joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400144c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15, rcx
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea edi, [rbp + 0x14]
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov esi, 0x13a8
mov eax, dword [rsi + r14]
mov r13d, 0x20
mov r12d, 0xffffffff
test al, 1
jne 0x14001456c
or eax, 1
mov dword [rsi + r14], eax
mov ebx, r13d
add rbx, r14
call fcn.1400b0758
mov edx, eax
mov dword [rbx + 0x1384], r12d
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140014540
mov dword [rbx], 0x270
mov eax, dword [rsi + r14]
test al, 2
jne 0x14001458d
or eax, 2
mov dword [rsi + r14], eax
mov eax, 0x13b0
mov ebx, eax
mov qword [rax + r14], rbp
mov qword [rax + r14 + 8], 0x3d
jmp 0x140014592
mov ebx, 0x13b0
mov qword [r15], rbp
mov qword [r15 + 0x10], rbp
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov dword [rsp + 0x20], 1
mov rdx, rdi
mov rcx, r15
call fcn.140018420
lea rsi, [r14 + rbx]
mov ebp, r13d
add rbp, r14
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop dword [rax]
dec rdi
mov rdx, qword [rsi + 8]
mov rbx, qword [rsi]
mov qword [rsp + 0x28], rbp
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r12
ja 0x1400145f0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
sub rdx, rbx
lea rcx, [rsp + 0x28]
cmp rdx, 0xffffffffffffffff
jne 0x14001461a
call fcn.14001bc10
jmp 0x140014622
inc rdx
call fcn.14001be20
lea rcx, [rax + rbx]
movzx edx, byte [rcx + r14]
mov rcx, r15
call fcn.140018a30
test rdi, rdi
jne 0x1400145d0
mov rax, r15
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140014660
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r11, rcx
mov rax, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x140014696
mov r11, qword [rcx]
lea rdx, [r11 + rax*2]
mov rcx, r11
call fcn.140012020
cmp rax, rdx
je 0x1400146bf
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400146b6
cmp cx, 0x2f
jne 0x1400146bf
add rax, 2
cmp rax, rdx
jne 0x1400146a7
sub rax, r11
sar rax, 1
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov r8, rax
mov rdx, r11
lea rcx, [rsp + 0x40]
call fcn.14000b840
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000a300
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140014763
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001475e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001485a
call fcn.1400ada10
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x40]
call fcn.14000b7d0
test ebx, ebx
je 0x14001478e
cmp qword [rbp], 0xc800000
jb 0x1400147af
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1400ad9f0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
lfence
mov r8d, 0x1e
lea rdx, str.mb_free_space_to_run_correctly
lea rcx, [rbp - 0x20]
call fcn.140010110
mov rdi, rax
mov edx, 0xc8
lea rcx, [rbp - 0x40]
call fcn.140013120
mov rbx, rax
mov r8d, 0x41
lea rdx, str.You_dont_have_enough_space_on_disk._This_process_needs_at_least
lea rcx, [rbp - 0x60]
call fcn.140010110
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140018b80
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140018b80
nop
lea rcx, [rbp - 0x80]
call fcn.14000a3c0
nop
lea rcx, [rbp - 0x60]
call fcn.14000a3c0
nop
lea rcx, [rbp - 0x40]
call fcn.14000a3c0
nop
lea rcx, [rbp - 0x20]
call fcn.14000a3c0
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.1400069d0
lea rdx, [0x140160050]
lea rcx, [rsp + 0x68]
call fcn.1400d4390
nop
call fcn.1400e39e0
int3
Function at 0x1400150c0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor r14d, r14d
mov dword [rsp + 0x38], r14d
lea r8, [rsp + 0x38]
xor edx, edx
lea ecx, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140015255
xorps xmm0, xmm0
xor eax, eax
mov edi, dword [rsp + 0x38]
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
test rdi, rdi
je 0x14001519d
add rdi, rdi
cmp rdi, 0x1000
jb 0x14001516d
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400152bf
lfence
call fcn.1400adcb8
mov rcx, rax
test rax, rax
je 0x140015245
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001517d
test rdi, rdi
je 0x14001517d
lfence
mov rcx, rdi
call fcn.1400adcb8
mov qword [rsp + 0x40], rax
lea rbx, [rdi + rax]
mov qword [rsp + 0x50], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.1400d41f0
mov qword [rsp + 0x48], rbx
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14001524b
mov r8d, dword [rsp + 0x38]
mov qword [rsi], r14
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14000b840
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001521e
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015219
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015245
call fcn.1400ada10
mov rax, rsi
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400ad9f0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400e39e0
int3
lea rcx, [rsp + 0x40]
call fcn.140018160
lea rcx, [rsp + 0x60]
call fcn.1400152d0
call fcn.140089150
mov rdx, rax
mov r8d, 3
lea rcx, [rsp + 0x60]
call fcn.1400142e0
cmp byte [rbp + 0x68], 0
jne 0x140015292
lea rdx, str.GetComputerNameExW___failed_to_retrieve_ComputerNamePhysicalDnsHostname_value.
lea rcx, [rsp + 0x60]
call fcn.140018de0
mov byte [rbp + 0x68], 1
lea rcx, [rsp + 0x60]
call fcn.140014330
lea rdx, str.Failed_to_get_ComputerNamePhysicalDnsHostname
lea rcx, [rsp + 0x20]
call fcn.140010540
lea rdx, [0x140160050]
lea rcx, [rsp + 0x20]
call fcn.1400d4390
int3
call fcn.1400067c0
int3
Function at 0x14001bc10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14001bcb4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14001bc70
mov ecx, dword [r10]
jmp 0x14001bd97
cmp ecx, 0x4e0
jb 0x14001bd97
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001bcd0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001bd20
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x14001bc50
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x14001bc40
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x14001be20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x14001c036
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14001bee4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14001bea0
mov ecx, dword [r10]
jmp 0x14001bfc7
cmp ecx, 0x4e0
jb 0x14001bfc7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001bf00
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001bf50
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14001be80
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14001be70
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14001c05a
cmp r8, r14
jne 0x14001be50
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14001c650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rbx, r8
mov rbp, rdx
mov r14, rcx
mov qword [rsp + 0x20], rcx
xor r15d, r15d
mov qword [rcx], r15
call fcn.1400b0758
mov dword [r14 + 0x138c], 0xffffffff
mov dword [r14 + 0xc], eax
lea edx, [r15 + 1]
lea r8, [r14 + 0x10]
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x14001c6a0
mov dword [r14 + 8], 0x270
mov dword [r14 + 0x1390], 0xff0000
lea rcx, [r14 + 0x1398]
mov rdx, rbx
call fcn.14000a4e0
nop
lea rsi, [r14 + 0x13b8]
mov qword [rsp + 0x28], rsi
mov qword [rsi], r15
mov qword [rsi + 8], r15
lea rcx, [rsi + 0x10]
mov edx, 2
call fcn.1400b0a60
nop
lea rbx, [rsi + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov ecx, 0x40
call fcn.1400adcb8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov r8, rbp
lea rdx, [rsi + 8]
mov rcx, rsi
call fcn.1400608a0
nop
lea rcx, [r14 + 0x1428]
mov rdx, rbp
call fcn.14000a300
nop
cmp qword [r14 + 0x13a8], 0
je 0x14001c779
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401226e0]
mov rcx, r14
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x14001c793
mov rax, r14
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lfence
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.14001c560
nop
mov r8, rax
lea rdx, str.Cannot_initialise_RSA_algorithm:
lea rcx, [rsp + 0x70]
call fcn.140018d70
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400069d0
lea rdx, [0x140160050]
lea rcx, [rsp + 0x38]
call fcn.1400d4390
int3
Function at 0x14001dfd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14001dff2
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14001e07e
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.140011d30
test rax, rax
jle 0x14001e04e
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov rax, qword [rbx + 0x38]
mov r8, rsi
mov rdx, qword [rax]
call fcn.1400d44b0
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14001e06e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x140032886.0]
cmp eax, 0xffffffff
je 0x14001e076
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x14001e010
sub rbp, rdi
jmp 0x14001e168
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001e095
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001e097
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14001e0cc
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1400d44b0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001e162
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001e107
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x14001e140
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1400e79e0
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x14001e162
cmp rsi, rax
ja 0x14001e110
test rdi, rdi
je 0x14001e162
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400e79e0
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x14001f8f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14001f994
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14001f950
mov ecx, dword [r10]
jmp 0x14001fa77
cmp ecx, 0x4e0
jb 0x14001fa77
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001f9b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001fa00
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x14001f930
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x14001f920
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x14001faf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
movzx r15d, dx
mov rdi, rcx
xor r12d, r12d
lea r14d, [r15 - 1]
nop dword [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14001fcfa
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14001fbb4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14001fb70
mov ecx, dword [r10]
jmp 0x14001fc97
cmp ecx, 0x4e0
jb 0x14001fc97
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001fbd0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001fc20
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x14001fb50
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x14001fb40
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14001fd1a
cmp r8d, r14d
jne 0x14001fb20
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
movzx eax, dx
pop r15
pop r14
pop r12
ret