joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400465e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140046747
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x1400465f2
cmp edx, ecx
jne 0x140046735
nop word [rax + rax]
test rsi, rsi
jne 0x140046735
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x140046654
nop
call fcn.140068860
xorps xmm15, xmm15
mov r14, qword [0x1405e09a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.140046500
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x140046730
mov rdx, qword [0x14058bd38]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x140046725
mov rcx, qword [0x14058bd30]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x14058d110]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x14058d110], rax
nop
mov edx, 1
lea rsi, [0x14058d118]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x140046713
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x1402d69bd]
mov ebx, 0x28
nop
call fcn.140037ae0
mov rax, rsi
mov rcx, rdx
call fcn.140066fc0
call fcn.140036000
lea rax, [0x1402d4e03]
mov ebx, 0x23
call fcn.140037ae0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140064ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1400465e0
Function at 0x140053600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x140053777
movzx edx, byte [rax]
test edx, edx
jne 0x140053634
nop dword [rax]
test r8b, r8b
jne 0x140053634
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x140053647
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x140053737
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x140053725
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x140053717
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x14005369d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x1400536e0
mov eax, 1
cmp rax, rbx
ja 0x1400536cb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.140067080
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x14005370f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x1400536d3
mov rcx, r11
mov eax, r12d
jmp 0x1400536a2
mov rcx, rbx
call fcn.140066fc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.140066fc0
mov eax, r8d
mov rcx, rbx
call fcn.140067080
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x14005376d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x140053730
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x14005364d
mov eax, edx
mov rcx, rbx
call fcn.140066fc0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.140066fc0
nop
int3
Function at 0x14005af80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005b02f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x14005b080]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140064ba0
xorps xmm15, xmm15
mov r14, qword [0x1405e09a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140064ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.14005af80
Function at 0x140066b20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1405e0c60]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1405e06ee], 0
je 0x140066b56
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1405e0fa0]
aesenc xmm0, xmmword [0x1405e0fb0]
aesenc xmm0, xmmword [0x1405e0fc0]
movq rax, xmm0
ret
jmp 0x14000a660

Function at 0x1401faaf0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14057d380]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1401fab10
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1401fab18
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1401fab10
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1401fab65
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1401fab5c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1401fab10
add rax, 0x28
cmp rax, r9
jne 0x1401fab48
xor eax, eax
ret

Function at 0x1401fab70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14057d380]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401fab90
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1401fab98
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1401fab90
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1401fac20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14057d380]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401fac40
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1401fac48
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1406fb6d8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406fb85f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406fb709
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fb6ef
add dl, dl
jne 0x1406fb716
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fb776
xor eax, eax
add dl, dl
jne 0x1406fb725
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fb82d
add dl, dl
jne 0x1406fb736
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fb743
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fb750
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fb75d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406fb76a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406fb6fe
mov eax, 1
add dl, dl
jne 0x1406fb786
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fb793
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fb77b
sub eax, ebx
mov ebx, 1
jne 0x1406fb7cc
mov ecx, 1
add dl, dl
jne 0x1406fb7ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406fb7bb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fb7a3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fb6fe
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406fb7e8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406fb7f5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fb7dd
cmp eax, 0x7d00
jae 0x1406fb81b
cmp eax, 0x500
jb 0x1406fb816
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fb6fe
cmp eax, 0x7f
ja 0x1406fb81e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fb6fe
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406fb852
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406fb6fe
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140f46058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f461df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f46089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f4606f
add dl, dl
jne 0x140f46096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f460f6
xor eax, eax
add dl, dl
jne 0x140f460a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f461ad
add dl, dl
jne 0x140f460b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f460c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f460d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f460dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f460ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f4607e
mov eax, 1
add dl, dl
jne 0x140f46106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f46113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f460fb
sub eax, ebx
mov ebx, 1
jne 0x140f4614c
mov ecx, 1
add dl, dl
jne 0x140f4612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f4613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f46123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f46168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f46175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f4615d
cmp eax, 0x7d00
jae 0x140f4619b
cmp eax, 0x500
jb 0x140f46196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4607e
cmp eax, 0x7f
ja 0x140f4619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f461d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f4607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400022a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r14d, Ordinal_41
mov eax, dword [r14 + rsi]
mov r12d, Ordinal_50
test al, 1
jne 0x140002348
or eax, 1
mov dword [r14 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
mov ecx, 1
lea r8, [rbx + 8]
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140002320
mov dword [rbx], 0x270
mov ecx, dword [r14 + rsi]
mov ebx, Ordinal_26
mov eax, ebx
test cl, 2
jne 0x14000236c
or ecx, 2
mov dword [r14 + rsi], ecx
mov qword [rsi + rbx], r15
mov qword [rsi + rbx + 8], reloc.WLDAP32.dll_Ordinal_35
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rbp, 0x10
jb 0x1400023a2
mov rdx, rbp
mov rcx, rdi
call fcn.14001bd60
mov qword [rdi + 0x10], r15
mov eax, ebx
jmp 0x1400023ab
test rbp, rbp
je 0x140002453
lea r15, [rsi + rax]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
nop dword [rax]
dec rbp
mov qword [rsp + 0x28], rbx
mov r14, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, r14
cmp rdx, 0xffffffffffffffff
jne 0x1400023f5
mov rcx, rbx
call fcn.14001cb70
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.14001cb70
mov eax, eax
or rsi, rax
jmp 0x140002405
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14001c980
mov rsi, rax
lea rax, [rsi + r14]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000243a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x14000242f
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000244a
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call fcn.14001c0a0
test rbp, rbp
jne 0x1400023c0
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001a150
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14001a178
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001a19e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001a1a0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001a1f9
test ecx, ecx
jle 0x14001a1d9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001a1f9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001a1f9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14001a220
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001a242
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14001a258
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001a274
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001a276
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001a2b2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001a34e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001a2ed
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14001a32e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14001a34e
cmp rbx, rax
ja 0x14001a300
test rbx, rbx
je 0x14001a34e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14001a7b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a00c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001a7dd
xor eax, eax
jmp 0x14001a949
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14001a817
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14001a817
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14001a949
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001a93c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001a85a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001a885
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001a941
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001a8f4
sub eax, 1
je 0x14001a8f4
cmp eax, 2
jne 0x14001a93c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001a941
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001a922
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001a93c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14001a941
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400801f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001b220
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400a00c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001b2f3
cmp byte [rcx + 0x71], 0
je 0x14001b2f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14001b2ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001b2b4
sub eax, 1
je 0x14001b2b8
cmp eax, 2
jne 0x14001b2ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400801f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001b2e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001b2ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001b29c
xor al, al
jmp 0x14001b29c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400801f0
add rsp, 0x60
pop rbx
ret
Function at 0x14001cb70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14001cbd1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14001cb90
mov ecx, dword [r9]
jmp 0x14001ccbb
cmp ecx, 0x4e0
jb 0x14001ccbb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14001cbf0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14001cc40
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret