joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400149b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400149d0
xor al, al
jmp 0x140014a51
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400149e3
xor al, al
jmp 0x140014a51
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014a0d
xor al, al
jmp 0x140014a51
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014a21
xor al, al
jmp 0x140014a51
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014a33
xor al, al
jmp 0x140014a51
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014a4f
xor al, al
jmp 0x140014a51
mov al, 1
add rsp, 0x38
ret

Function at 0x1400112b2
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x140011a10
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e1f8]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x140024105]
call fcn.140011393
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 2
jae 0x140011a6d
xor eax, eax
jmp 0x140011ab8
mov dword [rbp + 0x60], 0x40
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x68]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 2
jae 0x140011ab3
xor eax, eax
jmp 0x140011ab8
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad00]
call fcn.140011320
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140011b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x140024105]
call fcn.140011393
mov rax, qword [rbp + 0x1e0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xc4], 0
jmp 0x140011bf4
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x1c]
cmp dword [rbp + 0xc4], eax
jae 0x140011c81
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rcx, qword [rbp + 0xe8]
call fcn.140011384
cmp eax, dword [rbp + 0x1e8]
jne 0x140011c7c
mov r8d, dword [rbp + 0x1e8]
mov rdx, qword [rbp + 0xe8]
lea rcx, str.successfully_found___s____d_n
call fcn.140011401
mov eax, dword [rbp + 0xc4]
mov rcx, qword [rbp + 0xa8]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x1e0]
add rcx, rax
mov rax, rcx
jmp 0x140011c83
jmp 0x140011be6
xor eax, eax
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1400026b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x14016de14], 0
lea rdi, [0x14016de10]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002788
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1400026e0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x1400027be
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x1400027a0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1400027ff
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400027e3
cmp byte [r8], r9b
jne 0x1400027e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1400027d0
not eax
pop rdi
ret
Function at 0x140013f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0xb0
xor eax, eax
movsxd r13, r9d
mov dword [rsp + 0xe8], eax
mov r14, rdx
mov qword [rsp + 0x60], r13
mov rbp, rcx
test r9d, r9d
jle 0x14001416e
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
mov r11d, 0x100
movss xmm8, dword [0x1400d9cf0]
nop dword [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140013fdc
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140013ffb
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
movzx eax, byte [rbp + 0x20]
xor edi, edi
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x140014116
mov r15, qword [rsp + 0xf0]
mov rax, r12
mov r13d, dword [rsp + 0xe8]
add r15, 6
shl rax, 4
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140014050
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x140014053
mov edx, dword [rax + rsi]
mov rcx, r14
call fcn.14000f0f0
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.140011b70
movzx eax, word [rbp + 0x20]
inc r13d
sub ax, word [rsp + 0x50]
inc r12
dec ax
inc edi
add ax, word [rbp + 0x1c]
add rsi, 4
add ax, word [rsp + 0x54]
mov word [r15 - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x58]
dec ax
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x5c]
mov word [r15], ax
add r15, 0x10
cmp edi, dword [rbx - 0x10]
jl 0x140014040
mov dword [rsp + 0xe8], r13d
mov r11d, 0x100
mov r13, qword [rsp + 0x60]
add rbx, 0x28
sub r13, 1
mov qword [rsp + 0x60], r13
jne 0x140013f90
mov eax, dword [rsp + 0xe8]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop r14
pop r13
pop rbp
ret
Function at 0x14001c800
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14001c828
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001c84e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001c850
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001c8a9
test ecx, ecx
jle 0x14001c889
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001c8a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001c8a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14001c8d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001c8f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14001c908
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001c924
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001c926
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001c962
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001c9fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001c99d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14001c9de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14001c9fe
cmp rbx, rax
ja 0x14001c9b0
test rbx, rbx
je 0x14001c9fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14001ce60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ee098]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001ce8d
xor eax, eax
jmp 0x14001cfea
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14001ceb8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14001ceb8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14001cfea
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001cfdd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001cefb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001cf26
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001cfe2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001cf95
sub eax, 1
je 0x14001cf95
cmp eax, 2
jne 0x14001cfdd
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001cfe2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001cfc3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001cfdd
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14001cfe2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400b4d80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001d2c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400ee098]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001d393
cmp byte [rcx + 0x71], 0
je 0x14001d393
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14001d38f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001d354
sub eax, 1
je 0x14001d358
cmp eax, 2
jne 0x14001d38f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b4d80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001d386
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001d38f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001d33c
xor al, al
jmp 0x14001d33c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b4d80
add rsp, 0x60
pop rbx
ret
Function at 0x1400221a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x24], ebp
lea r15d, [rbp + 0x1e]
mov rax, qword gs:[0x58]
mov r12, qword [rax]
mov edi, Ordinal_60
mov eax, dword [rdi + r12]
mov ebx, 0x40
test al, 1
jne 0x14002224a
or eax, 1
mov dword [rdi + r12], eax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [r12 + rbx + 0x1384], 0xffffffff
mov dword [r12 + rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
add r8, r12
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140022220
mov dword [r12 + rbx], 0x270
mov eax, dword [rdi + r12]
mov r13d, 0x13c8
test al, 2
jne 0x14002226c
or eax, 2
mov dword [rdi + r12], eax
mov qword [r12 + r13], rbp
mov qword [r12 + r13 + 8], 0x46
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov dword [rsp + 0x24], 1
mov rdx, r15
mov rcx, rsi
call fcn.140044b80
mov qword [rsi + 0x10], rbp
add rbx, r12
movzx edi, byte [rsp + 0x20]
dec r15
mov qword [rsp + 0x28], rbx
mov rbp, qword [r12 + r13]
mov rdx, qword [r12 + r13 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x1400222d8
mov rcx, rbx
call fcn.14004ca30
mov r14d, eax
shl r14, 0x20
mov rcx, rbx
call fcn.14004ca30
mov eax, eax
or r14, rax
jmp 0x1400222e8
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14004b6f0
mov r14, rax
lea rax, [r14 + rbp]
lea rcx, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_____
movzx r9d, byte [rax + rcx]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x140022324
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140022319
mov rax, qword [rsi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140022335
movzx r8d, dil
mov edx, 1
mov rcx, rsi
call fcn.14001d730
test r15, r15
jne 0x1400222a0
mov rax, rsi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140022680
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x13f0
call fcn.1400b5c90
sub rsp, rax
mov rax, qword [0x1400ee098]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x24], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bpl
mov dword [rsp + 0x24], 1
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rbp + 1]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140022700
mov dword [rsp + 0x50], 0x270
movzx edi, byte [rsp + 0x20]
movzx ebx, byte [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14004ca30
mov ecx, eax
shl rcx, 4
shr rcx, 0x20
cmp ecx, 0xa
jge 0x1400227b0
mov edx, ecx
lea rcx, [rsp + 0x30]
call fcn.14001eaa0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140022765
mov rax, qword [rax]
mov rdx, rax
mov rcx, rsi
call fcn.140043460
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400227f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400227a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022886
call fcn.1400b5358
jmp 0x1400227f3
add cl, 0x57
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
cmp rdx, r8
jae 0x1400227de
lea rax, [rdx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp r8, 0x10
jb 0x1400227d4
mov rax, qword [rsi]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x1400227f3
movzx r9d, cl
movzx r8d, dil
mov edx, 1
mov rcx, rsi
call fcn.14001d730
lea r14d, [rbp + 1]
mov eax, r14d
and eax, 0x80000003
jge 0x140022808
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14002284e
cmp ebp, 0xf
je 0x14002284e
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x14002283a
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140022832
mov rax, qword [rsi]
mov word [rax + rcx], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14002284e
mov r9b, reloc.WLDAP32.dll_Ordinal_45
movzx r8d, bl
mov edx, 1
mov rcx, rsi
call fcn.14001d730
mov ebp, r14d
cmp r14d, 0x10
jl 0x140022731
mov rax, rsi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400b4d80
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140022890
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.1400b5c90
sub rsp, rax
mov rax, qword [0x1400ee098]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x24], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea r8d, [rbx + 0x3e]
lea rdx, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
lea rcx, [rsp + 0x30]
call fcn.14001d630
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rbx + 1]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140022920
mov dword [rsp + 0x50], 0x270
mov r15d, dword [rsp + 0x40]
dec r15d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
xor r8d, r8d
lea rdx, [0x1400c8816]
mov rcx, rdi
call fcn.14001d630
mov dword [rsp + 0x24], 1
mov r14d, reloc.WLDAP32.dll_Ordinal_30
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
movzx ebx, byte [rsp + 0x20]
nop dword [rax]
lea rcx, [rsp + 0x50]
cmp r15d, 0xffffffff
jne 0x1400229a4
call fcn.14004ca30
mov ecx, eax
jmp 0x1400229e8
lea esi, [r15 + 1]
call fcn.14004ca30
mov ebp, esi
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jae 0x1400229e4
mov eax, esi
neg eax
xor edx, edx
div esi
mov esi, edx
cmp ecx, edx
jae 0x1400229e4
nop word [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.14004ca30
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jb 0x1400229d0
shr rcx, 0x20
lea rdx, [rsp + 0x30]
cmp r13, 0x10
cmovae rdx, r12
movsxd rax, ecx
movzx r9d, byte [rax + rdx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140022a29
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140022a1e
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140022a3a
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.14001d730
sub r14, 1
jne 0x140022990
cmp r13, 0x10
jb 0x140022a7f
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140022a77
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140022a77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400b5358
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400b4d80
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret