joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee860
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee990
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call sym.crypto_internal_edwards25519_field._Element_.reduce
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4ee8f4
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x4ee937
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x4ee963
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
test byte [rbx], al
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x4ee8ee
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x4ee8ee
nop
jb 0x4ee94a
mov rax, rsi
mov ecx, 0x20
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.crypto_internal_edwards25519_field._Element_.bytes
Function at 0x4f48c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4a06
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4f49f6
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call sym.math_big.addVV.abi0
xorps xmm15, xmm15
mov r14, qword [0x00733990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4f49db
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4f49f1
cmp rsi, rcx
ja 0x4f49e9
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4f49e1
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call sym.math_big.addVW.abi0
xorps xmm15, xmm15
mov r14, qword [0x00733990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call sym.runtime.panicSliceB
mov rax, rsi
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAcap
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.math_big.karatsubaAdd
Function at 0x4f4a60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4ba6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4f4b96
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call sym.math_big.subVV.abi0
xorps xmm15, xmm15
mov r14, qword [0x00733990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4f4b7b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4f4b91
cmp rsi, rcx
ja 0x4f4b89
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4f4b81
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call sym.math_big.subVW.abi0
xorps xmm15, xmm15
mov r14, qword [0x00733990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call sym.runtime.panicSliceB
mov rax, rsi
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAcap
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.math_big.karatsubaSub
Function at 0x4ff320
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4ff3a5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4ff506
cmp rcx, 0xe
jne 0x4ff420
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4ff506
cmp rcx, 0xf
jne 0x4ff497
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4ff506
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x505ec0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x505ed8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x505ed8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x505ee0
xor eax, eax
ret
cmp rbx, 3
je 0x505eec
cmp rbx, 4
jne 0x505f19
cmp al, 0x2c
ja 0x505f06
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x505f16
cmp al, 0x24
je 0x505f16
nop dword [rax]
cmp al, 0x26
jae 0x505f16
jmp 0x505f19
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x505f16
cmp al, 0x5b
je 0x505f16
cmp al, 0x5d
jne 0x505f19
xor eax, eax
ret
cmp al, 0x2f
ja 0x505f52
nop dword [rax]
cmp al, 0x26
ja 0x505f31
cmp al, 0x24
je 0x505f71
cmp al, 0x26
je 0x505f71
jmp 0x505feb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x505f71
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x505fe8
cmp al, 0x2f
je 0x505f71
jmp 0x505feb
cmp al, 0x3d
ja 0x505f69
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x505f71
nop
cmp al, 0x3d
je 0x505f71
jmp 0x505feb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x505fe0
cmp rbx, 2
jg 0x505fa7
cmp rbx, 1
je 0x505fa1
nop dword [rax]
cmp rbx, 2
jne 0x505feb
cmp al, 0x2f
je 0x505f92
cmp al, 0x3b
je 0x505f92
cmp al, 0x2c
jne 0x505f99
mov ecx, 1
jmp 0x505f9e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x505fca
cmp al, 0x40
je 0x505fb9
cmp al, 0x2f
je 0x505fb9
cmp al, 0x3f
jne 0x505fc2
mov ecx, 1
nop
jmp 0x505fc7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x505fd9
cmp rbx, 7
jne 0x505feb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x505fe8
cmp al, 0x7e
jne 0x505feb
xor eax, eax
ret
cmp rbx, 7
jne 0x506001
cmp al, 0x21
je 0x505ffd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x506001
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5087e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5089eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x508904
cmp rdx, 0x40
ja 0x5089dd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x508874
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x5088e0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00733990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x5089d5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x508907
mov r8, rcx
cmp r8, 0x40
jl 0x508985
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00733990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x5089c8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x5089c4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x140001140
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x14000118c
cmp rax, rbx
jne 0x14000117f
mov ebx, 1
mov esi, ebx
jmp 0x140001191
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001164
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400011a7
mov ecx, 0x1f
call fcn.140094000
jmp 0x140001216
mov eax, dword [0x140003640]
test eax, eax
jne 0x140001210
mov dword [0x140003640], ebx
lea r15, [0x140002310]
lea rdi, [0x1400022f8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001202
test eax, eax
jne 0x140001206
cmp qword [rdi], 0
je 0x1400011f7
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [vtable.q:P:H_tH_:.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400011ce
test eax, eax
je 0x140001216
mov eax, 0xff
jmp 0x1400012fc
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x14000123d
lea rdx, [0x1400022f0]
lea rcx, [0x1400022e0]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x14000124a
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001288
lea rcx, [0x140003648]
call fcn.140001510
test eax, eax
je 0x140001288
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [vtable.q:P:H_tH_:.0]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.140001a78
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x1400012b8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x1400012cd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x1400012fc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400015a4
add rsp, 0x28
jmp 0x140001140

Function at 0x1400013fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001448
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001440
cmp dword [rcx + 0x3c], edx
jl 0x140001440
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001440
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001448
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400015a0
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400044e0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.1400011e0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.enter_to_exit.
call fcn.140001ef0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002ae4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b2e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b30
xor al, al
add rsp, 0x28
ret
Function at 0x14000d6a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14000d6dc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14000d6e6
add rdi, rbx
sub rsi, rbx
jne 0x14000d6ba
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x14000fe40
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xb0]
mov rax, qword [0x140114040]
xor rax, rsp
mov qword [rsp + 0x48], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14009208c
mov rsi, rax
mov rax, qword [0x1401165a0]
and rax, r15
cmp rax, qword [0x140116588]
jne 0x14000fea5
mov rcx, r15
call fcn.140056440
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x140003810]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14000ff17
test r14, r14
je 0x14000ff0c
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400941a0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000fee8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x27a
jle 0x14000ff3c
cmp ebp, 0x5af
je 0x14000ffb7
cmp ebp, 0x27b
jne 0x14000ff46
jmp 0x14000ffb7
cmp ebp, 8
je 0x14000ffb7
cmp ebp, 0xe
je 0x14000ffb7
mov eax, dword [0x140125784]
mov ecx, dword [0x140122718]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000ffbf
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, ebp
call fcn.14004ba40
cmp byte [rbx + 0x17], 0
jns 0x14000ff86
mov rcx, qword [rsp + 0x30]
call fcn.140092084
test rsi, rsi
je 0x14000fee8
mov rcx, qword [rsi]
mov rax, qword [0x1401165a0]
and rax, rcx
cmp rax, qword [0x140116588]
jne 0x14000ffaa
call fcn.140056990
mov rcx, rsi
call fcn.140092084
jmp 0x14000fee8
mov rcx, rbx
call fcn.1400e2650
lea rcx, [0x140125784]
call fcn.140092134
cmp dword [0x140125784], 0xffffffff
jne 0x14000ff67
lea rcx, [0x140125784]
call fcn.1400920c8
jmp 0x14000ff67
Function at 0x140010ab0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x140114040]
xor rax, rsp
mov qword [rsp + 0x48], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov qword [rdx], rcx
mov qword [rdx + 8], r8
mov byte [rdx + 0x10], r9b
mov qword [rdx + 0x18], 0
lea rcx, [rsp + 0x20]
mov qword [rcx], rbx
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140010bf6
lea rcx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rsi + 0x20], rax
mov qword [rcx], rbx
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140010bf9
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x28], rax
mov eax, dword [0x14012bc00]
mov ecx, dword [0x140122718]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140010b90
mov rdx, rdi
shl rdx, 4
lea rcx, [0x14012a200]
xor r8d, r8d
call fcn.140010c00
mov qword [rsi + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
test rdi, rdi
je 0x140010bfc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400941a0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14012bc00]
call fcn.140092134
cmp dword [0x14012bc00], 0xffffffff
jne 0x140010b4e
mov al, 0xaa
lea rdx, [rsp + 0x20]
mov byte [rdx + 7], al
mov cx, 0xaaaa
mov word [rdx + 5], cx
mov word [rdx + 0x19], cx
mov dword [rdx + 0x1b], 0xaaaa00aa
mov byte [rdx + 0x1f], al
xor eax, eax
mov dword [rdx], eax
mov byte [rdx + 4], al
xorps xmm0, xmm0
movups xmmword [rdx + 8], xmm0
mov byte [rdx + 0x18], al
mov dword [rdx + 0x20], eax
lea rcx, [0x14012a200]
call fcn.14001bfa0
lea rcx, [0x14012bc00]
call fcn.1400920c8
jmp 0x140010b4e
int3
int3
int3

Function at 0x140012e40
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x140122718]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x120], 0
je 0x140012efd
mov eax, dword [0x140122718]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x160], 1
je 0x140012ef9
mov ecx, dword [rsi + 0x1928]
test ecx, ecx
jne 0x140012ef9
mov ecx, 1
lock xadd dword [rsi + 0x1928], ecx
cmp ecx, 0x7fffffff
je 0x140012f07
test rsi, rsi
je 0x140012f0a
lea rbx, [rax + 0x160]
call fcn.1400843d0
mov edx, 0x568
mov rcx, rax
xor r8d, r8d
call fcn.140010c00
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.140012f10
mov ecx, dword [0x1401261e8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rbx], rdi
lock dec dword [rsi + 0x1928]
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x140012eee
call fcn.140093458
jmp 0x140012e6a
int3
int3
Function at 0x140016500
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x140114040]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x14012bc78]
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400165f7
cmp byte [0x14012bc80], 0
je 0x140016595
lea rcx, [0x14012bc78]
mov rax, qword [0x14012bc88]
mov rdx, qword [0x14012bc90]
mov qword [0x14012bc88], rdx
mov rsi, rax
shl rsi, 0x17
xor rsi, rax
mov rax, rdx
shr rax, 0x1a
xor rax, rdx
xor rax, rsi
shr rsi, 0x11
xor rsi, rax
mov qword [0x14012bc90], rsi
add rsi, rdx
shr rsi, 0x20
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400941a0
mov eax, esi
add rsp, 0x30
pop rsi
ret
movabs rsi, 0xaaaaaaaaaaaaaaaa
xorps xmm0, xmm0
movups xmmword [0x14012bc88], xmm0
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140016608
lea rcx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [0x14012bc88], rax
mov qword [rcx], rsi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14001660b
mov rax, qword [rsp + 0x20]
mov qword [0x14012bc90], rax
mov byte [0x14012bc80], 1
jmp 0x140016532
lea rcx, [0x14012bc78]
call fcn.14007a5f0
jmp 0x140016529
int3
int3
Function at 0x140017e90
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140094140
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140114040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400c42d0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017f43
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140017f47
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.140017fa0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400941a0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140017f24
cmp eax, 2
jne 0x140017f8f
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400c42d0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x140017f96
lea rdx, [rsp + 0x40]
jmp 0x140017f1a
mov edi, 0x3f4
jmp 0x140017f24
mov edi, 0xea
jmp 0x140017f24