 0x7fffffffffffffff
cmp rax, rsi
ja 0x14003d266
cmp rax, 0x10
jb 0x14003d1c4
or rax, 0xf
cmp rax, rsi
jbe 0x14003d17e
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140048f68
test rax, rax
je 0x14003d1a9
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x14003d1bd
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14003d1b0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003d26c
jmp 0x14003d163
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003d1bd
call fcn.140048f68
mov rbp, rax
mov qword [rbx], rbp
mov qword [rbx + 0x18], rsi
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003d1d1
mov rdx, qword [rbx]
movzx ecx, byte [rdi]
mov rax, qword [rbx + 0x10]
mov byte [rdx + rax], cl
inc qword [rbx + 0x10]
mov rax, qword [rbx + 0x10]
add rdi, 2
cmp rdi, r14
jne 0x14003d1c4
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003d1f9
mov rcx, qword [rbx]
mov byte [rax + rcx], 0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
cmp rdx, 8
jb 0x14003d245
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x14003d23d
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d23d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.140048c18
mov rax, rbx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.14003bb20
nop
call fcn.14003ba80
int3
Function at 0x14003d4e0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x48
cmp qword [rcx + 0x18], 0x10
mov rdx, rcx
jb 0x14003d4fa
mov r8, qword [rcx]
add r8, qword [rcx + 0x10]
mov rdx, qword [rcx]
jmp 0x14003d501
mov r8, qword [rcx + 0x10]
add r8, rcx
lea rcx, [rsp + 0x20]
call fcn.1400473b0
cmp qword [rax + 0x18], 8
jb 0x14003d515
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003d563
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d55e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d55e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048c18
add rsp, 0x48
ret
Function at 0x14003df60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003e041
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003e038
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003dfc0
cmp qword [rbx + 0x18], 8
mov r8, rbx
mov rdx, qword [rbx + 0x10]
jb 0x14003dfdb
mov r8, qword [rbx]
cmp rdx, rax
jne 0x14003e022
lea rax, [rsp + 0x4c]
test rdx, rdx
je 0x14003e006
lea rcx, [rsp + 0x4c]
sub r8, rcx
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x14003e022
add rax, 2
sub rdx, 1
jne 0x14003dff2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003dfb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x270]
xor al, al
add rsp, 0x260
pop rdi
ret
Function at 0x14003ede0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13b0
call fcn.140049920
sub rsp, rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r9d, 1
mov dword [rsp + 0x24], eax
mov r10d, 0x270
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, r10
jb 0x14003ee22
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], r10d
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x14003eef2
lea r8, [rsp + 0x28]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14003ee80
mov r10d, dword [rsp + 0x20]
mov ecx, dword [rsp + r10*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor edx, ecx
jmp 0x14003ef29
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x14003ef10
lea rcx, [rsp + 0x20]
call fcn.140048a80
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x14003ef29
cmp r9d, ebx
jne 0x14003eef5
add edx, esi
lea r11, [rsp + 0x13b0]
mov rbx, qword [r11 + 0x10]
cmp edx, ebp
mov rsi, qword [r11 + 0x20]
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
cmovae eax, ecx
mov rsp, r11
pop rdi
ret
Function at 0x140046470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140046494
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400464cb
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x1400464cb
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400465fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004650e
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140046539
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140046601
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400465ae
sub eax, 1
je 0x1400465ae
cmp eax, 2
jne 0x1400465fc
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140046601
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400465df
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400465fc
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140046601
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140046ac0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140046b89
cmp byte [rcx + 0x71], 0
je 0x140046b89
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140046b7c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140046b38
sub eax, 1
je 0x140046b3c
cmp eax, 2
jne 0x140046b7c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140046b6a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140046b7c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret