joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b7180
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x120]
call fcn.1800b7030
mov r9, rax
test rax, rax
je 0x1800b71cd
mov r8, qword [rsp + 0x120]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800b735c
lea rdx, str..xXnN
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x1800b7208
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x1800b735a
cmp edi, 0x78
jne 0x1800b720a
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.1800b6e50
jmp 0x1800b721b
xor edi, edi
lea rdx, [rsp + 0x120]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x120]
lea rbp, [0x1802d1290]
cmp rax, rbx
je 0x1800b7267
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800b7255
nop dword [rax]
inc rax
mov qword [rsp + 0x120], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800b7240
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
jne 0x1800b7346
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rsi, rax
test rax, rax
je 0x1800b735a
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1800b7290
cmp rcx, 0xc8
ja 0x1800b735a
lea rdx, [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800b72b1
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub rsi, rbx
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x20], al
cmp edi, 0x78
jne 0x1800b72eb
call fcn.1800b6e50
jmp 0x1800b72f1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x120]
lea rcx, [rsp + 0x20]
cmp rax, rcx
je 0x1800b735a
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800b7325
nop dword [rax]
inc rax
mov qword [rsp + 0x120], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800b7310
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
je 0x1800b735a
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x1800b735a
mov al, 0x13
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800b735c
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800c1940
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x48
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov r9d, 0x658
mov rcx, rsi
lea r8d, [rdx + 8]
call rbp
test rax, rax
jne 0x1800c196a
add rsp, 0x48
pop rsi
pop rbp
ret
mov qword [rsp + 0x68], rbx
xor ecx, ecx
lea rbx, [rax + 0xd0]
mov word [rax + 0x10], 0x808
mov byte [rbx + 0x64], 8
mov qword [rax + 0x20], rbx
mov qword [rsp + 0x70], rdi
lea rdi, [rax + 8]
mov qword [rdi + 0x50], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [fcn.1800c1940]
mov qword [rbx + 8], rsi
mov qword [rsp + 0x40], r14
xor r14d, r14d
mov dword [rdi + 0xb0], r14d
add dword [rdi + 0xb0], 0x10000
mov qword [rdi + 0x30], r14
mov qword [rdi + 0x20], r14
lea esi, [r14 + 0x18]
mov word [rdi + 0xc], r14w
mov qword [rdi + 0x58], r14
mov qword [rdi + 0xa0], r14
mov qword [rsp + 0x30], rax
mov dword [rdi + 0xc0], r14d
mov qword [rdi + 0xb8], r14
mov word [rdi + 0xa], pe_nt_image_headers64
mov qword [rdi + 0x38], r14
mov qword [rdi + 0xa8], r14
mov dword [rdi + 0xb4], r14d
mov qword [rbx + 0x70], rdi
mov qword [rdi], r14
mov qword [rbx], rbp
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x108], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xor eax, esi
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rsp + rsi + 0x1f]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub rsi, 1
jne 0x1800c1a40
mov dword [rbx + 0x60], eax
lea rdx, [0x1800c1560]
mov dword [rbx + 0x6a], 0x19320002
xor r8d, r8d
mov qword [rbx + 0x38], r14
mov rcx, rdi
mov qword [rbx + 0x30], r14
mov byte [rbx + 0x48], r14b
mov qword [rbx + 0x100], r14
mov dword [rbx + 0x65], 0x14000008
mov qword [rbx + 0xb8], r14
mov qword [rbx + 0xb0], r14
mov qword [rbx + 0x80], r14
mov qword [rbx + 0xd0], r14
mov qword [rbx + 0xc8], r14
mov qword [rbx + 0xc0], r14
mov qword [rbx + 0xd8], r14
mov qword [rbx + 0xf0], r14
mov qword [rbx + 0xe8], r14
mov qword [rbx + 0xe0], r14
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x90], r14
mov qword [rbx + 0x88], r14
mov qword [rbx + 0xa8], r14
mov qword [rbx + 0xa0], r14
mov qword [rbx + 0x98], r14
mov qword [rbx + 0xf8], r14
mov qword [rbx + 0x10], 0x658
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x28], r14
mov qword [rbx + 0x50], r14
mov byte [rbx + 0x58], 3
mov byte [rbx + 0x6e], 0xd
mov byte [rbx + 0x69], 0x19
mov qword [rbx + 0x1e0], r14
mov qword [rbx + 0x1e8], r14
mov qword [rbx + 0x1f0], r14
mov qword [rbx + 0x1f8], r14
mov qword [rbx + 0x200], r14
mov qword [rbx + 0x208], r14
mov qword [rbx + 0x210], r14
mov qword [rbx + 0x218], r14
mov qword [rbx + 0x220], r14
call fcn.1800a7560
mov rbx, qword [rsp + 0x68]
test eax, eax
je 0x1800c1b78
mov rcx, rdi
call fcn.1800c17f0
mov rdi, r14
mov r14, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x70]
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x1800c1ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
cmp r8, 0x28
ja 0x1800c1ef5
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800c1d20
movabs rax, 0x7fffffffffffffdf
cmp rdi, rax
jae 0x1800c1f36
mov rdx, rdi
mov qword [rsp + 0x30], rbx
call fcn.1800c1cb0
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax + 0x18]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1800b45e0
int3
Function at 0x1800ca5d0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov esi, r8d
mov r11, qword [rcx + 0x10]
mov r8d, edx
mov rbx, rcx
mov r9, qword [rax]
add r9, 0x20
cmp r9, r11
jb 0x1800ca601
mov rcx, qword [rcx + 0x18]
add rcx, 0x50
jmp 0x1800ca604
mov rcx, r9
movzx edx, byte [rcx + 8]
mov qword [rsp + 0x30], rdi
test dl, 0xf
jne 0x1800ca6f2
mov rax, qword [rbx + 0x18]
add rax, 0x50
cmp rcx, rax
je 0x1800ca6f2
test dl, 0xf
jne 0x1800ca6f2
mov edx, r8d
mov rcx, rbx
xor edi, edi
call fcn.1800988f0
mov edx, esi
mov r11, rax
call fcn.1800988f0
movzx r8d, byte [r11 + 8]
mov rdx, rax
and r8b, 0xf
jne 0x1800ca666
mov rcx, qword [rbx + 0x18]
add rcx, 0x50
cmp r11, rcx
je 0x1800ca7f1
movzx ecx, byte [rax + 8]
and cl, 0xf
jne 0x1800ca680
mov rax, qword [rbx + 0x18]
add rax, 0x50
cmp rdx, rax
je 0x1800ca7f1
cmp r8b, 3
jne 0x1800ca6a2
cmp cl, r8b
jne 0x1800ca6cf
mov rcx, r11
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.1800cddc0
cmp r8b, 4
jne 0x1800ca6cf
cmp cl, r8b
jne 0x1800ca6cf
mov rdx, qword [rdx]
mov rcx, qword [r11]
call fcn.1800cdd00
mov edi, eax
shr edi, 0x1f
mov eax, edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov r8, rdx
mov r9d, 0x14
mov rdx, r11
mov rcx, rbx
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.1800cb5d0
cmp r9, r11
jb 0x1800ca6ff
mov r9, qword [rbx + 0x18]
add r9, 0x50
mov rax, qword [r9]
lea edx, [r8 - 1]
mov qword [r11], rax
mov rcx, rbx
movzx eax, byte [r9 + 8]
mov byte [r11 + 8], al
add qword [rbx + 0x10], 0x10
mov r10, qword [rbx + 0x10]
call fcn.1800988f0
lea edx, [rsi - 2]
mov rcx, qword [rax]
mov qword [r10], rcx
mov rcx, rbx
movzx eax, byte [rax + 8]
mov byte [r10 + 8], al
add qword [rbx + 0x10], 0x10
mov r10, qword [rbx + 0x10]
call fcn.1800988f0
mov rcx, qword [rax]
mov qword [r10], rcx
movzx eax, byte [rax + 8]
mov byte [r10 + 8], al
mov eax, dword [rbx + 0xb0]
add qword [rbx + 0x10], 0x10
add eax, 0x10001
mov rdx, qword [rbx + 0x10]
movzx ecx, ax
add rdx, 0xffffffffffffffd0
mov dword [rbx + 0xb0], eax
cmp ecx, 0xc8
jb 0x1800ca78e
je 0x1800ca803
cmp ecx, 0xdc
jae 0x1800ca813
mov edi, 1
mov rcx, rbx
mov r8d, edi
call fcn.1800a83b0
test rax, rax
je 0x1800ca7b4
mov rdx, rax
mov word [rax + 0x3e], 4
mov rcx, rbx
call fcn.1800cebb0
add dword [rbx + 0xb0], 0xfffeffff
mov rsi, qword [rbx + 0x10]
add rsi, 0xfffffffffffffff0
movzx eax, byte [rsi + 8]
cmp al, dil
je 0x1800ca7d3
test al, 0xf
jne 0x1800ca7d5
xor edi, edi
cmp qword [rbx + 0x40], rsi
jb 0x1800ca7ed
xor r9d, r9d
mov rdx, rsi
mov rcx, rbx
lea r8d, [r9 - 1]
call fcn.1800a9b50
mov qword [rbx + 0x10], rsi
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
lea rdx, str.C_stack_overflow
mov rcx, rbx
call fcn.1800a7040
int3
mov edx, 5
mov rcx, rbx
call fcn.1800a74b0
int3
Function at 0x1800d47c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1800d5080
mov r9, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1800d4831
lea r8, [r9 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800d47f0
mov ecx, dword [r9]
jmp 0x1800d4914
cmp ecx, 0x4e0
jb 0x1800d4914
lea r10, [r9 + 0x9c4]
mov ebx, 0xe3
mov r11d, dword [r10]
nop dword [rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800d4850
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800d48a0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1800d4cf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1800d4d51
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800d4d10
mov ecx, dword [r9]
jmp 0x1800d4e38
cmp ecx, 0x4e0
jb 0x1800d4e38
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800d4d70
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800d4dc0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800d4e80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.1800d5080
mov rdi, rax
add ebp, 0xffffffff
je 0x1800d505c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
xor r12d, r12d
nop dword [rax]
mov r9, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x1800d4f24
lea rax, [r9 + 8]
mov r10d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r10, 1
jne 0x1800d4ee0
mov ecx, dword [r9]
jmp 0x1800d5003
cmp ecx, 0x4e0
jb 0x1800d5003
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x1800d4f40
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop word [rax + rax]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x1800d4f90
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov ecx, r12d
mov dword [r9], r12d
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rdi, rax
add ebp, 0xffffffff
jne 0x1800d4ec0
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rax, r15
mov rsi, qword [rsp + 0x58]
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800d5080
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1800d50e1
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800d50a0
mov ecx, dword [r9]
jmp 0x1800d51c8
cmp ecx, 0x4e0
jb 0x1800d51c8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800d5100
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800d5150
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x1800da340
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
lea rsi, [r8 + r9]
mov r14b, 1
mov rbp, qword [rsp + 0x60]
nop word [rax + rax]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov r9, rcx
sub r9, rax
mov rdx, rsi
sub rdx, r8
cmp rdx, r9
jl 0x1800da408
mov r11, rsi
sub r11, r9
mov r9, rax
cmp rax, rcx
je 0x1800da3cb
nop word [rax + rax]
movzx r10d, byte [r9]
mov rdx, r8
sub rdx, rax
cmp byte [rdx + r9], r10b
je 0x1800da3c3
cmp r10b, 0xcc
je 0x1800da3c3
cmp r8, r11
je 0x1800da408
inc r8
mov r9, rax
jmp 0x1800da3a0
inc r9
cmp r9, rcx
jne 0x1800da3a0
mov rbx, r8
cmp r8, rsi
jae 0x1800da408
mov qword [rsp + 0x50], rbx
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1800da47f
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
test al, al
sete r14b
mov r8, qword [rdi + 8]
sub r8, qword [rdi]
add r8, rbx
test al, al
je 0x1800da370
xor r14b, 1
mov rcx, qword [rdi]
xor ebx, ebx
test rcx, rcx
je 0x1800da44e
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800da43e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800da486
mov rcx, r8
call fcn.180277944
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1800da468
mov r8, qword [rcx]
cmp rcx, rbp
setne dl
call qword [r8 + 0x20]
mov qword [rbp + 0x38], rbx
movzx eax, r14b
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1800e6170
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Dll_eject_in_10_seconds__
mov byte [0x18033c6e0], 1
mov byte [0x18033c7ac], 0
call fcn.180055e00
lea rdx, [0x180055fe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x18033c898]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x270f
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18033c850]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x270f
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18033c890]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18033c930]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.18012dc70
xor r8d, r8d
lea rcx, [0x180336ee0]
mov dl, 1
call fcn.180041650
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.18012d790
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18033c820]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18033c818]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
Function at 0x18011ee00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
mov r14, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
lea ecx, [rbp + 0x28]
call fcn.1802779bc
mov rsi, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
mov rcx, rax
call fcn.180055370
nop
mov qword [rsi + 0x20], rdi
mov qword [rsp + 0x60], rsi
mov ebx, 1
mov dword [rsp + 0x30], ebx
lea rdi, [r14 + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov r9, rsi
lea r8, [0x180121cc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r14], rax
test rax, rax
je 0x18011ee9f
mov qword [rsp + 0x60], rbp
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov dword [rdi], ebp
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3