joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057aac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14028fa08]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x140057b15
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140057b20
lea rdx, [0x14024a3e0]
mov rcx, rbx
mov rdi, rax
call fcn.140043414
mov rbx, rax
test rax, rax
je 0x140057b15
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140072c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x140072e21
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140072cd2
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x140072cf4
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x140265e30]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x140072e14
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140072d42
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x140072d46
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14006dff0
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.140070464
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x1c]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x20]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x140072d31
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x140072c80
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007e79c
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rdx
mov eax, 0x5e6ea9af
mul r8d
mov ebx, r8d
xor r9d, r9d
shr edx, 0xb
mov r10d, 1
imul eax, edx, 0x15b0
sub ebx, eax
test r8d, r8d
je 0x14007e88e
xor ecx, ecx
cmp ebx, 7
jbe 0x14007e83b
lea edx, [rcx + 7]
movzx eax, byte [r11]
add ecx, 8
add r10d, eax
add edx, 8
movzx eax, byte [r11 + 1]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 2]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 3]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 4]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 5]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 6]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 7]
add r9d, r10d
add r10d, eax
add r11, 8
add r9d, r10d
cmp edx, ebx
jb 0x14007e7d6
cmp ecx, ebx
jae 0x14007e858
mov eax, ebx
sub eax, ecx
mov ecx, eax
movzx eax, byte [r11]
inc r11
add r10d, eax
add r9d, r10d
sub rcx, 1
jne 0x14007e845
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r9d, ecx
sub r8d, ebx
mov ebx, 0x15b0
jne 0x14007e7cc
mov rbx, qword [rsp + 8]
shl r9d, 0x10
lea eax, [r10 + r9]
ret

Function at 0x140081110
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.140046fa8
mov rcx, qword [0x14028fc28]
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x28]
sub ecx, dword [rsp + 0x20]
movd xmm1, ecx
mov ecx, dword [rsp + 0x2c]
sub ecx, dword [rsp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x30]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm1
movss dword [rbx + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xorps xmm1, xmm1
sub rax, qword [0x14028fc30]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14028fc38]
mov ecx, reloc.WS2_32.dll_recvfrom
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rsp + 0x30]
mov qword [0x14028fc30], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rbx + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [rbx + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x12b], 0
mov byte [rbx + 0x12a], al
call fcn.140081044
cmp byte [rbx + 0xc8], 0
je 0x140081203
or eax, 0xffffffff
jmp 0x140081210
mov rax, qword [0x14028fa08]
mov eax, dword [rax + 0x1d70]
cmp dword [reloc.WS2_32.dll_htonl], eax
je 0x140081223
mov dword [reloc.WS2_32.dll_htonl], eax
call fcn.140080f98
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140225770
add rsp, 0x40
pop rbx
ret
Function at 0x14009cb3c
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
xor r9d, r9d
mov rbx, r8
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
lea r8d, [r9 + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14009cbb6
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rdi
lea r8d, [r9 + 0x30]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 8
jb 0x14009cbb6
cmp dword [rsp + 0x20], 0x10264511
jne 0x14009cbb6
cmp dword [rsp + 0x24], 2
jne 0x14009cbb6
mov rax, qword [rsp + 0x28]
mov qword [rbx], rax
mov al, 1
jmp 0x14009cbb8
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140225770
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret

Function at 0x14009cc48
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140225770
add rsp, 0x1d8
ret

Function at 0x14009cc94
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
mov ebx, 2
mov ecx, 0x7f000001
mov word [rsp + 0x20], bx
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, 0x6d70
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
xor r8d, r8d
lea edx, [rbx - 1]
mov ecx, ebx
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14009ccf5
or rax, 0xffffffffffffffff
jmp 0x14009cd1c
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14009cd19
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14009ccef
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140225770
add rsp, 0x40
pop rbx
ret
Function at 0x14009d2c4
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14009d2fd
xor eax, eax
jmp 0x14009d358
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x14009d320
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x4c]
lea rcx, str.FortniteClient_Win64_Shipping.exe
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14009d349
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14009d320
jmp 0x14009d34d
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140225770
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret

Function at 0x14009d37c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14009d3f1
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14009d3f1
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14009d460
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x14009d464
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x14009d464
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1402640e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x14009d464
xor al, al
jmp 0x14009d4c0
movups xmm0, xmmword [rbx]
movups xmmword [0x140290100], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [0x140290110], xmm1
mov eax, dword [rbx + 0x18]
mov dword [0x140290118], eax
movzx eax, word [rbx + 0x1c]
mov word [0x14029011c], ax
movups xmm0, xmmword [r8]
movups xmmword [0x140290120], xmm0
movsd xmm1, qword [r8 + 0x10]
movsd qword [0x140290130], xmm1
mov eax, dword [r8 + 0x18]
mov dword [0x140290138], eax
movzx eax, word [r8 + 0x1c]
mov word [0x14029013c], ax
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14009d4c8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
mov rbx, rdx
mov edx, 0x1000
mov r8d, edx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14009d553
movups xmm0, xmmword [0x140290100]
mov r8d, Ordinal_45
mov rdx, rbx
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140290110]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x140290118]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14029011c]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
setg al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a05c8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x14028fba4]
movsxd rcx, dword [0x14028fafc]
xor eax, eax
cmp ecx, 0x7b
ja 0x1400a060a
mov rax, rcx
lea rcx, [0x14028d760]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
and qword [rbp - 0x18], 0
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
test rax, rax
jne 0x1400a064e
mov qword [rbp - 0x18], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x140264398]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], 0
jmp 0x1400a065e
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400a655c
mov rdx, qword [rbp - 0x10]
cmp edi, 1
jne 0x1400a06ae
lea eax, [rdi + 8]
cmp rdx, rax
jb 0x1400a0694
lea rbx, [rbp - 0x28]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov r8d, eax
lea rdx, str.Input_key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
jmp 0x1400a06aa
lea r9, str.Input_key
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400aa5f8
mov rdx, qword [rbp - 0x10]
mov dword [rbp - 0x30], 0x42fa0000
mov dword [rbp - 0x2c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp rdx, 0xf
cmova rcx, qword [rbp - 0x28]
xor r8d, r8d
lea rdx, [rbp - 0x30]
call fcn.140082714
test al, al
je 0x1400a06fc
test edi, edi
jne 0x1400a06fc
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400a0564]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400a073a
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0735
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a0735
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140225e3c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140225770
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400a30ac
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x12f0]
mov eax, 0x13f0
call fcn.140226700
sub rsp, rax
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rbp + 0x12e0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
mov r8d, 0x3e
lea rdx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
lea rcx, [rsp + 0x30]
call fcn.1400a9fcc
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
or dword [rbp + 0x12d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov r13d, 1
mov ecx, r13d
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
add rcx, r13
cmp rcx, r8
jb 0x1400a313f
mov dword [rsp + 0x50], r8d
mov r15d, dword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], r13d
mov r14d, 0xa
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x30]
lea r9d, [r15 - 1]
xor r8d, r8d
lea rdx, [rsp + 0x50]
call fcn.1400abee0
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rdi
cdqe
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x1400a31e2
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400a31d7
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400a31f0
xor r8d, r8d
mov rdx, r13
mov rcx, rbx
call fcn.1400aa228
sub r14, r13
jne 0x1400a3194
cmp rsi, 0xf
jbe 0x1400a322f
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a3227
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a3227
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140225e3c
mov rax, rbx
mov rcx, qword [rbp + 0x12e0]
xor rcx, rsp
call fcn.140225770
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x1400abd84
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 4
jb 0x1400abd91
mov rax, rcx
ret

Function at 0x1400abe5c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140282140]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140226268
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400acb68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400abecf
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140225770
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400ac930
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
mov r10d, 0x270
mov r8, rcx
cmp dword [rcx], r10d
jne 0x1400ac981
lea r9, [rcx + 8]
mov edx, dword [r9 - 4]
xor edx, dword [r9]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x62c]
xor ecx, edx
mov dword [r9 + 0x9b8], ecx
sub r10, 1
jne 0x1400ac946
jmp 0x1400ac98e
cmp dword [rcx], 0x4e0
jb 0x1400ac98e
call fcn.1400aca14
mov eax, dword [r8]
mov edx, dword [r8 + rax*4 + 4]
inc eax
mov dword [r8], eax
mov ecx, edx
mov eax, dword [r8 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x28
ret

Function at 0x1400aca14
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400aca2b
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400aca76
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x1400afe50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400afe80
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400afef8
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400afe97
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400afe99
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400afef2
test ecx, ecx
jle 0x1400afed2
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.14022d7ec
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400afef2
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400afef2
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400aff14
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400aff34
xor eax, eax
jmp 0x1400b001d
cmp qword [rcx + 0x68], 0
je 0x1400aff46
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400b001d
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400aff5d
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400aff5f
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400aff91
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14022d7ec
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400b0017
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400affc8
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400afff2
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1400b0017
cmp rdi, rbx
ja 0x1400affcf
test rdi, rdi
je 0x1400b0017
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret