joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180028c40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 8
cmp qword [rbx + 0x10], rdx
jb 0x180028c6f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180028c69
mov rax, qword [rbx]
mov byte [rax + 8], 0
jmp 0x180028c7e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180028c88
mov rbx, qword [rbx]
nop
mov ecx, 0x3957427e
mov dword [rbx], 0xcc68faf2
mov edx, 9
nop
mov dword [rbx + 4], 0x3cdd666a
nop
mov byte [rbx + 8], 0x6f
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180028ca6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180028cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 8
cmp qword [rbx + 0x10], rdx
jb 0x180028cff
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180028cf9
mov rax, qword [rbx]
mov byte [rax + 8], 0
jmp 0x180028d0e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180028d18
mov rbx, qword [rbx]
nop
mov ecx, 0x2b4da5d
mov dword [rbx], 0x2fc57cab
mov edx, 9
nop
mov dword [rbx + 4], 0x29459dc5
nop
mov byte [rbx + 8], 0x3f
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180028d36
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180028d60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 8
cmp qword [rbx + 0x10], rdx
jb 0x180028d8f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180028d89
mov rax, qword [rbx]
mov byte [rax + 8], 0
jmp 0x180028d9e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180028da8
mov rbx, qword [rbx]
nop
mov ecx, 0x59adf182
mov dword [rbx], 0x3c77e47b
mov edx, 9
nop
mov dword [rbx + 4], 0xf432026e
nop
mov byte [rbx + 8], 0x78
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180028dc6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180028df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 8
cmp qword [rbx + 0x10], rdx
jb 0x180028e1f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180028e19
mov rax, qword [rbx]
mov byte [rax + 8], 0
jmp 0x180028e2e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180028e38
mov rbx, qword [rbx]
nop
mov ecx, 0x59c06da8
mov dword [rbx], 0xbd046a4f
mov edx, 9
nop
mov dword [rbx + 4], 0x48e2a25b
nop
mov byte [rbx + 8], 0xa5
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180028e56
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180028e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 8
cmp qword [rbx + 0x10], rdx
jb 0x180028eaf
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180028ea9
mov rax, qword [rbx]
mov byte [rax + 8], 0
jmp 0x180028ebe
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180028ec8
mov rbx, qword [rbx]
nop
mov ecx, 0x2c27ebf9
mov dword [rbx], 0x336a63f7
mov edx, 9
nop
mov dword [rbx + 4], 0x165d0d6
nop
mov byte [rbx + 8], 0xf
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180028ee6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180028f10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 8
cmp qword [rbx + 0x10], rdx
jb 0x180028f3f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180028f39
mov rax, qword [rbx]
mov byte [rax + 8], 0
jmp 0x180028f4e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180028f58
mov rbx, qword [rbx]
nop
mov ecx, 0x9bad4a34
mov dword [rbx], 0xafabdd31
mov edx, 9
nop
mov dword [rbx + 4], 0x339dacc1
nop
mov byte [rbx + 8], 4
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180028f76
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180028fa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 9
cmp qword [rbx + 0x10], rdx
jb 0x180028fcf
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180028fc9
mov rax, qword [rbx]
mov byte [rax + 9], 0
jmp 0x180028fde
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180028fe8
mov rbx, qword [rbx]
nop
mov ecx, 0x8ebb2627
mov dword [rbx], 0x2ef55f3b
mov edx, 0xa
nop
mov dword [rbx + 4], 0x243d4994
nop
mov word [rbx + 8], 0xd5ee
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180029008
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180029030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 9
cmp qword [rbx + 0x10], rdx
jb 0x18002905f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029059
mov rax, qword [rbx]
mov byte [rax + 9], 0
jmp 0x18002906e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029078
mov rbx, qword [rbx]
nop
mov ecx, 0x8ebb2648
mov dword [rbx], 0xc5b8e94f
mov edx, 0xa
nop
mov dword [rbx + 4], 0x8ce47b31
nop
mov word [rbx + 8], 0x4f60
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180029098
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800290c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 9
cmp qword [rbx + 0x10], rdx
jb 0x1800290ef
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800290e9
mov rax, qword [rbx]
mov byte [rax + 9], 0
jmp 0x1800290fe
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029108
mov rbx, qword [rbx]
nop
mov ecx, 0x8ebb2669
mov dword [rbx], 0xfb6e72d3
mov edx, 0xa
nop
mov dword [rbx + 4], 0xd4932552
nop
mov word [rbx + 8], 0xc9f7
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180029128
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180029150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 9
cmp qword [rbx + 0x10], rdx
jb 0x18002917f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029179
mov rax, qword [rbx]
mov byte [rax + 9], 0
jmp 0x18002918e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029198
mov rbx, qword [rbx]
nop
mov ecx, 0x6fbc0def
mov dword [rbx], 0x84fd430
mov edx, 0xa
nop
mov dword [rbx + 4], 0xd20dab56
nop
mov word [rbx + 8], 0x2db
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x1800291b8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800291e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x18002920f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029209
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x18002921e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029228
mov rbx, qword [rbx]
nop
mov edx, 0xb
mov dword [rbx], 0xdb25ea7d
mov ecx, 0x86e7ffc7
nop
mov dword [rbx + 4], 0x680fb40b
nop
mov word [rbx + 8], 0x7c7a
mov byte [rbx + 0xa], 0x54
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x18002924c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180029274
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x1800292a3
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18002929d
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x1800292b2
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x1800292bc
mov rbx, qword [rbx]
nop
mov ecx, 0x12e99ed3
mov dword [rbx], 0xc8cd46ac
mov edx, 0xb
nop
mov dword [rbx + 4], 0x75119f6a
nop
mov word [rbx + 8], 0xa062
mov byte [rbx + 0xa], 0x55
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x1800292e0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180029308
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x180029337
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029331
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x180029346
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029350
mov rbx, qword [rbx]
nop
mov ecx, 0x931dd994
mov dword [rbx], 0xd069bce9
mov edx, 0xb
nop
mov dword [rbx + 4], 0x9791c469
nop
mov word [rbx + 8], 0x5b30
mov byte [rbx + 0xa], 0x48
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180029374
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18002939c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x1800293cb
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800293c5
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x1800293da
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x1800293e4
mov rbx, qword [rbx]
nop
mov ecx, 0xd6426896
mov dword [rbx], 0xcdf605c
mov edx, 0xb
nop
mov dword [rbx + 4], 0x60b771d9
nop
mov word [rbx + 8], 0x4bc5
mov byte [rbx + 0xa], 0x3f
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180029408
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180029430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x18002945f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029459
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x18002946e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029478
mov rbx, qword [rbx]
nop
mov ecx, 0x96ab5283
mov dword [rbx], 0xdfda462a
mov edx, 0xb
nop
mov dword [rbx + 4], 0x9154aa4a
nop
mov word [rbx + 8], 0x2325
mov byte [rbx + 0xa], 0x36
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x18002949c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800294c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x1800294f3
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800294ed
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x180029502
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x18002950c
mov rbx, qword [rbx]
nop
mov ecx, 0xbfa186c1
mov dword [rbx], 0x451932e2
mov edx, 0xb
nop
mov dword [rbx + 4], 0x50e2453a
nop
mov word [rbx + 8], 0x4f9f
mov byte [rbx + 0xa], 0x13
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180029530
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180029558
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x180029587
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029581
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x180029596
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x1800295a0
mov rbx, qword [rbx]
nop
mov ecx, 0x6af7e1d4
mov dword [rbx], 0x886f105
mov edx, 0xb
nop
mov dword [rbx + 4], 0xd139c690
nop
mov word [rbx + 8], 0xf081
mov byte [rbx + 0xa], 0x50
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x1800295c4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800295ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xa
cmp qword [rbx + 0x10], rdx
jb 0x18002961b
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029615
mov rax, qword [rbx]
mov byte [rax + 0xa], 0
jmp 0x18002962a
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029634
mov rbx, qword [rbx]
nop
mov ecx, 0xc3d706f1
mov dword [rbx], 0xf8f2f762
mov edx, 0xb
nop
mov dword [rbx + 4], 0x1c02b6eb
nop
mov word [rbx + 8], 0x8811
mov byte [rbx + 0xa], 0x63
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x180029658
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180029680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x13
cmp qword [rbx + 0x10], rdx
jb 0x1800296af
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800296a9
mov rax, qword [rbx]
mov byte [rax + 0x13], 0
jmp 0x1800296be
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x1800296c8
mov rbx, qword [rbx]
nop
mov ecx, 0x76d96618
mov dword [rbx], 0x7e268c41
mov edx, 0x14
nop
mov dword [rbx + 4], 0x6ac0fb43
nop
mov dword [rbx + 8], 0x94bcead0
nop
mov dword [rbx + 0xc], 0x6bf84522
nop
mov dword [rbx + 0x10], 0xd77d943
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x1800296f9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180029720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 0xc
cmp qword [rbx + 0x10], rdx
jb 0x18002974f
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180029749
mov rax, qword [rbx]
mov byte [rax + 0xc], 0
jmp 0x18002975e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.180005910
cmp qword [rbx + 0x18], 0xf
jbe 0x180029768
mov rbx, qword [rbx]
nop
mov ecx, 0xe1c4f699
mov dword [rbx], 0xe5a83996
mov edx, 0xd
nop
mov dword [rbx + 4], 0x84a952d3
nop
mov dword [rbx + 8], 0xe9d053cc
nop
mov byte [rbx + 0xc], 0xc6
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rbx], al
inc rbx
sub rdx, 1
jne 0x18002978e
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18002a69d
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x1800515c8]
syscall
ret

Function at 0x18002a6a9
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x180050f58]
syscall
ret
Function at 0x140001290
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x260]
call fcn.140001450
nop
lea rdx, [rsp + 0x260]
cmp qword [rsp + 0x278], 0xf
cmova rdx, qword [rsp + 0x260]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003020
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000133d
mov dword [rsp + 0x20], 0x238
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000133d
lea rdx, str.cs2.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x1400013bc
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001311
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_to_inject_DLL_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003020
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
nop
mov rdx, qword [rsp + 0x278]
cmp rdx, 0xf
jbe 0x14000142a
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001425
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001425
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001353
xor dil, dil
cmp rax, 0xffffffffffffffff
je 0x14000140e
lea rdx, [rsp + 0x260]
cmp qword [rsp + 0x278], 0xf
cmova rdx, qword [rsp + 0x260]
mov rcx, rax
call fcn.140001760
movzx edi, al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
jne 0x140001373
jmp 0x140001353
call fcn.140003790
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140003770
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x140002210
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002238
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000225e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002260
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400022b9
test ecx, ecx
jle 0x140002299
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400022b9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400022b9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400022e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002302
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002318
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002334
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002336
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002372
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000240e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400023ad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400023ee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000240e
cmp rbx, rax
ja 0x1400023c0
test rbx, rbx
je 0x14000240e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000289d
xor eax, eax
jmp 0x140002a09
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400028d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400028d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002a09
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400029fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000291a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002945
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002a01
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400029b4
sub eax, 1
je 0x1400029b4
cmp eax, 2
jne 0x1400029fc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002a01
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400029e2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400029fc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002a01
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003770
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret