joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400801e0
Capabilities:
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
cmp dword [0x1405d69a8], 0
jne 0x1400802c4
xorps xmm0, xmm0
mov word [rbp - 0x79], 2
xor eax, eax
lea rcx, [rbp - 0x79]
movups xmmword [rbp - 0x77], xmm0
mov dword [rbp + 0x19], eax
movups xmmword [rbp - 0x67], xmm0
mov word [rbp + 0x1d], ax
movups xmmword [rbp - 0x57], xmm0
movups xmmword [rbp - 0x47], xmm0
movups xmmword [rbp - 0x37], xmm0
movups xmmword [rbp - 0x27], xmm0
movups xmmword [rbp - 0x17], xmm0
movups xmmword [rbp - 7], xmm0
movups xmmword [rbp + 9], xmm0
call fcn.14007f5b0
lea rcx, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movaps xmm0, xmmword [rbp - 0x79]
movaps xmm1, xmmword [rbp - 0x69]
mov eax, dword [rbp + 0x47]
movaps xmmword [0x1405d6910], xmm0
movaps xmmword [0x1405d6920], xmm1
movaps xmm1, xmmword [rbp - 0x49]
movaps xmmword [0x1405d6940], xmm1
movaps xmm1, xmmword [rbp - 0x29]
movaps xmmword [0x1405d6960], xmm1
movaps xmm1, xmmword [rbp - 9]
mov dword [rbp - 0x59], eax
movaps xmm0, xmmword [rbp - 0x59]
movaps xmmword [0x1405d6930], xmm0
movaps xmm0, xmmword [rbp - 0x39]
movaps xmmword [0x1405d6950], xmm0
movaps xmm0, xmmword [rbp - 0x19]
movaps xmmword [0x1405d6970], xmm0
movaps xmm0, xmmword [rbp + 7]
movaps xmmword [0x1405d6980], xmm1
movsd xmm1, qword [rbp + 0x17]
movaps xmmword [0x1405d6990], xmm0
movsd qword [0x1405d69a0], xmm1
mov dword [0x1405d69a8], 1
lea rax, [0x1405d6910]
add rsp, 0xf0
pop rbp
ret

Function at 0x1400803a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
mov eax, r8d
shr eax, 2
test al, 1
je 0x1400803be
shr r8d, 1
and r8d, 1
inc r8d
shl r8d, 5
jmp 0x1400803db
test r8b, 3
je 0x1400803d5
shr r8d, 1
and r8d, 1
lea r8d, [r8*2 + 2]
jmp 0x1400803db
mov r8d, 1
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov ecx, 2
test eax, eax
cmovne ecx, edx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400805b0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov eax, dword [0x1405d69b8]
nop
test eax, eax
jne 0x140080617
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec eax
mov ecx, eax
shr ecx, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or eax, ecx
mov ecx, eax
shr ecx, 4
or ecx, eax
mov edx, ecx
shr edx, 8
or edx, ecx
mov eax, edx
shr eax, 0x10
or eax, edx
inc eax
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x60]
mov qword [0x1405d69c0], rax
mov eax, 1
xchg dword [0x1405d69b8], eax
mov rax, qword [0x1405d69c0]
add rsp, 0x58
ret
Function at 0x140089e90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov rbx, rcx
mov ecx, 0x20
call fcn.1401dd024
mov r9, rax
test rax, rax
je 0x140089ef4
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rdi]
mov qword [r9 + 8], rax
mov rax, qword [rsi]
mov qword [r9 + 0x10], rax
mov rax, qword [r14]
mov qword [r9 + 0x18], rax
jmp 0x140089ef7
xor r9d, r9d
mov qword [rsp + 0x30], r9
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x14008bf20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140089f4c
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401dd5d0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400902a0
Capabilities:
Load ntoskrnl

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rsp + 0xd8], rax
lea rcx, [0x1405d5148]
call fcn.140098d50
test rax, rax
jne 0x1400902e6
movzx eax, word [0x1405d5130]
test eax, eax
jne 0x1400902e6
cmp qword [0x1405d5138], 0
je 0x1400902eb
jmp 0x140090516
lea rax, str.NtShutdownSystem
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov r8b, 1
mov rdx, qword [rsp + 0x50]
lea rcx, [0x1401e0de0]
call fcn.140097da0
mov dword [0x1405d5134], eax
xor edx, edx
mov eax, dword [0x1405d5134]
mov ecx, 0x1000
div ecx
mov eax, edx
mov word [0x1405d5130], ax
mov r8d, 1
xor edx, edx
lea rcx, [0x1401e0de0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1405d5138], rax
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rsp + 0xb0]
call fcn.14008f710
nop
lea rax, [0x1405d4fb0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa8]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x40]
call fcn.1400952b0
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
call fcn.1400952e0
jmp 0x1400903bd
lea rcx, [rsp + 0xa8]
call fcn.140091320
movzx edx, byte [rsp + 0xa0]
lea rcx, [rsp + 0xa8]
call fcn.1400912d0
movzx eax, al
test eax, eax
je 0x1400904a6
lea rcx, [rsp + 0xa8]
call fcn.140091310
lea rcx, [rsp + 0xc8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x58], rax
lea rax, [0x140099750]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.140089e90
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xb0]
call fcn.14008ad60
mov qword [rsp + 0x88], rax
cmp dword [rsp + 0x98], 0
je 0x140090481
mov dword [rsp + 0x34], 1
jmp 0x140090489
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1400904a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
jmp 0x1400903b0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.14008a4b0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x48]
call fcn.1400952f0
mov qword [rsp + 0x78], rax
jmp 0x1400904e1
mov rax, qword [rsp + 0x38]
add rax, 0x10
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x38], rax
je 0x140090509
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140098c50
jmp 0x1400904d3
lea rcx, [rsp + 0xb0]
call fcn.140090d40
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1401dd5d0
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x1400915a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.1401dd068
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x140091697
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x1400916d3
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x1405d4fb0]
call fcn.14008d1d0
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x14009168d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1401dd060
cmp qword [rsp + 0x50], 0
jne 0x1400916fa
mov qword [rsp + 0x60], 0
jmp 0x14009170d
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401dd5d0
add rsp, 0xa8
ret
Function at 0x140091b20
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r13
sub rsp, 0x38
movzx eax, word [rdx + 0x14]
lea r9, [rdx + 0x18]
mov r10d, dword [rdx + 0x90]
add r9, rax
movzx eax, word [rdx + 6]
mov rbp, rdx
mov r13, rcx
lea r8, [rax + rax*4]
lea r11, [r9 + r8*8]
cmp r9, r11
jae 0x140091b72
mov ecx, dword [r9 + 0xc]
cmp r10, rcx
jb 0x140091b69
mov eax, dword [r9 + 8]
add eax, ecx
cmp r10, rax
jb 0x140091c13
add r9, 0x28
cmp r9, r11
jb 0x140091b51
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test r10d, r10d
je 0x140091beb
cmp dword [rdx + 0x94], 0
je 0x140091beb
lea rbx, [rax + 0x10]
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx - 4]
add rdx, rbp
mov qword [rsp + 0x58], rbx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140091beb
nop dword [rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140091be2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140091c25
add rdx, 0x28
cmp rdx, r9
jb 0x140091bd0
mov al, 1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
pop r13
pop rbp
ret
mov eax, dword [r9 + 0x14]
sub rax, rcx
add rax, r10
add rax, r13
jmp 0x140091b74
mov r15d, dword [rdx + 0x14]
sub r15, rcx
add r15, r8
add r15, r13
je 0x140091beb
mov rdx, r15
lea rcx, str._nModuleName:__s
call fcn.14009d8f0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
je 0x140091d6e
movzx r8d, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add r8, 0x18
mov r9d, dword [rbx]
add r8, rbp
lea rdx, [rcx + rcx*4]
lea r10, [r8 + rdx*8]
cmp r8, r10
jae 0x140091c9d
nop dword [rax + rax]
mov ecx, dword [r8 + 0xc]
cmp r9, rcx
jb 0x140091c94
mov eax, dword [r8 + 8]
add eax, ecx
cmp r9, rax
jb 0x140091cc2
add r8, 0x28
cmp r8, r10
jb 0x140091c80
xor r14d, r14d
mov rdi, qword [r14]
test rdi, rdi
je 0x140091d57
jns 0x140091cd1
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
movzx edx, di
jmp 0x140091d20
mov r14d, dword [r8 + 0x14]
sub r14, rcx
add r14, r9
add r14, r13
jmp 0x140091ca0
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add rax, 0x18
add rax, rbp
lea rdx, [rcx + rcx*4]
lea r8, [rax + rdx*8]
cmp rax, r8
jae 0x140091d0b
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp rdi, rdx
jb 0x140091d02
mov ecx, dword [rax + 8]
add ecx, edx
cmp rdi, rcx
jb 0x140091d60
add rax, 0x28
cmp rax, r8
jb 0x140091cf0
xor esi, esi
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rdx, [rsi + 2]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, rbx
sub rdi, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rdi + r12]
mov qword [r14], rax
add r14, 8
mov rdi, qword [r14]
test rdi, rdi
jne 0x140091cac
mov rbx, qword [rsp + 0x58]
add rbx, 0x14
jmp 0x140091ba4
mov esi, dword [rax + 0x14]
sub rsi, rdx
add rsi, rdi
add rsi, r13
jmp 0x140091d0d
jmp 0x140091bed
Function at 0x140092070
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
mov qword [rax], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x2b0]
call fcn.1400963f0
test eax, eax
jne 0x140092189
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x2b0]
call fcn.140090a70
mov eax, dword [rsp + 0x20]
jmp 0x1400921d7
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140092136
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x2b0]
call fcn.140090a70
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401dd5d0
add rsp, 0x2a0
pop rdi
ret
Function at 0x1400922a0
Capabilities:
Enumerate threads

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x80
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
mov qword [rax], 0
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x1c
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x5c], eax
jne 0x14009239f
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov eax, dword [rsp + 0x20]
jmp 0x1400923e0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140092362
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401dd5d0
add rsp, 0x80
pop rdi
ret
Function at 0x140092a60
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push r12
push r14
push r15
mov r10d, dword [r8 + 0xb0]
mov rsi, r8
mov r12, rdx
mov r15, rcx
test r10d, r10d
je 0x140092ab6
movzx r9d, word [r8 + 0x14]
movzx r11d, word [rsi + 6]
add r9, 0x18
add r9, r8
xor r8d, r8d
test r11d, r11d
je 0x140092ab6
mov edx, dword [r9 + 0xc]
cmp r10d, edx
jb 0x140092aaa
mov ecx, dword [r9 + 8]
add ecx, edx
cmp r10d, ecx
jb 0x140092ac0
inc r8d
add r9, 0x28
cmp r8d, r11d
jl 0x140092a96
xor al, al
pop r15
pop r14
pop r12
pop rsi
ret
mov r14d, dword [r9 + 0x14]
sub r10d, edx
mov eax, r10d
add rax, r12
add r14, rax
je 0x140092ab6
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rsi + 0xb4], ebp
jbe 0x140092bb1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r13
mov r13d, 0xf000
nop word [rax + rax]
mov edi, dword [r14 + 4]
lea r10, [r14 + 8]
movzx eax, word [rsi + 0x14]
sub rdi, 8
movzx ebx, word [rsi + 6]
add rax, 0x18
mov r11d, dword [r14]
add rax, rsi
shr rdi, 1
xor r9d, r9d
test ebx, ebx
je 0x140092b50
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp r11d, r8d
jb 0x140092b44
mov edx, dword [rax + 8]
add edx, r8d
cmp r11d, edx
jb 0x140092bc0
inc r9d
add rax, 0x28
cmp r9d, ebx
jl 0x140092b30
xor r8d, r8d
xor ecx, ecx
test rdi, rdi
je 0x140092b8f
mov r9d, 0xa000
movzx eax, word [r10]
movzx edx, ax
and ax, r13w
cmp ax, r9w
jne 0x140092b82
and edx, 0xfff
mov rax, r15
sub rax, qword [rsi + 0x30]
add qword [rdx + r8], rax
inc ecx
add r10, 2
mov eax, ecx
cmp rax, rdi
jb 0x140092b60
add ebp, dword [r14 + 4]
mov r14, r10
cmp ebp, dword [rsi + 0xb4]
jb 0x140092b00
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov al, 1
pop r15
pop r14
pop r12
pop rsi
ret
sub r11d, r8d
mov r8d, dword [rax + 0x14]
lea rax, [r12 + r11]
add r8, rax
jmp 0x140092b53
Function at 0x1400935d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1405d4300]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400936a3
cmp byte [rcx + 0x71], 0
je 0x1400936a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14009369f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140093664
sub eax, 1
je 0x140093668
cmp eax, 2
jne 0x14009369f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401dd5d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140093696
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14009369f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14009364c
xor al, al
jmp 0x14009364c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401dd5d0
add rsp, 0x60
pop rbx
ret
Function at 0x140093f10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140094250
mov r9, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140093f81
lea r8, [r9 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140093f40
mov ecx, dword [r9]
jmp 0x140094067
cmp ecx, 0x4e0
jb 0x140094067
lea r10, [r9 + 0x9c4]
mov ebx, 0xe3
mov r11d, dword [r10]
nop dword [rax]
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140093fa0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140093ff0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400940c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140094121
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400940e0
mov ecx, dword [r9]
jmp 0x14009420b
cmp ecx, 0x4e0
jb 0x14009420b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140094140
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140094190
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret