joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001010
Capabilities:
Create new key via cryptacquirecontext
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbx
push rdi
push r12
push r14
sub rsp, 0x78
xor edi, edi
mov ebx, r8d
mov r14, r9
mov dword [rax - 0x50], 0x8004
mov r12, rdx
mov qword [rax - 0x48], rdi
xor r8d, r8d
mov dword [rax - 0x40], edi
lea r9d, [rdi + 0x18]
mov qword [rax - 0x38], rdi
xor edx, edx
mov dword [rax - 0x30], edi
lea rcx, [rax - 0x60]
mov dword [rax - 0x78], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000121d
mov qword [rsp + 0xa8], rbp
lea ecx, [rdi + 0x40]
lea ebp, [rbx + 0xc]
mov qword [rsp + 0xb0], rsi
mov edx, ebp
mov qword [rsp + 0x70], r15
mov r15, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400011fb
mov r8d, ebx
mov dword [rax], 0x208
lea rcx, [rax + 0xc]
mov dword [rax + 4], 0x6602
mov rdx, r12
mov dword [rax + 8], ebx
call fcn.14000aeb0
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov rdx, rsi
mov dword [rsp + 0x20], 0x100
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x1400011fb
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400011f0
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
xor r9d, r9d
lea edx, [rdi + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x1400011e5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, dword [rsp + 0xc0]
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400011e5
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0xa0]
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea edx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400011e5
mov edx, dword [rsp + 0xa0]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400011e5
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0xa0]
mov r8, rax
mov dword [rsp + 0x20], edi
lea edx, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0xc8]
mov r8d, 0x14
cmp dword [rsp + 0xa0], r8d
mov rdx, rbx
mov edi, eax
cmovb r8d, dword [rsp + 0xa0]
call fcn.14000aeb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov eax, edi
add rsp, 0x78
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x140002190
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ebp, ecx
mov rdx, qword [rdx]
mov edi, 0xc0000004
test rdx, rdx
je 0x1400021d4
lea r9, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov ebx, 0x1000
nop
mov edx, ebx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140002221
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test eax, eax
jns 0x140002217
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, ebx
cmp edi, 0xc0000004
je 0x1400021e0
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140002240
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rbp, rdx
mov esi, 0xc0000004
mov ebx, 0x1000
nop word [rax + rax]
mov edx, ebx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400022b4
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
test eax, eax
jns 0x1400022aa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, ebx
cmp esi, 0xc0000004
je 0x140002270
test esi, esi
js 0x1400022f1
mov rdx, rbp
mov rcx, rdi
mov rbx, rdi
call fcn.140002310
test eax, eax
je 0x1400022e8
nop word [rax + rax]
mov eax, dword [rbx]
test eax, eax
je 0x1400022e8
add rbx, rax
mov rdx, rbp
mov rcx, rbx
call fcn.140002310
test eax, eax
jne 0x1400022d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x38]
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400033d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [0x140024ab0]
mov edi, 2
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x1400033fe
call rcx
add rbx, 8
sub rdi, 1
jne 0x1400033f0
mov rcx, qword [0x140030c60]
xor ebx, ebx
test rcx, rcx
je 0x140003423
call qword [sym.imp.msasn1.dll_ASN1_CloseDecoder]
mov qword [0x140030c60], rbx
mov rcx, qword [0x140030c58]
test rcx, rcx
je 0x14000343c
call qword [sym.imp.msasn1.dll_ASN1_CloseEncoder]
mov qword [0x140030c58], rbx
mov rcx, qword [0x140030c50]
test rcx, rcx
je 0x140003455
call qword [sym.imp.msasn1.dll_ASN1_CloseModule]
mov qword [0x140030c50], rbx
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [0x140030c78]
test rcx, rcx
je 0x14000346c
call fcn.14000e010
xor edx, edx
mov qword [0x140030c78], rbx
lea rcx, [0x1400034e0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ecx, 1
call fcn.14000dd0c
mov rcx, rax
call fcn.14000e294
mov edx, dword [0x140031000]
mov ecx, eax
call fcn.14000e0bc
mov ecx, 2
call fcn.14000dd0c
mov rcx, rax
call fcn.14000e294
mov edx, dword [0x140030ff8]
mov ecx, eax
call fcn.14000e0bc
mov ecx, dword [0x140030ffc]
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400037f0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400038a3
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
je 0x140003893
mov edx, esi
mov qword [rsp + 0x38], rdi
add rdx, rdx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14000387e
mov r8d, esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp esi, eax
je 0x140003854
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rax
test rdi, rdi
je 0x14000387e
mov rcx, rdi
call fcn.1400038b0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x38]
mov eax, ebx
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x38]
mov eax, 0xc0000001
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rsi, qword [rsp + 0x30]
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret
Function at 0x1400038b0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r14d, r14d
lea rdx, [rsp + 0x58]
mov r12d, r14d
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, r14d
mov r13d, r14d
mov r15, rax
test rax, rax
je 0x140003a3f
cmp dword [rsp + 0x58], esi
jle 0x140003a3f
mov rcx, qword [rax]
lea rdx, [0x14002902c]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
call fcn.14000a494
mov rcx, qword [r15]
mov rbp, rax
test rax, rax
je 0x140003978
mov rdx, rax
sub rdx, rcx
lea ecx, [r14 + 0x40]
sar rdx, 1
lea rdx, [rdx*2 + 2]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000397b
mov rdx, qword [r15]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rdx + rdi*2], r12w
jne 0x140003941
mov rbx, rbp
mov rcx, rax
sub rbx, rdx
mov r8, rbx
sar r8, 1
add r8, r8
call fcn.14000aeb0
lea rcx, [rbx + 4]
sar rcx, 1
lea r13, [rbp + 4]
mov ecx, ecx
cmp rcx, rdi
cmovae r13, r14
jmp 0x14000397b
mov r13, rcx
movzx ebx, r14w
lea rbp, [0x140024ab0]
cmp bx, 2
jae 0x140003a19
movzx edi, bx
test rsi, rsi
je 0x1400039b1
mov rdx, qword [rbp + rdi*8]
mov rcx, rsi
mov rdx, qword [rdx]
call fcn.14000d98c
test eax, eax
je 0x1400039b1
inc bx
jmp 0x140003986
test r13, r13
je 0x140003a19
movzx ebx, r14w
lea r14, [rdi*8]
add r14, rbp
mov rdx, qword [r14]
cmp bx, word [rdx + 0x18]
jae 0x140003a19
mov rdx, qword [rdx + 0x20]
movzx eax, bx
lea rcx, [rax + rax*2]
mov rdx, qword [rdx + rcx*8 + 8]
lea rbp, [rcx*8]
mov rcx, r13
call fcn.14000d98c
xor edi, edi
test eax, eax
sete dil
test eax, eax
jne 0x140003a12
mov rax, qword [r14]
lea rdx, [r15 + 8]
mov ecx, dword [rsp + 0x58]
dec ecx
mov r8, qword [rax + 0x20]
call qword [r8 + rbp]
mov r12d, eax
inc bx
test edi, edi
je 0x1400039c5
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x140003a36
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, r12d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14000fd7c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000fae0
Function at 0x140afcec8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140afd04f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140afcef9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afcedf
add dl, dl
jne 0x140afcf06
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afcf66
xor eax, eax
add dl, dl
jne 0x140afcf15
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afd01d
add dl, dl
jne 0x140afcf26
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf33
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf40
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf4d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140afcf5a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140afceee
mov eax, 1
add dl, dl
jne 0x140afcf76
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afcf83
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afcf6b
sub eax, ebx
mov ebx, 1
jne 0x140afcfbc
mov ecx, 1
add dl, dl
jne 0x140afcf9e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140afcfab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afcf93
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afceee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140afcfd8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140afcfe5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afcfcd
cmp eax, 0x7d00
jae 0x140afd00b
cmp eax, 0x500
jb 0x140afd006
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afceee
cmp eax, 0x7f
ja 0x140afd00e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afceee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140afd042
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140afceee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002440
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14009a080]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x140002502
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140002502
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400024f9
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x1400024c1
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400024e3
inc rax
test ecx, ecx
jne 0x1400024d0
mov rcx, rdi
test edx, edx
je 0x140002525
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400024b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140078aa0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
setne al
jmp 0x140002504
Function at 0x14000f780
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14009a080]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rcx, [0x14008c804]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x14008c918]
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rcx, str.color_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.____________________________________________________________________________________________n_____________________________________________________________________________________________n__________________________________________________________________________________________n___________________________________________________________________________________n___________________________________________________________________________________________n
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, [0x14008cb00]
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, str._n_____________________________The_Game_Doesnt_give_you_a_Second_Chance__Beatware_Does._n
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, str._________________________________________________________________________________________n
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, str._n_n_n_n_n_n_n_n_____For_which_Would_you_like_to_Clean_
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, str._n_n_____Supported_Games:
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, str._n___1__Fortnite
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [0x14007d3d0]
call fcn.140013e10
lea rdx, [0x14009a1f8]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x14009a1f8]
mov r8, qword [reloc.WS2_32.dll_htons]
mov rcx, qword [0x14007d3d0]
call fcn.140015170
lea rdx, str._n_n___
mov rcx, rax
call fcn.140013e10
lea rdx, str.e_0m
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [str.e_0m]
mov r8, qword [reloc.WS2_32.dll_connect]
mov rcx, rax
call fcn.140015170
lea rdx, [rsp + 0x20]
mov rcx, qword [0x14007d3e8]
call fcn.140014000
lea rcx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
cmp rdi, 0x10
cmovae rcx, rbx
mov r8, qword [rsp + 0x30]
cmp r8, 1
jne 0x14000f938
lea rdx, [0x14008cca4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000f938
call fcn.14000aca0
nop
cmp rdi, 0x10
jb 0x14000f972
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000f96a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f96a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140078afc
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140078aa0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400103e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.1400794d0
sub rsp, rax
mov rax, qword [0x14009a080]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
lea ecx, [rsi + 1]
nop word [rax + rax]
mov eax, r8d
shr eax, 0x1e
xor eax, r8d
imul r8d, eax, 0x6c078965
add r8d, ecx
mov dword [rsp + rcx*4 + 0x34], r8d
inc rcx
cmp rcx, 0x270
jb 0x140010440
mov dword [rsp + 0x30], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
mov dword [rsp + 0x20], 1
test edi, edi
jle 0x140010517
lea rsi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.140015e70
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x1400104ca
lea rcx, [rsp + 0x30]
call fcn.140015e70
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x1400104b5
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140010502
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400104f7
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140010511
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140014950
sub rdi, 1
jne 0x1400104a0
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.140078aa0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140015e70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140015ed1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140015e90
mov ecx, dword [r10]
jmp 0x140015fba
cmp ecx, 0x4e0
jb 0x140015fba
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140015ef0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140015f40
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140016ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140016f04
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140016ef0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140016f34
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140016f4e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140016f5c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140015060
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140016fd6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016fd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016fd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078afc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140016ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140017024
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140017010
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140017054
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140017065
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140017073
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140015060
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400170ed
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400170e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400170e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140078afc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret