joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007840
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400139c0]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x140007910
cmp qword [rax + 0x60], 0
jne 0x140007930
lea rcx, [0x140012068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140007940
cmp qword [rax + 0x1d8], r12
jne 0x140007940
test byte [rax + 0x40], 0xc
jne 0x140007940
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140007940
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140007940
mov rax, qword [rbx]
test rax, rax
je 0x1400079a0
cmp qword [rax + 0x60], 0
jne 0x1400079c0
lea rcx, [0x140012068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x1400079d0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x1400079d8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x14000786b
test rax, rax
jne 0x140007930
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007876
mov rax, qword [rbx]
test rax, rax
je 0x140007970
cmp qword [rax + 0x60], 0
jne 0x140007990
lea rcx, [0x140012068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x14000794f
test rax, rax
jne 0x140007990
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x14000795a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x1400078da
test rax, rax
jne 0x1400079c0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x1400078e5
xor eax, eax
jmp 0x140007964
mov eax, 0x16
jmp 0x140007964
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000215b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002163
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x14000219a
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a320
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a365
xor al, al
jmp 0x14000a3b2
cmp word [rbx], 0
je 0x14000a37d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a370
cmp word [rsp + 0x30], 0
je 0x14000a3ab
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a3d3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a390
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b5a0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000dd08
int3
Function at 0x14000abe0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001c550
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002cd50]
lea rsi, [0x14002fd90]
mov rdi, rcx
test r11d, r11d
jne 0x14000ac59
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a3e0
test al, al
je 0x14000ad39
lea rcx, [rsp + 0x20]
call fcn.14001163c
movsxd r11, dword [0x14002cd50]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002cd50], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ac94
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ac84
add rax, 2
test ecx, ecx
jne 0x14000ac70
test edx, edx
je 0x14000acb7
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ac64
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000aca0
cmp rax, 2
jne 0x14000acbb
cmp word [rdi + 2], 0x3a
jne 0x14000acbb
mov al, 1
jmp 0x14000ad18
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ace6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ad0d
mov bl, 1
cmp dword [0x14002cd50], 0x400
jge 0x14000ad0d
mov rcx, rdi
call fcn.14001163c
movsxd rdx, dword [0x14002cd50]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002cd50], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b5a0
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000aa80
int3
Function at 0x14000ae60
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002cd58]
test rcx, rcx
je 0x14000ae9b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae8e
mov rcx, qword [0x14002cd58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002cd58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002cd68], 0
je 0x14000af8e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140026988]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002d590]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af6f
test al, 0x10
je 0x14000af6f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000af15
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000be94
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bede
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bede
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bede
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bede
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bede
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bee0
xor al, al
add rsp, 0x28
ret

Function at 0x14000dcfc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000db8f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000db8f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000db8f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000db8f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000db8f
cmp dword [rcx + 0x84], 0xe
jbe 0x14000db8f
cmp dword [rcx + 0xf8], 0
je 0x14000db8f
mov ecx, ebx
call fcn.14000dc30
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000da20
cmp dword [rbp + 0x20], 0
je 0x14000dbdc
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000dbe4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000db28
Function at 0x14001c490
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001c4b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001c4b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001430
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x70
xor ebx, ebx
mov dword [rax + 0x20], ebx
mov dword [rax + 0x18], ebx
lea rdx, [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x140001549
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
movdqa xmm0, xmmword [0x14000fc10]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14000fc20]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x14000fb00]
movdqu xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x20]
call fcn.140005f70
mov dword [rsp + 0xa8], 2
lea edx, [rbx + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140006d90
lea rcx, [rsp + 0x40]
call fcn.1400067f0
test rax, rax
je 0x140001521
movabs rsi, 0x4ec4ec4ec4ec4ec5
nop dword [rax]
nop word [rax + rax]
mov rax, rsi
mul rbx
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, bx
sub dx, cx
sub dx, 0x73
movsx eax, byte [rsp + rbx + 0x40]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rsp + 0x20]
call fcn.140006f20
inc rbx
lea rcx, [rsp + 0x40]
call fcn.1400067f0
cmp rbx, rax
jb 0x1400014d0
lea rcx, [rsp + 0x20]
call fcn.140005e00
mov edx, edi
mov rcx, rax
call fcn.140001030
lea rcx, [rsp + 0x20]
call fcn.140005e80
xor al, al
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov dword [rsp + 0x98], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0xa0], eax
sete al
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140001580
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400015f9
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400015f9
nop word [rax + rax]
lea rdx, str.Phasmophobia.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x14000160d
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400015d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x260
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x260
pop rbx
ret
Function at 0x140004740
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x68], 0
je 0x14000477b
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400048c2
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x40]
cmp qword [rax], 0
je 0x1400047a5
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
jmp 0x1400047ad
mov dword [rsp + 0x20], 0
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x70], 0
jle 0x14000486a
cmp qword [rsp + 0x28], 0
jle 0x14000486a
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x70], rax
jge 0x1400047e5
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x58]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x58]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x40]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x40]
mov qword [rcx], rax
cmp qword [rsp + 0x70], 0
jle 0x1400048b2
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x80], 0
je 0x1400048b2
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x70]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140006290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
je 0x1400062bb
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400062c2
mov al, 1
jmp 0x140006443
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x38], 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x60]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0xffffffff
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jne 0x140006316
mov dword [rsp + 0x3c], 1
jmp 0x14000631e
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x140006337
xor al, al
jmp 0x140006443
mov qword [rsp + 0x78], 0x20
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xc0]
add rcx, 0x74
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x80]
mov rdx, rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400063aa
cmp dword [rsp + 0x34], 1
je 0x1400063b6
cmp dword [rsp + 0x34], 3
je 0x140006431
jmp 0x140006441
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jbe 0x140006408
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x50], rax
je 0x140006408
xor al, al
jmp 0x140006443
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140006422
mov dword [rsp + 0x40], 1
jmp 0x14000642a
mov dword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
jmp 0x140006443
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140006443
xor al, al
add rsp, 0xb8
ret
Function at 0x14000a250
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.14000dc50
sub rsp, rax
mov r15, rcx
mov dword [rsp + 0x20], 0
movdqa xmm0, xmmword [0x14000fa60]
movdqu xmmword [rsp + 0x24], xmm0
movdqa xmm1, xmmword [0x14000fa30]
movdqu xmmword [rsp + 0x34], xmm1
movdqa xmm0, xmmword [0x14000fa90]
movdqu xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], 0x7e7a7a76
mov dword [rsp + 0x58], 0x28282828
mov dword [rsp + 0x5c], 0x28282828
mov word [rsp + 0x60], 0x1818
lea rcx, [rbp - 0x78]
call fcn.140005f70
mov dword [rsp + 0x20], 4
mov edx, 0x3e
lea rcx, [rbp - 0x78]
call fcn.140006d90
xor ebx, ebx
movabs rdi, 0x4ec4ec4ec4ec4ec5
nop word [rax + rax]
mov rax, rdi
mul rbx
shr rdx, 2
movsx eax, dx
imul ecx, eax, 0xd
movzx edx, bx
sub dx, cx
add dx, 0x18
movsx eax, byte [rsp + rbx + 0x24]
xor ax, dx
cwde
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pextrw edx, xmm0, 0
lea rcx, [rbp - 0x78]
call fcn.140006f20
inc rbx
cmp rbx, 0x3e
jb 0x14000a300
mov dword [rsp + 0x20], 2
lea rcx, [rbp - 0x78]
call fcn.140005e00
mov rbx, rax
movzx edx, byte [rbp + 0x1378]
lea rcx, [rsp + 0x68]
call fcn.140007ee0
nop
lea rcx, [rsp + 0x68]
call fcn.140006d40
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x14000a380
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000c2f0
nop
lea rcx, [rbp - 0x78]
call fcn.140005e80
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov dword [rbp + 0x1334], 0xffffffff
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [rbp + rdx*4 - 0x4c], ecx
mov eax, ecx
inc rdx
cmp rdx, 0x270
jb 0x14000a3c0
mov dword [rbp - 0x50], 0x270
lea rcx, [rsp + 0x68]
call fcn.140006e80
mov rsi, rax
lea ebx, [rax - 1]
mov rcx, r15
call fcn.140005f70
mov dword [rsp + 0x20], 3
mov r14d, 8
nop
cmp ebx, 0xffffffff
jne 0x14000a422
lea rcx, [rbp - 0x50]
call fcn.14000c760
mov edi, eax
jmp 0x14000a45c
xor ecx, ecx
xor eax, eax
test ebx, ebx
je 0x14000a43a
lea rcx, [rbp - 0x50]
call fcn.14000c760
mov ecx, eax
mov eax, 0xffffffff
xor edx, edx
div esi
mov r9d, edx
mov r8d, eax
xor edx, edx
mov eax, ecx
div esi
cmp eax, r8d
jb 0x14000a454
cmp r9d, ebx
jne 0x14000a422
xor edx, edx
mov eax, ecx
div esi
mov edi, edx
lea rcx, [rsp + 0x68]
call fcn.1400071e0
mov ecx, edi
movzx edx, byte [rax + rcx]
mov rcx, r15
call fcn.140006f20
sub r14, 1
jne 0x14000a410
lea rcx, [rsp + 0x68]
call fcn.140005e80
mov rax, r15
mov rbx, qword [rsp + 0x1480]
add rsp, 0x1440
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c760
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14000c7c1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14000c780
mov ecx, dword [r10]
jmp 0x14000c8aa
cmp ecx, 0x4e0
jb 0x14000c8aa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000c7e0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000c830
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret