joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52c600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52c71d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x474155f320f6f90d
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe9fd3af2652c2726
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe143203972357747
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6e6f3374f7654020
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2171201000a0804
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0c09020c0a170f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b0d18141d06100e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x812070a0c161917
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1006120914081905
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x52c6c0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x55]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x55]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x52c6ed
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x52c710
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x20
jb 0x52c69d
jmp 0x52c704
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.00440c40
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00450f20
mov eax, edi
mov ecx, 0x20
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.0052c600
Function at 0x52e080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x52e21b
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0xa185e404203a75c6
mov qword [rsp + 0x19], rdx
movabs rdx, 0x65e77377b1acaba1
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3ea2f32bdf663a20
mov qword [rsp + 0x28], rdx
movabs rdx, 0x37206ea1d974d2e6
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6eb970dc92894d84
mov qword [rsp + 0x38], rdx
movabs rdx, 0x95f0cf53c5a311b8
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd37645635041bf84
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2933362b0413232b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2c0d230606291605
mov qword [rsp + 0x58], rdx
movabs rdx, 0x8271e1a28183320
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1405302521151312
mov qword [rsp + 0x68], rdx
movabs rdx, 0x231a152e360c2d29
mov qword [rsp + 0x70], rdx
movabs rdx, 0xc330b2c172a20
mov qword [rsp + 0x78], rdx
movabs rdx, 0x80b281f2c2d0407
mov qword [rsp + 0x80], rdx
movabs rdx, 0x11804221b052910
mov qword [rsp + 0x88], rdx
movabs rdx, 0x133501232f1b090a
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x52e1b1
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x48
jge 0x52e1e8
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x52e20e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
nop dword [rax + rax]
cmp rsi, 0x37
jb 0x52e197
jmp 0x52e202
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x37
call fcn.00440c40
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.00450f20
mov eax, edi
mov ecx, 0x37
call fcn.00450f20
nop
nop dword [rax + rax]
call fcn.0044eca0
jmp fcn.0052e080

Function at 0x52e820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52e92c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x209bc6bb7495d9a4
mov qword [rsp + 0x19], rdx
movabs rdx, 0x73199e61a7b8d163
mov qword [rsp + 0x21], rdx
movabs rdx, 0xa120688f61b22073
mov qword [rsp + 0x28], rdx
movabs rdx, 0x97d3d68cbaad70b6
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd01111a171c1a0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x413050b11190016
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa060d090d1d1e02
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0d0e1b0b131706
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x52e8c8
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4f]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x52e8fc
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1f
jae 0x52e91f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4f]
cmp rsi, 0x1f
jb 0x52e8ae
jmp 0x52e913
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1f
call fcn.00440c40
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00450f20
mov eax, edi
mov ecx, 0x1f
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0052e820
Function at 0x532320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x53242a
push rbp
mov rbp, rsp
sub rsp, 0x90
movzx edx, byte [rax + 0x4c]
mov byte [rax + 0x4c], cl
nop
movabs rsi, 0xad4bdca6ae8a5430
mov qword [rsp + 0x57], rsi
movabs rsi, 0xbbad4bdca6ae8a54
mov qword [rsp + 0x58], rsi
movabs rsi, 0xa0a31e6fd9847df
mov qword [rsp + 0x60], rsi
movabs rsi, 0x9a7de9929db86500
mov qword [rsp + 0x46], rsi
movabs rsi, 0x839a7de9929db865
mov qword [rsp + 0x47], rsi
movabs rsi, 0x726c54829efa26e6
mov qword [rsp + 0x4f], rsi
xor ecx, ecx
nop
jmp 0x5323b6
movzx esi, byte [rsp + rcx + 0x57]
movzx edi, byte [rsp + rcx + 0x46]
xor edi, esi
mov byte [rsp + rcx + 0x46], dil
inc rcx
cmp rcx, 0x11
jl 0x5323a2
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x37], dl
mov qword [rsp + 0x38], rbx
lea rdx, [rax + 0x40]
mov qword [rsp + 0x88], rdx
lea rbx, [rsp + 0x46]
mov ecx, 0x11
lea rax, [rsp + 0x68]
call fcn.00440c40
mov ecx, 0x10
xor edi, edi
mov esi, 0x76
mov r8, rax
mov r9, rbx
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x38]
call fcn.0052fd20
movzx edx, byte [rsp + 0x37]
mov rsi, qword [rsp + 0xa0]
mov byte [rsi + 0x4c], dl
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0044eca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00532320

Function at 0x536d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536e8c
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x9c20785a35511373
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x727b6b6a9c20785a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6f440d8761587b98
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3654701d7c4f6454
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x393e6773429e5b39
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1e170c1b03171707
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x10171e170c1b0317
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9131b0201200421
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c04180c0d0a0a02
mov qword [rsp + 0x50], rdx
movabs rdx, 0x151a20120e140808
mov qword [rsp + 0x58], rdx
movabs rdx, 0x81f231222041b15
mov qword [rsp + 0x60], rdx
movabs rdx, 0x151e111d16080818
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x536e24
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x32
jge 0x536e5c
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x24
jae 0x536e7f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 0x24
jb 0x536e0a
jmp 0x536e73
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.00440c40
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00450f20
mov eax, edi
mov ecx, 0x24
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.00536d40
Function at 0x536ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536fa8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x7b20786174777984
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x616f767c7c777265
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1e6e69776e616f76
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6e797e3e9b87aa65
mov qword [rsp + 0x32], rdx
movabs rdx, 0x180b19070c0a0802
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x170a00070b1a160e
mov qword [rsp + 0x42], rdx
movabs rdx, 0xe1b11181415170a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x81a0d070b1b000c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x536f4b
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x13]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x13]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x536f78
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x536f9b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x536f2e
jmp 0x536f8f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00440c40
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00450f20
mov eax, edi
mov ecx, 0x1d
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.00536ea0

Function at 0x5380e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5381ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3764c83496723d30
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9f3764c83496723d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7871447e66557582
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc0a0c0d0301060e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50b0508020f0c0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20d010f090e0802
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x53816d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 6]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 6]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x53819a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5381bd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x538150
jmp 0x5381b1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00440c40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f20
mov eax, edi
mov ecx, 0x11
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.005380e0
Function at 0x538b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x538c4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xb29351cc7233af2
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x380b29351cc7233a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x24c000d4f621041
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20d0c0f06020200
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x30a0406020d0c0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0001070910010a
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x538bea
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x10]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x538c1c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x538c3f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x10]
cmp rsi, 0x11
jb 0x538bd0
jmp 0x538c33
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00440c40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f20
mov eax, edi
mov ecx, 0x11
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.00538b60
Function at 0x140006880
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140011238], rbx
je 0x1400068cc
cmp rax, rbx
jne 0x1400068bf
mov ebx, 1
mov esi, ebx
jmp 0x1400068d1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400068a4
mov ebx, 1
mov eax, dword [0x140011240]
cmp eax, ebx
jne 0x1400068e7
mov ecx, 0x1f
call fcn.1400a1000
jmp 0x14000694c
mov eax, dword [0x140011240]
test eax, eax
jne 0x140006946
mov dword [0x140011240], ebx
lea r15, [0x140008668]
lea rdi, [0x140008650]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140006938
test eax, eax
jne 0x14000693c
cmp qword [rdi], 0
je 0x14000692d
mov rax, qword [rdi]
mov rcx, qword [0x140008610]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000690e
test eax, eax
je 0x14000694c
mov eax, 0xff
jmp 0x140006a28
mov dword [0x14000f894], ebx
mov eax, dword [0x140011240]
cmp eax, ebx
jne 0x140006973
lea rdx, [0x140008648]
lea rcx, [0x140008618]
call sub.msvcrt.dll__initterm
mov dword [0x140011240], 2
test esi, esi
jne 0x140006980
xor eax, eax
xchg qword [0x140011238], rax
cmp qword [0x140011258], 0
je 0x1400069b4
lea rcx, [0x140011258]
call fcn.140007050
test eax, eax
je 0x1400069b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140011258]
mov r9, qword [0x140008610]
call r9
mov r8, qword [0x14000f8a8]
mov rdx, qword [0x14000f8a0]
mov ecx, dword [0x14000f898]
call fcn.14000166c
mov dword [0x14000f890], eax
cmp dword [0x14000f8b0], 0
jne 0x1400069e4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000f894], 0
jne 0x1400069f9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000f890]
jmp 0x140006a28
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400070e4
add rsp, 0x28
jmp 0x140006880

Function at 0x140006f3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006f88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140006f80
cmp dword [rcx + 0x3c], edx
jl 0x140006f80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140006f80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140006f88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x18003c3a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18003c3c8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18003c3ee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18003c3f0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18003c449
test ecx, ecx
jle 0x18003c429
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18003c449
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18003c449
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x18003c470
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18003c492
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18003c4a8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18003c4c4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18003c4c6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18003c502
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18003c59e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18003c53d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18003c57e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18003c59e
cmp rbx, rax
ja 0x18003c550
test rbx, rbx
je 0x18003c59e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x18003ca00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800ef280]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18003ca2d
xor eax, eax
jmp 0x18003cb99
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18003ca67
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18003ca67
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18003cb99
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18003cb8c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18003caaa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18003cad5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003cb91
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003cb44
sub eax, 1
je 0x18003cb44
cmp eax, 2
jne 0x18003cb8c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003cb91
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18003cb72
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18003cb8c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18003cb91
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18009bc90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18003dd30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800ef280]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18003de03
cmp byte [rcx + 0x71], 0
je 0x18003de03
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18003ddff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003ddc4
sub eax, 1
je 0x18003ddc8
cmp eax, 2
jne 0x18003ddff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009bc90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18003ddf6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18003ddff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18003ddac
xor al, al
jmp 0x18003ddac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009bc90
add rsp, 0x60
pop rbx
ret
Function at 0x180043780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13e0
call fcn.18009c640
sub rsp, rax
mov rax, qword [0x1800ef280]
xor rax, rsp
mov qword [rsp + 0x13d8], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x13c0], xmm1
mov qword [rsp + 0x13d0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, 0xffffffff
mov dword [rsp + 0x13b4], r8d
mov dword [rsp + 0x34], eax
mov r9d, 1
mov edx, r9d
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x34], eax
inc rdx
cmp rdx, 0x270
jb 0x180043800
mov dword [rsp + 0x30], 0x270
mov eax, 0x40
mov rsi, 0xffffffffffffffff
lea rax, [rax - 1]
shr rsi, 1
cmp rsi, r8
ja 0x180043833
mov r13, qword [0x1800f3ea8]
mov r12, qword [0x1800f3ea0]
sub r13, r12
sar r13, 2
cmp r13, r9
cmovl r9, r13
mov qword [rsp + 0x20], r9
test r13, r13
jle 0x180043956
lea r15, [rax - 1]
mov r14, qword [rsp + 0x13c8]
nop word [rax + rax]
xor ebx, ebx
xor edi, edi
lea rbp, [r13 - 1]
test rbp, rbp
je 0x1800438ca
nop dword [rax]
mov rcx, r15
shl rbx, cl
add rbx, rbx
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.180051470
mov eax, eax
cmp rax, rsi
ja 0x1800438a0
or rbx, rax
mov rcx, r15
shl rdi, cl
add rdi, rdi
or rdi, rsi
cmp rdi, rbp
jb 0x180043890
mov r9, qword [rsp + 0x20]
xor edx, edx
mov rax, rdi
div r13
mov r8, rdx
mov rcx, rax
xor edx, edx
mov rax, rbx
div r13
cmp rax, rcx
jb 0x1800438ea
cmp r8, rbp
jne 0x180043880
cmp rdx, r9
jge 0x180043941
cmp r14, qword [rsp + 0x13d0]
je 0x180043916
mov eax, dword [r12]
mov dword [r14], eax
mov r14, qword [rsp + 0x13c8]
add r14, 4
mov qword [rsp + 0x13c8], r14
jmp 0x180043936
mov r8, r12
mov rdx, r14
lea rcx, [rsp + 0x13c0]
call fcn.180052830
mov r14, qword [rsp + 0x13c8]
mov r9, qword [rsp + 0x20]
sub r9, 1
mov qword [rsp + 0x20], r9
je 0x180043951
add r12, 4
mov r13, rbp
test rbp, rbp
jg 0x180043880
mov rbx, qword [rsp + 0x28]
mov byte [rbx + 0x270], 1
movss xmm0, dword [0x1800f2558]
movss dword [rbx + 0x278], xmm0
mov rcx, qword [rsp + 0x13c0]
mov eax, dword [rcx]
mov dword [rbx + 0x274], eax
mov rdx, qword [rsp + 0x13d0]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800439b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800439b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18009c12c
mov rcx, qword [rsp + 0x13d8]
xor rcx, rsp
call fcn.18009bc90
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret