joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fe20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44ff97
movzx edx, byte [rax]
test edx, edx
jne 0x44fe54
nop dword [rax]
test r8b, r8b
jne 0x44fe54
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44fe67
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44ff57
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44ff45
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44ff37
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44febd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44ff00
mov eax, 1
cmp rax, rbx
ja 0x44feeb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00462aa0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44ff2f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44fef3
mov rcx, r11
mov eax, r12d
jmp 0x44fec2
mov rcx, rbx
call fcn.004629e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004629e0
mov eax, r8d
mov rcx, rbx
call fcn.00462aa0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44ff8d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44ff50
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44fe6d
mov eax, edx
mov rcx, rbx
call fcn.004629e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004629e0
nop
int3

Function at 0x455b60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455c15
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004537e0
nop
test bl, bl
je 0x455c0f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00455c60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004605e0
xorps xmm15, xmm15
mov r14, qword [0x005d6530]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460700
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455b60
Function at 0x458be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458c8f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458ce0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004605e0
xorps xmm15, xmm15
mov r14, qword [0x005d6530]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460700
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00458be0
Function at 0x462500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403cc3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409a60
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460700
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ca0
cmp byte [0x005d632b], 0
je 0x462515
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f740
jmp 0x403ca0

Function at 0x462520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005d6600]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005d632b], 0
je 0x462555
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005d6920]
aesenc xmm0, xmmword [0x005d6930]
aesenc xmm0, xmmword [0x005d6940]
movq rax, xmm0
ret
jmp 0x409c80

Function at 0x462560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005d6600]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x005d632b], 0
je 0x462596
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005d6920]
aesenc xmm0, xmmword [0x005d6930]
aesenc xmm0, xmmword [0x005d6940]
movq rax, xmm0
ret
jmp 0x409ce0

Function at 0x464320
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x464354
mov rcx, 0x28
jmp 0x46435f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005d6530], rcx
pop rbp
ret
Function at 0x47b880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b94a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403260
xorps xmm15, xmm15
mov r14, qword [0x005d6530]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47b92f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00492340]
xor ebx, ebx
mov rcx, rdx
call fcn.00449080
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047be60
inc rbx
cmp rcx, rbx
jae 0x47b91e
mov edi, 1
lea rsi, [0x00492340]
call fcn.00449160
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004c92f8]
lea rsi, [0x004c8c88]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460700
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047b880

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x1400022c8]
lea r9, str._J_ms8m
mov r8d, 5
mov qword [rsp + 0x38], rax
lea rax, [0x1400022b8]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140013800
Capabilities:
Listen for remote procedure calls

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0xc]
mov ecx, dword [rcx + 8]
mov r8d, 1
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
cmp eax, 0x6b1
je 0x140013871
test eax, eax
je 0x140013871
lea rcx, str...SwRpcServer.cpp
mov edx, 0x5c
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x140013841
inc rax
jmp 0x140013848
lea rax, str...SwRpcServer.cpp
lea rcx, [0x140042858]
mov rdx, rax
call fcn.140001760
movabs rcx, 0x212500000000
shl rax, 0x34
or rax, rbx
or rax, rcx
add rsp, 0x20
pop rbx
ret
movabs rax, 0x8000000000
add rsp, 0x20
pop rbx
ret

Function at 0x1428db058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1428db1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1428db089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1428db06f
add dl, dl
jne 0x1428db096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1428db0f6
xor eax, eax
add dl, dl
jne 0x1428db0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1428db1ad
add dl, dl
jne 0x1428db0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428db0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428db0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428db0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1428db0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1428db07e
mov eax, 1
add dl, dl
jne 0x1428db106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1428db113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1428db0fb
sub eax, ebx
mov ebx, 1
jne 0x1428db14c
mov ecx, 1
add dl, dl
jne 0x1428db12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1428db13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1428db123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1428db07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1428db168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1428db175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1428db15d
cmp eax, 0x7d00
jae 0x1428db19b
cmp eax, 0x500
jb 0x1428db196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1428db07e
cmp eax, 0x7f
ja 0x1428db19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1428db07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1428db1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1428db07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001840
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rcx, str.___Sliver_CPP_Stager_template_n
call fcn.140001010
lea rdx, [rsp + 0x30]
call fcn.140001210
mov ebx, dword [rsp + 0x38]
mov r9d, 0x40
mov edx, ebx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, ebx
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memmove
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1400018c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Cannot_create_thread_0x_d_n
call fcn.140001010
jmp 0x1400018d4
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call fcn.14000196c
lea rcx, str.___Sliver_Stager_executed__n
call fcn.140001010
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x1400022a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022f0
xor al, al
add rsp, 0x28
ret
Function at 0x1800485e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180048608
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18004862e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180048630
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180048689
test ecx, ecx
jle 0x180048669
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180048689
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180048689
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1800486b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800486d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1800486e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180048704
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180048706
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180048742
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800487de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18004877d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1800487be
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800487de
cmp rbx, rax
ja 0x180048790
test rbx, rbx
je 0x1800487de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180048c40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180100280]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180048c6d
xor eax, eax
jmp 0x180048dd9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180048ca7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180048ca7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180048dd9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180048dcc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180048cea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180048d15
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180048dd1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180048d84
sub eax, 1
je 0x180048d84
cmp eax, 2
jne 0x180048dcc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180048dd1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180048db2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180048dcc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180048dd1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800ab070
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18004a140
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180100280]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18004a213
cmp byte [rcx + 0x71], 0
je 0x18004a213
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18004a20f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004a1d4
sub eax, 1
je 0x18004a1d8
cmp eax, 2
jne 0x18004a20f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800ab070
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18004a206
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18004a20f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18004a1bc
xor al, al
jmp 0x18004a1bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800ab070
add rsp, 0x60
pop rbx
ret
Function at 0x180050cd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13e0
call fcn.1800aba20
sub rsp, rax
mov rax, qword [0x180100280]
xor rax, rsp
mov qword [rsp + 0x13d8], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x13c0], xmm1
mov qword [rsp + 0x13d0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, 0xffffffff
mov dword [rsp + 0x13b4], r8d
mov dword [rsp + 0x34], eax
mov r9d, 1
mov edx, r9d
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x34], eax
inc rdx
cmp rdx, 0x270
jb 0x180050d50
mov dword [rsp + 0x30], 0x270
mov eax, 0x40
mov rsi, 0xffffffffffffffff
lea rax, [rax - 1]
shr rsi, 1
cmp rsi, r8
ja 0x180050d83
mov r13, qword [0x180106148]
mov r12, qword [0x180106140]
sub r13, r12
sar r13, 2
cmp r13, r9
cmovl r9, r13
mov qword [rsp + 0x20], r9
test r13, r13
jle 0x180050ea6
lea r15, [rax - 1]
mov r14, qword [rsp + 0x13c8]
nop word [rax + rax]
xor ebx, ebx
xor edi, edi
lea rbp, [r13 - 1]
test rbp, rbp
je 0x180050e1a
nop dword [rax]
mov rcx, r15
shl rbx, cl
add rbx, rbx
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.180060080
mov eax, eax
cmp rax, rsi
ja 0x180050df0
or rbx, rax
mov rcx, r15
shl rdi, cl
add rdi, rdi
or rdi, rsi
cmp rdi, rbp
jb 0x180050de0
mov r9, qword [rsp + 0x20]
xor edx, edx
mov rax, rdi
div r13
mov r8, rdx
mov rcx, rax
xor edx, edx
mov rax, rbx
div r13
cmp rax, rcx
jb 0x180050e3a
cmp r8, rbp
jne 0x180050dd0
cmp rdx, r9
jge 0x180050e91
cmp r14, qword [rsp + 0x13d0]
je 0x180050e66
mov eax, dword [r12]
mov dword [r14], eax
mov r14, qword [rsp + 0x13c8]
add r14, 4
mov qword [rsp + 0x13c8], r14
jmp 0x180050e86
mov r8, r12
mov rdx, r14
lea rcx, [rsp + 0x13c0]
call fcn.1800612f0
mov r14, qword [rsp + 0x13c8]
mov r9, qword [rsp + 0x20]
sub r9, 1
mov qword [rsp + 0x20], r9
je 0x180050ea1
add r12, 4
mov r13, rbp
test rbp, rbp
jg 0x180050dd0
mov rbx, qword [rsp + 0x28]
mov byte [rbx + 0x270], 1
movss xmm0, dword [0x180104188]
movss dword [rbx + 0x278], xmm0
mov rcx, qword [rsp + 0x13c0]
mov eax, dword [rcx]
mov dword [rbx + 0x274], eax
mov rdx, qword [rsp + 0x13d0]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x180050f04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180050f04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ab50c
mov rcx, qword [rsp + 0x13d8]
xor rcx, rsp
call fcn.1800ab070
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret