joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027ec0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140012438
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140027f4a
cmp byte [rbp - 0x21], r15b
je 0x140027f45
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140027f80
call fcn.14001a5ac
test eax, eax
jne 0x140027f6c
cmp byte [rbp - 0x21], r15b
je 0x140027f64
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140027f80
cmp byte [rbp - 0x21], r15b
je 0x140027f7d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001c554
test eax, eax
jne 0x140028020
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140012438
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140027fbf
cmp byte [rbp - 0x21], r15b
je 0x140027ff4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140027ff4
call fcn.14001a5ac
test eax, eax
jne 0x140027fe0
cmp byte [rbp - 0x21], r15b
je 0x140027fd9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140027ff4
cmp byte [rbp - 0x21], r15b
je 0x140027ff1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001c554
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140028020
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140028023
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140028031
mov rcx, rdi
call fcn.14001754c
cmp byte [rbp + 0x3f], r15b
je 0x140028040
mov rcx, qword [rbp + 0x27]
call fcn.14001754c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140029664
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14003f600]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400296bb
cmp word [rdx], r13w
jne 0x1400296bb
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400296c0
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400297e5
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140029806
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400296f9
mov rdx, r9
mov word [rbx], cx
jmp 0x140029720
cmp r9, r8
jae 0x140029730
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400296da
jmp 0x1400297e5
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400297da
cmp dword [rsp + 0x80], esi
je 0x1400297da
lea r8, [0x14003f600]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400297b2
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140029782
mov word [rbx], r13w
jmp 0x1400297e2
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14002978f
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400297e2
cmp word [rsp + 0x70], r13w
jne 0x1400297bf
cmp rbx, r14
je 0x14002977c
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140029454
cmp word [rsp + 0x70], r13w
je 0x1400297e5
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14003f600]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400297df
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400297e5
Function at 0x14002a620
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140029454
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140029454
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002a770
cmp rax, 0xffffffffffffffff
je 0x14002a770
xor edi, edi
test rbp, rbp
jle 0x14002a71b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140019884
mov rbx, rax
test rax, rax
jne 0x14002a6a8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002a711
mov edx, 0x8000
mov ecx, r14d
call fcn.1400156c8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400254e4
cmp eax, 0xffffffff
je 0x14002a6f1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14002a6b8
mov edx, r15d
mov ecx, r14d
call fcn.1400156c8
jmp 0x14002a711
cmp byte [rsi + 0x38], dil
je 0x14002a708
cmp dword [rsi + 0x34], 5
jne 0x14002a708
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002a711
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001754c
jmp 0x14002a784
jns 0x14002a784
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140029454
cmp rax, 0xffffffffffffffff
jne 0x14002a73c
cmp byte [rsi + 0x30], dil
je 0x14002a784
mov edi, dword [rsi + 0x2c]
jmp 0x14002a784
mov ecx, r14d
call fcn.14001f60c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14002a784
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14002a784
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14002a77d
mov eax, dword [rsi + 0x2c]
jmp 0x14002a782
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140029454
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002b680
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002b6a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002b6a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14009bae0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1403627f0
add rsp, 0x28
ret

Function at 0x14009c140
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14039e090]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14009c1ce
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14009c172
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x14009c1e0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14039e090]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x14009c2e4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14009c2df
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x14009c2b4
cmp qword [rsp + 0x38], 2
jb 0x14009c2b4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c2b4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c2b4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14009c227
jmp 0x14009c376
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x14009c376
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14009c34c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c34c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c34c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14009c2e4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140100de0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.14010e8b0
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14010dcb0
nop
lea rcx, [rsp + 0x30]
call fcn.140112030
movzx eax, al
test eax, eax
je 0x140100e6a
lea rcx, [rsp + 0x30]
call fcn.140152ca0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140100e6a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14014b330
mov rcx, rax
call fcn.140103ae0
cmp eax, 0xf8f45725
jne 0x140100e68
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140139460
jmp 0x140100e81
jmp 0x140100e22
lea rcx, [rsp + 0x28]
call fcn.14014b3f0
movzx eax, al
test eax, eax
jne 0x140100def
xor eax, eax
add rsp, 0x58
ret

Function at 0x140100e90
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.14010e8b0
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14010dcb0
nop
lea rcx, [rsp + 0x30]
call fcn.140112030
movzx eax, al
test eax, eax
je 0x140100f1a
lea rcx, [rsp + 0x30]
call fcn.140152ca0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140100f1a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14014b330
mov rcx, rax
call fcn.140103ae0
cmp eax, 0x53b2070f
jne 0x140100f18
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140139460
jmp 0x140100f31
jmp 0x140100ed2
lea rcx, [rsp + 0x28]
call fcn.14014b3f0
movzx eax, al
test eax, eax
jne 0x140100e9f
xor eax, eax
add rsp, 0x58
ret

Function at 0x140100f40
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.14010e590
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14010dcb0
nop
lea rcx, [rsp + 0x38]
call fcn.140112030
movzx eax, al
test eax, eax
je 0x140100fca
lea rcx, [rsp + 0x38]
call fcn.140152ca0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140100fca
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14014b330
mov rcx, rax
call fcn.140103ae0
cmp eax, 0x53b2070f
jne 0x140100fc8
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140139460
jmp 0x140100fe1
jmp 0x140100f82
lea rcx, [rsp + 0x28]
call fcn.14014b3a0
movzx eax, al
test eax, eax
jne 0x140100f4f
xor eax, eax
add rsp, 0x58
ret
Function at 0x140100ff0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.14010e590
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14010dcb0
nop
lea rcx, [rsp + 0x38]
call fcn.140112030
movzx eax, al
test eax, eax
je 0x14010107a
lea rcx, [rsp + 0x38]
call fcn.140152ca0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x14010107a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14014b330
mov rcx, rax
call fcn.140103ae0
cmp eax, 0xf8f45725
jne 0x140101078
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140139460
jmp 0x140101091
jmp 0x140101032
lea rcx, [rsp + 0x28]
call fcn.14014b3a0
movzx eax, al
test eax, eax
jne 0x140100fff
xor eax, eax
add rsp, 0x58
ret

Function at 0x14010b030
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14010afe0
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x140113de0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140113e03
mov rcx, qword [rsp + 0x40]
call fcn.140136640
nop
jmp 0x140113e1b
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140113e1b
mov rcx, qword [rsp + 0x40]
call fcn.140136440
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140136440
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140136470
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x1401364f2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1401364be
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x1401364c6
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140136465
mov qword [rsp + 8], 0xe3
jmp 0x14013650a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140136591
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14013655b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140136563
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1401364fd
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x1401365e5
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x1401365ed
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140136640
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140136661
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x1401366e5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x1401366b0
mov dword [rsp + 4], 0x9908b0df
jmp 0x1401366b8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140136654
add rsp, 0x18
ret
Function at 0x140152b30
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x140155000
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140155025
xor eax, eax
jmp 0x1401551e6
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14015504d
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140155220
jmp 0x1401551e6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.140134720
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x1401550ea
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.1400895f0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.140144380
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1400e6900
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.140142e10
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x1401551d6
mov rcx, qword [rsp + 0x70]
call fcn.140136710
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14015518a
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1403627f0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x140155188
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x1401551e6
jmp 0x140155110
cmp qword [rsp + 0x20], 0
jbe 0x1401551d6
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1403627f0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret

Function at 0x1401574f0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret