joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004dd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, rcx
movabs r14, 0x7ffffffffffffffe
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rsi + 0x10]
mov rbp, rsi
cmp qword [rsi + 0x18], 8
jb 0x140004e11
mov rbp, qword [rsi]
cmp rbx, 8
jae 0x140004e2b
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 7
jmp 0x140004e64
mov rdi, rbx
or rdi, 7
cmp rdi, r14
cmova rdi, r14
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x20]
call fcn.14000ace0
mov qword [rsp + 0x20], rax
lea r8, [rbx*2 + 2]
mov rdx, rbp
mov rcx, rax
call fcn.14007dab0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x20]
call fcn.140005a30
test eax, eax
je 0x140004e95
mov r8d, eax
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140004e00
mov rcx, rsi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
jmp fcn.14000a970

Function at 0x140005a30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rbx, rcx
mov dword [rsp + 0x20], 0x238
xor esi, esi
xor edx, edx
lea ecx, [rsi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140005a90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14000a970
xor eax, eax
jmp 0x140005b1b
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x140005aa0
cmp qword [rbx + 0x18], 8
mov r9, rbx
jb 0x140005ab6
mov r9, qword [rbx]
mov r10, qword [rbx + 0x10]
lea rdx, [rsp + 0x4c]
cmp rax, r10
mov r8, r10
cmovb r8, rax
test r8, r8
je 0x140005aea
lea rcx, [rsp + 0x4c]
sub r9, rcx
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x140005af1
add rdx, 2
sub r8, 1
jne 0x140005ad6
cmp r10, rax
jb 0x140005af1
jbe 0x140005b04
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140005a90
jmp 0x140005b08
mov esi, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14000a970
mov eax, esi
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140006c00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov rbx, rcx
lea rdi, [rsp + 0x50]
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdi, [rsp + 0x70]
mov ecx, 0x68
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x140006c54
mov rdx, qword [rbx]
xor esi, esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne dil
test eax, eax
je 0x140006ce2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xf0]
mov dword [rsp + 0xf0], esi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0xf0], esi
mov rcx, qword [rsp + 0x50]
movzx edi, dil
cmovne edi, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14000a970
lea r11, [rsp + 0xe0]
movzx eax, dil
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140006e50
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
xor sil, sil
mov ebp, r9d
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rdi, rdx
jb 0x140006e7f
mov rdx, qword [rdx]
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006eda
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x140006ea9
mov rdx, qword [rbx]
mov eax, dword [rsp + 0x68]
mov r9d, ebp
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx esi, sil
mov ecx, 1
test eax, eax
cmove esi, ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.14000a970
mov rcx, rbx
call fcn.14000a970
mov rbx, qword [rsp + 0x40]
movzx eax, sil
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140009580
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r14, rdx
mov rdi, rcx
xor sil, sil
cmp qword [rcx + 0x18], 8
jb 0x1400095a8
mov rcx, qword [rcx]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x120089
lea r8d, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000960f
lea r8d, [r15 + 0x11]
lea rdx, str.CreateFile_failed
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.14000ad50
lea rcx, [rsp + 0x40]
call entry0
jmp 0x14000965a
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov ecx, eax
call fcn.14008264c
mov qword [r14], rax
mov dword [r14 + 8], ebx
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xa0]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140009657
lea r8d, [rax + 0xf]
lea rdx, str.ReadFile_failed
jmp 0x1400095e6
mov sil, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call fcn.14000a970
movzx eax, sil
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400096f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.14007bcd0
sub rsp, rax
mov edi, edx
mov esi, ecx
call fcn.14007b764
mov dword [rsp + 0x44], eax
mov r8d, 1
mov dword [rsp + 0x13c4], 0xffffffff
nop dword [rax + rax]
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x44], eax
inc r8
cmp r8, 0x270
jb 0x140009730
mov ebp, 0x80000000
mov dword [rsp + 0x40], 0x270
cmp esi, ebp
mov qword [rsp + 0x28], 0x20
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0xffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea eax, [rsi - 0x80000000]
lea ebx, [rsi + rbp]
cmovae ebx, eax
lea edx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae edx, eax
sub edx, ebx
cmp edx, 0xffffffff
jne 0x1400097ac
call fcn.140061f50
jmp 0x1400097b3
inc edx
call fcn.140061aa0
lea edx, [rbx + rax]
lea r11, [rsp + 0x13d0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x20]
cmovae eax, ecx
mov rsp, r11
pop rdi
ret
Function at 0x140035560
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rbx, r8
mov rsi, rdx
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov dword [rbp + 0x48], r14d
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r14w
cmp qword [rdx + 0x18], 8
jb 0x1400355a7
mov rdx, qword [rdx]
lea r8, [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140035699
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400355cd
mov r8, qword [rbx]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140035699
mov ecx, dword [rbp + 0x48]
call fcn.14008264c
mov rdi, rax
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x140035610
mov r8, qword [rbx]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003568c
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdi + r8*2], 0
jne 0x140035640
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000ad50
lea rdx, str.reg_val:
lea rcx, [0x1400cffd0]
call fcn.14000b160
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.14002f090
mov rcx, rax
call fcn.14000ba30
test rdi, rdi
je 0x140035699
mov rcx, rdi
call fcn.140082638
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400356a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400356e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400356e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035712
call fcn.14007bbb4
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r14w
mov rcx, rsi
call fcn.14000a970
nop
mov rcx, rbx
call fcn.14000a970
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140082148
nop
int3
Function at 0x14005a080
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 0x40], eax
xor ebx, ebx
mov esi, ebx
bt eax, esi
jae 0x14005a275
lea eax, [rsi + 0x41]
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], 1
mov word [rbp - 0x60], ax
mov word [rbp - 0x5e], bx
mov r8d, 1
lea rdx, [0x1400a9f78]
lea rcx, [rbp - 0x60]
call fcn.1400272a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14005a143
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a13e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a305
call fcn.14007bbb4
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], bx
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rbp - 0x10]
sub rax, r15
cmp rax, 0x1c
jb 0x14005a2ff
lea rax, [rbp - 0x20]
mov rdi, qword [rbp - 0x20]
mov r13, qword [rbp - 8]
cmp r13, 8
cmovae rax, rdi
mov qword [rbp + 0x48], rax
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
lea r12, [r15 + 0x1c]
mov ebx, 7
lea r14, [rbp - 0x40]
cmp r12, rbx
jbe 0x14005a1dd
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x14005a1b8
mov rbx, rcx
jmp 0x14005a1c5
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x40]
call fcn.14000ace0
mov r14, rax
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], rbx
movups xmm0, xmmword [str.fsutil_usn_deletejournal__n]
movups xmmword [r14], xmm0
movups xmm1, xmmword [0x1400a9fa0]
movups xmmword [r14 + 0x10], xmm1
movups xmm0, xmmword [0x1400a9fb0]
movups xmmword [r14 + 0x20], xmm0
movsd xmm1, qword [0x1400a9fc0]
movsd qword [r14 + 0x30], xmm1
lea rcx, [r14 + 0x38]
lea r8, [r15 + r15]
mov rdx, rax
call fcn.14007dab0
xor ebx, ebx
mov word [r14 + r12*2], bx
lea rcx, [rbp - 0x40]
call fcn.140006c00
nop
cmp r13, 8
jb 0x14005a272
lea rdx, [r13*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14005a26a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a2f9
mov rcx, rdi
call fcn.14007bbb4
mov eax, dword [rbp + 0x40]
inc esi
cmp esi, 0x20
jl 0x14005a0a7
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
mov r8d, 0x13
lea rdx, str.net_stop_Winmgmt__y
lea rcx, [rbp - 0x20]
call fcn.14000ad50
lea rcx, [rbp - 0x20]
call fcn.140006c00
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
mov r8d, 0x11
lea rdx, str.net_start_Winmgmt
lea rcx, [rbp - 0x20]
call fcn.14000ad50
lea rcx, [rbp - 0x20]
call fcn.140006c00
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140082148
nop
call fcn.14000acc0
nop
call fcn.140082148
int3
Function at 0x140061aa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x140061caa
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140061b64
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140061b20
mov ecx, dword [r10]
jmp 0x140061c47
cmp ecx, 0x4e0
jb 0x140061c47
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140061b80
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140061bd0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x140061b00
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x140061af0
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x140061cca
cmp r8d, r14d
jne 0x140061ad0
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x140061cf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x140061f06
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140061db4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140061d70
mov ecx, dword [r10]
jmp 0x140061e97
cmp ecx, 0x4e0
jb 0x140061e97
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140061dd0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140061e20
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x140061d50
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x140061d40
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x140061f2a
cmp r8, r14
jne 0x140061d20
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x140061f50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140061ff4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140061fb0
mov ecx, dword [r10]
jmp 0x1400620d7
cmp ecx, 0x4e0
jb 0x1400620d7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140062010
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140062060
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x140061f90
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x140061f80
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x140062150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400621f4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400621b0
mov ecx, dword [r10]
jmp 0x1400622d7
cmp ecx, 0x4e0
jb 0x1400622d7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140062210
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140062260
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x140062190
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x140062180
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret

Function at 0x140062d60
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1400cfc50], rax
cmp rax, 0x10
jae 0x140062d85
call fcn.140062930
mov edx, 0x10
lea rcx, [0x1400cfc58]
call fcn.140062ae0
xor eax, eax
add rsp, 0x58
ret