joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003cdb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x13b0
call fcn.140049770
sub rsp, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14003cde0
xor ebx, ebx
mov dword [rsp + 0x20], 0x270
lea edi, [rbx - 1]
nop dword [rax]
lea rcx, [rsp + 0x20]
call fcn.1400488d0
mov ecx, eax
mov eax, 0xf2805af1
mul ecx
shr edx, 0xa
cmp edx, 0x3ca016
jae 0x14003ce10
mov eax, 0xf2805af1
mul ecx
shr edx, 0xa
imul eax, edx, 0x439
sub ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.1400488d0
mov ecx, eax
mov eax, 0x422a20d3
mul ecx
shr edx, 9
cmp edx, 0x211510
jae 0x14003ce50
mov eax, 0x422a20d3
movss dword [rsp + 0x13cc], xmm1
mul ecx
shr edx, 9
imul eax, edx, 0x7bd
mov rdx, qword [0x140179c20]
sub ecx, eax
cmp rdx, qword [0x140179c28]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x13c8], xmm0
je 0x14003cec0
movsd xmm0, qword [rsp + 0x13c8]
movsd qword [rdx], xmm0
add qword [0x140179c20], 8
jmp 0x14003ced4
lea r8, [rsp + 0x13c8]
lea rcx, [0x140179c18]
call fcn.140048350
lea rcx, [rsp + 0x20]
call fcn.1400488d0
mov ecx, eax
and eax, 1
and ecx, 0xfffffffe
lea rcx, [rsp + 0x20]
lea eax, [rax*2 - 1]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.1400488d0
mov rdx, qword [0x140179c38]
mov ecx, eax
and ecx, 0xfffffffe
bt eax, 0
mov eax, 1
movss dword [rsp + 0x13d4], xmm1
cmovae eax, edi
cmp rdx, qword [0x140179c40]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x13d0], xmm0
je 0x14003cf4f
movsd xmm0, qword [rsp + 0x13d0]
movsd qword [rdx], xmm0
add qword [0x140179c38], 8
jmp 0x14003cf63
lea r8, [rsp + 0x13d0]
lea rcx, [0x140179c30]
call fcn.140048350
mov rdx, qword [0x140179c70]
cmp rdx, qword [0x140179c78]
mov dword [rsp + 0x13c0], 3
je 0x14003cf8e
mov dword [rdx], 3
add qword [0x140179c70], 4
jmp 0x14003cf9b
lea r8, [rsp + 0x13c0]
call fcn.1400481a0
inc ebx
cmp ebx, 0x3e8
jl 0x14003ce10
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x13b0
pop rdi
ret
Function at 0x14003d0a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x260
mov rbx, rcx
xor ebp, ebp
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140046560
nop
lea rcx, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
cmovae rcx, r8
mov rax, qword [rsp + 0x38]
lea r14, [rcx + rax*2]
lea rdi, [rsp + 0x28]
cmovae rdi, r8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
cmp rdi, r14
jne 0x14003d12a
mov byte [rbx], bpl
jmp 0x14003d207
mov rax, r14
sub rax, rdi
sar rax, 1
movabs rsi, 0x7fffffffffffffff
cmp rax, rsi
ja 0x14003d266
cmp rax, 0x10
jb 0x14003d1c4
or rax, 0xf
cmp rax, rsi
jbe 0x14003d17e
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140048db8
test rax, rax
je 0x14003d1a9
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x14003d1bd
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14003d1b0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003d26c
jmp 0x14003d163
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003d1bd
call fcn.140048db8
mov rbp, rax
mov qword [rbx], rbp
mov qword [rbx + 0x18], rsi
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003d1d1
mov rdx, qword [rbx]
movzx ecx, byte [rdi]
mov rax, qword [rbx + 0x10]
mov byte [rdx + rax], cl
inc qword [rbx + 0x10]
mov rax, qword [rbx + 0x10]
add rdi, 2
cmp rdi, r14
jne 0x14003d1c4
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003d1f9
mov rcx, qword [rbx]
mov byte [rax + rcx], 0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
cmp rdx, 8
jb 0x14003d245
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x14003d23d
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d23d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.140048a68
mov rax, rbx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.14003bb20
nop
call fcn.14003ba80
int3
Function at 0x14003d4e0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x48
cmp qword [rcx + 0x18], 0x10
mov rdx, rcx
jb 0x14003d4fa
mov r8, qword [rcx]
add r8, qword [rcx + 0x10]
mov rdx, qword [rcx]
jmp 0x14003d501
mov r8, qword [rcx + 0x10]
add r8, rcx
lea rcx, [rsp + 0x20]
call fcn.1400471c0
cmp qword [rax + 0x18], 8
jb 0x14003d515
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003d563
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d55e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d55e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048a68
add rsp, 0x48
ret
Function at 0x14003df70
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003e051
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003e048
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003dfd0
cmp qword [rbx + 0x18], 8
mov r8, rbx
mov rdx, qword [rbx + 0x10]
jb 0x14003dfeb
mov r8, qword [rbx]
cmp rdx, rax
jne 0x14003e032
lea rax, [rsp + 0x4c]
test rdx, rdx
je 0x14003e016
lea rcx, [rsp + 0x4c]
sub r8, rcx
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x14003e032
add rax, 2
sub rdx, 1
jne 0x14003e002
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003dfc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x270]
xor al, al
add rsp, 0x260
pop rdi
ret
Function at 0x14003ee10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13b0
call fcn.140049770
sub rsp, rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r9d, 1
mov dword [rsp + 0x24], eax
mov r10d, 0x270
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, r10
jb 0x14003ee52
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], r10d
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x14003ef22
lea r8, [rsp + 0x28]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14003eeb0
mov r10d, dword [rsp + 0x20]
mov ecx, dword [rsp + r10*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor edx, ecx
jmp 0x14003ef59
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x14003ef40
lea rcx, [rsp + 0x20]
call fcn.1400488d0
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x14003ef59
cmp r9d, ebx
jne 0x14003ef25
add edx, esi
lea r11, [rsp + 0x13b0]
mov rbx, qword [r11 + 0x10]
cmp edx, ebp
mov rsi, qword [r11 + 0x20]
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
cmovae eax, ecx
mov rsp, r11
pop rdi
ret
Function at 0x140045c50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140045c78
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140045c9e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140045ca0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140045cf9
test ecx, ecx
jle 0x140045cd9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140045cf9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140045cf9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140045d20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140045d51
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140045d6f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140045d8b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140045d8d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140045dc9
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140045e5e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140045e04
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140045e3e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140045e5e
cmp rbx, rax
ja 0x140045e10
test rbx, rbx
je 0x140045e5e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140046280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400462a4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400462db
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x1400462db
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x14004640c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004631e
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140046349
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140046411
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400463be
sub eax, 1
je 0x1400463be
cmp eax, 2
jne 0x14004640c
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140046411
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400463ef
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004640c
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140046411
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400468d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140046999
cmp byte [rcx + 0x71], 0
je 0x140046999
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004698c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140046948
sub eax, 1
je 0x14004694c
cmp eax, 2
jne 0x14004698c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14004697a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004698c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x1400488d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140048931
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400488f0
mov ecx, dword [r10]
jmp 0x140048a1a
cmp ecx, 0x4e0
jb 0x140048a1a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140048950
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400489a0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1400491fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140049246
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140049246
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140049246
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140049246
cmp dword [rcx + 0x84], 0xe
jbe 0x140049246
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140049248
xor al, al
add rsp, 0x28
ret
Function at 0x140003408
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140003438
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400034b0
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14000344f
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003451
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400034aa
test ecx, ecx
jle 0x14000348a
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400034aa
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400034aa
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400034cc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400034fa
xor eax, eax
jmp 0x1400035e3
cmp qword [rcx + 0x68], 0
je 0x14000350c
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400035e3
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003523
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003525
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003557
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400035dd
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000358e
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400035b8
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400035dd
cmp rsi, rbx
ja 0x140003595
test rsi, rsi
je 0x1400035dd
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400039c8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140138040]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140003a01
xor eax, eax
jmp 0x140003b21
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140003a3b
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140003a3b
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x140003b21
cmp qword [rbx + 0x80], 0
je 0x140003b1f
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003a76
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003a97
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x140003b1c
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003ae5
sub eax, 1
je 0x140003ae5
cmp eax, 2
jne 0x140003b1f
movsx ecx, byte [rbp - 0x40]
jmp 0x140003a83
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140003b10
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x140003b1f
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ec220
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret