joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009ffe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400a016c
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
nop word [rax + rax]
cmp rbx, 2
jl 0x1400a00b3
movzx ecx, byte [rax]
cmp byte [rax + 1], 0x3a
jne 0x1400a0038
lea edx, [rcx - 0x30]
cmp dl, 9
jbe 0x1400a002d
lea edx, [rcx - 0x61]
nop
cmp dl, 0x19
jbe 0x1400a002d
lea edx, [rcx - 0x41]
cmp dl, 0x19
ja 0x1400a0038
mov ebx, 2
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
cmp rbx, 5
jge 0x1400a004c
xor ecx, ecx
jmp 0x1400a0060
mov eax, ecx
call fcn.14009fea0
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
nop
test cl, cl
jne 0x1400a0068
xor ecx, ecx
jmp 0x1400a00a2
movzx ecx, byte [rax + 1]
mov eax, ecx
call fcn.14009fea0
test al, al
jne 0x1400a0085
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
jmp 0x1400a00a2
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + 2]
call fcn.14009fea0
xor eax, 1
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
test cl, cl
je 0x1400a00bd
cmp byte [rax + 2], 0x2e
je 0x1400a00bd
mov ecx, 3
jmp 0x1400a00d9
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
mov rcx, qword [rsp + 8]
inc rcx
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
lea rdx, [rbx - 1]
nop dword [rax]
cmp rcx, rdx
jge 0x1400a00bd
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.14009fea0
test al, al
je 0x1400a00c7
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
movzx eax, byte [rdx + rcx + 1]
call fcn.14009fea0
test al, al
jne 0x1400a00bd
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
movzx edx, byte [rcx + rax + 1]
cmp dl, 0x2e
je 0x1400a00bd
inc rcx
jmp 0x1400a0137
mov rcx, qword [rsp + 8]
inc rcx
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop dword [rax]
cmp rdx, rcx
jle 0x1400a0163
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.14009fea0
test al, al
je 0x1400a012a
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov rbx, rcx
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006c1c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14009ffe0

Function at 0x1400ab140
Capabilities:
Hash data using fnv

Disassembly:
movzx ecx, bl
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret

Function at 0x1400ab160
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x1400ab181
movzx esi, byte [rbx + rdx]
xor rax, rsi
movabs rsi, 0x100000001b3
imul rax, rsi
inc rdx
cmp rcx, rdx
jg 0x1400ab169
ret

Function at 0x1400ab1a0
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x1400ab1c0
movzx edx, bl
xor rax, rdx
inc rcx
shr rbx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 8
jl 0x1400ab1a4
ret

Function at 0x1400ab1e0
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x1400ab200
movzx edx, bl
xor rax, rdx
shr ebx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
inc rcx
nop
cmp rcx, 4
jl 0x1400ab1e4
ret
Function at 0x1400bb7a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400bb8c2
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x20], 0
mov rax, qword [0x1402154f0]
call fcn.1400ab6c0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x1400bb8e0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.1400048c0
xorps xmm15, xmm15
mov r14, qword [0x14029cfd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp + 0x18]
cmp rbx, 0xffffffffffffffff
je 0x1400bb897
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
sub rbx, rsi
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
inc rsi
and rsi, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rsi]
lea rdx, [rsp + 0x50]
nop
call rcx
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
call fcn.14006c1c0
jmp fcn.1400bb7a0
Function at 0x1400c9560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400c961a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.1400048c0
xorps xmm15, xmm15
mov r14, qword [0x14029cfd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x1400c95ed
xor eax, eax
lea rbx, [0x14012633c]
mov ecx, 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
lea r8, [0x140126359]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x70]
call fcn.140056aa0
add rsp, 0x48
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x14013a078]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
call fcn.1400569e0
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006c1c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.1400c9560

Function at 0x1400e03e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov rdi, rcx
rdtsc
mov r8, rax
xor eax, eax
cpuid
rdtsc
sub rax, r8
mov r9d, 1
mov r11d, 1
xor r8d, r8d
mov rbp, rax
mov r10, rax
nop word [rax + rax]
rdtsc
mov rsi, rax
mov eax, r8d
cpuid
rdtsc
sub rax, rsi
add r10, rax
cmp rbp, rax
sete al
add r9d, 1
and r11d, eax
cmp r9d, 0xa
jne 0x1400e0410
movabs rax, 0xcccccccccccccccd
mov byte [rdi + 8], r11b
mul r10
mov rax, rdi
shr rdx, 3
mov qword [rdi], rdx
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400e5d90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400e6e70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400e6e70
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400e5e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1402a1594]
mov rbx, rcx
test esi, esi
jle 0x1400e5f30
mov rax, qword [0x1402a1598]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400e5e4b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400e5ed5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400e5e30
mov rcx, rbx
call fcn.1400e6870
mov rdi, rax
test rax, rax
je 0x1400e5f52
mov rax, qword [0x1402a1598]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400e69b0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1402a1598]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400e5f37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400e5ece
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400e5ee0
add dword [0x1402a1594], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1402a1598]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400e5ece
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400e5d90
nop dword [rax]
xor esi, esi
jmp 0x1400e5e58
mov rax, qword [0x1402a1598]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400e5d90
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400e5d90
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400e64e0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1402a1600]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1402a15e0]
test rbx, rbx
je 0x1400e653c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400e6533
test eax, eax
jne 0x1400e6533
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400e6518
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400e6870
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1402090b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400e6890
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400e6898
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400e6890
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400e68ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400e68e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400e6890
add rax, 0x28
cmp rax, r9
jne 0x1400e68d0
xor eax, eax
ret

Function at 0x1400e68f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1402090b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400e690f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400e6918
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400e690f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400e69b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1402090b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400e69cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400e69d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140004e7c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetDefaultDllDirectories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004eaf
mov ecx, 0x800
call rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.1400021b0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000234c
mov ebx, eax
test eax, eax
js 0x140004f6e
lea rdx, str.user
lea rcx, [rsp + 0x20]
call fcn.140001a44
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140002828
mov rdx, qword [rsp + 0x20]
test al, al
sete dil
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004f1e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, str.unregister
lea rcx, [rsp + 0x28]
call fcn.140001a44
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140002828
mov rdx, qword [rsp + 0x28]
test al, al
sete bl
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004f62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dl, bl
mov cl, dil
call fcn.140004db8
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.1400022c8
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400bad3e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xbea9bea8
stosb byte [rdi], al
adc ebp, ebp
test eax, 0xed13aabe
xor dword [rcx], edi
push rbx
jp 0x1400bad41
cmp al, 0x6b
xor dword [rcx + rax], edx
test al, 0x21
sbb byte [rsi], dl
test dword [rdi], esi
jge 0x1400badba
mov esp, 0xd7d832c4
cmp dword [rdx], edi
add edi, dword [rdx + 0x15d22562]
pop rdx
xchg esp, eax
sub edx, dword [rbx]
sbb byte [rdx - 2], 0x1f
lahf
adc dword [rax - 0x8ac05af], esp
test byte [rdi - 0x3bef3adf], cl
invalid
invalid
Function at 0x14000196a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140080890
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x1400808b3
mov rcx, qword [rsp + 0x40]
call fcn.140001b5e
jmp 0x1400808ca
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x1400808ca
mov rcx, qword [rsp + 0x40]
call fcn.140002c43
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x140001b5e
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1400813d0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0x270
jmp 0x1400813ef

Function at 0x1400022f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140084bf0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0
jmp 0x140084c28

Function at 0x1400029af
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140080450
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140001faf
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400029fa
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140118930
mov rax, rcx
neg rcx
test rax, 7
je 0x14011894d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401189a8
test al, 7
jne 0x140118940
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140118961
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401189d2
test dh, dh
je 0x1401189cc
shr rdx, 0x10
test dl, dl
je 0x1401189c6
test dh, dh
je 0x1401189c0
shr rdx, 0x10
test dl, dl
je 0x1401189ba
test dh, dh
je 0x1401189b4
shr edx, 0x10
test dl, dl
je 0x1401189ae
test dh, dh
jne 0x140118961
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1400029ff
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
jmp 0x140084870
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x40]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xa0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x78], 0
movzx eax, word [rsp + 0xa0]
mov r8d, 0xa
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14008490a
lea rcx, str._error__FindResource_n
call fcn.140002b6c
call fcn.1400018de
xor eax, eax
jmp 0x140084a57
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14008493c
lea rcx, str._error__LoadResource_n
call fcn.140002b6c
call fcn.1400018de
xor eax, eax
jmp 0x140084a57
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14008496c
lea rcx, str._error__LockResource_n
call fcn.140002b6c
call fcn.1400018de
xor eax, eax
jmp 0x140084a57
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x14008499c
lea rcx, str._error__SizeOfResource_n
call fcn.140002b6c
call fcn.1400018de
xor eax, eax
jmp 0x140084a57
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0xffffffffffffffff
jne 0x1400849f3
lea rcx, str._error__WriteResourceToDisk.CreateFile_n
call fcn.140002b6c
call fcn.1400018de
mov eax, 0xffffffff
jmp 0x140084a57
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
jne 0x140084a3c
lea rcx, str._error__WriteResourceToDisk.WriteFile_n
call fcn.140002b6c
call fcn.1400018de
xor eax, eax
jmp 0x140084a57
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401724e0]
call fcn.140003f7b
mov rax, rdi
add rsp, 0x90
pop rdi
ret
Function at 0x140002c43
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140081150
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp], 0x26f
mov qword [rsp + 8], 0xe3
mov qword [rsp + 0x10], 0
jmp 0x140081183
mov rax, qword [rsp + 0x10]
inc rax
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x10], 0xe3
jae 0x14008120a
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x10]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x10]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x1400811d4
mov dword [rsp + 0x3c], 0x9908b0df
jmp 0x1400811dc
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x10]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x10]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140081176
mov qword [rsp + 0x20], 0xe3
jmp 0x140081222
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x26f
jae 0x1400812a9
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
and eax, 1
test eax, eax
je 0x140081273
mov dword [rsp + 0x40], 0x9908b0df
jmp 0x14008127b
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x28]
shr eax, 1
xor eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140081215
mov qword [rsp + 0x30], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x60]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
and eax, 1
test eax, eax
je 0x1400812fd
mov dword [rsp + 0x44], 0x9908b0df
jmp 0x140081305
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x38]
shr eax, 1
xor eax, dword [rsp + 0x44]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x60]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x60]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
add rsp, 0x50
pop rdi
ret

Function at 0x140002d92
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400aaf00
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400aa880
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400aaf3f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401bb020]
jmp 0x1400aaf49
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret