joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [0x14002d2c8]
xor edx, edx
test eax, eax
jne 0x140017831
mov byte [rbp - 0x38], 0x62
mov ecx, edx
mov byte [rbp - 0x37], 0x34
mov byte [rbp - 0x36], 0x64
mov byte [rbp - 0x35], 0x27
mov byte [rbp - 0x34], 0x4d
mov byte [rbp - 0x33], 0x68
mov byte [rbp - 0x32], WSAStartup
mov byte [rbp - 0x31], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x30], 0x6c
mov byte [rbp - 0x2f], 0x6b
mov byte [rbp - 0x2e], 0x27
mov byte [rbp - 0x2d], 0x7b
mov byte [rbp - 0x2c], 0x76
mov byte [rbp - 0x2b], 0x27
mov byte [rbp - 0x2a], 0x6e
mov byte [rbp - 0x29], 0x6c
mov byte [rbp - 0x28], 0x7b
mov byte [rbp - 0x27], 0x27
mov byte [rbp - 0x26], 0x7d
mov byte [rbp - 0x25], 0x6c
mov byte [rbp - 0x24], 0x79
mov byte [rbp - 0x23], 0x7a
mov byte [rbp - 0x22], WSAStartup
mov byte [rbp - 0x21], 0x76
mov byte [rbp - 0x20], 0x75
mov byte [rbp - 0x1f], 0x27
mov byte [rbp - 0x1e], 0x76
mov byte [rbp - 0x1d], 0x7a
mov byte [rbp - 0x1c], 0x27
mov byte [rbp - 0x1b], WSAStartup
mov byte [rbp - 0x1a], 0x75
mov byte [rbp - 0x19], 0x6d
mov byte [rbp - 0x18], 0x76
mov byte [rbp - 0x17], dl
mov al, byte [rbp - 0x38]
mov al, byte [rbp + rcx - 0x38]
sub al, 7
mov byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x21
jb 0x1400177e7
mov qword [rbp - 0x60], rdx
lea rax, [rbp - 0x38]
mov qword [rbp - 0x50], rdx
or r8, 0xffffffffffffffff
mov qword [rbp - 0x48], 0xf
inc r8
cmp byte [rax + r8], dl
jne 0x140017812
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x60]
call fcn.140004fa8
lea rcx, [rbp - 0x60]
call fcn.140017144
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140020140
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140017854
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
cmp qword [rcx + 0x18], 0x10
jb 0x140017884
mov rcx, qword [rcx]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [0x14002d358]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001792c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rdi
test eax, eax
je 0x140017925
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x40]
mulsd xmm6, qword [0x140026a80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140017919
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140017914
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001791e
mov rcx, r8
call fcn.1400203ec
movaps xmm0, xmm6
jmp 0x14001796a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140017962
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001795d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017997
mov rcx, r8
call fcn.1400203ec
movsd xmm0, qword [0x140026a90]
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140020140
mov rbx, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400179a0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rdi, rdx
mov qword [rsp + 0x20], rcx
mov rbx, rcx
lea rdx, [rsp + 0x60]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140017a0d
and qword [rbx], 0
lea rdx, [0x14002672c]
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
xor r8d, r8d
mov byte [rbx], 0
jmp 0x140017ad0
cmp qword [rdi + 0x18], 0x10
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x2c], 2
mov dword [rsp + 0x30], 1
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
jb 0x140017a39
mov rdi, qword [rdi]
lea r9, [rsp + 0x20]
xor edx, edx
lea r8, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x140017a5a
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400179ea
mov rdi, qword [rsp + 0x20]
test rdi, rdi
je 0x140017a91
mov rdx, qword [rdi + 0x20]
lea r8, [rbp + 0x100]
mov r9d, 0x16
add rdx, 4
lea ecx, [r9 - 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntop]
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x140017a64
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
and qword [rbx], 0
lea rax, [rbp + 0x100]
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
or r8, 0xffffffffffffffff
mov byte [rbx], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140017abf
lea rdx, [rbp + 0x100]
mov rcx, rbx
call fcn.140004fa8
mov rax, rbx
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.140020140
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400199f8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140019a29
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140019a9c
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140019a40
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140019a42
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140019a96
test ecx, ecx
jle 0x140019a76
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x140019a96
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140019a96
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140019ab8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140019ae5
xor eax, eax
jmp 0x140019bd4
cmp qword [rcx + 0x68], 0
je 0x140019af7
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140019bd4
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140019b0e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140019b10
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140019b3d
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rsi + 0x80], 0
mov rbx, rbp
je 0x140019bce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140019b7b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
jmp 0x140019ba9
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140019bed
cmp rbp, r15
ja 0x140019b83
test rbx, rbx
je 0x140019bce
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rdi, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x140019bd1
Function at 0x140019f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140019fc9
xor eax, eax
jmp 0x14001a0dc
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140019ff2
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x140019ff2
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14001a0dc
cmp qword [rcx + 0x80], 0
je 0x14001a0da
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001a02d
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001a051
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x14001a0da
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001a09f
sub eax, 1
je 0x14001a09f
cmp eax, 2
jne 0x14001a0da
movsx ecx, byte [rbp - 0x40]
jmp 0x14001a03a
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14001a0ca
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x14001a0da
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
mov eax, esi
jne 0x14001a0dc
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140020140
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001a98c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14001a9ce
movzx eax, r14w
jmp 0x14001aaf3
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14001a9fe
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rdx, [rcx + r8*2]
cmp rcx, rdx
jae 0x14001a9fe
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void____ptr64]
mov word [rax], si
movzx eax, si
jmp 0x14001aaf3
cmp qword [rbx + 0x80], r14
je 0x14001aaf0
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001aa3c
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001aa66
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, di
je 0x14001aaf0
movzx edi, si
jmp 0x14001aaf0
lea rax, [rbp - 0x38]
mov word [rbp - 0x40], si
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3e]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001aab4
sub eax, 1
je 0x14001aab4
cmp eax, 2
jne 0x14001aaf0
movzx ecx, word [rbp - 0x40]
jmp 0x14001aa48
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x14001aadf
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x14001aaf0
lea rax, [rbp - 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rbp - 0x30], rax
movzx eax, si
jne 0x14001aaf3
movzx eax, di
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140020140
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001b670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001b6df
cmp byte [rcx + 0x71], 0
je 0x14001b6df
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001b734
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001b6f9
sub eax, 1
je 0x14001b6fd
cmp eax, 2
jne 0x14001b734
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020140
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001b72b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001b734
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001b6e1
xor al, al
jmp 0x14001b6e1

Function at 0x14001b890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14002c010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001b903
cmp byte [rcx + 0x72], 0
je 0x14001b903
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14001b958
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001b91d
sub eax, 1
je 0x14001b921
cmp eax, 2
jne 0x14001b958
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020140
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001b94f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001b958
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14001b905
xor al, al
jmp 0x14001b905
Function at 0x14001fe00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov ecx, 0x20
call fcn.1400203b0
mov rdx, qword [rsp + 0x60]
mov qword [rax], rdx
mov rdx, qword [rbx]
mov qword [rax + 8], rdx
mov rdx, qword [rdi]
mov qword [rax + 0x10], rdx
lea rcx, [0x14000ced4]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14001feb8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x14001fe8a
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140002cb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.14000ca20
sub rsp, rax
mov rax, qword [0x140046080]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8d, 0x3e
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
lea rcx, [rsp + 0x30]
call fcn.140008040
nop
call fcn.14000b9e8
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, 1
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140002d40
mov dword [rsp + 0x50], 0x270
mov r14d, dword [rsp + 0x40]
dec r14d
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov r12d, 0x80000000
xor r14d, r12d
mov ebp, 0xa
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
cmp r14d, 0x7fffffff
jne 0x140002dc7
call fcn.1400098a0
mov ecx, eax
jmp 0x140002e08
lea edi, [r14 - 0x7fffffff]
call fcn.1400098a0
mov esi, edi
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jae 0x140002e04
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x140002e04
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.1400098a0
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jb 0x140002df0
shr rcx, 0x20
lea eax, [rcx + r12]
xor eax, r12d
lea rcx, [rsp + 0x30]
cmp r13, 0xf
cmova rcx, r15
cdqe
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140002e4f
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140002e44
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140002e5f
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.140008940
sub rbp, 1
jne 0x140002db0
cmp r13, 0xf
jbe 0x140002e9c
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140002e94
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ed0
mov rcx, r15
call fcn.14000c3f0
mov rax, rbx
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.14000c3d0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14001657c
int3
Function at 0x1400098a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140009901
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400098c0
mov ecx, dword [r9]
jmp 0x1400099eb
cmp ecx, 0x4e0
jb 0x1400099eb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140009920
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140009970
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret