joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180024270
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x18030a008]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r14d, r14d
mov rsi, r8
cmp dword [rdx], 4
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x31], r14
jbe 0x180024371
mov qword [rbp - 0x39], r14
mov qword [rbp + 0x17], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x39]
lea edx, [r14 + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180024322
lea r8, [rbp + 0x17]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x180024322
mov rax, qword [rbp + 0x17]
lea r9d, [r14 + 0x10]
mov rcx, qword [rbp - 0x39]
lea r8, [rbp + 0x1f]
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rbp + 0x23], rax
mov dword [rbp + 0x1f], 1
mov dword [rbp + 0x2b], 2
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x180024322
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180024331
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx]
lea r9, [rbp - 0x29]
mov edx, dword [rsi]
lea r8, [rbp - 0x19]
xorps xmm0, xmm0
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x31]
mov qword [rbp - 0x21], r14
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp - 0x19], 0x30
mov qword [rbp - 1], r14
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], r14
call qword [rdi + 0xa8]
mov rax, qword [rbp - 0x31]
jmp 0x180024374
mov rax, r14
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180044eb0
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18008167c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18006b3ca
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18006b3ad
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x18006b398

Function at 0x18009e350
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x28
mov r12d, r9d
mov r15, r8
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x18009e52b
test rdx, rdx
je 0x18009e52b
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x18009e52b
cmp dword [rcx], 0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], r14
mov r14, qword [rsp + 0x70]
jne 0x18009e3bf
mov r8, r14
mov edx, 0x100
call fcn.18009e6a0
test al, al
je 0x18009e450
movzx eax, byte [rsi]
mov rcx, rsi
mov edi, 0x1505
test al, al
je 0x18009e3e5
nop
imul rdi, rdi, 0x21
movzx eax, al
lea rcx, [rcx + 1]
add rdi, rax
movzx eax, byte [rcx]
test al, al
jne 0x18009e3d0
xor edx, edx
mov eax, edi
div dword [rbp]
mov rax, qword [rbp + 0x10]
mov r13d, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x18009e430
nop dword [rax]
cmp dword [rbx + 0x20], edi
jne 0x18009e427
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18009e423
inc rax
test ecx, ecx
jne 0x18009e410
test edx, edx
je 0x18009e471
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x18009e400
mov ecx, 0x28
call fcn.18004b948
mov rbx, rax
test rax, rax
jne 0x18009e492
xor r8d, r8d
lea edx, [rax + 0xe]
mov rcx, r14
call fcn.180096da0
xor al, al
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
test r12b, 8
je 0x18009e47e
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x18009e489
cmp qword [rbx + 0x10], 0xffffffffffffffff
je 0x18009e516
xor r8d, r8d
lea edx, [r8 + 0xa]
jmp 0x18009e448
mov qword [rax], rsi
xorps xmm1, xmm1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13*8]
mov qword [rbx + 0x18], rcx
mov rax, qword [rbp + 0x10]
mov qword [rax + r13*8], rbx
mov dword [rbx + 0x20], edi
mov qword [rbx + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rcx, qword [rbp + 8]
mov edx, dword [rbp]
test rcx, rcx
js 0x18009e4ce
cvtsi2sd xmm1, rcx
jmp 0x18009e4e3
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1800be628]
comisd xmm1, xmm0
jbe 0x18009e516
cmp edx, 0x80000000
jae 0x18009e516
add edx, edx
mov r8, r14
mov rcx, rbp
call fcn.18009e6a0
test al, al
je 0x18009e450
test r12b, 8
je 0x18009e520
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x18009e452
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [r8 + 0x12]
call fcn.180096da0
xor al, al
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x18009ee80
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call fcn.1800a2550
test rbx, rbx
je 0x18009eeae
movzx r8d, word [rbx + 8]
mov ecx, eax
mov rdx, qword [rbx]
add rsp, 0x20
pop rbx
jmp fcn.1800a2550
add rsp, 0x20
pop rbx
ret

Function at 0x1800a15d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x1800a16ee
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800a1672
sub rsi, rdx
movzx eax, word [rbx + 8]
lea rdx, [rsp + 0x48]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx]
not ecx
call fcn.1800a2550
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1800a2550
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x1800a1601
jmp 0x1800a16da
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x48]
movzx eax, byte [rdi + rsi]
not ecx
mov r8d, 1
mov byte [rsp + 0x48], al
call fcn.1800a2550
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1800a2550
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x1800a1680
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a16f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x1800a182e
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800a17b2
mov qword [rsp + 0x40], rsi
sub r15, rdx
nop dword [rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx esi, byte [r15 + r14]
not ecx
movzx edi, word [rbx + 8]
mov r8d, 1
or di, 2
mov byte [rsp + 0x58], sil
call fcn.1800a2550
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1800a2550
not eax
lea r14, [r14 + 1]
mov dword [rbx + 8], eax
movzx eax, di
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, sil
mov byte [r14 - 1], cl
sub rbp, 1
jne 0x1800a1730
mov rsi, qword [rsp + 0x40]
jmp 0x1800a181b
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx eax, byte [rdi + r15]
not ecx
mov r8d, 1
mov byte [rsp + 0x58], al
call fcn.1800a2550
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.1800a2550
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x1800a17c0
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret

Function at 0x1800a1850
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x58
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], r8
lea r8d, [r9 + 0x10]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
setns al
add rsp, 0x58
ret

Function at 0x1800a1a90
Capabilities:
Hash data via bcrypt

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1800a1ab9
mov eax, 0xffffffff
cmp r8, rax
ja 0x1800a1ab9
mov rcx, qword [rcx + 8]
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
test eax, eax
setns al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x1800a1de0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
movzx r8d, dx
mov r9d, 2
mov rdx, rcx
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns al
add rsp, 0x28
ret
Function at 0x141488058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1414881df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141488089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14148806f
add dl, dl
jne 0x141488096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414880f6
xor eax, eax
add dl, dl
jne 0x1414880a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414881ad
add dl, dl
jne 0x1414880b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414880c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414880d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414880dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1414880ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14148807e
mov eax, 1
add dl, dl
jne 0x141488106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141488113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414880fb
sub eax, ebx
mov ebx, 1
jne 0x14148814c
mov ecx, 1
add dl, dl
jne 0x14148812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14148813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141488123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14148807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141488168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141488175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14148815d
cmp eax, 0x7d00
jae 0x14148819b
cmp eax, 0x500
jb 0x141488196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14148807e
cmp eax, 0x7f
ja 0x14148819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14148807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1414881d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14148807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000235c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rax - 0x38], 0
and dword [rax - 0x40], 0
mov r8d, 3
mov dword [rax - 0x48], r8d
xor r9d, r9d
mov edx, 0x40000000
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400024a4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x10]
mov r8d, 0x200
lea rdx, [0x14002da60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xorps xmm0, xmm0
xorps xmm1, xmm1
lea rcx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
test eax, eax
je 0x140002441
mov r8d, 0x19
lea rdx, str.MBR_successfully_written.
call fcn.1400046c4
nop
lea rcx, [rbp - 0x20]
call fcn.14000281c
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002499
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002494
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000251c
jmp 0x140002494
mov r8d, 0x14
lea rdx, str.Failed_to_write_MBR.
call fcn.1400046c4
nop
lea rcx, [rbp - 0x20]
call fcn.14000281c
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002499
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002494
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002522
call fcn.140006934
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000250b
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x1e
lea rdx, str.Failed_to_open_PhysicalDrive0.
lea rcx, [rbp - 0x20]
call fcn.1400046c4
nop
lea rcx, [rbp - 0x20]
call fcn.14000281c
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000250b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002506
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002516
call fcn.140006934
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
call fcn.14000e7a4
int3
call fcn.14000e7a4
int3
call fcn.14000e7a4
int3
Function at 0x14000281c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rbx, rcx
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140002a29
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rbp + 0xb0]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140002874
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.1400046c4
nop
mov r8d, 0xa
lea rdx, str.debug.log
lea rcx, [rsp + 0x30]
call fcn.140004100
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
and qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002916
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002911
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a40
call fcn.140006934
movdqa xmm0, xmmword [0x14002dc90]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140003c7c
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x6c], edx
cmp qword [rbp - 8], 0
je 0x1400029d1
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140002980
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x70]
call fcn.140004ff8
mov rcx, rax
call fcn.140004338
lea rcx, [rsp + 0x78]
call fcn.140003bec
test rax, rax
jne 0x1400029d1
mov rax, qword [rsp + 0x70]
movsxd rdx, dword [rax + 4]
mov rax, qword [rbp + rdx - 0x48]
neg rax
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 6
or ecx, dword [rbp + rdx - 0x80]
and ecx, 0x17
mov dword [rbp + rdx - 0x80], ecx
mov eax, dword [rbp + rdx - 0x7c]
and eax, ecx
jne 0x140002a46
lea rcx, [rbp + 0x18]
call fcn.140003728
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.140005cec
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002a29
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a3a
call fcn.140006934
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2c0
pop rbp
ret
call fcn.14000e7a4
nop
call fcn.14000e7a4
nop
test al, 4
je 0x140002a53
lea rbx, str.ios_base::badbit_set
jmp 0x140002a67
test al, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400012f8
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140001abc
lea rdx, [0x140031568]
lea rcx, [rbp + 0x80]
call fcn.140008850
int3
Function at 0x140002e48
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140002e76
xor eax, eax
jmp 0x140002f5c
cmp qword [rcx + 0x68], 0
je 0x140002e87
call fcn.14000362c
jmp 0x140002f5c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002e9e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002ea0
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002ed2
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400210e0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140002f56
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140002f09
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140002f32
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14000df94
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140002f56
cmp rsi, rbx
ja 0x140002f10
test rsi, rsi
je 0x140002f56
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14000df94
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000527c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rcx]
mov ebx, 0x270
mov ecx, dword [r9]
cmp ecx, ebx
jne 0x1400052e7
lea r8, [r9 + 8]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r10d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub rbx, 1
jne 0x1400052aa
mov ecx, dword [r9]
jmp 0x1400053bd
cmp ecx, 0x4e0
jb 0x1400053bd
lea rbx, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [rbx]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov eax, edi
mov r8, rbx
mov edx, eax
add rbx, 4
mov edi, dword [rbx]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x14000530d
lea rbx, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [rbx]
mov eax, edi
mov r8, rbx
mov edx, eax
add rbx, 4
mov edi, dword [rbx]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x140005352
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x14000756c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400075b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400075b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400075b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400075b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400075b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400075b8
xor al, al
add rsp, 0x28
ret
Function at 0x14000c4cc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000c53b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c53b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c53b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c53b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c53b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c53b
cmp dword [rcx + 0xf8], 0
je 0x14000c53b
mov ecx, ebx
call fcn.14000c5ec
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000c3c8
nop
cmp dword [rbp + 0x20], 0
je 0x14000c589
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000c594
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000c4cc

Function at 0x14000c6d0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000c53b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c53b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c53b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c53b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c53b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c53b
cmp dword [rcx + 0xf8], 0
je 0x14000c53b
mov ecx, ebx
call fcn.14000c5ec
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000c3c8
nop
cmp dword [rbp + 0x20], 0
je 0x14000c589
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000c594
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000c4cc