joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push r13
push r12
push rdi
sub rsp, 0x238
mov r12, rcx
call sym._errno
mov dword [rax], 0
test r12, r12
je 0x140019280
cmp word [r12], 0
je 0x140019270
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140019290
test al, 0x10
je 0x140019270
lea r13, [rsp + 0x20]
mov rdx, r12
mov r8d, 0x104
mov rcx, r13
call sym._wfullpath
mov rcx, r13
call sym.wcslen
lea rcx, [0x1400dc160]
mov r12, rax
call sym.wcslen
lea rcx, [0x1400dc164]
add r12, rax
call sym.wcslen
lea rcx, [r12 + rax + 0x229]
add rcx, rcx
call sym.malloc
mov r12, rax
test rax, rax
je 0x1400192a3
lea r14, [rax + 0x44c]
mov rdx, r13
mov rcx, r14
call sym.wcscpy
cmp word [r12 + 0x44c], 0
jne 0x140019230
lea rdx, [0x1400dc164]
mov rcx, r14
call sym.wcscat
lea rdx, [r12 + 0x238]
mov ecx, 0x41
xor eax, eax
mov qword [r12 + 0x440], 0xffffffffffffffff
mov rdi, rdx
mov dword [r12 + 0x448], 0
mov qword [r12 + 0x230], 0
rep stosq qword [rdi], rax
mov rax, r12
add rsp, 0x238
pop rdi
pop r12
pop r13
pop r14
ret
mov rcx, r14
call sym.wcslen
cmp word [r12 + rax*2 + 0x44a], 0x2f
je 0x1400191d1
mov rcx, r14
call sym.wcslen
cmp word [r12 + rax*2 + 0x44a], 0x5c
je 0x1400191d1
lea rdx, [0x1400dc160]
mov rcx, r14
call sym.wcscat
jmp 0x1400191d1
call sym._errno
xor r12d, r12d
mov dword [rax], 0x14
jmp 0x140019219
call sym._errno
mov dword [rax], 0xe
jmp 0x140019219
call sym._errno
xor r12d, r12d
mov dword [rax], 2
jmp 0x140019219
call sym._errno
mov dword [rax], 0xc
jmp 0x140019219
Function at 0x140019860
Capabilities:
Enumerate disk volumes
Get disk information
Get disk size
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov r14d, ecx
mov rbx, rdx
cmp ecx, 0xffffffff
je 0x140019918
test rdx, rdx
js 0x140019918
call sym._get_osfhandle
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140019ac0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x140019ac0
mov ecx, r14d
call sym._telli64
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x140019918
lea rdx, [rsp + 0x68]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140019ac0
cmp rbx, qword [rsp + 0x68]
ja 0x140019970
xor r9d, r9d
mov qword [rsp + 0x70], rbx
lea r8, [rsp + 0x74]
mov edx, ebx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140019930
cmp dword [rsp + 0x70], 0xffffffff
je 0x140019930
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x83
je 0x140019a88
mov ecx, 0x16
call dbg._set_errno
mov eax, 0xffffffff
jmp 0x140019955
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140019918
mov rdx, qword [rsp + 0x48]
xor r8d, r8d
mov ecx, r14d
call sym._lseeki64
cmp rax, 0xffffffffffffffff
je 0x140019918
xor eax, eax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140019918
mov edx, 2
mov ecx, 0x33
call sym.calloc
mov edx, 2
mov ecx, 0x106
mov r12, rax
call sym.calloc
mov r15, rax
test r12, r12
je 0x140019ac0
test rax, rax
je 0x140019ac0
mov edx, 0x32
mov rcx, r12
lea rbp, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rdi, qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rsi, rax
jmp 0x1400199fa
mov r8d, 0x32
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
je 0x140019aa0
mov dword [rsp + 0x38], 0
mov r9, rbp
mov rdx, r15
mov r8d, 0x105
mov qword [rsp + 0x30], 0
mov rcx, r12
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x8c], eax
jne 0x1400199e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, r15
call sym.free
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rcx, r12
mov esi, eax
call sym.free
test esi, esi
je 0x140019a88
mov rax, rbx
sub rax, qword [rsp + 0x68]
cmp rax, qword [rsp + 0x60]
jbe 0x1400198e3
nop dword [rax]
mov ecx, 0x1b
call dbg._set_errno
mov eax, 0xffffffff
jmp 0x140019955
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, r12
xor r12d, r12d
call sym.free
jmp 0x140019a44
mov ecx, 9
call dbg._set_errno
mov eax, 0xffffffff
jmp 0x140019955
Function at 0x140024580
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rbx
test rax, rax
je 0x1400245c8
mov rcx, r12
mov qword [dbg.init_rand_s], rax
add rsp, 0x28
pop rbx
pop r12
jmp rax
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rbx
mov qword [0x140109000], rax
lea rax, [dbg.mingw_rand_s]
jmp 0x1400245af

Function at 0x1400253c0
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x140025400
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x140025428
call method.std::_V2.generic_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rdx, rbx
mov rcx, r12
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
jne 0x14002540d
xor eax, eax
jmp 0x1400253ef

Function at 0x1400268c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x1400268ec
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140027560
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x1400d6ed0], 0
jne 0x14002766a
mov byte [0x1400d6ed0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x140027640
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x140027631
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x1400d7521]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14002762c
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x1400275fb
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x1400276ff
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x140027665
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x140027665

Function at 0x140083430
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x140083470
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x140083498
call method.std::_V2.generic_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rdx, rbx
mov rcx, r12
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
jne 0x14008347d
xor eax, eax
jmp 0x14008345f
Function at 0x140086a30
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call method.std::filesystem.symlink_status_std::filesystem::__cxx11::path_const__std::error_code_
test al, al
je 0x140086a97
cmp al, 0xff
je 0x140086a88
mov rdx, rbx
mov rcx, rsi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
je 0x140086aa0
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140086aad
mov eax, dword [rbx]
test eax, eax
jne 0x140086a97
call method.std::_V2.system_category__
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
xor eax, eax
jmp 0x140086a99
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140086a58
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140086ba0
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
mov rbx, r8
mov rcx, rsi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov rdi, rax
cmp al, 0xff
je 0x140086c40
mov ecx, dword [rbx]
test ecx, ecx
jne 0x140086c18
test al, al
jne 0x140086c58
mov rdx, qword [rsi]
mov rcx, qword [rbp]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140086c28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x140086c90
call rdi
mov dword [rax], 5
call method.std::_V2.generic_category__
mov rsi, rax
call rdi
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x140086bd1
mov rdx, rbx
mov rcx, rbp
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov edx, dword [rbx]
test edx, edx
jne 0x140086c18
cmp dil, 2
je 0x140086ca0
cmp al, 2
jne 0x140086bd1
call method.std::_V2.generic_category__
mov dword [rbx], 0x14
mov qword [rbx + 8], rax
jmp 0x140086c18
call rdi
mov dword [rax], 0xd
jmp 0x140086c06
cmp al, 2
je 0x140086bd1
call method.std::_V2.generic_category__
mov dword [rbx], 0x15
mov qword [rbx + 8], rax
jmp 0x140086c18
Function at 0x14008e510
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13, qword [rsp + 0xa0]
mov qword [rsp + 0x28], 0
mov r12, rdx
mov rbp, r8
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rdi, r9
lea r9, [rsp + 0x38]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov esi, eax
call method.std::_V2.system_category__
mov rbx, rax
test esi, esi
je 0x14008e5b8
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14008e579
mov qword [r12], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14008e587
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x14008e5b0
mov dword [r13], 0
mov qword [r13 + 8], rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rdi], rax
jmp 0x14008e591
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [r13 + 8], rbx
mov dword [r13], eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140093c20
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140093c47
call rbp
cmp dword [rax], 4
jne 0x140093c64
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140093c40
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400a7780
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400a77a8
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400a77f0
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400a77c0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400a77fc
call rbp
cmp dword [rax], 4
je 0x1400a77c0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b46a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0x80000000
mov dword [rbp - 0x18], 0x7fffffff
mov qword [rbp - 8], 0
cmp qword [rbp - 8], 0xe2
ja 0x1400b473c
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 0x18d]
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + rdx*4]
mov eax, dword [rbp - 0x1c]
shr eax, 1
xor edx, eax
mov eax, dword [rbp - 0x1c]
and eax, 1
test eax, eax
je 0x1400b4721
mov eax, 0x9908b0df
jmp 0x1400b4726
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov dword [rax + rdx*4], ecx
add qword [rbp - 8], 1
jmp 0x1400b46c2
mov qword [rbp - 0x10], 0xe3
cmp qword [rbp - 0x10], 0x26e
ja 0x1400b47be
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x20], eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax - 0xe3]
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + rdx*4]
mov eax, dword [rbp - 0x20]
shr eax, 1
xor edx, eax
mov eax, dword [rbp - 0x20]
and eax, 1
test eax, eax
je 0x1400b47a3
mov eax, 0x9908b0df
jmp 0x1400b47a8
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov dword [rax + rdx*4], ecx
add qword [rbp - 0x10], 1
jmp 0x1400b4744
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x9bc]
and eax, 0x80000000
mov edx, eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
and eax, 0x7fffffff
or eax, edx
mov dword [rbp - 0x24], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x630]
mov eax, dword [rbp - 0x24]
shr eax, 1
xor edx, eax
mov eax, dword [rbp - 0x24]
and eax, 1
test eax, eax
je 0x1400b4801
mov eax, 0x9908b0df
jmp 0x1400b4806
mov eax, 0
xor edx, eax
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x9bc], edx
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400b4830
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x18]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov rdx, qword [rbp + 0x10]
mov dword [rdx], eax
mov qword [rbp - 8], 1
cmp qword [rbp - 8], 0x26f
ja 0x1400b48b2
mov rax, qword [rbp - 8]
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shr eax, 0x1e
xor dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
imul eax, eax, 0x6c078965
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__624u__1u__0u__unsigned_int_
add dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov dword [rdx + rcx*4], eax
add qword [rbp - 8], 1
jmp 0x1400b4857
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0x270
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400b4900
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
cmp rax, 0x26f
jbe 0x1400b4928
mov rcx, qword [rbp + 0x10]
call sym._ZNSt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2636928640ELy15ELj4022730752ELy18EL
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
lea rcx, [rax + 1]
mov rdx, qword [rbp + 0x10]
mov qword [rdx + 0x9c0], rcx
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + rax*4]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0xb
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x12
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x1400c9c50
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xc6a4a7935bd1e995
mov rax, rdx
mov r11, rdx
imul rax, r9
and r11, 0xfffffffffffffff8
add r11, rcx
xor rax, r8
cmp rcx, r11
je 0x1400c9ca0
nop dword [rax + rax]
mov r10, qword [rcx]
add rcx, 8
imul r10, r9
mov r8, r10
shr r8, 0x2f
xor r8, r10
imul r8, r9
xor r8, rax
mov rax, r8
imul rax, r9
cmp r11, rcx
jne 0x1400c9c78
and edx, 7
je 0x1400c9cd5
sub edx, 1
xor r8d, r8d
movsxd rdx, edx
nop
movzx ecx, byte [r11 + rdx]
shl r8, 8
sub rdx, 1
add r8, rcx
test edx, edx
jns 0x1400c9cb0
xor r8, rax
movabs rax, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
movabs r8, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
ret

Function at 0x1400caa90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
test rdx, rdx
je 0x1400caabc
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
movsx r8, byte [rcx]
add rcx, 1
xor rax, r8
imul rax, r9
cmp rcx, rdx
jne 0x1400caaa8
ret
Function at 0x1400d3940
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call dbg.__main
mov rax, qword [0x1400dd420]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x1400dd410]
mov r8, qword [rax]
mov rax, qword [0x1400dd400]
mov rcx, qword [rax]
add rsp, 0x28
jmp sym.WinMain
Function at 0x140001c08
Capabilities:
Access pe header
Allocate or change rwx memory

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14007a2b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
test rax, rax
je 0x140001ca2
and dword [rsp + 0x40], 0
mov eax, dword [rax + 0x54]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140001cab
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.140034240
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
jmp 0x140001ca7
mov eax, 0xc000000d
mov dword [rsp + 0x30], eax
jmp 0x140001cb1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002ff90
add rsp, 0x68
ret
Function at 0x140002078
Capabilities:
Access pe header
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x60
mov rax, qword [0x14007a2b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
and dword [rsp + 0x48], 0
mov r14, rcx
mov rcx, rdx
mov rbp, rdx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
je 0x140002207
mov r8d, 9
lea r9, [rsp + 0x48]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov rbx, rax
test rax, rax
je 0x140002207
cmp byte [r14 + 0x58], 0
mov r12d, 0x20b
jne 0x140002198
cmp word [rdi + 0x18], r12w
jne 0x1400020f6
mov rax, qword [rax]
jmp 0x1400020f8
mov eax, dword [rax]
test rax, rax
je 0x140002198
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x50]
mov eax, 0x1000
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], eax
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140002198
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadTeb]
mov rcx, qword [r14]
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
je 0x140002174
mov ecx, dword [rsp + 0x40]
mov dword [rsi + 0x202c], ecx
cmp word [rdi + 0x18], r12w
jne 0x140002169
mov rcx, qword [rbx]
jmp 0x14000216b
mov ecx, dword [rbx]
mov rax, qword [rsp + 0x40]
mov dword [rax], ecx
jmp 0x140002193
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x58], rax
cmp word [rdi + 0x18], r12w
jne 0x140002189
mov rcx, qword [rbx]
jmp 0x14000218b
mov ecx, dword [rbx]
mov rax, qword [rsp + 0x40]
mov qword [rax], rcx
mov byte [r14 + 0x58], 1
movzx ecx, word [rdi + 0x18]
cmp cx, r12w
jne 0x1400021a8
mov rbx, qword [rbx + 0x18]
jmp 0x1400021ab
mov ebx, dword [rbx + 0xc]
cmp cx, r12w
jne 0x1400021b6
mov rax, qword [rbx]
jmp 0x1400021b8
mov eax, dword [rbx]
test rax, rax
je 0x140002207
cmp cx, r12w
jne 0x1400021c8
mov r8, qword [rbx]
jmp 0x1400021cb
mov r8d, dword [rbx]
and qword [rsp + 0x30], 0
mov r9d, 3
mov qword [rsp + 0x28], 1
mov rdx, r14
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call fcn.1400afe84
movzx ecx, word [rdi + 0x18]
mov eax, 4
cmp cx, r12w
lea edx, [rax + 4]
cmove eax, edx
add rbx, rax
jmp 0x1400021ab
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ff90
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140002228
Capabilities:
Get system information on windows

Disassembly:
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx]
jmp fcn.1400ad540