joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011fa6d
Capabilities:
Manually build aes constants

Disassembly:
neg byte [rsp + rsi - 0xa56ffeb]
xor r9w, ax
dec ebp
xchg r11w, dx
cmove r11, rbp
lea rax, [rsp + rax + 0x18]
mov rsi, qword [rax + rsi*2 - 0x14ae0000]
shr dl, cl
mov qword [rsp + rcx*2 + 0x1fff2], rdx
lea rdi, [rdi + rcx + 0xfff1]
sal bx, 0xe3
mov qword [rdi + rcx + 0xfff9], rsi
and rcx, 0x658b0617
pop rdx
pop rcx
pop rbp
jne fcn.14014e84a
mov edx, 0x6fb9d0a8
rol dx, 0x48
jae 0x140242512
mov ebp, 0x552421bd
movzx r9d, bp
lea rdi, [rdi + rbp - 0x552421c1]
xadd r9, rbp
movsx ebx, bp
push rbx
mov ebp, dword [rbp + rdi - 0x21bd]
jnp 0x1402ab0d0
lea rdi, [rdi + rdx - 0x6fb9a8d4]
mov ebx, dword [rdi + rdx - 0x6fb9a8d0]
movzx ecx, dx
xor ebx, esi
mov r8d, edx
mov ebp, r8d
push rbp
lea ebx, [rcx + rbx + 0x181350d7]
movsx eax, bp
neg ebx
call fcn.14022ee73
or dword [rsp + rbx*8 - 0x10de4], ebx
xor ebp, esi
movzx edx, bl
movsx r8d, byte [rsp + r9 - 0x55244377]
lea ebp, [rbp + rbx - 0x72142569]
shl r9d, 0xef
rol r9w, 0x81
xor ebp, 0xfa2fb114
not ebp
xadd word [rsp + r9 - 0x21bcfffb], dx
neg ebp
lea ebp, [rbp + rbx*2 - 0x988b081]
mov qword [rsp + r9*2 - 0x437a0000], rsi
xor dword [rsp + rbx*2 - 0x437a], ebp
movsx ecx, dl
mov eax, 0xd08c7024
pop rsi
jmp 0x1401a0786

Function at 0x14012340c
Capabilities:
Hash data using murmur3

Disassembly:
dec cx
mov qword [rsp + rbx], 0xffffffffcd97469f
mov r11d, dword [r11 + rbx]
sar byte [rsp + rbx + 6], 0xe1
sub r8d, ecx
pop rbp
jle fcn.1402a2318

Function at 0x140123866
Capabilities:
Hash data using murmur3

Disassembly:
adc r10, rbx
call fcn.1401e07a1
mov r9d, 0xb8373e3d
lea rax, [r9 - 0x4e7901df]
mov esi, dword [rdi + rax - 0x69be3c5e]
call fcn.1402a6a1b
lea rdi, [rdi + rdx + 4]
movsx r11d, dx
je 0x1402c3010
jmp 0x1401faaf0
mov bp, word [rdi]
mov edx, 0x3528f9a5
mov dx, word [rdi + rdx*2 - 0x6a51f348]
mov r9d, 0x99a65885
mov cl, byte [rdi + riz + 4]
movsx eax, r9b
lea r8, [rax*2 - 0x33c119d6]
and r9, 0x4b81c72a
lea rdi, [rdi + r9*8 - 0x4c01fffc]
lea r9, [r9*2 - 0x2dcc6e43]
push rax
push r8
shrd bp, dx, cl
mov word [rdi + r9*4 + 0x6b2fb90c], bp
lea rsi, [rsi + r9 + 0x1acbee3f]
movsx ecx, r8w
shl word [rsp + r9*4 + 0x6b2fb915], 0x83
mov ebx, dword [rsi + r9 + 0x1acbee43]
xor ebx, r11d
dec ebx
call fcn.14022c1c2
movzx eax, r11w
xor ebx, r10d
lea rcx, [rax + rdx*2 + 0x4989c431]
dec ebx
lea r9, [rcx + 0x35816f02]
call fcn.1401cdcba

Function at 0x14016398e
Capabilities:
Hash data using murmur3

Disassembly:
push r12
push 0x3303202a
mov qword [rsp], rbx
call fcn.1401cfae9
ror rax, cl
lea r8, [rax + r9*8 + 0x5236e02d]
movsxd r10, r10d
ror bx, 0xce
bt r8, 0x13
jae 0x140219bff
add r11, r10
sub rbx, 0x6b1b0210
mov bp, word [rbx + rbp - 0x50a2387d]
jno fcn.1402bd294
jmp 0x14026676c
jmp 0x14011d68b
Function at 0x1401752a2
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + r10 - 0x3690014e], rcx
mov qword [rsp + r11*4 - 0x27a00], rdi
dec r10
movzx edi, bl
inc r11w
xor dword [rsp + r10 - 0x3690014d], eax
pop rdi
shl dl, 0xc6
adc cl, 0xb
movsxd rax, eax
lea rdx, [r10 + r10 - 0x74f50471]
je 0x14014ebd3
add r8, rax
lea r9, [rdx + r9 + 0x7d501d5]
movzx ecx, word [r10 + r9 - 0x3690014d]
shl ebx, 0x77
mov eax, 0x4abb9d83
xor cx, di
ror edx, 0xf7
sal r11w, 0x2e
dec cx
xor ax, ax
dec r11b
xor cx, 0x4d1f
push rbx
pop rbp
add cx, 0xb0a3
sar r10, 0x55
rol al, 0xe1
sbb r11d, edx
xor cx, 0xd2b8
btr r10w, dx
shl ebp, 0xdb
not cx
cwd
xor di, cx
lea rbp, [rbp + rbx*4 + 0x52036a87]
add rcx, rsp
lea r11, [rbx - 0x3d7236de]
and al, bpl
not al
adc bl, byte [rcx + r10 - 0x1b4]
add rbp, rax
sub bp, r10w
cwd
lea rsi, [r10 + rsi - 0x1b6]
cqo
xor rax, r11
mov word [r10 + rsi - 0x1b4], bx
cdqe
cdq
mov ecx, 0xb331972d
jns fcn.1401df8bc
mov ebp, 0xdfb0b68a
movzx edx, bp
movzx ebx, dl
mov rbp, r10
jmp 0x1402d0356

Function at 0x1401c79f7
Capabilities:
Manually build aes constants

Disassembly:
ror si, 1
neg si
push r11
sar rbp, cl
pop r11
xor r9w, si
dec eax
shr dx, 0xc6
lea rsi, [rsp + rsi + 8]
inc rcx
inc bpl
btc ebx, eax
mov bx, word [rsi + rbp*2 - 2]
lea rdi, [rdi + rbp - 3]
bt ax, 0x29
sar r11d, cl
mov word [rdi + rbp*2 - 2], bx
mov qword [rsp + rbp*2 - 2], 0xffffffff86afd917
or dword [rsp + rbp - 1], eax
jae 0x14024b92f
pop rbx
js fcn.14014e84a
mov ebp, 0xd1a0073a
mov ax, word [r10 + riz]
imul ebp, ebp
adc r10, 1
sar ebp, 0xba
movzx edi, bpl
movzx ebp, word [r11 + rdi*2 - 0x1de]
lea rcx, [rdi - 0x7547ca80]
xchg cl, dil
call fcn.1401ebef9
mov r11d, 0xcb9ec23d
movsx edi, r11b
push r11
movzx r11d, word [rbp + rdi*2 - 0x7a]
movsx eax, di
lea rbp, [rdi + rbp - 0x3b]
jmp 0x14026e5fd
cdqe
xor r11w, r9w
ror r11w, 1
neg r11w
inc r11w
not r11w
cdqe
movsx ecx, dil
xor r9w, r11w
add rdi, rcx
movsx r10d, al
not r10d
lea r11, [rsp + r11 + 8]
cbw
call fcn.140287da0

Function at 0x1401dd4f1
Capabilities:
Authenticate hmac
Hash data using murmur3

Disassembly:
rol ebp, 1
lea rcx, [rdi + rdi*2 + 0x7f9b66b8]
sub dil, r9b
lea ebp, [rbp + rdi*2 + 0x6d537eae]
rol ebp, 1
mov qword [rsp + rdi - 0x3f22a0e9], rsi
jmp 0x1402563d4
mul rdi
neg ebp

Function at 0x1401defa9
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + rdx*2 - 0x46], rax
ror r10d, 1
not r10d
or dl, byte [rsp + rcx - 0x63304021]
btr eax, 0x2a
ror qword [rsp + rsi - 0x63304023], cl
dec r10d
bswap r10d
ror r10d, 1
idiv cl
mov qword [rsp + rdx*2 - 0x46], r8
movsx ebx, cl
call fcn.14021a0d8
Function at 0x1401e07a1
Capabilities:
Hash data using murmur3
Parse pe header

Disassembly:
mov rbp, qword [rdx + rax - 0x174bfdb3]
movsx eax, r9w
bts r8d, eax
mov qword [rdx + rdi - 0x174bfdb3], rbp
ror bx, 0xee
lea rbp, [rdx + rax + 0x55b2e7b9]
btc rbp, rbx
jmp r10
bt r9, 0x25
rol dl, 0x61
lea rdi, [rdi + r9 - 0x4f161601]
and ebp, ebp
movzx r8d, byte [rdi + rbp*2 - 0xfa]
imul r9w, cx
movsx ebx, cl
mul qword [rsp + rbp - 0x66]
xor r8b, sil
neg r8b
add r8b, 0xb9
call fcn.140183c97
mov r8d, 0x3ab5a2bf
dec r8w
mov eax, 0x73bc01b0
lea rsi, [rsi + r8 - 0x3ab5a2c2]
call fcn.1401973b5
shr word [rsp + rcx - 0x2d], 0x8c
not qword [rsp + rcx*2 - 0x60]
lea r8d, [r8 + rbp - 0x388ed126]
call fcn.1401f7bd7
mov edx, 0x6f9b62a7
lea rax, [rdx*2 - 0x64c77f68]
movzx ebp, al
lea rsi, [rsi + rdx - 0x6f9b62ab]
mov r9d, dword [rbp + rsi - 0xe6]
mov r8d, ebp
push rax
xor r9d, r11d
ror r9d, 1
pop rcx
movzx ebx, dl
btc ecx, ebp
lea r9d, [r9 + rax*2 + 0x3df18b4]
shl rdx, 0xb5
rol r9d, 2
sal ebp, cl
mul al
lea r9d, [r9 + rax + 0xd248a95]
btr edx, 0x93
push r11
ror ecx, 0xd3
div eax
xor dword [rsp + rdx*2], r9d
inc rax
xadd al, ch
movzx r11d, ax
pop r11
shr dl, 0x62
sal ebx, cl
movsxd r9, r9d
ror rbp, cl
sub edx, ecx
and eax, ebp
adc r10, r9
movzx r9d, r8w
mov rax, qword [rax + rdi - 1]
imul r8w, bx
lea r8, [rcx + rbx*2 - 0x4b70bfcf]
jo 0x140122f39
jb 0x1401f00d9
xor r10d, 0xc91213af
shr cx, 0xc2
lea rax, [rcx*4 - 0x3fe1d3e1]
rol bx, cl
rol r10d, 1
lea rdx, [rax*8 - 0xd6125b]
or al, 0x9a
not r10d
inc r10d
cwd
xadd eax, ebx
push r8
jae 0x140251fce
jg 0x14025343f
mov rdx, qword [rbp + riz]
mov ebx, 0xfe3b333c
movsx edi, bx
mov ecx, dword [rdx + rdi - 0x333c]
lea r10, [rbx + rbx*4 + 0x382e4e8c]
sar r10b, 0xa2
lea rbp, [rbp + rdi*8 - 0x199dc]
bts rbx, 0xa0
mov dword [rbp + rdi*4 - 0xccf0], ecx
mov eax, dword [r9 + rdi - 0x333c]
shr dil, 6
lea rdx, [r10*4 + 0x57a9bd06]
lea r9, [r9 + rdi - 0x32fc]
push rbx
xor eax, r8d
or dx, 0xb218
xor eax, 0xffb655af
sar byte [rsp + rdi*8 - 0x197fc], 0x86
bts edx, 0x94
bswap eax
sbb ebx, edx
xor eax, 0xac80bb8c
movzx ecx, dx
inc bl
not eax
mov qword [rsp + rdi - 0x3300], r8
btc rdx, rcx
jb 0x140219db5
xor dword [rsp + rdi - 0x3300], eax
pop r8
imul r10d, ecx
movsx esi, bl
push rsi
movsxd rax, eax
inc dword [rsp + rdi*4 - 0xcbff]
add r11, rax
rol di, 0xcb
mov qword [rsp + rdi - 0x198], r11
ret
movzx esi, bl
xor dword [rsp + rdi - 0xf6], r10d
mul cl
lea rax, [rdx + rax - 0x95e695c]
pop r8
movsxd r10, r10d
ror rsi, 0xf2
push rdx
adc r11, r10
shl qword [rsp + rdi - 0xf6], cl
neg edx
mov si, word [rbp + rdi*8 - 0x7b0]
movzx r10d, byte [rsp + rdi - 0xf2]
cbw
idiv di
lea rbp, [rdi + rbp - 0xf4]
push r10
mov r10b, byte [rdi + r9 - 0xf6]
mul qword [rsp + rdi - 0xee]
lea r9, [r9 + rdi*2 - 0x1eb]
call fcn.14016996a
Function at 0x1401e6471
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + rdx - 0x9bfb], rdx
rol r10b, 1
sub qword [rsp + rdx*4 - 0x26fec], 0x1e8f8fbe
xor r10b, 0xb8
dec r10b
not word [rsp + rdx - 0x9bf8]
xor r8b, r10b
and qword [rsp + rdx - 0x9bfb], 0x7d93b528
add esi, eax
ja 0x14021adad
mov rdi, qword [rax + rdx*2 - 0xc40332]
lea rax, [rcx + r11*8 + 0x3dad1a25]
lea rbx, [rbx + rdx - 0x6201a1]
jp 0x140264697
sets r11b
mov qword [rdx + rbx - 0x620199], rdi
adc si, r10w
jns 0x140176e06

Function at 0x140209a1a
Capabilities:
Hash data using murmur3

Disassembly:
movzx r10d, r11w
shl r10d, 0x4c
push rbp
movzx ebp, si
bswap r10d
push r10
movabs r10, 0
xor esi, ebx
adc edx, 0x8638609b
mov qword [rsp + rbx - 0x190ea9f7], r10
mov esi, dword [rsp + rsi - 0x190ea997]
xadd rbp, r11
call fcn.1401e2a9a
mov r9d, 0x2914531f
movsx edi, r9w
sar r9w, 0x28
mov rsp, rbx
popfq
pop rax
pop rcx
movzx ebp, dil
pop r15
movsx r13d, dil
push rdi
mov rbx, qword [rsp + rdi*4 - 0x14c74]
movsx r10d, word [rsp + r9 - 0x29140051]
jmp 0x1401e2566
not r13b
mov rbp, qword [rsp + r9 - 0x29140043]
call fcn.14023d901
sub rdi, 4
mov r9d, 0xe31948a4
mov edx, dword [rdi + riz]
movzx eax, r9b
movsx ebp, r9b
xor edx, esi
idiv al
lea r8, [rax*8 - 0x177811e1]
neg rax
ror edx, 3
inc r9b
shr eax, 0xae
adc r8, 0x49842b92
sbb edx, 0xba83fe17
movsx ebx, r8w
bt ebp, ebp
bswap edx
sbb ebx, ebx
rol edx, 1
call fcn.1402253dc
pop rdx
mov qword [rsp], r10
push rbx
push r8
push r11
mov r10d, 0x190eaa1f
mov ebx, r10d
push r9
push r10
push rbx
pop rbx
mov qword [rsp + r10 - 0x190eaa1f], r13
push rsi
push rdi
push r14
jmp 0x14028bd45
movsx r9d, r10b
push rsi
push r10
pushfq
pop r10
mov qword [rsp + rbx*2 - 0x321d543e], r10
lea rdi, [rbx + rbx + 0x3d9b7124]
mov r11d, 0xa43b469d
lea r9d, [rbx - 0x18ceaa1f]
sal r9, 0xa
movsx esi, r11b
push r15
lea rdi, [rsp + rbx - 0x190eaa2f]
shl rsi, 0x22
movzx edx, r11w
lea r8, [rsi + rsi + 0x71307988]
push rcx
jp 0x140185779
jmp 0x1402653cc

Function at 0x14023878f
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + r9 - 0xf682], rsi
cwd
xor dword [rsp + r9*2 - 0x1ed04], ebp
xor eax, r9d
pop rsi
xor bl, ah
movsxd rbp, ebp
adc r10, rbp
call fcn.140168ba0

Function at 0x1402708ef
Capabilities:
Hash data using murmur3

Disassembly:
rol ebx, 2
cwd
rol ax, 0x8c
dec word [rsp + rax*2 + 0x67836369]
inc ebx
call fcn.1402080a0

Function at 0x14027ee0a
Capabilities:
Manually build aes constants

Disassembly:
not rdx
rol word [rsp + rcx*2 + 0xb], 0xea
adc word [rsp + rcx*8 + 0xc], 0xb910
jbe 0x1401af12b
and r8, rdx
mov qword [r11 + rcx*8], r8
mov qword [rsp + rcx], r10
ret 8
Function at 0x14028f396
Capabilities:
Manually build aes constants

Disassembly:
neg rdx
sbb eax, 0x70b82f97
xor ebx, edi
ror ebx, 1
inc ebx
xor cx, cx
not dx
xor ebx, 0x75bb3489
bswap ebx
mov r8d, r10d
bswap ecx
rol ebx, 3
push rdi
or rcx, rcx
bts r8, r10
sar edx, cl
xor dword [rsp + rcx - 0x1a3f], ebx
sub r10w, cx
xadd rdx, r9
pop rdi
sar r10d, 0x33
bswap r10d
div cx
movsxd rbx, ebx
imul r10b
adc r9d, r9d
adc r11, rbx
bt dx, 0xb6
add r9, r11
jmp r9
lea r9, [r9 + rsi*2 - 0x5c0f2c32]
xor edi, r8d
not edi
sal dword [rsp + rsi*2 - 0x5c0f2c36], 0x33
xor edi, 0x2c187a8a
movsx ebx, word [rsp + rsi*2 - 0x5c0f2c2c]
movzx eax, dl
lea edi, [rdi + rax*2 - 0x11347037]
bts dx, bx
xor edi, 0xaf3c538c
cdq
neg edi
mov dword [rsp + rdx*2 + 3], eax
dec bx
not edi
cwd
mov qword [rsp + rsi*2 - 0x5c0f2c2e], r8
xor dword [rsp + rsi*2 - 0x5c0f2c2e], edi
dec esi
lea rcx, [rax*4 + 0x4a96113e]
mov r8, qword [rsp + rsi*2 - 0x5c0f2c2c]
mov qword [rsp + rsi - 0x2e079612], rdx
push rdx
and qword [rsp + rsi - 0x2e079617], 0x768a0f96
movsxd rdi, edi
sub dx, si
jge 0x140244e54
mov r8, qword [rbp + riz]
mov ecx, 0x6c0883b3
bts cx, cx
lea rbp, [rbp + rcx - 0x6c0883b3]
push r8
movsx r9d, cx
popfq
lea rsi, [rsi + rcx - 0x6c0883bf]
inc r9
movsx r8d, cx
mov edx, dword [rsi + rcx - 0x6c0883bb]
movzx eax, r9b
cmovs ecx, r9d
xor edx, edi
not edx
sar rax, cl
movzx ebx, cx
jns 0x1402a7433
mov esi, 0x2e07961b
mov edi, dword [rsi + r9 - 0x2e07961b]
lea rdx, [rsi*4 + 0xe81c39e]
mov qword [rsp + rsi - 0x2e07961b], 0xffffffffc130fe8b
jmp 0x140210284
lea edx, [rax + rdx - 0x1f3e3318]
push r8
sar dword [rsp + rax*4 + 3], cl
neg edx
not edx
or dword [rsp + rcx - 0x6c0883b9], r8d
and word [rsp + rax*4 + 1], r8w
neg edx
lea r10, [rbx + 0xd9c552b]
xor edx, 0x2d18df94
xor ebx, ecx
setp cl
sbb rcx, r10
mov qword [rsp + rax], rdi
btr ax, cx
xor dword [rsp + rcx - 0x5e6baa1b], edx
pop rdi
lea r9, [r9 + r9 - 0x71f4e442]
xor ecx, r8d
jg 0x14013a211
movsxd rdx, edx
bswap r8
call fcn.1401fea4a
mov ecx, 0x3f1a8626
movsx edx, cx
mov r10, qword [rbp + rcx*2 - 0x7e350c4c]
not edx
mov r9, qword [rcx + r10 - 0x3f1a8626]
btc rcx, rcx
sbb cx, cx
movzx eax, dx
mov qword [rbp + rdx*2 - 0xf3b2], r9
lea r10, [rdx + rdx*2 - 0x3fc69ac1]
lea rsi, [rdx + rsi - 0x79dd]
mul cx
movsx r9d, dl
mov ebx, dword [rsi + rdx*4]
jno 0x14011985f
mov ebx, 0x36955532
mov r8d, ebx
lea r8, [r8*8 + 0x372ea695]
lea rsi, [rsi + rbx - 0x36955536]
movzx r9d, bx
mov edx, dword [rbx + rsi - 0x36955532]
bts r9d, 0xa
xor edx, edi
jmp 0x1402171ab

Function at 0x1402a8a0d
Capabilities:
Hash data using murmur3

Disassembly:
neg r8d
mov r9d, 0x63a3e13
bts edx, 0x8c
lea r8d, [r8 + rcx*2 - 0x14bbc78c]
Function at 0x1402cf8c3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r10, [rsp + r10 + 0x18]
xor byte [rsp + r11*2 - 0x2957df23], dl
mov qword [rsp + r11*2 - 0x2957df2a], rax
mov byte [r10 + rax*4 - 0x42590000], bl
lea r9, [r9 + rax*2 - 0x212c8004]
shr word [rsp + r11*4 - 0x52afbe61], 0x21
mov ecx, dword [r9 + r11*2 - 0x2957df3a]
sar rax, 0xa2
not rax
movzx ebx, bp
xor ecx, edi
mov qword [rsp + r11*2 - 0x2957df3a], 0x220ffe3e
ror ecx, 3
movzx r10d, byte [rsp + r11*4 - 0x52afbe60]
neg r11d
bts ebp, r11d
bswap ecx
sbb ecx, eax
push rbx
push rax
xor ecx, eax
push rbp
lea rbx, [rax + r10*8 - 0x43792049]
neg dl
mov qword [rsp + rax + 0x29], rdi
adc r10b, byte [rsp + rax*4 + 0x28]
xor dword [rsp + rax*4 + 0x2c], ecx
mov rdi, qword [rsp + rax*8 + 0x30]
jmp 0x140210ea1
mov ebx, 0x2da5561d
xor edx, 0xfb05970c
imul r8, rcx
mov qword [rsp + rax*4 - 0x1800d8], r11
xor dword [rsp + rax - 0x60036], edx
pop r11
and bl, r9b
je 0x1401a2cff
movsxd rdx, edx
adc r10, rdx
lea rdx, [rbp + r8*8 + 0x7d2da701]
sar bp, 0xe4
rol rcx, 0xc9
jae fcn.14023edf6
call fcn.140293ff4
mov qword [rsp + rdi], r9
ret
not ebx
lea r11, [rbx*8 - 0xac34eee]
mov rbp, rdx
add bx, 0x3083
bts ebx, 0xa4
mov rbx, r10
lea rcx, [r11*2 + 0x64b4c600]
sal rcx, cl
jne 0x140122bd6
cwd
mul bpl
movsxd rcx, ecx
call fcn.14025c046
xor dil, r10b
sar qword [rsp + r11 - 0x14abef8d], 0xda
jp 0x1401b4770
mov edx, 0xa8075b1e
lea r8, [rdx + rdx*8 + 0x5b92edb8]
sub rsi, 1
push r8
movzx r9d, byte [rsp]
mov ecx, r9d
movzx ebx, byte [rsi + r9*4 - 0x318]
lea rbp, [r9*8 + 0x1da2808f]
ror word [rsp + r9 - 0xc5], cl
xor bl, r11b
movzx eax, cl
idiv al
lea rbp, [rcx + r8 - 0x2ad9b0d6]
not bl
cwd
ror bl, 1
sar dx, cl
inc bl
rol eax, cl
btc r9w, 0xba
bts r9w, cx
not bl
cwd
xor bl, 0x99
sub r8d, 0x39015c9f
adc bl, 0xb7
or bp, word [rsp + r9 - 0x4c6]
xor r11b, bl
not rdx
lea rbx, [rsp + rbx + 8]
mov rcx, qword [r8 + rbx - 0xad3c527]
neg qword [rsp + r8*2 - 0x15a78a4e]
sbb r8, 0xffffffffe1a0fe87
rol r8, 0x54
lea rdi, [rdi + r9 - 0x4ce]
mov qword [rdi + rax - 0x63f40], rcx
lea rsi, [r9 + rsi - 0x4ca]
cbw
sal dword [rsp + r9*4 - 0x1314], 0x18
xadd al, bpl
mov edx, dword [rsi + r9 - 0x4c6]
neg r9d
dec word [rsp + rax - 0x60035]
shr r9w, 0x2f
xor edx, r11d
not dword [rsp + rax - 0x60035]
dec word [rsp + rax - 0x60030]
ror edx, 1
movsx ecx, r9w
lea edx, [rax + rdx + 0x9adbcf3]
not r9w
bswap edx
neg cx
lea edx, [rax + rdx + 0x61b242e3]
jb 0x1401c2920
mov r8d, 0xc3038633
mov rdx, qword [r10 + riz]
movzx eax, r8b
cwde
mov ebx, eax
lea r10, [r10 + rbx*4 - 0xc4]
jmp 0x14020fbfe
Function at 0x21b838f48d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov dword [rbp - 4], ecx
mov ecx, dword [rbp - 4]
mov edx, 0xffffffff
call fcn.21b83904bc0
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0xffffffff
mov eax, 0xffffffff
xor eax, 0x9677a5aa
or ecx, edx
or eax, 0x9677a5aa
mov dword [rbp - 8], eax
mov edx, 0xffffffff
call fcn.21b83904bc0
mov edx, dword [rbp - 8]
mov ecx, eax
call fcn.21b83909c10
mov dword [0x21b83915290], eax
mov ecx, 0x5776defb
call fcn.21b8390bea0
mov dword [0x21b839164e8], eax
cmp dword [0x21b839164e8], 0x270
jge 0x21b838f49ea
mov eax, dword [0x21b839164e8]
mov dword [rbp - 0xc], eax
mov ecx, 0x81ac5a1d
call fcn.21b8390bea0
mov ecx, dword [rbp - 0xc]
mov edx, eax
call fcn.21b83901d90
mov ecx, eax
mov edx, 1
call fcn.21b83902ff0
sub eax, 0xd6da84e7
movsxd rcx, eax
lea rax, [0x21b83915290]
mov eax, dword [rax + rcx*4]
mov ecx, dword [0x21b839164e8]
sub ecx, 1
movsxd rdx, ecx
lea rcx, [0x21b83915290]
mov ecx, dword [rcx + rdx*4]
shr ecx, 0x1e
xor eax, ecx
imul edx, eax, 0x6c078965
add edx, dword [0x21b839164e8]
movsxd rcx, dword [0x21b839164e8]
lea rax, [0x21b83915290]
mov dword [rax + rcx*4], edx
movsxd rcx, dword [0x21b839164e8]
lea rax, [0x21b83915290]
mov edx, dword [rax + rcx*4]
and edx, 0xffffffff
lea rax, [0x21b83915290]
mov dword [rax + rcx*4], edx
mov eax, dword [0x21b839164e8]
add eax, 1
mov dword [0x21b839164e8], eax
jmp 0x21b838f4935
add rsp, 0x30
pop rbp
ret
Function at 0x140003c40
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003c74
cmp word [rcx], 0x5a4d
jne 0x140003c74
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003c74
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003c74
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003b80
test eax, eax
jne 0x140003c90
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003bf0
test rax, rax
je 0x140003c85
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000443f
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004340
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400042e0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140009954
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1405791d8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1405791d4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400099a2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000999a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140009a89
inc ebx
add rax, 0x28
jmp 0x14000997a
mov rcx, r12
call fcn.14000a181
mov rbp, rax
test rax, rax
jne 0x1400099c1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400098f0
movsxd rbx, ebx
mov rax, qword [0x1405791d8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000a22f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1405791d8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140009a23
mov rax, qword [0x1405791d8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400098f0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140009a83
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140009a83
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1405791d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140009a83
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400098f0
inc dword [0x1405791d4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140009eb0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140579240]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140579220]
test rbx, rbx
je 0x140009efc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140009ef6
test eax, eax
jne 0x140009ef6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140009ece
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14000a0b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14000a0d3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14000a0d3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14000a0d4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000a10e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x14000a105
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000a110
inc r8d
add rax, 0x28
jmp 0x14000a0ec
xor eax, eax
ret

Function at 0x14000a181
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14056ec10]
mov r8, rcx
mov rcx, r9
call fcn.14000a0b0
test eax, eax
je 0x14000a1ad
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.14000a0d4
xor eax, eax
add rsp, 0x28
ret