joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009bc60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140374390
add rsp, 0x28
ret

Function at 0x14009c2d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1403b0090]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14009c35e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14009c302
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x14009c370
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1403b0090]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x14009c474
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14009c46f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x14009c444
cmp qword [rsp + 0x38], 2
jb 0x14009c444
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c444
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c444
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14009c3b7
jmp 0x14009c506
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x14009c506
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14009c4dc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c4dc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009c4dc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14009c474
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1400ce1f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400ce216
mov dword [rsp + 0x20], 1
jmp 0x1400ce21e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1401032e0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x3285501
lea rcx, [rsp + 0x40]
call fcn.140113570
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140103345
lea rcx, [rsp + 0x50]
call fcn.14014dc00
cmp eax, dword [rsp + 0x24]
jne 0x140103412
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x60]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140103412
lea rcx, [rsp + 0x60]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140103412
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, dword [rsp + 0x28]
jne 0x14010340d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14013fd90
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140150610
movzx eax, al
test eax, eax
je 0x140103406
mov rcx, qword [rsp + 0x30]
call fcn.14014dc80
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140158480
nop
jmp 0x140103412
mov rax, qword [rsp + 0x30]
jmp 0x140103429
jmp 0x14010337c
lea rcx, [rsp + 0x40]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x140103305
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140103860
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x53b2070f
lea rcx, [rsp + 0x40]
call fcn.140113570
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x1401038c5
lea rcx, [rsp + 0x50]
call fcn.14014dc00
cmp eax, dword [rsp + 0x24]
jne 0x140103992
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x60]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140103992
lea rcx, [rsp + 0x60]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140103992
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, dword [rsp + 0x28]
jne 0x14010398d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14013fd90
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140150610
movzx eax, al
test eax, eax
je 0x140103986
mov rcx, qword [rsp + 0x30]
call fcn.14014dc80
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140158480
nop
jmp 0x140103992
mov rax, qword [rsp + 0x30]
jmp 0x1401039a9
jmp 0x1401038fc
lea rcx, [rsp + 0x40]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x140103885
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140103b20
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x820621f3
lea rcx, [rsp + 0x40]
call fcn.140113570
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140103b85
lea rcx, [rsp + 0x50]
call fcn.14014dc00
cmp eax, dword [rsp + 0x24]
jne 0x140103c52
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x60]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140103c52
lea rcx, [rsp + 0x60]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140103c52
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, dword [rsp + 0x28]
jne 0x140103c4d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14013fd90
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140150610
movzx eax, al
test eax, eax
je 0x140103c46
mov rcx, qword [rsp + 0x30]
call fcn.14014dc80
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140158480
nop
jmp 0x140103c52
mov rax, qword [rsp + 0x30]
jmp 0x140103c69
jmp 0x140103bbc
lea rcx, [rsp + 0x40]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x140103b45
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140104200
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0xbdcac9ce
lea rcx, [rsp + 0x40]
call fcn.140113570
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140104265
lea rcx, [rsp + 0x50]
call fcn.14014dc00
cmp eax, dword [rsp + 0x24]
jne 0x140104332
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x60]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140104332
lea rcx, [rsp + 0x60]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140104332
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, dword [rsp + 0x28]
jne 0x14010432d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14013fd90
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140150610
movzx eax, al
test eax, eax
je 0x140104326
mov rcx, qword [rsp + 0x30]
call fcn.14014dc80
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140158480
nop
jmp 0x140104332
mov rax, qword [rsp + 0x30]
jmp 0x140104349
jmp 0x14010429c
lea rcx, [rsp + 0x40]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x140104225
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140104d00
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0xf8f45725
lea rcx, [rsp + 0x40]
call fcn.140113570
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140104d65
lea rcx, [rsp + 0x50]
call fcn.14014dc00
cmp eax, dword [rsp + 0x24]
jne 0x140104e32
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x60]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140104e32
lea rcx, [rsp + 0x60]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140104e32
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, dword [rsp + 0x28]
jne 0x140104e2d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14013fd90
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140150610
movzx eax, al
test eax, eax
je 0x140104e26
mov rcx, qword [rsp + 0x30]
call fcn.14014dc80
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140158480
nop
jmp 0x140104e32
mov rax, qword [rsp + 0x30]
jmp 0x140104e49
jmp 0x140104d9c
lea rcx, [rsp + 0x40]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x140104d25
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140104e60
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0xfaba0065
lea rcx, [rsp + 0x40]
call fcn.140113570
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x50]
sub eax, 8
mov word [rsp + 0x50], ax
cmp dword [rsp + 0x24], 0
je 0x140104ec5
lea rcx, [rsp + 0x50]
call fcn.14014dc00
cmp eax, dword [rsp + 0x24]
jne 0x140104f92
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x60]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140104f92
lea rcx, [rsp + 0x60]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x2c], 0
je 0x140104f92
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, dword [rsp + 0x28]
jne 0x140104f8d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14013fd90
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140150610
movzx eax, al
test eax, eax
je 0x140104f86
mov rcx, qword [rsp + 0x30]
call fcn.14014dc80
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x40]
call fcn.140158480
nop
jmp 0x140104f92
mov rax, qword [rsp + 0x30]
jmp 0x140104fa9
jmp 0x140104efc
lea rcx, [rsp + 0x40]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x140104e85
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret

Function at 0x140105b00
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.140113570
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x38]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140105b8a
lea rcx, [rsp + 0x38]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140105b8a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, 0xfaba0065
jne 0x140105b88
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14013fd90
jmp 0x140105ba1
jmp 0x140105b42
lea rcx, [rsp + 0x28]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x140105b0f
xor eax, eax
add rsp, 0x58
ret
Function at 0x140105dc0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.140113890
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x30]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140105e4a
lea rcx, [rsp + 0x30]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140105e4a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, 0xf8f45725
jne 0x140105e48
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14013fd90
jmp 0x140105e61
jmp 0x140105e02
lea rcx, [rsp + 0x28]
call fcn.140155400
movzx eax, al
test eax, eax
jne 0x140105dcf
xor eax, eax
add rsp, 0x58
ret

Function at 0x140105e70
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.140113890
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x30]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x140105efa
lea rcx, [rsp + 0x30]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140105efa
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, 0x53b2070f
jne 0x140105ef8
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14013fd90
jmp 0x140105f11
jmp 0x140105eb2
lea rcx, [rsp + 0x28]
call fcn.140155400
movzx eax, al
test eax, eax
jne 0x140105e7f
xor eax, eax
add rsp, 0x58
ret

Function at 0x140105fd0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.140113890
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x30]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x14010605a
lea rcx, [rsp + 0x30]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x14010605a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, 0x2fa62ca8
jne 0x140106058
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14013fd90
jmp 0x140106071
jmp 0x140106012
lea rcx, [rsp + 0x28]
call fcn.140155400
movzx eax, al
test eax, eax
jne 0x140105fdf
xor eax, eax
add rsp, 0x58
ret
Function at 0x140106080
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.140113570
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x38]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x14010610a
lea rcx, [rsp + 0x38]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x14010610a
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, 0x53b2070f
jne 0x140106108
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14013fd90
jmp 0x140106121
jmp 0x1401060c2
lea rcx, [rsp + 0x28]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x14010608f
xor eax, eax
add rsp, 0x58
ret

Function at 0x140106130
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call fcn.140113570
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140112cd0
nop
lea rcx, [rsp + 0x38]
call fcn.140117050
movzx eax, al
test eax, eax
je 0x1401061ba
lea rcx, [rsp + 0x38]
call fcn.14015cb30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1401061ba
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140155340
mov rcx, rax
call fcn.140108c20
cmp eax, 0xf8f45725
jne 0x1401061b8
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14013fd90
jmp 0x1401061d1
jmp 0x140106172
lea rcx, [rsp + 0x28]
call fcn.1401553b0
movzx eax, al
test eax, eax
jne 0x14010613f
xor eax, eax
add rsp, 0x58
ret

Function at 0x1401100c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140110070
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140118900
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop
mov eax, dword [rsp + 0x34]
mov ecx, eax
call fcn.140364000
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x40]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
jmp 0x1401189d7
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x30], eax
jae 0x140118a14
mov rax, qword [rsp + 0x38]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x68]
lea rcx, [0x1405f0498]
call fcn.1401029a0
nop
mov rax, qword [rsp + 0x38]
add rax, 0x14
mov qword [rsp + 0x38], rax
jmp 0x1401189cd
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140363c48
nop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x88
ret

Function at 0x140118ce0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140118d03
mov rcx, qword [rsp + 0x40]
call fcn.14013d1e0
nop
jmp 0x140118d1b
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140118d1b
mov rcx, qword [rsp + 0x40]
call fcn.14013cfe0
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret