joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44a082
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.00449590
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x449fa2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.00449b50
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x48], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x40], rdx
call fcn.00430b50
lea rax, [0x006e2434]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.00431500
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.00431500
call fcn.00430da0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.00431390
call fcn.00430da0
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.00431390
call fcn.00430da0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.00431390
call fcn.00430da0
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.00431320
call fcn.00430df0
call fcn.00430be0
mov eax, dword [rsp + 0x3c]
jmp 0x449f91
call fcn.004587a0
jmp fcn.00449f20
Function at 0x450a10
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x450af0
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00458050]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00458650
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.004587a0
jmp fcn.00450a10
Function at 0x46e1d0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
neg rsi
imul rsi, rsi, 0x1c
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rsi, 0x3f
sar rdx, 5
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x46e2ab
lea rsi, [rdx + rdx*2]
lea rdi, [0x008c6360]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x46e254
inc rdx
jmp 0x46e22b
cmp r9, 0xffffffffffffffe0
jle 0x46e25f
dec rdx
jmp 0x46e22b
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.0045b150
nop
int3
Function at 0x554350
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
cmp al, 0x61
jb 0x554363
cmp al, 0x7a
ja 0x554363
mov byte [rsp + 0x18], 0
ret
cmp al, 0x41
jb 0x5544fb
cmp al, 0x5a
setbe cl
test cl, cl
jne 0x55435d
cmp al, 0x30
jb 0x5544f4
cmp al, 0x39
setbe cl
test cl, cl
jne 0x55435d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x5544e5
cmp al, 0x2c
ja 0x5544c4
lea edx, [rax - 0x21]
cmp dl, 1
ja 0x5543aa
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x5543a4
lea edx, [rax - 0x26]
cmp dl, 6
jbe 0x5543a4
cmp al, 0x2f
ja 0x55448e
cmp al, 0x26
ja 0x554467
cmp al, 0x24
jne 0x55445d
cmp rcx, 2
jg 0x554422
cmp rcx, 1
je 0x55441a
cmp rcx, 2
jne 0x5543fd
cmp al, 0x2f
jne 0x5543ee
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
je 0x5543e4
cmp al, 0x2c
je 0x5543e4
cmp al, 0x3f
sete al
jmp 0x5543e9
cmp rcx, 7
jne 0x554414
cmp al, 0x21
jne 0x55440d
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x554407
mov byte [rsp + 0x18], 1
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x554445
cmp al, 0x40
jne 0x554436
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
je 0x55442c
cmp al, 0x3f
je 0x55442c
cmp al, 0x3a
sete al
jmp 0x554431
cmp rcx, 6
je 0x554457
cmp rcx, 7
jne 0x5543fd
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x5543ce
jmp 0x5543fd
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x5543ce
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x554481
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x5543ce
jmp 0x5543fd
cmp al, 0x3d
ja 0x5544ab
lea edx, [rax - 0x3a]
cmp dl, 1
jbe 0x5543ce
cmp al, 0x3d
je 0x5543ce
jmp 0x5543fd
lea edx, [rax - 0x3f]
cmp dl, 1
jbe 0x5543ce
cmp al, 0x5f
je 0x55447b
cmp al, 0x7e
je 0x55447b
jmp 0x5543fd
lea edx, [rax - 0x3a]
cmp dl, 4
jbe 0x5543a4
cmp al, 0x5b
je 0x5543a4
cmp al, 0x5d
je 0x5543a4
jmp 0x5543b6
cmp rcx, 4
je 0x554394
jmp 0x5543b6
xor ecx, ecx
jmp 0x554381
xor ecx, ecx
jmp 0x554370
Function at 0x5a1200
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x5a120d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x5a121d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x5a1205
lea eax, [rcx + 1]
jmp 0x5a122b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x5a123e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x5a1224
sub eax, 3
jb 0x5a125e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x5a12ad
sar eax, 1
movsxd rbp, eax
jb 0x5a1294
jmp 0x5a126c
add ebx, ebx
jne 0x5a126a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x5a1294
inc ecx
add ebx, ebx
jne 0x5a127a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x5a1294
call r11
adc ecx, ecx
add ebx, ebx
jne 0x5a128d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x5a127c
add ecx, 2
jmp 0x5a1299
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.005a11c2
jmp 0x5a120d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x94a00
mov dl, 0x1e
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x5a12f9
cmp rsi, rcx
jae 0x5a1301
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x5a12e0
cmp al, 0x8f
ja 0x5a12e0
cmp byte [rsi - 2], 0xf
je 0x5a12e6
sub al, 0xe8
cmp al, 1
ja 0x5a12ca
cmp rsi, rcx
jae 0x5a1301
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x5a12d0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x5a1301
lodsb al, byte [rsi]
jmp 0x5a12e0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x19e000]
mov eax, dword [rdi]
or eax, eax
je 0x5a135e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1a1000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x5a130e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x5a1358
mov qword [rbx], rax
add rbx, 8
jmp 0x5a132e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x5a1398
cmp al, 0xef
ja 0x5a138a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x5a136a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x5a1379
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x5a13ec
sub rsp, 0xffffffffffffff80
jmp 0x46b8e0
Function at 0x14000fe60
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x14000ff00
jmp 0x14000feef
jae 0x14000ffc0
cmp r8, 0x201
jae 0x14000ff00
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000ff58
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000ff2f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140025e30
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000ff81
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140010028
mov r8d, r14d
cmp r15, r8
jne 0x14000fee0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140010055
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000feef
jmp 0x14000ff00
cmp rsi, r8
jb 0x14001006f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140011e90
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140010011
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140004da0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x14000fff9
jmp 0x140010011
lea rcx, str.internal_error:_entered_unreachable_code_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.1400267b0
jmp 0x140010084
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140026c00
ud2
Function at 0x1400164c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14002a700]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140016504
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001656a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400165a1
test eax, eax
js 0x14001657b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140016594
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140011bd0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14000e110
mov ecx, 7
int 0x29
ud2
Function at 0x1400241c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14002423a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140024230
cmp r11, r10
ja 0x1400242c5
cmp r10, rdx
ja 0x1400242d7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140024232
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140024210
jmp 0x1400242a7
ja 0x14002423a
mov r11, r10
cmp rax, r8
jne 0x1400241e2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400242ab
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140024280
mov r8, r10
sub ecx, r9d
jns 0x14002429e
jmp 0x1400242ad
cmp r10, rdx
je 0x1400242b9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400242ad
xor al, 1
cmp r8, rdx
jne 0x140024260
jmp 0x1400242ad
xor eax, eax
jmp 0x1400242ad
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140026650
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140026c80
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140026c00
int3

Function at 0x1400257e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025832
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025832
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025832
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025832
cmp dword [rcx + 0x84], 0xe
jbe 0x140025832
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140025834
xor al, al
add rsp, 0x28
ret
Function at 0x140004ac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140004b21
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140004ae0
mov ecx, dword [r9]
jmp 0x140004c0b
cmp ecx, 0x4e0
jb 0x140004c0b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140004b40
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140004b90
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140005bb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13b0
call fcn.140097f00
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x140005bf0
mov ebp, 0x80000000
mov dword [rsp + 0x20], 0x270
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x140005c63
call fcn.140004ac0
mov ecx, eax
jmp 0x140005cab
inc edi
mov ebx, edi
call fcn.140004ac0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x140005ca7
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x140005ca7
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.140004ac0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x140005c90
shr rcx, 0x20
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x28]
cmovae eax, ecx
mov rsp, r11
pop rdi
ret

Function at 0x1400071b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140007279
cmp byte [rcx + 0x71], 0
je 0x140007279
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000726c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140007228
sub eax, 1
je 0x14000722c
cmp eax, 2
jne 0x14000726c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14000725a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000726c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x1400074f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [0x1400c8f60]
mov ecx, 0x10
call fcn.140097c60
test rax, rax
je 0x14000751a
mov qword [rax], rbx
lea rcx, [0x140008190]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140006a10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140007587
cmp dword [rsp + 0x38], 0
je 0x14000757c
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14000757c
mov byte [0x1400c90b8], 1
add rsp, 0x50
pop rbx
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1400075a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [0x1400c8f60]
mov ecx, 0x10
call fcn.140097c60
test rax, rax
je 0x1400075ca
mov qword [rax], rbx
lea rcx, [0x140009580]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140006a10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140007637
cmp dword [rsp + 0x38], 0
je 0x14000762c
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14000762c
mov byte [0x1400c90b9], 1
add rsp, 0x50
pop rbx
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3