joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010ce10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14018c040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x14015c510]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x2e9
call fcn.140041f00
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140045840
cmp byte [rdi + 0x17], 0
jns 0x14010ce92
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14010cf1e
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.14002b3cc
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
setne bl
cmp rax, 2
jb 0x14010cf1e
call fcn.140041f20
mov rcx, qword [rsp + 0x40]
call fcn.140039890
lea rcx, [rsp + 0x60]
call fcn.1400458c0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008ffc0
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14010dcd0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x860
mov rsi, rcx
mov rax, qword [0x14018c040]
xor rax, rsp
mov qword [rsp + 0x858], rax
mov rdx, qword [0x14019dff0]
test rdx, rdx
setne al
and al, byte [0x14018e4c8]
cmp al, 1
jne 0x14010debd
cmp byte [rdx + 0x17], 0
jns 0x14010dd1a
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x14010dee8
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140041f20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x14015c510]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0x80]
mov rdx, rbx
call fcn.14002c016
lea r15, [rsp + 0x48]
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.14003c600
mov eax, dword [rsi + 8]
test eax, eax
je 0x14010de00
cmp eax, 1
je 0x14010de06
mov bp, 1
add eax, 0xfffffffe
cmp eax, 2
jae 0x14010de0a
lea r12, [rsp + 0x80]
mov r8d, 0x7d8
mov rcx, r12
mov dl, 0xaa
call fcn.1400c5530
mov rcx, r12
call fcn.1400759f0
mov rcx, r12
mov rdx, r15
call fcn.1401272e0
movsx r8, byte [rsp + 0x5f]
test r8, r8
jns 0x14010dde0
mov r8, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.140109a86
cmp byte [rsp + 0x5f], 0
jns 0x14010de0a
mov rcx, qword [rsp + 0x48]
call fcn.14008eadc
jmp 0x14010de0a
mov bp, 4
jmp 0x14010de0a
mov bp, 2
cmp byte [rsp + 0x77], 0
jns 0x14010de16
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x48], 0
mov rcx, qword [0x14019e000]
cmp byte [rcx + 0x17], 0
jns 0x14010de37
mov rcx, qword [rcx]
lea rdx, [rsp + 0x48]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x14010df1b
mov rax, qword [rsp + 0x48]
mov r9d, dword [0x14019dffc]
movzx r8d, word [0x14019dff8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x14010df00
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14010de9e
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rsp + 0x77], 0
jns 0x14010deaf
mov rcx, qword [rsp + 0x60]
call fcn.14008eadc
call fcn.140041f20
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140064b70
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.14008ffc0
nop
add rsp, 0x860
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.14002af36
jmp 0x14010debd
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.14002af36
jmp 0x14010de8e
lea rcx, [rsi + 0x10]
lea rdx, str.___ERROR_GETTING_USER_SID__
mov r8d, 0x1b
call fcn.14002af36
jmp 0x14010de49
Function at 0x1401131c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1401131f0
cmp rbx, 2
jb 0x1401132d8
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x140171a60]
movdqa xmm7, xmmword [0x140171a70]
movdqa xmm8, xmmword [0x140171a80]
movdqa xmm9, xmmword [0x140171a90]
mov rcx, rsi
call fcn.140123200
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x14011324e
mov rcx, rsi
call fcn.1401236e0
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x1401132ac
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x140113244
mov rcx, rsi
call fcn.140123200
xor eax, eax
movdqa xmm0, xmmword [0x140171a60]
movdqa xmm1, xmmword [0x140171a70]
movdqa xmm2, xmmword [0x140171a80]
movdqa xmm3, xmmword [0x140171a90]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x140113302
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14011335d
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14011f160
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x14018c040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x14011f1bf
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14011f1db
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x14011f205
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14011f226
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x14011f248
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x14011f26e
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x14011f26c
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
and r15d, 1
add r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400c5530
mov r8, r12
xor r8, r15
dec r8
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.14011c2e0
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x14011f2aa
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x14015c510]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
movsxd rcx, dword [rdi + 0x148]
test rcx, rcx
jle 0x14011f378
xor eax, eax
xor edx, edx
or rdx, qword [rsi + rax*8]
inc rax
cmp rcx, rax
jne 0x14011f318
test rdx, rdx
sete dl
test ecx, ecx
je 0x14011f3c8
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x14011f350
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x14011f350
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
test rax, rax
jle 0x14011f397
xor ecx, ecx
jmp 0x14011f38c
mov dl, 1
jmp 0x14011f32a
xor r8d, r8d
mov qword [rsp + rcx*8 + 0x30], r8
inc rcx
cmp rax, rcx
je 0x14011f397
test dl, dl
jne 0x14011f37c
mov r8, qword [rsp + rcx*8 + 0x30]
jmp 0x14011f37f
test eax, eax
je 0x14011f3c8
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x14011f3aa
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14008ffc0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1401203a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14018c040]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x14015c510]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test r9, r9
je 0x140120408
xor edi, edi
cmp r9, 0x30
ja 0x14012042a
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r9, rax
jne 0x1401203f8
mov r8d, 0x30
mov rcx, rsi
call fcn.14006ffc0
test eax, eax
je 0x140120440
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008ffc0
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x14012042a

Function at 0x140122ec0
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.140046220
mov ebp, eax
bt eax, 0x1d
jb 0x140122f03
not ebp
test ebp, 0x128
jne 0x140122f29
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140010e30
mov ecx, 1
call fcn.140046220
bt eax, 9
jae 0x140122ee3
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000eec0
mov ecx, 1
call fcn.140046220
mov ebp, eax
bt eax, 0x1c
jae 0x140122f48
xor ecx, ecx
call fcn.140046220
bt eax, 0x1e
jb 0x140122f72
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140122f64
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000de80
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000f190
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140010030
Function at 0x140125b40
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140125b50
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x140125b71
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x140125b95
cmp byte [r14 + 0x50], 1
jne 0x140125b8f
or edi, 0x80000000
jmp 0x140125b95
or edi, 0x20000000
test dil, 8
je 0x140125bb0
cmp byte [r14 + 0x68], 1
je 0x140125baa
or edi, 0x10000000
jmp 0x140125bb0
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x140125bc4
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x140125bd5
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x140125be8
lea rcx, [r14 + 0x20]
call fcn.14005f3b0
mov r15, rax
cmp byte [r14 + 0x18], 1
je 0x140125c0d
xor r9d, r9d
jmp 0x140125c18
xor edx, edx
jmp 0x140125c34
mov edx, 4
jmp 0x140125c34
mov edx, 1
jmp 0x140125c34
mov edx, 6
jmp 0x140125c34
mov rcx, r14
call fcn.14005f3b0
mov r9, rax
cmp ebx, 4
ja case.default.0x140125c2d
mov eax, ebx
lea rcx, [0x140173dec]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x140125c5d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401344bf
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1401344fe
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1401344ce
mov dword [rsi], 7
jmp 0x1401344ce
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14007ae93
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1401344da
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1401344da
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x1401345b0
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1401344d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401344ce
Function at 0x140141350
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x140141363
cmp dword [0x1401a5cd8], ecx
jle 0x14014136a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call 0x1401413b0
test edi, edi
je 0x140141363
cmp byte [rsi + rdi - 1], 0xa
je 0x140141363
lea rcx, [0x14015f6fb]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1401413b0
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14018c040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140141427
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x140141427
add rdi, rax
test ecx, ecx
jne 0x1401413ed
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ffc0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401413b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x140141363
cmp dword [0x1401a5cd8], ecx
jle 0x14014136a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call 0x1401413b0
test edi, edi
je 0x140141363
cmp byte [rsi + rdi - 1], 0xa
je 0x140141363
lea rcx, [0x14015f6fb]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1401413b0
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14018c040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140141427
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x140141427
add rdi, rax
test ecx, ecx
jne 0x1401413ed
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008ffc0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140001a30
Capabilities:
Execute command
Set console window title

Disassembly:
sub rsp, 0x28
lea rcx, str.Bloxpredictor_Beta___v1.0.0
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.140007a10
call fcn.1400011d0
lea rcx, [0x14000b804]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140002690
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13d0
call fcn.1400099d0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13b4], 0xffffffff
mov ecx, 1
mov edx, eax
mov dword [rsp + 0x34], eax
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x34], edx
inc rcx
cmp rcx, 0x270
jb 0x1400023e0
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x270
call fcn.140006aa0
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x5f
ja 0x140002435
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.140006aa0
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x60
jb 0x140002420
shr rax, 0x20
add eax, 0x80000001
btc eax, 0x1f
cmp eax, 0x2d
ja 0x140002450
lea rdx, [0x14000b81c]
jmp 0x140002463
lea rdx, [0x14000b824]
cmp eax, 0x37
jle 0x140002463
lea rdx, [0x14000b82c]
mov rcx, rbx
call fcn.140004ce0
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1400086d0
add rsp, 0x13d0
pop rbx
ret
Function at 0x140002490
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1410
call fcn.1400099d0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1400], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
mov word [rsp + 0x20], 0x514a
mov byte [rsp + 0x22], 0x4b
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13f4], 0xffffffff
mov dword [rsp + 0x74], eax
mov ecx, 1
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x74], edx
inc rcx
cmp rcx, 0x270
jb 0x1400024f0
mov dword [rsp + 0x70], 0x270
lea rcx, [rsp + 0x70]
call fcn.140006aa0
mov ecx, eax
lea rax, [rcx + rcx*2]
test eax, eax
jne 0x140002545
nop dword [rax + rax]
lea rcx, [rsp + 0x70]
call fcn.140006aa0
mov ecx, eax
lea rax, [rcx + rcx*2]
cmp eax, 1
jb 0x140002530
shr rax, 0x20
mov esi, 0x80000000
sub rax, rsi
xor rax, 0xffffffff80000000
movzx edi, byte [rsp + rax + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140006aa0
mov ecx, eax
lea rdx, [rcx + rcx*4]
add rdx, rdx
cmp edx, 5
ja 0x14000258c
lea rcx, [rsp + 0x70]
call fcn.140006aa0
mov ecx, eax
lea rdx, [rcx + rcx*4]
add rdx, rdx
cmp edx, 6
jb 0x140002574
shr rdx, 0x20
add edx, 0x80000001
xor edx, esi
lea rcx, [rsp + 0x50]
call fcn.140005410
nop
movzx r8d, dil
mov edx, 1
lea rcx, [rsp + 0x28]
call fcn.140004f50
nop
lea r9, [rsp + 0x50]
mov r8, rax
mov rcx, rbx
call fcn.140006240
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140002608
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002603
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000872c
movdqa xmm0, xmmword [0x14000be30]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000265b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002656
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002656
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000872c
mov rax, rbx
mov rcx, qword [rsp + 0x1400]
xor rcx, rsp
call fcn.1400086d0
lea r11, [rsp + 0x1410]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006aa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140006b01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140006ac0
mov ecx, dword [r9]
jmp 0x140006beb
cmp ecx, 0x4e0
jb 0x140006beb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140006b20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140006b70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140009120
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000916a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000916a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000916a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000916a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000916a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000916c
xor al, al
add rsp, 0x28
ret