joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e3b60
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.hid.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1404f5398], rax
cmp qword [0x1404f5398], 0
je 0x1400e3d55
lea rdx, str.HidD_GetAttributes
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5348], rax
cmp qword [0x1404f5348], 0
jne 0x1400e3bb5
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, [0x14031ec58]
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5350], rax
cmp qword [0x1404f5350], 0
jne 0x1400e3be4
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, [0x14031ec78]
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5358], rax
cmp qword [0x1404f5358], 0
jne 0x1400e3c13
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, [0x14031ec98]
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5360], rax
cmp qword [0x1404f5360], 0
jne 0x1400e3c42
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, [0x14031ecb0]
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5368], rax
cmp qword [0x1404f5368], 0
jne 0x1400e3c71
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, str.HidD_GetFeature
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5370], rax
cmp qword [0x1404f5370], 0
jne 0x1400e3ca0
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, [0x14031ecd0]
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5378], rax
cmp qword [0x1404f5378], 0
jne 0x1400e3ccf
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, [0x14031ece8]
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5380], rax
cmp qword [0x1404f5380], 0
jne 0x1400e3cfb
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, str.HidD_FreePreparsedData
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5388], rax
cmp qword [0x1404f5388], 0
jne 0x1400e3d27
mov eax, 0xffffffff
jmp 0x1400e3d5e
lea rdx, [0x14031ed18]
mov rcx, qword [0x1404f5398]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f5390], rax
cmp qword [0x1404f5390], 0
jne 0x1400e3d53
mov eax, 0xffffffff
jmp 0x1400e3d5e
jmp 0x1400e3d5c
mov eax, 0xffffffff
jmp 0x1400e3d5e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400e69e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..pipeLOCALDP110Pipe
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x1400e6a53
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 6
lea rdx, str.QUIT_n
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x58
ret

Function at 0x1400e8430
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x78]
call fcn.140084510
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400e9530
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1400e7030
nop
lea rcx, [rsp + 0x40]
call fcn.1400e6d30
lea rax, [0x1400e82d0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
call fcn.1400e6dc0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1400e84da
lea rcx, [rsp + 0x30]
call fcn.1400e6de0
jmp 0x1400e84f1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1402d4c38
nop
lea rcx, [rsp + 0x30]
call fcn.1400e6d30
add rsp, 0x68
ret

Function at 0x1400e8500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x78]
call fcn.140084510
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400e95d0
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1400e70f0
nop
lea rcx, [rsp + 0x40]
call fcn.1400e6bf0
lea rax, [0x1400e8340]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
call fcn.1400e6c80
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1400e85aa
lea rcx, [rsp + 0x30]
call fcn.1400e6ca0
jmp 0x1400e85c1
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1402d4c38
nop
lea rcx, [rsp + 0x30]
call fcn.1400e6bf0
add rsp, 0x68
ret
Function at 0x1400ec2d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
lea rdx, [0x140321144]
mov rcx, qword [rsp + 0x50]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400ec398
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
mov rcx, qword [rsp + 0x28]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x30]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
je 0x1400ec38e
mov rcx, qword [rsp + 0x30]
call fcn.1402f8b10
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x28]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1400ef3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x2c], 0
mov rcx, qword [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
jne 0x1400ef52f
mov eax, dword [rsp + 0x30]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x28]
mov dword [rax], ecx
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jge 0x1400ef50a
cmp dword [rsp + 0x2c], 0
jne 0x1400ef50a
mov eax, dword [rsp + 0x24]
add eax, eax
cdqe
mov rcx, qword [rsp + 0x60]
movzx eax, byte [rcx + rax]
mov byte [rsp + 0x20], al
mov eax, dword [rsp + 0x24]
lea eax, [rax + rax + 1]
cdqe
mov rcx, qword [rsp + 0x60]
movzx eax, byte [rcx + rax]
mov byte [rsp + 0x21], al
movzx ecx, byte [rsp + 0x20]
call fcn.1400ef6b0
mov dword [rsp + 0x34], eax
movzx ecx, byte [rsp + 0x21]
call fcn.1400ef6b0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x34], 0
jl 0x1400ef4fd
cmp dword [rsp + 0x38], 0
jl 0x1400ef4fd
imul eax, dword [rsp + 0x34], 0x10
add eax, dword [rsp + 0x38]
mov byte [rsp + 0x22], al
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rsp + 0x22]
mov byte [rcx + rax], dl
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x1400ef505
mov dword [rsp + 0x2c], 1
jmp 0x1400ef463
cmp dword [rsp + 0x2c], 1
jne 0x1400ef52f
mov rcx, qword [rsp + 0x40]
call fcn.1402f8b10
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
mov rax, qword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1400f0290
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x12d8
call fcn.1401a6810
sub rsp, rax
mov rax, qword [0x1404e6228]
xor rax, rsp
mov qword [rsp + 0x12c0], rax
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x48]
call fcn.1400a7100
nop
lea rdx, [rsp + 0x2c0]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x1400f03c3
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 5
jne 0x1400f03a5
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1c0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea rdx, str.VdsPKCS11WindowsVdsPKCS1132.dll
lea rcx, [rsp + 0x1c0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x1400f039a
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x60]
call fcn.1400a4430
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400cb200
nop
lea rcx, [rsp + 0x60]
call fcn.140088270
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 1]
mov qword [rsp + 0x20], rax
jmp 0x1400f02ec
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x12e8]
call fcn.1400de290
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x48]
call fcn.1400ace90
mov rax, qword [rsp + 0x12e8]
mov rcx, qword [rsp + 0x12c0]
xor rcx, rsp
call fcn.1401a6870
add rsp, 0x12d8
ret

Function at 0x1400f6250
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x78]
call fcn.140084510
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400f66b0
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1400f5910
nop
lea rcx, [rsp + 0x40]
call fcn.1400f5770
lea rax, [0x1400f61e0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
call fcn.1400f5800
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1400f62fa
lea rcx, [rsp + 0x30]
call fcn.1400f5820
jmp 0x1400f6311
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1402d4c38
nop
lea rcx, [rsp + 0x30]
call fcn.1400f5770
add rsp, 0x68
ret
Function at 0x14010e570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov dword [rsp + 0x14], 0
jmp 0x14010e599
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 4
jge 0x14010e701
mov dword [rsp + 0x10], 0
jmp 0x14010e5b8
mov eax, dword [rsp + 0x10]
inc eax
mov dword [rsp + 0x10], eax
cmp dword [rsp + 0x10], 4
jge 0x14010e6fc
mov dword [rsp + 0xc], 0
jmp 0x14010e5d7
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
cmp dword [rsp + 0xc], 2
jge 0x14010e6f7
mov dword [rsp + 8], 0
jmp 0x14010e5f6
mov eax, dword [rsp + 8]
inc eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0x10
jge 0x14010e6f2
cmp dword [rsp + 0x38], 1
jne 0x14010e61d
movsxd rax, dword [rsp + 4]
lea rcx, [0x1403288c0]
movzx eax, byte [rcx + rax]
mov byte [rsp], al
jmp 0x14010e668
cmp dword [rsp + 0x38], 2
jne 0x14010e639
movsxd rax, dword [rsp + 4]
lea rcx, [0x140328ac0]
movzx eax, byte [rcx + rax]
mov byte [rsp], al
jmp 0x14010e668
cmp dword [rsp + 0x38], 3
jne 0x14010e655
movsxd rax, dword [rsp + 4]
lea rcx, [0x140328cc0]
movzx eax, byte [rcx + rax]
mov byte [rsp], al
jmp 0x14010e668
movsxd rax, dword [rsp + 4]
lea rcx, [0x140328ec0]
movzx eax, byte [rcx + rax]
mov byte [rsp], al
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
movsxd rax, dword [rsp + 0x14]
imul rax, rax, 0x80
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x10]
imul rcx, rcx, 0x20
add rax, rcx
movsxd rcx, dword [rsp + 0xc]
imul rcx, rcx, 0x10
add rax, rcx
movsxd rcx, dword [rsp + 8]
movzx edx, byte [rsp]
movzx eax, byte [rax + rcx]
xor eax, edx
movsxd rcx, dword [rsp + 8]
movsxd rdx, dword [rsp + 0xc]
imul rdx, rdx, 0x10
movsxd r8, dword [rsp + 0x10]
imul r8, r8, 0x20
movsxd r9, dword [rsp + 0x14]
imul r9, r9, 0x80
mov r10, qword [rsp + 0x30]
add r10, r9
mov r9, r10
add r9, r8
mov r8, r9
add r8, rdx
mov rdx, r8
mov byte [rdx + rcx], al
jmp 0x14010e5ec
jmp 0x14010e5cd
jmp 0x14010e5ae
jmp 0x14010e58f
add rsp, 0x28
ret

Function at 0x14010fd50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, 0x1571
mov rcx, qword [rsp + 0x30]
call fcn.14010fd00
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140110160
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140110182
mov rcx, qword [rsp + 0x40]
call fcn.1401106e0
jmp 0x140110199
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140110199
mov rcx, qword [rsp + 0x40]
call fcn.140110510
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140110510
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov qword [rsp + 0x18], 0
jmp 0x140110531
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0xe3
jae 0x1401105b5
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140110580
mov dword [rsp + 4], 0x9908b0df
jmp 0x140110588
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140110524
jmp 0x1401105c4
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0x26f
jae 0x14011064b
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
and eax, 1
test eax, eax
je 0x140110615
mov dword [rsp + 0xc], 0x9908b0df
jmp 0x14011061d
mov dword [rsp + 0xc], 0
mov eax, dword [rsp + 8]
shr eax, 1
xor eax, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1401105b7
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140110692
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14011069a
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x30]
xor eax, dword [rdx + rcx + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
mov rax, qword [rsp + 0x30]
mov dword [rax], 0
add rsp, 0x28
ret
Function at 0x1401106e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140110701
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140110785
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140110750
mov dword [rsp + 4], 0x9908b0df
jmp 0x140110758
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1401106f4
add rsp, 0x18
ret
Function at 0x140114d50
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1404e6228]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp qword [0x1404f95a0], 0
jne 0x140114f4d
lea rcx, str.win8ble.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140114f4d
lea rdx, [0x14032a078]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95a8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rdx, str.SCT_InitDeviceList
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95a8], rax
cmp qword [0x1404f95a8], 0
je 0x140114f42
lea rdx, str.SCT_GetDeviceName
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95b0], rax
cmp qword [0x1404f95b0], 0
je 0x140114f42
lea rdx, str.SCT_GetDeviceSerial
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95b8], rax
cmp qword [0x1404f95b8], 0
je 0x140114f42
lea rdx, str.SCT_BeginTransaction
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95c0], rax
cmp qword [0x1404f95c0], 0
je 0x140114f42
lea rdx, str.SCT_EndTransaction
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95c8], rax
cmp qword [0x1404f95c8], 0
je 0x140114f42
lea rdx, str.SCT_SendData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95d0], rax
cmp qword [0x1404f95d0], 0
je 0x140114f42
lea rdx, str.SCT_RecvData
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95d8], rax
cmp qword [0x1404f95d8], 0
je 0x140114f42
lea rdx, str.SCT_Ping
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95e0], rax
cmp qword [0x1404f95e0], 0
je 0x140114f42
lea rdx, str.SCT_Abort
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f95e8], rax
cmp qword [0x1404f95e8], 0
je 0x140114f42
mov rax, qword [rsp + 0x40]
mov qword [0x1404f95a0], rax
jmp 0x140114f4d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1404f95a0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401a6870
add rsp, 0x168
ret
Function at 0x140121040
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x80]
call fcn.140084510
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x78]
call fcn.140084510
mov rcx, qword [rsp + 0x38]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140121810
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14008cda0
nop
lea rcx, [rsp + 0x48]
call fcn.140121dd0
lea rax, [0x140120f60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x30]
call fcn.140086a80
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x58]
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x140121109
lea rcx, [rsp + 0x30]
call fcn.1400cbc10
jmp 0x140121120
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1402d4c38
nop
lea rcx, [rsp + 0x30]
call fcn.140121dd0
add rsp, 0x68
ret